roles/Sharingan/files/suricata/siem-block

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+cidr="$1"
+
+# If no CIDR was provided, query suricata.
+if [ -z "$cidr" ]; then
+    echo Top offenders last 8 hours:
+    journalctl --since=-8h -xeu suricata | cut -f 2 -d '}' | cut -f 1 -d : | sort -n | uniq -c | sort -n | tail -n 10
+    read -p Target: cidr
+fi
+
+whois "$cidr" | grep -iE 'inet|cidr|country|address|organization'
+read -p "Sanitized CIDR: " cidr
+
+set -x
+ssh shadownet iptables -A siem -s "$cidr" -j DROP
+if [ $? -ne 0 ]; then
+    ssh shadownet iptables -N siem
+    ssh shadownet iptables -I INPUT 3 -j siem
+    ssh shadownet iptables -A siem -s "$cidr" -j DROP
+fi
+
+sudo iptables -A siem -s "$cidr" -j DROP
+set +x