home *** CD-ROM | disk | FTP | other *** search
- <?xml version='1.0' ?>
- <!-- /*//////////////////////////////////////////////////////////////////////
- //filename: log.xsl
- //copyright(c): Tiny Software corp 2002, 2003 (http://www.tinysoftware.com)
- //author: Jozef Palocko (jpalocko@tinysoftware.com)
- //product: Tiny Personal Firewall 5.x
- //description: Log analyzer stylesheet
- //changelog:
- // 18.8.2003 - added displaying date in local time zone
- ///////////////////////////////////////////////////////////////////////*/ -->
- <xsl:stylesheet version="1.0"
- xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
- xmlns:msxsl="urn:schemas-microsoft-com:xslt"
- xmlns:time="http://mycompany.com/mynamespace">
-
- <xsl:import href="log.xsl"/>
- <!--xsl:output method="html" indent="yes" /-->
-
- <xsl:template match="/">
- <style>
- <xsl:text>
- BODY {
- font-family: "MS Sans serif", "Verdana", "Tahoma" ;
- font-size: 10px;
- background-color: #ffffff;
- color:#000000;
- }
- .clsFirewall{
- background-color: e2bde6;
- height:10px;
- }
- .clsSandbox{
- background-color: #f2f7b6;
- height:10px;
- }
- .clsIDS{
- background-color: #ffffd7;
- height:10px;
- }
- .clsEvent{
- background-color: #fafafa;
- text-align : left;
- margin-bottom: 10px;
- }
- .clsAllow{
- color =#2e8b57;
- font-weight : bold;
- }
- .clsPrevent{
- color =#ff0000;
- font-weight : bold;
- }
- .clsAskUser{
- color =#00ffff;
- font-weight : bold;
- }
-
-
- </xsl:text>
- </style>
-
- <xsl:call-template name="tplModule">
- <xsl:with-param name="Events" select="/Root/Event"/>
- </xsl:call-template>
- </xsl:template>
-
- <!--
- //////////////////////////////////////
- ///////// Element templates
-
- -->
-
-
- <!-- ///////// Object //////////// -->
- <xsl:template match="Object">
- <B> Ot: </B>
- <xsl:value-of select="@ot"/>
- <!--xsl:choose>
- <xsl:when test="@ot='0x00000001'">file</xsl:when>
- <xsl:when test="@ot='0x00000002'">service</xsl:when>
- <xsl:when test="@ot='0x00000004'">registry key</xsl:when>
- <xsl:when test="@ot='0x00000008'">Spawning object</xsl:when>
- <xsl:when test="@ot='0x00000010'">Device</xsl:when>
- <xsl:when test="@ot='0x00000020'">VBA Macro</xsl:when>
- <xsl:when test="@ot='0x00000040'">COM object</xsl:when>
- <xsl:when test="@ot='0x00000080'">System privileges</xsl:when>
- <xsl:when test="@ot='0x00000400'">Transport object</xsl:when>
- <xsl:when test="@ot='0x10000000'">Action</xsl:when>
- <xsl:when test="@ot='0x20000000'">Message</xsl:when>
- </xsl:choose-->
- <B> Object: </B>
- <xsl:value-of select="." />
- <BR />
- </xsl:template>
-
- <!-- ///////// App //////////// -->
- <xsl:template match="App">
- <B>App: </B>
- <xsl:value-of select="." />
- <BR />
- <xsl:if test="@chksm">
- <B> Chksm: </B>
- <xsl:value-of select="@chksm" />
- </xsl:if>
- </xsl:template>
-
- <!-- ///////// Action //////////// -->
- <xsl:template match="Action">
- <B>Message:</B>
- <xsl:value-of select="." />
- <xsl:if test="@fncMsg"> - <xsl:value-of select="@fncMsg" />
- </xsl:if>
-
- <xsl:if test="@fnc">
- <B> Fnc: </B>
- <xsl:variable name="ID" select="@fnc" /> <xsl:value-of select="$Def//Fnc[@id_dec=$ID]" /> (<xsl:value-of select="$ID" />)
- <BR />
- </xsl:if>
- </xsl:template>
-
- <!-- ///////// Msg //////////// -->
- <xsl:template match="Msg">
- <B>Msg: </B>
- <xsl:value-of select="." />
- <br />
- </xsl:template>
-
- <!-- ///////// InetDef //////////// -->
- <xsl:template match="InetDef">
- <B>Prot: </B>
- <xsl:value-of select="@prot" />
- <B> Dir: </B>
- <xsl:value-of select="@dir" />
- <B> RemIp: </B>
- <xsl:value-of select="@remIp" />
- <xsl:if test="@locPort">
- <B> LocPort: </B>
- <xsl:value-of select="@locPort" />
- </xsl:if>
- <xsl:if test="@locPort">
- <B> RemPort: </B>
- <xsl:value-of select="@remPort" />
- <BR />
- </xsl:if>
- <xsl:if test="@icmpFn">
- <B> IcmpFn: </B>
- <xsl:value-of select="@icmpFn" />
- <BR />
- </xsl:if>
- <xsl:if test="@locIp">
- <B> LocIp: </B>
- <xsl:value-of select="@locIp" />
- <BR />
- </xsl:if>
- </xsl:template>
-
- <!-- ///////// Event //////////// -->
- <xsl:template match="Event">
- <xsl:param name="Total"/>
- <xsl:param name="Events"/>
- <xsl:if test="($Filter//cnt=0) or (position()>$Total - $Filter//cnt)">
- <div class="clsEvent" >
- <div >
- <xsl:attribute name="class">
- <xsl:choose>
- <xsl:when test="@module=1">clsSandbox</xsl:when>
- <xsl:when test="@module=2">clsFirewall</xsl:when>
- <xsl:when test="@module=16">clsIDS</xsl:when>
- </xsl:choose>
- </xsl:attribute>
-
- <div style="width:90%; float: left; ">
- <xsl:text>Module: </xsl:text>
- <xsl:choose>
- <xsl:when test="@module=1">
- <b>Windows security</b>
- </xsl:when>
- <xsl:when test="@module=2">
- <b>Firewall</b>
- </xsl:when>
- <xsl:when test="@module=16">
- <b>IDS</b>
- </xsl:when>
- <xsl:otherwise>
- <xsl:value-of select="@module"/>
- </xsl:otherwise>
- </xsl:choose>
-
- <xsl:text> Date: </xsl:text>
- <xsl:value-of select="time:LocalTime(.)"/>
- <!-- <xsl:value-of select="@dateTimeLast" />-->
- <xsl:if test="@user">
- <xsl:text> User: </xsl:text>
- <B>[<xsl:value-of select="@user" />] </B>
- </xsl:if>
- <xsl:if test="@domain">
- <xsl:text> Domain: </xsl:text>
- <B>[<xsl:value-of select="@domain" />] </B>
- </xsl:if>
-
- </div>
- <div style="float: right; text-align: right; width:5%; ">
- <xsl:choose>
- <xsl:when test="$Filter//sort='App'">
- <xsl:variable name="thisApp" select="App"/>
- <xsl:variable name="thisUser" select="@user"/>
- <xsl:variable name="thisDomain" select="@domain"/>
- <xsl:variable name="thisModule" select="@module"/>
- <xsl:variable name="thisAction" select="Action"/>
- <xsl:variable name="thisMsg" select="Msg"/>
- <xsl:variable name="thisProt" select="InetDef/@prot"/>
- <xsl:variable name="thisDir" select="InetDef/@dir"/>
- <xsl:variable name="thisRemPort" select="InetDef/@remPort"/>
- <xsl:variable name="thisRemIp" select="InetDef/@remIp"/>
- <xsl:variable name="equalEvents" select="$Events[
- (@module=$thisModule) and
- (App=$thisApp or (count($thisApp)=0 and count(App)=0)) and
- (@user=$thisUser or (count($thisUser)=0 and count(@user)=0)) and
- (@domain=$thisDomain or (count($thisDomain)=0 and count(@domain)=0)) and
- (Action=$thisAction) and
- (not($thisModule=16) or $thisMsg=Msg) and
- (not($thisModule=2) or ($thisProt=InetDef/@prot and
- (count($thisDir)=0 and count(InetDef/@dir)=0 or $thisDir=InetDef/@dir) and
- (count($thisRemPort)=0 and count(InetDef/@remPort)=0 or $thisRemPort=InetDef/@remPort) and
- (count($thisRemIp)=0 and count(InetDef/@remIp)=0 or $thisRemIp=InetDef/@remIp)
- )
- )
-
- ]"/>
- <!--B> Count: </B-->
- <xsl:value-of select="count($equalEvents)"/>
- </xsl:when>
- <xsl:otherwise>
- <xsl:if test="@count">
- <!--B> Count: </B-->
- <xsl:value-of select="@count" />
- </xsl:if>
- </xsl:otherwise>
- </xsl:choose>
- </div>
- </div>
- <!-- <xsl:if test="@ruleID">
- <B> RULEID: </B>
- <xsl:value-of select="@ruleID" />
- </xsl:if>
- -->
- <xsl:apply-templates />
- </div>
- </xsl:if>
- </xsl:template>
-
- </xsl:stylesheet>
-