# シェルスクリプトの依存関係
# Debian/Ubuntu
apt-get install jq gawk gzip

# RHEL/CentOS/Fedora
dnf install jq gawk gzip

# macOS
brew install jq gawk

# Python依存関係（FTDCデコード用）
pip install -r requirements.txt

# リポジトリのクローン
git clone https://github.com/your-org/mongobleed-detector.git
cd mongobleed-detector

# スクリプトに実行権限を付与
chmod +x mongobleed-detector.sh
chmod +x mongobleed-remote.py
chmod +x ftdc-decode.py

# Python依存関係のインストール（オプション、FTDC対応用）
pip install -r requirements.txt

./collected-data/
├── logs/                    # MongoDB JSONログ
│   ├── mongod.log
│   ├── mongod.log.1
│   └── mongod.log.2.gz
├── assert-counts/           # serverStatus().asserts スナップショット
│   ├── asserts-2025-01-01.json
│   └── asserts-2025-01-02.json
└── ftdc-files/              # FTDC diagnostic.data の内容
    ├── metrics.2025-01-02T10-00-00Z-00000
    └── metrics.interim

# リモートホストからコピー
scp user@mongohost:/var/log/mongodb/mongod.log* ./collected-data/logs/

mongosh --quiet --eval 'JSON.stringify({
  timestamp: new Date().toISOString(),
  hostname: db.hostInfo().system.hostname,
  asserts: db.serverStatus().asserts,
  uptime: db.serverStatus().uptime
})' > asserts-$(date +%Y%m%d-%H%M%S).json

# FTDCファイルのコピー（sudoが必要な場合あり）
sudo cp /var/lib/mongodb/diagnostic.data/metrics.* ./collected-data/ftdc-files/

# 自動検出モード - 利用可能なすべてのデータを分析
./mongobleed-detector.sh --data-dir ./collected-data/

# カスタム閾値
./mongobleed-detector.sh --data-dir ./collected-data/ \
    -t 1440 \              # 24時間のルックバック
    -c 50 \                # 接続閾値を下げる
    --spike-threshold 50   # スパイク閾値を下げる

# デフォルトパスをスキャン
./mongobleed-detector.sh

# 特定のログファイルをスキャン
./mongobleed-detector.sh -p /path/to/logs/*.json

# フォレンジックモード（複数ホストを分析）
./mongobleed-detector.sh --forensic-dir /evidence/

# ホストファイルを作成
cat > hosts.txt << EOF
mongo-prod-01.example.com
mongo-prod-02.example.com
mongo-staging.example.com
EOF

# 収集と分析
./mongobleed-remote.py --hosts-file hosts.txt --user admin --output-dir ./collected-data/

# 特定のSSH鍵を使用
./mongobleed-remote.py --hosts-file hosts.txt --user admin --key ~/.ssh/mongodb_key

# 並列実行
./mongobleed-remote.py --hosts-file hosts.txt --user admin --parallel 10

# FTDC収集をスキップ（高速）
./mongobleed-remote.py --hosts-file hosts.txt --user admin --skip-ftdc

# 収集のみ、後で分析
./mongobleed-remote.py --hosts-file hosts.txt --user admin --collect-only

# SSHオプションを渡す（例：ジャンプホスト）
./mongobleed-remote.py --hosts-file hosts.txt --user admin \
    -o "ProxyJump=bastion.example.com"

# 特権ファイルアクセスにsudoを使用（FTDCファイルは制限されていることが多い）
./mongobleed-remote.py --hosts-file hosts.txt --user admin --sudo

# 接続問題のトラブルシューティング用デバッグモード
./mongobleed-remote.py --hosts-file hosts.txt --user admin --debug

INFO: Auto-discovery mode: analyzing ./collected-data/
INFO: Module A: Analyzing 3 log file(s)...
INFO: Module B1: Analyzing assert-counts...

╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
║                              MongoBleed (CVE-2025-14847) Detection Results                                       ║
╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

Module Status:
  [✓] Module A (Log Correlation): 3 log file(s) found
  [✓] Module B1 (Assert Counts): 4 snapshot(s) found
  [−] Module B2 (FTDC Spikes): No FTDC files or decoder unavailable

Analysis Parameters:
  Time Window:        4320 minutes
  Connection Thresh:  100
  Burst Rate Thresh:  400/min
  Metadata Rate:      0.10
  Spike Threshold:    100
  User Ratio Thresh:  250x

Module A - Log Correlation Findings:

Risk     SourceIP                                  ConnCount  MetaCount  DiscCount    MetaRate%    BurstRate/m FirstSeen (UTC)        LastSeen (UTC)        
-------- ---------------------------------------- ---------- ---------- ---------- ------------ -------------- ---------------------- ----------------------
HIGH     137.137.137.137                                8172          0       8172        0.00%         490.32 2025-12-27T12:55:52Z   2025-12-27T13:12:32Z  

Module B1 - Assert Counts Analysis:
  Analyzed 4 snapshots from 2025-01-01T10:00:00Z to 2025-01-01T11:30:00Z
    asserts.user: 100 -> 860 (delta: 760)
  SPIKE DETECTED: 2025-01-01T10:30:00Z to 2025-01-01T11:00:00Z
    Delta: +740 user asserts (110 -> 850)

═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Combined Verdict:
  MEDIUM CONFIDENCE - Investigation recommended
    - Suspicious connection patterns but FTDC data unavailable for correlation

⚠ IMPORTANT: If exploitation is confirmed, patching alone is insufficient.
  - Rotate all credentials that may have been exposed
  - Review accessed data for sensitive information disclosure
  - Check for lateral movement from affected systems
  - Preserve logs for forensic analysis

Caveats:
  - Connection metadata absence is PoC-specific and can be evaded
  - Assertion counters are cumulative - false positives possible without baseline
  - FTDC provides timing but not perfect attribution
  - Patch + rotate secrets remains mandatory regardless of detection results

example-data/
├── logs/                    # 攻撃パターンを含む実際のMongoDBログ
│   ├── mongod.log
│   └── mongod.log.1.gz
├── assert-counts/           # 攻撃後のserverStatus().assertsスナップショット
│   └── asserts-post-attack.json
└── ftdc-files/              # 実際のFTDC診断データファイル
    └── metrics.*

./test/generate-test-logs.sh

./test/test-detector.sh

╔════════════════════════════════════════════════════════╗
║       MongoBleed Detector Test Suite                   ║
╚════════════════════════════════════════════════════════╝

Module A Tests (Log Correlation):
✓ PASS: Exit code is 1 (findings detected)
✓ PASS: Detected source IP 137.137.137.137
...

Module B1 Tests (Assert Counts):
✓ PASS: Shows Module B1 status
✓ PASS: Detected assert spike
...

Auto-Discovery Mode Tests:
✓ PASS: Shows Module A status
✓ PASS: Shows combined verdict
...

Results:
  Passed: 24
  Failed: 0

All tests passed!