setup-ecrimelabs

#!/bin/bash

. /usr/sbin/so-common

echo
header "Welcome to the Security Onion eCrimeLabs Import Wizard!"
echo
echo "Would you like to configure NIDS rules for Snort/Suricata?"
echo
echo "Is so, please type YES below and press the ENTER key:"
echo
read nids_rules
echo

echo
echo "Would you like to configure Intel data for Bro?"
echo
echo "Is so, please type YES below and press the ENTER key:"
echo
read intel
echo

if [ ! $nids_rules = "YES" ] && [ ! $intel = "YES"  ]; then
	echo "No rules or intel data selected to import.  Exiting..."
	exit 0
fi

echo "To confirm, we will configure the following:"
echo

if [ $nids_rules = "YES" ]; then
echo "NIDS Rules: /etc/nsm/rules/local.ecrimelabs.rules"
fi

if [ $intel = "YES" ]; then
echo "Bro Intel: /opt/bro/share/bro/intel/ecrimelabs-intel.dat"
fi

echo
echo "If you would like to continue, please type \"YES\" below and press the ENTER key:"
read confirm
echo

if [ $confirm != "YES" ]; then
        echo "Did confirm configuration...exiting..."
	echo
	exit 0
else

	eCrimeLabsCFG="/etc/ecrimelabs/ecrimelabscfg"
	mkdir -p /etc/ecrimelabs
        cp securityonion-ecrimelabs/ecrimelabscfg $eCrimeLabsCFG

	echo "Configuring..."

	# Configure download-eCrimeLabs with appropriate values
	sed -i "s/^INTEL=.*/INTEL=\"${intel,,}\"/" $eCrimeLabsCFG
	sed -i "s/^NIDS_RULES.*/NIDS_RULES=\"${nids_rules,,}\"/" $eCrimeLabsCFG

	# Copy eCrimeLabs scripts into place
	cp securityonion-ecrimelabs/download-ecrimelabs /usr/sbin/download-ecrimelabs
	cp securityonion-ecrimelabs/configure-ecrimelabs /usr/sbin/configure-ecrimelabs

	# Set perms
	chmod +x /usr/sbin/download-ecrimelabs
        chmod +x /usr/sbin/configure-ecrimelabs

	echo
	# Run configuration script
	/usr/sbin/configure-ecrimelabs
	echo
fi