Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.
# $language = "VBScript" # $interface = "1.0" ' ASSUMPTION: file being 'tailed' contains information ' similar to: ' Jan 5 18:26:13 device01 9927: Jan 5 18:26:12: %LINK-3-UPDOWN: Interface POS5/2, changed state to down ' Jan 5 18:26:47 device02 6332: Jan 5 18:26:46.243: %LINK-3-UPDOWN: Interface GigabitEthernet3/1, changed state to down ' Jan 5 18:28:40 device01 9937: Jan 5 18:28:39: %LINK-3-UPDOWN: Interface POS5/2, changed state to down Sub Main() ' Make sure that we are running in Synchronous mode so ' that when WaitForStrings() finds something, we can ' capture the current line without risk of it already ' having flown by on the screen. This slows things down ' a bit, but provides insurance against errors due to ' SecureCRT and the script running asynchronously. crt.Screen.Synchronous = true ' Start tailing a file... crt.Screen.Send "tail tailfile.txt" & vbcr ' Example #1: Uses WaitForString to look for just the text ' we care about. Once the text is found, the ' line on which the text was located is captured ' and a piece of information is parsed using the ' Split() builtin VBScript method. CaptureJustTheLinesWeCareAbout ' Example #2: Uses WaitForString to detect when every new line ' arrives from the remote. Each line of text is ' captured, and the Instr() builtin VBScript ' function is used to detect the presence of the ' specific text we care about. Iff it is present, ' the Split() builtin VBScript method is used to ' parse out the relevant piece of information. ' ' The benefit of this method over ' CaptureJustTheLinesWeCareAbout is that we ' can retrieve information from the line if ' the text we care about comes prior to the ' relevant piece of information that we would ' like to display as part of our notification. ' ' To enable this example, comment out the statement ' on line 29 and uncomment the line below: ' CaptureAllLinesAndSearchForTextWeCareAbout End Sub '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Sub CaptureJustTheLinesWeCareAbout() MsgBox "Capturing just the lines we care about" do ' Look for specific output crt.Screen.WaitForString "changed state to down" ' Once specific output is found, capture the line ' of text on which the "changed to state down" string ' was located. szCurrentLine = crt.Screen.Get(crt.Screen.CurrentRow, _ 0, _ crt.Screen.CurrentRow, _ crt.Screen.Columns) ' Trim off any leading or training spaces szCurrentLine = Trim(szCurrentLine) ' Use the Split() method (builtin VBScript method) ' to get at the component we care about (deviceID) vElements = Split(szCurrentLine, " ") for each x in vElements 'document.write(x & "<br />") next MsgBox "Device """ & vElements(3) & """ just went down." ' Modify the "$" or the "->" in the array below to reflect the actual shell ' prompt you expect to find when authentication is successful to your remote ' machine. PossibleShellPrompts = Array(_ "changed state to down:") Do Select Case objNewTab.Screen.MatchIndex Case 1 ' "changed state to down:" ' Send the username objNewTab.Screen.Send strUser & vbcr & "show ip int brief" Case Else DisplayMessage "Ooops! Looks like you forgot to add code " & _ "to handle this index: " & objNewTab.Screen.MatchIndex & _ vbcrlf & _ vbcrlf & _ "Modify your script code's ""Select Case"" block " & _ "to have 'Case' statements for all of the strings you " & _ "are passing to the ""WaitForStrings"" method." objNewTab.Session.Disconnect ' Only attempt to close the tab if it's not *the* script tab If crt.GetScriptTab().Index <> objNewTab.Index Then objNewTab.Close End If Exit Sub End Select Loop 'MsgBox "Device """ & vElements(0) & vElements(1) & vElements(2) & vElements(3) & """ just went down." 'MsgBox "Device """ & vElements(0) & vElements(1) & vElements(2) & vElements(3) & "is " vElements(6)" Loop End Sub
Join the community of 500,000 technology professionals and ask your questions.
Connect with top rated Experts
7 Experts available now in Live!