├── README.md ├── d3chart └── forceopacity.html ├── map2.html ├── pivotmap.sh ├── sample_data.csv └── so.csv /README.md: -------------------------------------------------------------------------------- 1 | # pivotmap 2 | Analyst tool for creating pivot maps of data sources 3 | 4 | Usage: cat sample_data.csv | ./pivotmap.sh > map.html 5 | 6 | Examine sample_data.csv or so.csv for an example of how your input should be formatted. 7 | 8 | This tool is based on Moplotter (https://github.com/automayt/MoPlotter). Special thanks to Jason Smith. 9 | -------------------------------------------------------------------------------- /d3chart/forceopacity.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 
dataplaceholder
  5 |
6 | 94 | 95 | 96 |
97 | 101 | 110 |
111 |
112 | 113 | 311 | 312 | 313 | 314 | 315 | -------------------------------------------------------------------------------- /map2.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 
  5 | source,target
  6 | bro_http,timestamp
  7 | bro_http,bro_id
  8 | bro_http,ip
  9 | bro_http,port
 10 | bro_http,http_method
 11 | bro_http,domain
 12 | bro_http,user_agent
 13 | bro_http,uri
 14 | bro_http,bytes
 15 | bro_http,http_status
 16 | bro_http,filename
 17 | bro_http,x_originating_ip
 18 | bro_http,mime_type
 19 | bro_files,timestamp
 20 | bro_files,bro_id
 21 | bro_files,ip
 22 | bro_files,port
 23 | bro_files,mime_type
 24 | bro_files,duration
 25 | bro_files,bytes
 26 | bro_files,hash
 27 | bro_intel,timestamp
 28 | bro_intel,bro_id
 29 | bro_intel,ip
 30 | bro_intel,post
 31 | bro_intel,mime_type
 32 | bro_intel,indicator_type
 33 | bro_intel,intel_source
 34 | bro_dns,timestamp
 35 | bro_dns,bro_id
 36 | bro_dns,protocol
 37 | bro_dns,dns_trans_id
 38 | bro_dns,domain
 39 | bro_dns,dns_query_type
 40 | bro_dns,dns_response_code
 41 | bro_conn,timestamp
 42 | bro_conn,bro_id
 43 | bro_conn,ip
 44 | bro_conn,port
 45 | bro_conn,protocol
 46 | bro_conn,service
 47 | bro_conn,duration
 48 | bro_conn,bytes
 49 | bro_conn,pkt_count
 50 | bro_conn,countrycode
 51 | bro_notice,timestamp
 52 | bro_notice,bro_id
 53 | bro_notice,mime_type
 54 | bro_notice,protocol
 55 | bro_notice,ip
 56 | bro_notice,port
 57 | bro_smtp,timestamp
 58 | bro_smtp,bro_id
 59 | bro_smtp,mail_user_agent
 60 | bro_smtp,mail_subject
 61 | bro_smtp,mail_from
 62 | bro_smtp,mail_to
 63 | bro_smtp,mail_helo
 64 | bro_smtp,x_originating_ip
 65 | bro_software,timestamp
 66 | bro_software,bro_id
 67 | bro_software,ip
 68 | bro_software,port
 69 | bro_software,program_name
 70 | bro_software,program_version
 71 | bro_ssl,timestamp
 72 | bro_ssl,bro_id
 73 | bro_ssl,ip
 74 | bro_ssl,port
 75 | bro_ssl,ssl_version
 76 | bro_ssl,domain
 77 | bro_ssl,cert_subject
 78 | bro_ssl,cert_expiration
 79 | bro_ssl,cert_hash
 80 | bro_ssl,cert_validation_status
 81 | bro_ssh,timestamp
 82 | bro_ssh,bro_id
 83 | bro_ssh,ip
 84 | bro_ssh,port
 85 | bro_ssh,ssh_auth_status
 86 | bro_ssh,ssh_client_string
 87 | bro_ssh,ssh_server_string
 88 | bro_ssh,bytes
 89 | bro_tunnel,timestamp
 90 | bro_tunnel,bro_id
 91 | bro_tunnel,ip
 92 | bro_tunnel,port
 93 | bro_tunnel,tunnel_type
 94 | bro_tunnel,tunnel_action
 95 | bro_weird,timestamp
 96 | bro_weird,bro_id
 97 | bro_weird,ip
 98 | bro_weird,port
 99 |
100 | 188 | 189 | 190 |
191 | 195 | 204 |
205 |
206 | 207 | 405 | 406 | 407 | 408 | 409 | -------------------------------------------------------------------------------- /pivotmap.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | genmap () { 4 | 5 | sed '1 s/^/source,target\ 6 | /' >> temp.test 7 | 8 | sed '/dataplaceholder/{ 9 | s/dataplaceholder//g 10 | r temp.test 11 | }' d3chart/forceopacity.html 12 | 13 | rm temp.test 14 | 15 | } 16 | 17 | if [ "$1" == "-h" ]; then 18 | echo -e "Usage: cat sample.csv | ./pivotmap.sh > map.html" 19 | echo -e "Examine sample.csv or so.csv for an example of how your input should be formatted." 20 | exit 0 21 | fi 22 | 23 | genmap -------------------------------------------------------------------------------- /sample_data.csv: -------------------------------------------------------------------------------- 1 | flow,ip 2 | flow,port 3 | flow,protocol 4 | flow,bytes 5 | firewall,ip 6 | firewall,port 7 | firewall,protocol 8 | pcap,ip 9 | pcap,port 10 | pcap,protocol 11 | proxy,ip 12 | proxy,port 13 | proxy,http_status 14 | proxy,http_method 15 | proxy,uri 16 | proxy,user_agent 17 | -------------------------------------------------------------------------------- /so.csv: -------------------------------------------------------------------------------- 1 | bro_http,timestamp 2 | bro_http,bro_id 3 | bro_http,ip 4 | bro_http,port 5 | bro_http,http_method 6 | bro_http,domain 7 | bro_http,user_agent 8 | bro_http,uri 9 | bro_http,bytes 10 | bro_http,http_status 11 | bro_http,filename 12 | bro_http,x_originating_ip 13 | bro_http,mime_type 14 | bro_files,timestamp 15 | bro_files,bro_id 16 | bro_files,ip 17 | bro_files,port 18 | bro_files,mime_type 19 | bro_files,duration 20 | bro_files,bytes 21 | bro_files,hash 22 | bro_intel,timestamp 23 | bro_intel,bro_id 24 | bro_intel,ip 25 | bro_intel,post 26 | bro_intel,mime_type 27 | bro_intel,indicator_type 28 | bro_intel,intel_source 29 | bro_dns,timestamp 30 | bro_dns,bro_id 31 | bro_dns,protocol 32 | bro_dns,dns_trans_id 33 | bro_dns,domain 34 | bro_dns,dns_query_type 35 | bro_dns,dns_response_code 36 | bro_conn,timestamp 37 | bro_conn,bro_id 38 | bro_conn,ip 39 | bro_conn,port 40 | bro_conn,protocol 41 | bro_conn,service 42 | bro_conn,duration 43 | bro_conn,bytes 44 | bro_conn,pkt_count 45 | bro_conn,countrycode 46 | bro_notice,timestamp 47 | bro_notice,bro_id 48 | bro_notice,mime_type 49 | bro_notice,protocol 50 | bro_notice,ip 51 | bro_notice,port 52 | bro_smtp,timestamp 53 | bro_smtp,bro_id 54 | bro_smtp,mail_user_agent 55 | bro_smtp,mail_subject 56 | bro_smtp,mail_from 57 | bro_smtp,mail_to 58 | bro_smtp,mail_helo 59 | bro_smtp,x_originating_ip 60 | bro_software,timestamp 61 | bro_software,bro_id 62 | bro_software,ip 63 | bro_software,port 64 | bro_software,program_name 65 | bro_software,program_version 66 | bro_ssl,timestamp 67 | bro_ssl,bro_id 68 | bro_ssl,ip 69 | bro_ssl,port 70 | bro_ssl,ssl_version 71 | bro_ssl,domain 72 | bro_ssl,cert_subject 73 | bro_ssl,cert_expiration 74 | bro_ssl,cert_hash 75 | bro_ssl,cert_validation_status 76 | bro_ssh,timestamp 77 | bro_ssh,bro_id 78 | bro_ssh,ip 79 | bro_ssh,port 80 | bro_ssh,ssh_auth_status 81 | bro_ssh,ssh_client_string 82 | bro_ssh,ssh_server_string 83 | bro_ssh,bytes 84 | bro_tunnel,timestamp 85 | bro_tunnel,bro_id 86 | bro_tunnel,ip 87 | bro_tunnel,port 88 | bro_tunnel,tunnel_type 89 | bro_tunnel,tunnel_action 90 | bro_weird,timestamp 91 | bro_weird,bro_id 92 | bro_weird,ip 93 | bro_weird,port 94 | --------------------------------------------------------------------------------