Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Matching entries using python

I have parsed two logs so that just the CVE numbers write into a text file so they appear as one list. here is part of the output;

NeXpose Results: CVE-2007-6519
NeXpose Results: CVE-1999-0559
NeXpose Results: CVE-1999-1382
Snort results: CVE-1999-0016
Snort results: CVE-1999-0016
Snort results: CVE-1999-0016
Snort results: CVE-1999-0016
Snort results: CVE-1999-0016

and it is like this all of the way through the file. Now I would like to get my code to cipher through the CVE numbers and look if any of the NeXpose CVE's match the snort CVE's as I am looking at correlating the two. Here is my code;

#!/usr/bin/env python
nexpose = {}
snort = {}

CVE = open("CVE.txt","r")
cveWarning = open("Warning","w")

for line in CVE.readlines():
        list_of_line = line.split(' ')

    if "NeXpose" in list_of_line[0]:
        nexResults = list_of_line[2]
        #print 'NeXpose: ', nexResults



    if "Snort" in list_of_line[0]:
        cveResults = list_of_line[2]
        #print 'Snort: ', cveResults


a_match = [True for match in nexResults if match in cveResults]
print a_match

If there is a better way of doing this please let me know as I think I may be overcomplicating things.

like image 880
user2099445 Avatar asked Aug 08 '26 10:08

user2099445


1 Answers

Have you considered Python sets?

#!/usr/bin/python

lines = open('CVE.txt').readlines()
nexpose = set([l.split(':')[1].strip() for l in lines if l.startswith('NeXpose')])
snort   = set([l.split(':')[1].strip() for l in lines if l.startswith('Snort')])

# print 'Nexpose: ', ', '.join(nexpose)
# print 'Snort  : ', ', '.join(snort)

print 'CVEs both in Nexpose and Snort  : ', ', '.join(snort.intersection(nexpose))
like image 198
Adam Matan Avatar answered Aug 11 '26 10:08

Adam Matan