#NEWLINE# def writeElasticSearchResults( searchResults , vulnObject , sourceIP , vulnerability ) : #NEWLINE# #INDENT# for hit in searchResults [ 'hits' ] [ 'hits' ] : #NEWLINE# #INDENT# es = Elasticsearch ( ) #NEWLINE# doc = { #NEWLINE# #INDENT# 'doc' : { #NEWLINE# #INDENT# vulnObject : 'YES' , #NEWLINE# 'CVE' : vulnerability , #NEWLINE# #UNINDENT# } , #NEWLINE# #UNINDENT# } #NEWLINE# res = es . update ( index = hit [ '_index' ] , id = hit [ '_id' ] , doc_type = 'logs' , body = doc ) #NEWLINE# cnx = getDBConnector ( ) #NEWLINE# cursor = cnx . cursor ( ) #NEWLINE# query = ( ( ( ( ( ( "SELECT count(*) as count from attackInventory where victim_ip = '" + str ( ip2long ( sourceIP ) ) ) + "' and threat_id = '" ) + vulnerability ) + "' and attack_log = '" ) + hit [ '_source' ] [ 'message' ] ) + "'" ) #NEWLINE# cursor . execute ( query ) #NEWLINE# for row in cursor : #NEWLINE# #INDENT# logCheck = row [ 0 ] #NEWLINE# #UNINDENT# cursor . close ( ) #NEWLINE# if ( logCheck == 0 ) : #NEWLINE# #INDENT# cursor = cnx . cursor ( ) #NEWLINE# add_logInstance = 'INSERT INTO attackInventory (victim_ip, attacker_ip, attack_time, attack_log, threat_id) VALUES (%s, %s, %s, %s, %s)' #NEWLINE# try : #NEWLINE# #INDENT# attackerIP = ip2long ( hit [ '_source' ] [ 'host' ] ) #NEWLINE# #UNINDENT# except : #NEWLINE# #INDENT# attackerIP = '0' #NEWLINE# #UNINDENT# logData = ( ip2long ( sourceIP ) , es , hit [ '_source' ] [ '@timestamp' ] , hit [ '_source' ] [ 'message' ] , vulnerability ) #NEWLINE# cursor . execute ( add_logInstance , logData ) #NEWLINE# cnx . commit ( ) #NEWLINE# cursor . close ( ) #NEWLINE# cnx . close ( )