2008-06-20 03:09:05 +02:00
|
|
|
# $NetBSD: Makefile,v 1.19 2008/06/20 01:09:33 joerg Exp $
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
#
|
|
|
|
|
|
2007-11-25 19:09:53 +01:00
|
|
|
DISTNAME= base-1.3.9
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
CATEGORIES= security
|
|
|
|
|
MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=secureideas/}
|
|
|
|
|
|
|
|
|
|
MAINTAINER= adrianp@NetBSD.org
|
2006-05-13 00:31:38 +02:00
|
|
|
HOMEPAGE= http://secureideas.sourceforge.net/
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
COMMENT= Analysis engine to process a database of security events
|
|
|
|
|
|
2008-06-20 03:09:05 +02:00
|
|
|
PKG_DESTDIR_SUPPORT= destdir
|
|
|
|
|
|
2007-11-25 19:09:53 +01:00
|
|
|
.include "../../mk/apachever.mk"
|
|
|
|
|
.include "../../lang/php/phpversion.mk"
|
2007-06-30 15:47:38 +02:00
|
|
|
|
2007-11-25 19:09:53 +01:00
|
|
|
DEPENDS+= adodb>=4.96a:../../databases/adodb
|
2006-06-02 20:27:54 +02:00
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-gd>=4.0.4:../../graphics/php-gd
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-sockets>=4.0.4:../../net/php-sockets
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-mysql>=4.0.4:../../databases/php-mysql
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Log-[0-9]*:../../sysutils/pear-Log
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Numbers_Words-[0-9]*:../../math/pear-Numbers_Words
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Numbers_Roman-[0-9]*:../../math/pear-Numbers_Roman
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Image_Color-[0-9]*:../../graphics/pear-Image_Color
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Image_Graph-[0-9]*:../../graphics/pear-Image_Graph
|
2007-11-25 19:09:53 +01:00
|
|
|
DEPENDS+= ${APACHE_PKG_PREFIX}-${PHP_PKG_PREFIX}>=4.0.4:../../www/ap-php
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
|
|
|
|
NO_BUILD= YES
|
|
|
|
|
|
2006-05-13 00:31:38 +02:00
|
|
|
.include "../../mk/bsd.prefs.mk"
|
|
|
|
|
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
DOC_FILES= CHANGELOG CREDITS README README.mssql TODO UPGRADE base_faq.rtf
|
|
|
|
|
BASE_DIR= ${PREFIX}/share/base
|
|
|
|
|
EGDIR= ${PREFIX}/share/examples/base
|
|
|
|
|
MESSAGE_SUBST+= EGDIR=${EGDIR:Q} BASE_DIR=${BASE_DIR:Q}
|
|
|
|
|
PAX_DIRS= admin help images includes languages scripts setup sql styles
|
|
|
|
|
WWW_USER?= ${APACHE_USER}
|
|
|
|
|
WWW_GROUP?= ${APACHE_GROUP}
|
2008-05-26 04:13:14 +02:00
|
|
|
USE_TOOLS+= pax perl:run
|
2006-03-13 13:25:29 +01:00
|
|
|
REPLACE_PERL+= scripts/base_maintenance.pl
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
2007-11-25 19:09:53 +01:00
|
|
|
# SKIP_PORTABILITY_CHECK= YES
|
2007-10-21 01:22:08 +02:00
|
|
|
|
2007-07-04 22:54:31 +02:00
|
|
|
PKG_GROUPS_VARS+= WWW_GROUP
|
|
|
|
|
PKG_USERS_VARS+= WWW_USER
|
|
|
|
|
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
CONF_FILES= ${EGDIR}/base.conf ${PKG_SYSCONFDIR}/base.conf
|
|
|
|
|
|
|
|
|
|
CONF_FILES_PERMS= ${EGDIR}/base_conf.php ${BASE_DIR}/base_conf.php \
|
|
|
|
|
${WWW_USER} ${WWW_GROUP} 0600
|
|
|
|
|
|
2007-11-25 19:09:53 +01:00
|
|
|
BUILD_DEFS+= APACHE_USER APACHE_GROUP
|
|
|
|
|
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
SUBST_CLASSES+= conf
|
|
|
|
|
SUBST_STAGE.conf= post-patch
|
|
|
|
|
SUBST_FILES.conf= base.conf base_conf.php.dist
|
2006-03-13 13:25:29 +01:00
|
|
|
SUBST_SED.conf= -e "s|@BASE_DIR@|${BASE_DIR}|g"
|
|
|
|
|
SUBST_SED.conf+= -e "s|@DBTYPE@|${DBTYPE}|g"
|
|
|
|
|
SUBST_SED.conf+= -e "s|@PREFIX@|${PREFIX}|g"
|
|
|
|
|
SUBST_MESSAGE.conf= Fixing configuration files.
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
2008-06-20 03:09:05 +02:00
|
|
|
INSTALLATION_DIRS= ${BASE_DIR} ${EGDIR} share/doc/base
|
|
|
|
|
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
.include "options.mk"
|
|
|
|
|
|
|
|
|
|
post-extract:
|
2006-10-23 20:19:45 +02:00
|
|
|
${CP} ${FILESDIR}/base.conf ${WRKSRC}/base.conf
|
2007-05-19 01:27:22 +02:00
|
|
|
${FIND} ${WRKSRC} -name *.php | ${XARGS} ${CHMOD} ${SHAREMODE}
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
|
|
|
|
do-install:
|
2008-06-20 03:09:05 +02:00
|
|
|
${INSTALL_DATA} ${WRKSRC}/base.conf ${DESTDIR}${EGDIR}
|
|
|
|
|
${INSTALL_DATA} ${WRKSRC}/base_conf.php.dist ${DESTDIR}${EGDIR}/base_conf.php
|
|
|
|
|
${INSTALL_DATA} ${WRKSRC}/*.php ${DESTDIR}${BASE_DIR}
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
|
|
|
|
. for f in ${DOC_FILES}
|
2008-06-20 03:09:05 +02:00
|
|
|
${INSTALL_DATA} ${WRKSRC}/docs/${f:Q} ${DESTDIR}${PREFIX}/share/doc/base
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
. endfor
|
|
|
|
|
|
|
|
|
|
. for i in ${PAX_DIRS}
|
2008-06-20 03:09:05 +02:00
|
|
|
cd ${WRKSRC}/${i:Q} && pax -rw . ${DESTDIR}${BASE_DIR}/${i:Q}
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
. endfor
|
|
|
|
|
|
2008-06-20 03:09:05 +02:00
|
|
|
${CHOWN} ${WWW_USER} ${DESTDIR}${BASE_DIR}
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
|
|
|
|
.include "../../mk/bsd.pkg.mk"
|
