+ 
+ 
+
"
+ msg += self.template["high_msg"].format(
+ self.nb_translate(len(self.alerts["high"])))
+ msg += "
"
+ return msg
+ elif len(self.alerts["moderate"]):
+ msg = ""
+ msg += self.template["moderate_msg"].format(
+ self.nb_translate(len(self.alerts["moderate"])))
+ msg += "
"
+ return msg
+ elif len(self.alerts["low"]):
+ msg = ""
+ msg += self.template["low_msg"].format(
+ self.nb_translate(len(self.alerts["low"])))
+ msg += "
"
+ return msg
+ else:
+ msg = ""
+ msg += self.template["none_msg"]
+ msg += "
"
+ return msg
+
+ def nb_translate(self, nb):
+ """ Translate a number in a string.
+
+ Args:
+ nb (int): integer
+
+ Returns:
+ string: A translated string related to the integer
+ """
+ a = self.template["numbers"]
+ return a[nb-1] if nb <= 9 else str(nb)
+
+ def generate_suspect_conns_block(self):
+ """Generate the block and the table of communications categorized as suspect.
+
+ Returns:
+ str: HTML block of the suspect communications
+ """
+
+ tbody = ""
+
+ for record in self.records:
+ if record["suspicious"] == True:
+ tbody += "{self.template['suspect_title']}
" + table = "| {self.template['protocol']} | " + table += f"{self.template['domain']} | " + table += f"{self.template['dst_ip']} | " + table += f"{self.template['dst_port']} | " + table += "
|---|
{}
".format(self.template["uncat_title"]) + table = "| {self.template['protocol']} | " + table += f"{self.template['domain']} | " + table += f"{self.template['dst_ip']} | " + table += f"{self.template['dst_port']} | " + table += "
|---|
{}
".format(self.template["whitelist_title"]) + table = "| {self.template['protocol']} | " + table += f"{self.template['domain']} | " + table += f"{self.template['dst_ip']} | " + table += f"{self.template['dst_port']} | " + table += "
|---|
"
+ header += ""
+ header += f"
"
+ return header
+
+ def generate_alerts(self):
+ """Generate a block embedding the alerts triggered during the analysis.
+
+ Returns:
+ str: HTML block containing the data.
+ """
+ alerts = "
{self.template['device_mac']}: {self.device['mac_address']}
"
+ header += f"{self.template['detection_methods']}: {'☑' if self.methods['iocs'] else '☐'} IOCs {'☑' if self.methods['heuristics'] else '☐'} Heuristics {'☑' if self.methods['active'] else '☐'} Active analysis
"
+ header += f"{self.template['capture_sha1']}: {self.capture_sha1}
"
+ header += f"{self.template['instance_uuid']}: {self.instance['instance_uuid']}
"
+ header += f"{self.template['report_generated_on']} {datetime.now().strftime('%d/%m/%Y - %H:%M:%S')}
"
+ if self.capinfos is not None:
+ header += f"{self.template['capture_duration']}: {self.capinfos['Capture duration'].split(' ')[0]} {self.template['seconds']}
"
+ header += f"{self.template['analysis_duration']}: {self.analysis_duration} {self.template['seconds']}
"
+ header += f"{self.template['packets_number']}: {self.capinfos['Number of packets']}
"
+ header += "
- "
+ for alert in self.alerts["high"]:
+ alerts += "
- "
+ alerts += "High"
+ alerts += "{}".format(alert["id"])
+ alerts += "" + alerts += "{}".format(alert["title"]) + alerts += "" + alerts += "
{}
".format( + alert["description"]) + alerts += " "
+
+ for alert in self.alerts["moderate"]:
+ alerts += " - "
+ alerts += "moderate"
+ alerts += "{}".format(alert["id"])
+ alerts += "" + alerts += "{}".format(alert["title"]) + alerts += "" + alerts += "
{}
".format( + alert["description"]) + alerts += " "
+ for alert in self.alerts["low"]:
+ alerts += " - "
+ alerts += "low"
+ alerts += "{}".format(alert["id"])
+ alerts += "" + alerts += "{}".format(alert["title"]) + alerts += "" + alerts += "
{}
".format( + alert["description"]) + alerts += " "
+
+ alerts += "