34 lines
1.3 KiB
Python
34 lines
1.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Shared core for the local-dev intrusion-detection scripts.
|
|
|
|
`copyparty.py` and `npm.py` are thin adapters. They only provide:
|
|
|
|
* a log-file matcher (glob-ish pattern / suffixes)
|
|
* a line parser producing `Request` objects
|
|
* a flagging rule (which IPs look hostile)
|
|
* column definitions for their CSV output
|
|
|
|
Everything else -- IP aggregation, whitelisting, console + file reports,
|
|
MikroTik RouterOS export -- lives in this module.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
|
|
|
|
def arg_parser(description: str, default_log_path: str,
|
|
default_report_dir: str) -> argparse.ArgumentParser:
|
|
p = argparse.ArgumentParser(description=description)
|
|
p.add_argument("--log-path", default=default_log_path,
|
|
help=f"log directory (default: {default_log_path})")
|
|
p.add_argument("--report-dir", default=default_report_dir,
|
|
help=f"report output dir (default: {default_report_dir})")
|
|
p.add_argument("--top", type=int, default=30,
|
|
help="rows in the top-IP table (default: 30)")
|
|
p.add_argument("--quiet", action="store_true",
|
|
help="write files, print nothing but the paths")
|
|
p.add_argument("--no-rsc", action="store_true",
|
|
help="skip MikroTik .rsc generation")
|
|
return p
|