#!/bin/sh

# Author: Guy Bruneau, gbruneau@ipss.ca
# Version: 1.0
# Date: 23 August 2017
# Title: netwitness_sdk.sh

# Description:
# This script gets the statistics from the Concentrator/Decoders and create a 
# web page that can be reviewed by the analysts.
 
# Statistics on SA server at URL: http://sa/stats/

# Place the netwitness_stats.sh script in the /root/scripts directory.
# If it doesn't exist, create it and then add the following cronjob 
# that will run every 30 minutes.
# To add the cronjob do: cronjob -e 
# add the following two lines and save it.
 
# These statistics are queried every 15 minutes.
# 0,30 * * * * /home/scripts/netwitness_stats.sh > /dev/null 2>&1

# Copy these line as many time you need to reflect your network setup
# You will need the variables for all your concentrators/decoders/logdecoders
# You will also need to copy all the wget (4 lines) for each devices and 
# change the variable and the device name to show correctly in the report.


# Set Concentrator 1 default IP
CON1='192.168.25.13'
 
# Set Concentrator 2 default IP
CON2='192.168.25.xx'

# Set Decoder 1 default IP
DEC1='192.168.25.14'

# Set Decoder 2 default IP
DEC2='192.168.25.xx'

# Set LogDecoder 1 default IP
LOGDEC1='192.168.25.15'

# Set LogDecoder 2 default IP
LOGDEC2='192.168.25.xx'

LASTUPDATE=`date -u +%d-%b-%Y:%H-%M-%S`
 
echo "<title>NetWitness Statistics</title>" > stats.htm
echo "Last Update: $LASTUPDATE" >> stats.htm
echo "<h1 align='center'>Oldest Meta - Concentrators</h1>" >> stats.htm
 
wget --http-user=admin --http-password=netwitness http://$CON1:50105/database/stats/meta.oldest.file.time 
sed -i 's/<string>/<string>Concentrator 1 - /g' meta.oldest.file.time
cat meta.oldest.file.time >> stats.htm
rm meta.oldest.file.time
 
echo "<h1 align='center'>Oldest Packets/Logs - Decoders</h1>" >> stats.htm
 
wget --http-user=admin --http-password=netwitness http://$DEC1:50104/database/stats/packet.oldest.file.time 
sed -i 's/<string>/<string>Decoder 1 - /g' packet.oldest.file.time
cat packet.oldest.file.time >> stats.htm
rm packet.oldest.file.time

wget --http-user=admin --http-password=netwitness http://$LOGDEC1:50102/database/stats/packet.oldest.file.time 
sed -i 's/<string>/<string>LogDecoder 1 - /g' packet.oldest.file.time
cat packet.oldest.file.time >> stats.htm
rm packet.oldest.file.time

echo "<h1 align='center'>Decoders Uptime and Dropped Packet</h1>" >> stats.htm
 
wget --http-user=admin --http-password=netwitness http://$DEC1:50104/decoder/stats/time.capture
sed -i 's/<string>/<string>Decoder 1 - /g' time.capture
cat time.capture >> stats.htm
rm time.capture
 
wget --http-user=admin --http-password=netwitness http://$DEC1:50104/decoder/stats/capture.dropped
sed -i 's/<string>/<string>Decoder 1 Packet Dropped - /g' capture.dropped
cat capture.dropped >> stats.htm
rm capture.dropped

# This is the LogDecoder list

wget --http-user=admin --http-password=netwitness http://$LOGDEC1:50102/decoder/stats/time.capture
sed -i 's/<string>/<string>LogDecoder 1 - /g' time.capture
cat time.capture >> stats.htm
rm time.capture
 
wget --http-user=admin --http-password=netwitness http://$LOGDEC1:50102/decoder/stats/capture.dropped
sed -i 's/<string>/<string>LogDecoder 1 Packet Dropped - /g' capture.dropped
cat capture.dropped >> stats.htm
rm capture.dropped

 
sed -i 's/response>/response><br\/>/g' stats.htm
 
# Check to make sure the directory exists
 
OUTPUTDIR="/var/netwitness/srv/www/stats"
 
if [[ ! -d $OUTPUTDIR ]]; then
 mkdir -p $OUTPUTDIR
fi
 
# Moving the stats in the web directory
mv stats.htm /var/netwitness/srv/www/stats/index.htm
