check_snorby

Project Notes

This plugin queries the Snorby (https://github.com/Snorby/snorby) database for High severity events in a time interval. The time interval is defined by -i argument, the accepted arguments are integer values.

Requirements
- Access to Snorby database
- Before executing the script you need to modify the database connection values defined inside the script

Usage
./check_snorby.sh -i <minutes>

Output
OK - 0 High severity events in the defined interval
CRITICAL - 1 or more High severity events in the defined interval
UNKNOWN - something hasn't been set properly

Examples
$ ./check_snorby.sh -i 5
OK - 0 High severity events in the defined interval

$ ./check_snorby.sh -i 60000
CRITICAL - 14 High severity events in the defined interval

$ ./check_snorby.sh -i z
UNKNOWN - set the time interval to a integer value

For more info visit: https://github.com/ninoabbate/nrpe-plugins#check_snorby