Read rogue UserAgents from file instead of hardcoded in alarm.py
@@ -231,7 +231,18 @@ class alarm():
def alarm_check3(self):
## This check queries for UA's that are listed in any blacklist_useragents.conf and do talk to c2* paths on redirectors\n
- keywords = ["curl","python"]
+ # We will dig trough ALL data finding specific IP related lines and tag them
+ fname = "/etc/redelk/rogue_useragents.conf"
+ with open(fname) as f:
+ content = f.readlines()
+ with open(fname) as f:
+ content = f.readlines()
+ uaList = []
+ for line in content:
+ if not line.startswith('#'):
+ ua = line.strip()
+ uaList.append(line.strip())
+ keywords = uaList
# IF NO KEYWORDS EXIT
qSub = ""
for keyword in keywords:
