# unified2

> unified2 parser

Latest version **0.1.5** (published 2013-09-07) · GPLv3 license · 0 weekly downloads

## Install

```sh
npm install unified2
pnpm add unified2
yarn add unified2
bun add unified2
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.1.5 |
| Published | 2013-09-07 |
| First published | 2013-05-01 |
| Weekly downloads | 0 |
| License | GPLv3 |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 7 |
| Known vulnerabilities | 0 (+4 in 2 direct dependencies) |
| Install scripts | no |
| Author | Jen Andre |
| Maintainers | jandre |

## Links

- npm: https://www.npmjs.com/package/unified2
- Repository: https://github.com/threatstack/unified2
- Issues: https://github.com/threatstack/unified2/issues
- npm.io page: https://npm.io/package/unified2

## Dependencies (7)

- [ip](https://npm.io/package/ip.md) 0.0.5
- [ref](https://npm.io/package/ref.md) ~0.1.3
- [pcap](https://npm.io/package/pcap.md) https://github.com/threatstack/node_pcap/tarball/develop
- [debug](https://npm.io/package/debug.md) ~0.7.2
- [ref-array](https://npm.io/package/ref-array.md) 0.0.3
- [ref-union](https://npm.io/package/ref-union.md) 0.0.2
- [ref-struct](https://npm.io/package/ref-struct.md) 0.0.5

## Recent versions

- 0.1.5 (latest) — 2013-09-07
- 0.1.4 — 2013-05-29
- 0.1.3 — 2013-05-22
- 0.1.2 — 2013-05-22
- 0.1.1 — 2013-05-14
- 0.1.0 — 2013-05-01

## README

# Unified2

A small library for unified2 parsing in node.js.  Unified2 is a common output 
format for network intrusion detection devices such as Snort + Suricata.

See Sourcefire's documentation for the unified2 protocol: http://manual.snort.org/node44.html

## Installation

```
$ npm install unified2 
 ```

## Usage

### Example

```js
var unified2 = require('unified2');
parser = new unified2unified2.Parser('unified2.alert.14560142132', { offset: 0 });

parser.on('data', function(data) {
  // event data...
});

parser.on('error', function(error) {
  // error
});

parser.on('eof', function() {
  // triggered when an EOF (no data is received).  Useful to save a bookmark
  // when you are running in tail mode (see below).

});

parser.on('rollover', function() {
  // triggered when a rollover is detected (the file shrinks in size)
});

parser.on('end', function(data) {
  // triggered when parser ends (e.g., out of data)
});

parser.run()
```
### Tailing a file

It is often useful to wait for more data as the file is being written, e.g. by a Snort sensor.

Simply pass `tail: true` in the options for the parser to wait for more logs, e.g.:

```js
var unified2 = require('unified2');
parser = new unified2.Parser('unified2.alert.14560142132', { offset: 0, tail: true });
...
parser.run();
```

To stop the parser, you can do `parser.stop()` which will trigger an end event.

### Bookmark

To read the current bookmark, you can use `parser.last_read_position`,
which is the offset after the last read unified2 event. Useful after a 'eof'
event or 'end' event if you wish to resume parsing again later,
you can pass this into the `offset: <value>` parameter in the Parser
constructor.

### Debug logging

pass in `DEBUG=unified2` as an environment variable to turn on debug logging.

## Is it fast? This is javascript after all.

In tests, parsing happens at about ~7000k/events per second.  Obviously, this 
slows down as you add processing and IO.

Here's reading ~4.6 MB and writing parsed objects (~34MB) to stdout.
```
unified2 (master*) $ time node tests/test.js > /tmp/test.js.output                                                                                                                                                                ~/src/unified2
node tests/test.js > /tmp/test  11.67s user 0.38s system 100% cpu 11.977 total
```
## Missing?

Right now, this is just a bare bones parser. E.g., the pcaps and extra data 
are not correlated with the ids event messages.  This is intentional.  

Please refer to Pigsty (https://github.com/threatstack/pigsty) for a more
complete unified2 parser and plugin framework for handling the output.

## Bug Reporting

Please use Github or email support@threatstack.com.  

## License

Copyright (C) 2013 Threat Stack, Inc (https://www.threatstack.com) 

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.

---
_Source: https://npm.io/package/unified2 · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._