response_engine.py

#!/usr/bin/env python3
import time
import smtplib
import subprocess
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
from datetime import datetime

# ✅ Your email details
SENDER_EMAIL = "favour.ids.monitor@gmail.com"
RECEIVER_EMAIL = "favour.ids.alerts@gmail.com"
APP_PASSWORD = "jdoqsyjiilywqwjq"

# Log file location
LOG_FILE = "/var/log/suricata/fast.log"

# Track already responded alerts
responded_alerts = set()

def send_email(subject, body):
    """Send email alert"""
    try:
        msg = MIMEMultipart()
        msg['From'] = SENDER_EMAIL
        msg['To'] = RECEIVER_EMAIL
        msg['Subject'] = subject

        msg.attach(MIMEText(body, 'plain'))

        server = smtplib.SMTP('smtp.gmail.com', 587)
        server.starttls()
        server.login(SENDER_EMAIL, APP_PASSWORD)
        server.send_message(msg)
        server.quit()

        print(f"[+] Email sent: {subject}")

    except Exception as e:
        print(f"[!] Email failed: {e}")

def block_ip(ip):
    """Auto block IP using iptables"""
    try:
        subprocess.run([
            'iptables', '-A', 'INPUT',
            '-s', ip, '-j', 'DROP'
        ], check=True)
        print(f"[!!!] BLOCKED IP: {ip}")
    except Exception as e:
        print(f"[!] Block failed: {e}")

def extract_ip(line):
    """Extract source IP from alert line"""
    try:
        # Suricata format: timestamp [**] [sid] msg [**] [class] [priority] {protocol} src_ip:port -> dst_ip:port
        parts = line.split('{')
        if len(parts) > 1:
            ip_part = parts[-1].split('}')[-1].strip()
            src_ip = ip_part.split(':')[0].strip()
            return src_ip
    except:
        pass
    return None

def handle_alert(line):
    """Decide response based on priority"""

    # Skip if already handled
    if line in responded_alerts:
        return
    responded_alerts.add(line)

    timestamp = datetime.now().strftime('%Y-%m-%d %H:%M:%S')
    ip = extract_ip(line)

    # 🔴 CRITICAL — Auto block + Email
    if 'FTP' in line or 'MySQL' in line:
        print(f"[!!!] CRITICAL ALERT at {timestamp}")

        # Block the IP
        if ip:
            block_ip(ip)

        # Send email
        send_email(
            subject="🚨 CRITICAL ALERT — Favour's IDS",
            body=f"""
CRITICAL SECURITY ALERT!

Time: {timestamp}
Alert: {line}
Source IP: {ip}
Action Taken: IP has been automatically blocked!

Review immediately!

Favour's IDS Response Engine
            """
        )

    # 🟡 WARNING — Email only
    elif 'Port Scan' in line or 'HTTP' in line:
        print(f"[!!] WARNING ALERT at {timestamp}")

        send_email(
            subject="⚠️ WARNING — Favour's IDS",
            body=f"""
WARNING SECURITY ALERT!

Time: {timestamp}
Alert: {line}
Source IP: {ip}
Action Taken: Alert logged and reported

Monitor this activity closely!

Favour's IDS Response Engine
            """
        )

    # 🔵 INFO — Email only
    elif 'Ping' in line or 'ICMP' in line:
        print(f"[i] INFO ALERT at {timestamp}")

        send_email(
            subject="ℹ️ INFO — Ping Detected — Favour's IDS",
            body=f"""
INFO ALERT

Time: {timestamp}
Alert: {line}
Source IP: {ip}
Action Taken: Logged for monitoring

Favour's IDS Response Engine
            """
        )

def monitor_log():
    """Watch fast.log for new alerts"""
    print("🛡️  Favour's IDS Response Engine Started!")
    print("👀 Watching for alerts...")
    print("Press Ctrl+C to stop\n")

    with open(LOG_FILE, 'r') as f:
        # Go to end of file
        f.seek(0, 2)

        while True:
            line = f.readline()
            if line:
                line = line.strip()
                if line:
                    print(f"[*] New alert: {line[:60]}...")
                    handle_alert(line)
            else:
                time.sleep(1)

# Run
try:
    monitor_log()
except KeyboardInterrupt:
    print("\n[*] Response Engine stopped!")
except FileNotFoundError:
    print(f"[!] Log file not found: {LOG_FILE}")
    print("[!] Make sure Suricata is running first!")