694 lines
62 KiB
Python
694 lines
62 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
|
|
from pathlib import Path
|
|
from urllib import error, request
|
|
from urllib.parse import parse_qs, urlparse
|
|
|
|
from .config import ConfigStore
|
|
from .exports import investigation_report, investigation_report_markdown
|
|
from .graylog_mcp import GraylogMcpClient
|
|
from .metrics import prometheus_metrics
|
|
from .feedback import FeedbackStore
|
|
from .incidents import IncidentStore
|
|
|
|
|
|
def _ollama_models(host: str = "http://127.0.0.1:11434") -> dict[str, object]:
|
|
try:
|
|
req = request.Request(f"{host.rstrip('/')}/api/tags", method="GET")
|
|
with request.urlopen(req, timeout=5) as response:
|
|
payload = json.loads(response.read().decode("utf-8"))
|
|
except error.URLError as exc:
|
|
return {"status": "error", "error": str(exc), "models": []}
|
|
except (json.JSONDecodeError, OSError) as exc:
|
|
return {"status": "error", "error": str(exc), "models": []}
|
|
models = payload.get("models", [])
|
|
if not isinstance(models, list):
|
|
models = []
|
|
output = []
|
|
for item in models:
|
|
if not isinstance(item, dict):
|
|
continue
|
|
output.append({
|
|
"name": str(item.get("name", "")),
|
|
"modified_at": str(item.get("modified_at", "")),
|
|
"size": int(item.get("size", 0) or 0),
|
|
})
|
|
return {"status": "ok", "models": sorted(output, key=lambda model: model["name"])}
|
|
|
|
|
|
HTML = """<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>SignalScope Monitor</title>
|
|
<style>
|
|
:root { color-scheme: dark; font-family: Arial, sans-serif; background: #031426; color: #d9e8f7; }
|
|
body { margin: 0; }
|
|
header { background: #04182d; color: white; padding: 14px 24px; border-bottom: 1px solid #1c4b70; }
|
|
h1 { margin: 0; font-size: 22px; }
|
|
main { padding: 14px; max-width: 1440px; margin: 0 auto; }
|
|
.hero { display: grid; grid-template-columns: 180px 1fr; gap: 12px; align-items: stretch; }
|
|
.hero img { width: 100%; height: 144px; object-fit: cover; border-radius: 6px; border: 1px solid #1f3b57; background: #061322; }
|
|
.hero .panel { margin-bottom: 0; }
|
|
.grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 12px; }
|
|
.panel { background: #071d33; border: 1px solid #1c4b70; border-radius: 6px; padding: 14px; margin-bottom: 12px; box-shadow: 0 8px 24px rgba(0,0,0,.16); }
|
|
.metric { font-size: 28px; font-weight: 700; }
|
|
.label, .muted { color: #91abc4; font-size: 13px; margin-top: 4px; }
|
|
table { width: 100%; border-collapse: collapse; font-size: 14px; }
|
|
th, td { border-bottom: 1px solid #163b59; padding: 8px; text-align: left; vertical-align: top; }
|
|
th { color: #83bce9; font-weight: 600; }
|
|
.sev-critical { color: #b00020; font-weight: 700; }
|
|
.sev-high { color: #b54708; font-weight: 700; }
|
|
.sev-medium { color: #8a6d00; font-weight: 700; }
|
|
.sev-low { color: #345995; font-weight: 700; }
|
|
code { background: #0b2944; color: #b9e3ff; padding: 2px 4px; border-radius: 4px; }
|
|
.capabilities { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 8px; }
|
|
.capability { border: 1px solid #1c4b70; background: #08243e; padding: 5px 8px; font-size: 12px; }
|
|
.capability.on { border-color: #1d9b72; color: #72e2ae; background: #082f2b; }
|
|
.capability.warn { border-color: #c89436; color: #ffd36e; background: #33260b; }
|
|
.tabs { display: flex; border-bottom: 1px solid #1c4b70; margin: 14px 0 12px; gap: 4px; }
|
|
.tab { border: 0; border-bottom: 3px solid transparent; background: transparent; padding: 10px 14px; color: #91abc4; cursor: pointer; }
|
|
.tab.active { border-bottom-color: #1ea9ff; color: #f2f8ff; font-weight: 700; }
|
|
[data-view] { display: none; } [data-view].active { display: block; }
|
|
.split { display: grid; grid-template-columns: minmax(0, 1.3fr) minmax(320px, 0.7fr); gap: 12px; }
|
|
.table-wrap { overflow-x: auto; }
|
|
#settingsForm label:has(#fieldPicker) { grid-column: 1 / -1; }
|
|
#fieldPicker { margin-top: 8px; max-height: 460px; overflow: auto; border: 1px solid #d9e0e7; background: #fbfcfd; }
|
|
.field-header, .field-row { display: grid; grid-template-columns: minmax(190px, 1.2fr) 100px minmax(180px, 1fr) minmax(320px, 1.4fr); gap: 10px; align-items: center; padding: 8px 10px; }
|
|
.field-header { position: sticky; top: 0; background: #edf3f7; color: #536170; font-size: 12px; font-weight: 700; z-index: 1; }
|
|
.field-row { border-top: 1px solid #e4e9ee; font-size: 13px; }
|
|
.field-row code { width: fit-content; }
|
|
.field-controls { display: flex; flex-wrap: wrap; gap: 10px; }
|
|
.field-controls label { white-space: nowrap; }
|
|
.stream-row { display: flex; align-items: center; justify-content: space-between; gap: 10px; padding: 4px 0; }
|
|
.stream-row button { border: 1px solid #39709a; background: #0b2944; color: #d9e8f7; padding: 4px 8px; cursor: pointer; }
|
|
.toolbar { display: flex; flex-wrap: wrap; gap: 10px; align-items: center; margin: 8px 0 12px; color: #91abc4; }
|
|
.toolbar label { display: inline-flex; align-items: center; gap: 6px; }
|
|
.summary-card { border: 1px solid #163b59; background: #061a2e; padding: 10px; margin-bottom: 8px; border-radius: 6px; }
|
|
.summary-card h3 { margin: 0 0 6px; font-size: 16px; }
|
|
.review-actions { display: flex; flex-wrap: wrap; gap: 6px; min-width: 250px; }
|
|
.review-actions button { border: 1px solid #39709a; background: #0b2944; color: #d9e8f7; padding: 6px 8px; cursor: pointer; }
|
|
.review-actions button[data-status="false_positive"] { border-color: #b7823a; color: #ffd36e; }
|
|
.review-actions button[data-status="confirmed"] { border-color: #2a9b6e; color: #7be3ae; }
|
|
.chart { width: 100%; height: 280px; background: #04182d; border: 1px solid #163b59; }
|
|
.graph { width: 100%; height: 360px; background: #04182d; border: 1px solid #163b59; }
|
|
.sort-button { border: 0; background: transparent; color: #83bce9; cursor: pointer; font: inherit; font-weight: 600; padding: 0; }
|
|
.sort-button:hover { color: #d9e8f7; }
|
|
.model-list { display: flex; flex-wrap: wrap; gap: 8px; }
|
|
.model-pill { border: 1px solid #39709a; background: #08243e; color: #d9e8f7; padding: 5px 8px; cursor: pointer; }
|
|
@media (max-width: 860px) { .hero, .split { grid-template-columns: 1fr; } .hero img { display: none; } }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<header><h1>SignalScope Monitor</h1><div id="stamp" class="muted"></div><div id="capabilities" class="capabilities"></div></header>
|
|
<main>
|
|
<section class="hero">
|
|
<img src="/images/FGinspectionagent.png" alt="FortiGate AI/ML Analyzer">
|
|
<div>
|
|
<section class="grid" id="metrics"></section>
|
|
<section class="panel"><h2>Live Status</h2><div id="liveStatus" class="muted">Waiting for monitor data.</div></section>
|
|
</div>
|
|
</section>
|
|
<nav class="tabs" aria-label="Dashboard views"><button class="tab active" data-tab="overview">Overview</button><button class="tab" data-tab="findings">Findings</button><button class="tab" data-tab="diagnostics">Diagnostics</button><button class="tab" data-tab="settings">Settings</button></nav>
|
|
<div data-view="overview" class="active"><section class="split"><div class="panel"><h2>Events and Anomalies</h2><canvas id="trendChart" class="chart"></canvas></div><div class="panel"><h2>Baseline and Stream Health</h2><div id="health"></div></div></section><section class="split"><div class="panel"><h2>Correlation Map</h2><canvas id="correlationGraph" class="graph"></canvas><div id="correlationGraphInfo" class="muted"></div></div><div class="panel"><h2>AI Assessment</h2><div id="llmAssessment" class="muted">LLM assessment disabled.</div></div></section><section class="panel"><h2>Investigation Incidents</h2><div id="incidents"></div></section><section class="split"><div class="panel"><h2>Anomalies</h2><div id="anomalies"></div></div><div class="panel"><h2>Recommendations</h2><div id="recommendations"></div></div></section></div>
|
|
<div data-view="findings"><section class="panel"><h2>Triage Queue</h2><div id="triageQueue"></div></section><section class="panel"><h2>Field Baseline Deviations</h2><div class="toolbar"><label><input id="showReviewedFindings" type="checkbox"> show reviewed</label><label><input id="showLowFindings" type="checkbox"> show low score</label><span id="findingSummary"></span></div><div id="feedbackNotice" class="muted" role="status"></div><div id="fieldDeviations"></div></section><section class="panel"><h2>Related Activity Across Sources</h2><div id="relatedActivity"></div></section><section class="split"><div class="panel"><h2>Block Candidates</h2><div id="blocks"></div></div><div class="panel"><h2>Threat Intelligence</h2><div id="reputation"></div></div></section><section class="panel"><h2>Policy Findings</h2><div id="policies"></div></section></div>
|
|
<div data-view="diagnostics"><section class="panel"><h2>Diagnostics</h2><div id="diagnostics"></div></section></div>
|
|
<div data-view="settings"><section class="panel"><h2>Recommended Stream Profiles</h2><div id="profileSuggestions" class="muted">Waiting for observed stream data.</div></section><section class="panel"><h2>Installed Ollama Models</h2><div id="ollamaModels" class="muted">Loading local Ollama models.</div></section><section class="panel"><h2>Runtime Configuration</h2><form id="settingsForm"><div class="grid"><label>Log source<br><select name="log_source"><option value="local_syslog">Local syslog</option><option value="graylog_mcp">Graylog MCP</option></select></label><label>Graylog MCP URL<br><input name="graylog_mcp_url" type="url" placeholder="https://graylog.example/api/mcp"></label><label>Enabled streams<br><button type="button" id="loadStreams">Load streams</button><div id="streamPicker" class="muted">Load streams after URL and token are saved.</div></label><label>Profile editor<br><button type="button" id="loadFields">Edit first checked stream profile</button><div id="profileEditorStatus" class="muted">No profile selected for editing.</div><div id="fieldPicker" class="muted">Click Edit profile on one stream.</div></label><label>Profile name<br><input name="profile_name" placeholder="Example: Windows login behavior"></label><label>Detector thresholds (JSON)<br><textarea name="profile_detectors" placeholder='{"auth_failure":{"enabled":true,"minimum":5,"z_threshold":3}}'></textarea></label><label>Field weights (JSON)<br><textarea name="profile_field_weights" placeholder='{"url":1.5,"auth_failure_burst":2,"query_domain":{"rare_value":1.8}}'></textarea></label><label>Graylog query<br><input name="graylog_query" placeholder="*"></label><label>Graylog MCP poll window seconds<br><input name="graylog_range_seconds" type="number" min="60" step="60" placeholder="300"></label><label>Graylog max events per stream<br><input name="graylog_max_events_per_stream" type="number" min="1" step="1000" placeholder="5000"></label><label>Baseline training days<br><input name="baseline_training_days" type="number" min="1" step="1" placeholder="7"></label><label>Baseline bucket retention days<br><input name="baseline_retention_days" type="number" min="1" step="1" placeholder="14"></label><label>Baseline value retention days<br><input name="baseline_value_retention_days" type="number" min="1" step="1" placeholder="7"></label><label>Max values per entity field<br><input name="baseline_max_values_per_field" type="number" min="1" step="100" placeholder="2000"></label><label>Threat intel provider<br><select name="threat_intel_provider"><option value="auto">Auto</option><option value="abuseipdb">AbuseIPDB</option><option value="virustotal">VirusTotal</option></select></label><label>AbuseIPDB API key<br><input name="abuseipdb_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>VirusTotal API key<br><input name="virustotal_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>Threat intel daily limit<br><input name="threat_intel_daily_limit" type="number" min="1" step="1" placeholder="100"></label><label>Threat intel cache TTL seconds<br><input name="threat_intel_ttl_seconds" type="number" min="60" step="60" placeholder="604800"></label><label>Threat intel error TTL seconds<br><input name="threat_intel_error_ttl_seconds" type="number" min="60" step="60" placeholder="3600"></label><label>AbuseIPDB max age days<br><input name="abuseipdb_max_age_days" type="number" min="1" step="1" placeholder="90"></label><label>Graylog field mapping (JSON)<br><textarea name="graylog_field_mapping" placeholder='{"srcip":"client_ip","dstip":"server_ip","action":"event_action"}'></textarea></label><label>Graylog MCP token<br><input name="graylog_mcp_token" type="password" placeholder="Leave blank to keep current token"></label><label>Ollama model<br><input name="llm_model" placeholder="llama3.1"></label><label>Profile advisor model<br><input name="profile_advisor_model" placeholder="qwen3:8b"></label><label>Profile advisor timeout seconds<br><input name="profile_advisor_timeout" type="number" min="1" step="1" placeholder="120"></label><label><input name="llm_enabled" type="checkbox"> Enable Ollama analysis</label><label><input name="profile_advisor_enabled" type="checkbox"> Enable Ollama profile advisor</label><label><input name="threat_intel_enabled" type="checkbox"> Enable threat intelligence</label></div><p><button type="submit">Save configuration</button> <span id="settingsResult" class="muted"></span></p></form></section></div>
|
|
</main>
|
|
<script>
|
|
function esc(value) {
|
|
return String(value ?? "").replace(/[&<>"']/g, c => ({'&':'&','<':'<','>':'>','"':'"',"'":'''}[c]));
|
|
}
|
|
function metric(label, value) {
|
|
return `<div class="panel"><div class="metric">${esc(value)}</div><div class="label">${esc(label)}</div></div>`;
|
|
}
|
|
function bytes(value) { const n=Number(value||0); if (!n) return '0 B'; const units=['B','KB','MB','GB','TB']; const i=Math.min(units.length-1, Math.floor(Math.log(n)/Math.log(1024))); return `${(n/Math.pow(1024,i)).toFixed(i?1:0)} ${units[i]}`; }
|
|
const tableSort = {};
|
|
const uiCache = {correlations: [], fieldRows: []};
|
|
function table(rows, columns, id = '') {
|
|
if (!rows || rows.length === 0) return '<p class="muted">No data.</p>';
|
|
const sort = tableSort[id];
|
|
const sorted = sort ? [...rows].sort((left, right) => { const a=left[sort.key] ?? '', b=right[sort.key] ?? ''; const numeric=Number(a), numericB=Number(b); const compare=Number.isFinite(numeric) && Number.isFinite(numericB) && String(a).trim() !== '' && String(b).trim() !== '' ? numeric-numericB : String(a).localeCompare(String(b)); return sort.direction * compare; }) : rows;
|
|
const head = columns.map(c => `<th>${c.key && id ? `<button class="sort-button" data-sort-table="${esc(id)}" data-sort-key="${esc(c.key)}">${esc(c.label)}${sort && sort.key === c.key ? (sort.direction === 1 ? ' ▲' : ' ▼') : ''}</button>` : esc(c.label)}</th>`).join('');
|
|
const body = sorted.map(row => `<tr>${columns.map(c => `<td>${c.render ? c.render(row) : esc(row[c.key])}</td>`).join('')}</tr>`).join('');
|
|
return `<div class="table-wrap"><table><thead><tr>${head}</tr></thead><tbody>${body}</tbody></table></div>`;
|
|
}
|
|
function capability(label, state, detail) { return `<span class="capability ${state}">${esc(label)}: ${esc(detail)}</span>`; }
|
|
function compactRelatedActivity(rows) {
|
|
const groups = new Map();
|
|
for (const row of rows || []) {
|
|
const key = `${row.entity || row.source_ip || '-'}|${row.stream || '-'}|${row.type || '-'}`;
|
|
const group = groups.get(key) || {entity: row.entity || row.source_ip || '-', stream: row.stream || '-', type: row.type || '-', count: 0, security: 0, actions: new Set(), destinations: new Set(), services: new Set(), first: row.timestamp || '', last: row.timestamp || '', samples: []};
|
|
group.count += 1;
|
|
if (row.severity && !['-','info','notice','low'].includes(String(row.severity).toLowerCase())) group.security += 1;
|
|
if (row.action && row.action !== '-') group.actions.add(row.action);
|
|
if (row.destination && row.destination !== '-') group.destinations.add(row.destination);
|
|
if (row.service && row.service !== '-') group.services.add(row.service);
|
|
if (row.timestamp && (!group.first || row.timestamp < group.first)) group.first = row.timestamp;
|
|
if (row.timestamp && (!group.last || row.timestamp > group.last)) group.last = row.timestamp;
|
|
if (group.samples.length < 6) group.samples.push(row);
|
|
groups.set(key, group);
|
|
}
|
|
return [...groups.values()].sort((left,right) => (right.security-left.security) || (right.count-left.count)).slice(0,25);
|
|
}
|
|
function drawTrend(history) {
|
|
const canvas=document.getElementById('trendChart'), ctx=canvas.getContext('2d'), ratio=window.devicePixelRatio||1, cw=canvas.clientWidth, ch=canvas.clientHeight;
|
|
canvas.width=cw*ratio; canvas.height=ch*ratio; ctx.scale(ratio,ratio); ctx.clearRect(0,0,cw,ch);
|
|
const rows=(history||[]).slice(-72);
|
|
if (!rows.length) { ctx.fillStyle='#91abc4'; ctx.font='14px Arial'; ctx.fillText('Waiting for monitor history.', 16, 28); return; }
|
|
const left=58,right=58,top=34,bottom=36,w=cw-left-right,h=ch-top-bottom;
|
|
const eventsMax=Math.max(1,...rows.map(item=>Number(item.events)||0));
|
|
const anomalyMax=Math.max(1,...rows.map(item=>Number(item.anomalies)||0),...rows.map(item=>Number(item.high||0)+Number(item.critical||0)));
|
|
ctx.strokeStyle='#163b59'; ctx.lineWidth=1; ctx.font='11px Arial'; ctx.textAlign='right'; ctx.fillStyle='#91abc4';
|
|
for(let tick=0; tick<=4; tick++){
|
|
const y=top+h-(tick/4)*h;
|
|
ctx.beginPath(); ctx.moveTo(left,y); ctx.lineTo(cw-right,y); ctx.stroke();
|
|
ctx.fillText(Math.round(eventsMax*tick/4).toLocaleString(), left-8, y+4);
|
|
ctx.textAlign='left'; ctx.fillText(Math.round(anomalyMax*tick/4).toLocaleString(), cw-right+8, y+4); ctx.textAlign='right';
|
|
}
|
|
const points=(key,max) => rows.map((item,index)=>({x:left+index*w/Math.max(1,rows.length-1), y:top+h-((Number(item[key])||0)/max)*h}));
|
|
const drawLine=(pts,color,width=2.5) => { ctx.strokeStyle=color; ctx.lineWidth=width; ctx.beginPath(); pts.forEach((point,index)=>index?ctx.lineTo(point.x,point.y):ctx.moveTo(point.x,point.y)); ctx.stroke(); };
|
|
const eventsPts=points('events',eventsMax), anomaliesPts=points('anomalies',anomalyMax), highPts=rows.map((item,index)=>({x:left+index*w/Math.max(1,rows.length-1), y:top+h-(((Number(item.high)||0)+(Number(item.critical)||0))/anomalyMax)*h}));
|
|
ctx.fillStyle='rgba(30,169,255,.12)';
|
|
ctx.beginPath(); eventsPts.forEach((point,index)=>index?ctx.lineTo(point.x,point.y):ctx.moveTo(point.x,point.y)); ctx.lineTo(left+w,top+h); ctx.lineTo(left,top+h); ctx.closePath(); ctx.fill();
|
|
drawLine(eventsPts,'#1ea9ff',2.5);
|
|
drawLine(highPts,'#ffcf5a',2);
|
|
drawLine(anomaliesPts,'#ff6666',2.5);
|
|
const last=rows[rows.length-1] || {};
|
|
ctx.strokeStyle='#285071'; ctx.strokeRect(left,top,w,h);
|
|
ctx.textAlign='left'; ctx.fillStyle='#1ea9ff'; ctx.fillText(`events max ${eventsMax.toLocaleString()}`, left, 18);
|
|
ctx.fillStyle='#ffcf5a'; ctx.fillText(`high+ max ${anomalyMax.toLocaleString()}`, left+150, 18);
|
|
ctx.fillStyle='#ff6666'; ctx.fillText(`anomalies latest ${Number(last.anomalies||0).toLocaleString()}`, left+280, 18);
|
|
ctx.textAlign='right'; ctx.fillStyle='#91abc4'; ctx.fillText(`${rows.length} samples`, cw-right, ch-10); ctx.textAlign='left';
|
|
}
|
|
function drawCorrelationGraph(correlations) {
|
|
const canvas=document.getElementById('correlationGraph'), ctx=canvas.getContext('2d'), ratio=window.devicePixelRatio||1, cw=canvas.clientWidth, ch=canvas.clientHeight;
|
|
canvas.width=cw*ratio; canvas.height=ch*ratio; ctx.scale(ratio,ratio); ctx.clearRect(0,0,cw,ch);
|
|
const short=(value,max=22)=>String(value||'-').length>max?`${String(value).slice(0,max-3)}...`:String(value||'-');
|
|
const items=[...(correlations||[])].sort((a,b)=>(Number(b.security_events)||0)-(Number(a.security_events)||0) || (Number(b.events)||0)-(Number(a.events)||0) || (b.streams||[]).length-(a.streams||[]).length).slice(0,8);
|
|
if (!items.length) { ctx.fillStyle='#91abc4'; ctx.font='14px Arial'; ctx.fillText('No multi-stream entities in the current analysis window.', 16, 28); return; }
|
|
const streamScores=new Map();
|
|
items.forEach(item => (item.streams||[]).forEach(stream => streamScores.set(stream, (streamScores.get(stream)||0)+Number(item.security_events||0)+1)));
|
|
const streams=[...streamScores.entries()].sort((a,b)=>b[1]-a[1]).map(([name])=>name).slice(0,7);
|
|
const top=34,bottom=42,entityX=Math.max(170,Math.min(260,cw*.24)),streamX=Math.min(cw-190,Math.max(cw*.72,entityX+260));
|
|
const entityY=index => top+(index+.5)*(ch-top-bottom)/items.length;
|
|
const streamY=index => top+(index+.5)*(ch-top-bottom)/streams.length;
|
|
const streamIndex=Object.fromEntries(streams.map((stream,index)=>[stream,index]));
|
|
items.forEach((item,index)=>{
|
|
const y1=entityY(index);
|
|
(item.streams||[]).filter(stream => stream in streamIndex).forEach(stream => {
|
|
const y2=streamY(streamIndex[stream]);
|
|
const security=Number(item.security_events)||0;
|
|
ctx.strokeStyle=security ? 'rgba(255,95,95,.55)' : 'rgba(51,145,202,.45)';
|
|
ctx.lineWidth=Math.min(4,1.2+Math.log10(Math.max(1,Number(item.events)||1)));
|
|
ctx.beginPath();
|
|
ctx.moveTo(entityX,y1);
|
|
ctx.bezierCurveTo(entityX+120,y1,streamX-120,y2,streamX,y2);
|
|
ctx.stroke();
|
|
});
|
|
});
|
|
items.forEach((item,index)=>{
|
|
const y=entityY(index), security=Number(item.security_events)||0, radius=Math.min(16,8+Math.log10(Math.max(1,Number(item.events)||1))*3);
|
|
ctx.fillStyle=security ? '#d95f5f' : '#2389cc'; ctx.beginPath(); ctx.arc(entityX,y,radius,0,Math.PI*2); ctx.fill();
|
|
ctx.textAlign='right'; ctx.font='12px Arial'; ctx.fillStyle='#d9e8f7'; ctx.fillText(short(item.entity||item.source_ip,22), entityX-radius-10, y-2);
|
|
ctx.fillStyle='#91abc4'; ctx.fillText(`${Number(item.events)||0} events`, entityX-radius-10, y+12);
|
|
});
|
|
streams.forEach((stream,index)=>{
|
|
const y=streamY(index);
|
|
ctx.fillStyle='#238b5d'; ctx.fillRect(streamX-10,y-10,20,20);
|
|
ctx.textAlign='left'; ctx.font='12px Arial'; ctx.fillStyle='#d9e8f7'; ctx.fillText(short(stream,26), streamX+16, y+4);
|
|
});
|
|
ctx.textAlign='left'; ctx.fillStyle='#91abc4'; ctx.font='12px Arial'; ctx.fillText('Top correlated entities and streams. Red links/entities include security-event activity; circle size follows event volume.', 8, ch-14);
|
|
}
|
|
async function refresh() {
|
|
const openDetails = new Set([...document.querySelectorAll('details[open][data-detail-id]')].map(item => item.dataset.detailId));
|
|
const res = await fetch('/api/status', {cache: 'no-store'});
|
|
const data = await res.json();
|
|
const s = data.summary || {};
|
|
const a = data.anomaly_summary || {};
|
|
const baseline = data.baseline || {};
|
|
const threat = (data.capabilities || {}).threat_intel || {};
|
|
const mcp = (data.capabilities || {}).graylog_mcp || {};
|
|
const configuration = data.configuration || {};
|
|
const streamCoverage = data.stream_coverage || [];
|
|
const enabledStreams = streamCoverage.filter(item => item.enabled);
|
|
const streamsMissingProfile = enabledStreams.filter(item => !item.profile_ready).length;
|
|
const rawCorrelations = data.cross_source_correlations || [];
|
|
const correlationsCached = rawCorrelations.length === 0 && uiCache.correlations.length > 0;
|
|
const correlations = rawCorrelations.length ? rawCorrelations : uiCache.correlations;
|
|
if (rawCorrelations.length) uiCache.correlations = rawCorrelations;
|
|
drawTrend(data.history || []);
|
|
drawCorrelationGraph(correlations);
|
|
document.getElementById('correlationGraphInfo').textContent = `${correlations.length} entities correlated across enabled streams${correlationsCached ? ' (cached from previous non-empty poll)' : ''}. Graph shows the highest-signal entities linked to the streams where they were observed.`;
|
|
document.getElementById('stamp').textContent = data.generated_at ? `Updated ${new Date(data.generated_at * 1000).toLocaleString()}` : 'Waiting for monitor data';
|
|
document.getElementById('metrics').innerHTML = [
|
|
metric('Total events', s.total || 0),
|
|
metric('UTM events', s.utm || 0),
|
|
metric('Threat actions', s.threat_actions || 0),
|
|
metric('Anomalies high+', (a.high || 0) + (a.critical || 0))
|
|
].join('');
|
|
const llm = data.llm_assessment || {};
|
|
document.getElementById('capabilities').innerHTML = [
|
|
capability('Baseline', baseline.enabled ? 'on' : 'warn', baseline.enabled ? `${baseline.sources_ready || 0} sources ready` : 'disabled'),
|
|
capability('Ollama', llm.enabled && llm.status !== 'error' ? 'on' : 'warn', llm.enabled ? (llm.status || 'starting') : 'disabled'),
|
|
capability('Threat Intel', threat.enabled && threat.configured ? 'on' : 'warn', threat.enabled ? `${threat.provider || 'unknown'}${threat.configured ? '' : ', key missing'}` : 'disabled'),
|
|
capability('Graylog MCP', mcp.status === 'connected' ? 'on' : 'warn', configuration.log_source === 'graylog_mcp' ? (mcp.status || 'checking') : 'not selected')
|
|
].join('');
|
|
document.getElementById('liveStatus').innerHTML = [
|
|
`Log file: <code>${esc(data.log_path || '')}</code>`,
|
|
`Policy file: <code>${esc(data.policy_path || 'none')}</code>`,
|
|
`Critical anomalies: ${esc((a.critical || 0))}`,
|
|
`High anomalies: ${esc((a.high || 0))}`,
|
|
`Baseline sources ready: ${esc((data.baseline || {}).sources_ready || 0)}`,
|
|
`Baseline training days: ${esc((data.baseline || {}).training_days || 0)}`,
|
|
`Baseline DB size: ${esc(bytes((data.baseline || {}).size_bytes || 0))}`,
|
|
`MCP poll window: ${esc(mcp.range_seconds || configuration.graylog_range_seconds || 0)}s`,
|
|
`MCP max events/stream: ${esc(mcp.max_events_per_stream || configuration.graylog_max_events_per_stream || 0)}`,
|
|
`MCP coverage: ${esc(mcp.coverage_status || 'unknown')}${mcp.partial_streams ? ` (${esc(mcp.partial_streams)} partial)` : ''}${mcp.truncated_streams ? ` (${esc(mcp.truncated_streams)} truncated)` : ''}`,
|
|
mcp.coverage_warning ? `<span class="sev-high">${esc(mcp.coverage_warning)}</span>` : ''
|
|
].filter(Boolean).join('<br>');
|
|
document.getElementById('health').innerHTML = [
|
|
metric('Enabled streams', enabledStreams.length), metric('Streams missing profile', streamsMissingProfile), metric('MCP events fetched', mcp.events_fetched || 0), metric('Partial streams', mcp.partial_streams || 0), metric('Truncated streams', mcp.truncated_streams || 0), metric('Correlated entities', correlations.length)
|
|
].join('');
|
|
window.profileSuggestions = data.profile_suggestions || [];
|
|
const advisor = ((data.capabilities || {}).profile_advisor || {});
|
|
document.getElementById('profileSuggestions').innerHTML = table(window.profileSuggestions, [
|
|
{label:'Stream', key:'stream_name'},
|
|
{label:'Events', key:'events'},
|
|
{label:'Confidence', key:'confidence'},
|
|
{label:'Advisor', render:r => esc((r.profile_advisor || {}).status || (advisor.enabled ? advisor.status : 'heuristic'))},
|
|
{label:'Profile', render:r => r.profile_exists ? 'exists' : 'new'},
|
|
{label:'Entity fields', render:r => esc((r.entity_fields || []).join(', ') || '-')},
|
|
{label:'Time', key:'timestamp_field'},
|
|
{label:'Baseline fields', render:r => esc([...(r.categorical_fields || []), ...(r.numeric_fields || [])].slice(0,8).join(', ') || '-')},
|
|
{label:'Detectors', render:r => esc(Object.keys(r.detectors || {}).join(', ') || '-')},
|
|
{label:'Common denominators', render:r => esc((r.common_fields || []).slice(0,5).map(item => `${item.field} ${(item.coverage*100).toFixed(0)}%`).join(', ') || '-')},
|
|
{label:'Action', render:r => `<button type="button" class="apply-suggested-profile" data-stream-id="${esc(r.stream_id)}">Apply profile</button>`}
|
|
], 'profile-suggestions');
|
|
const llmText = llm.text ? esc(llm.text).replace(/\\n/g, '<br>') : esc(llm.error || 'LLM assessment disabled or waiting for first run.');
|
|
document.getElementById('llmAssessment').innerHTML = `<div>Status: <code>${esc(llm.status || 'unknown')}</code></div><p>${llmText}</p>`;
|
|
document.getElementById('anomalies').innerHTML = table(data.anomalies || [], [
|
|
{label:'Source', key:'subject'},
|
|
{label:'Score', key:'score'},
|
|
{label:'Severity', render:r => `<span class="sev-${esc(r.severity)}">${esc(r.severity)}</span>`},
|
|
{label:'Confidence', key:'confidence'},
|
|
{label:'Rate / ports / hits', render:r => {
|
|
const e = r.evidence || {};
|
|
const rate = e.timed_events > 1 ? `${e.events_per_minute} events/min` : 'no timestamps';
|
|
return esc(`${rate}; dst ports: ${e.distinct_dst_ports || 0}; src ports: ${e.distinct_src_ports || 0}; hitcount: ${e.hitcount_total || 0}`);
|
|
}},
|
|
{label:'Reasons', render:r => esc((r.reasons || []).join('; '))}
|
|
], 'anomalies');
|
|
document.getElementById('recommendations').innerHTML = table(data.recommendations || [], [
|
|
{label:'Subject', key:'subject'},
|
|
{label:'Score', key:'score'},
|
|
{label:'Severity', render:r => `<span class="sev-${esc(r.severity)}">${esc(r.severity)}</span>`},
|
|
{label:'Title', key:'title'},
|
|
{label:'Recommendation', key:'recommendation'},
|
|
{label:'Policies', render:r => esc((r.related_policy_ids || []).join(', '))},
|
|
{label:'Services', render:r => esc((r.related_services || []).join(', '))}
|
|
], 'recommendations');
|
|
document.getElementById('incidents').innerHTML = table(data.incidents || [], [
|
|
{label:'Entity', key:'entity', render:r => esc(`${r.entity} (${r.entity_type || 'entity'})`)},
|
|
{label:'Score', key:'score'},
|
|
{label:'Severity', render:r => `<span class="sev-${esc(r.severity)}">${esc(r.severity)}</span>`},
|
|
{label:'State', render:r => esc(r.lifecycle_status || 'open')},
|
|
{label:'Streams', render:r => esc((r.correlated_streams || []).join(', ') || 'single stream')},
|
|
{label:'Evidence', render:r => esc((r.evidence || []).join('; '))},
|
|
{label:'Timeline', render:r => { const rows=(r.timeline||[]).map(item => `${esc(`${item.timestamp || ''} | ${item.stream || ''} | ${item.action || ''} | ${item.destination || ''} | ${item.context || item.message || ''}`)}${item.graylog_query ? `<br><code>${esc(item.graylog_query)}</code>` : ''}`).join('<br>'); const id=`incident:${r.id || r.entity}:${r.first_seen || ''}`; return rows ? `<details data-detail-id="${esc(id)}"><summary>${esc(`${r.first_seen || '-'} to ${r.last_seen || '-'}`)}</summary><p>${rows}</p></details>` : '-'; }},
|
|
{label:'Action', render:r => `<div class="review-actions"><button class="incident-action" data-id="${esc(r.id)}" data-status="acknowledged">Ack</button><button class="incident-action" data-id="${esc(r.id)}" data-status="resolved">Resolve</button><button class="incident-action" data-id="${esc(r.id)}" data-status="open">Reopen</button></div>${r.note ? `<div class="muted">${esc(r.note)}</div>` : ''}`}
|
|
], 'incidents');
|
|
document.querySelectorAll('.incident-action').forEach(button => button.addEventListener('click', async () => {
|
|
const note = prompt('Incident note (optional):') || '';
|
|
const response = await fetch('/api/incidents', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({id:button.dataset.id, status:button.dataset.status, note})});
|
|
document.getElementById('feedbackNotice').textContent = response.ok ? 'Incident state saved.' : 'Could not save incident state.';
|
|
refresh();
|
|
}));
|
|
document.getElementById('blocks').innerHTML = table(data.block_candidates || [], [
|
|
{label:'Source', key:'src_ip'},
|
|
{label:'Score', key:'score'},
|
|
{label:'Reasons', render:r => esc((r.reasons || []).join('; '))}
|
|
], 'blocks');
|
|
const reputationRows = Object.entries(data.reputation || {}).map(([ip, intel]) => ({ip, ...intel}));
|
|
const relatedRows = correlations.flatMap(correlation => (correlation.samples || []).map(sample => ({entity: correlation.entity || correlation.source_ip, source_ip: correlation.source_ip, ...sample})));
|
|
const streamTitles = Object.fromEntries((configuration.graylog_streams || []).map(item => [item.id, item.title || item.id]));
|
|
document.getElementById('triageQueue').innerHTML = table(data.triage_queue || [], [
|
|
{label:'Entity', key:'entity'},
|
|
{label:'Score', key:'score'},
|
|
{label:'Severity', render:r => `<span class="sev-${esc(r.severity)}">${esc(r.severity)}</span>`},
|
|
{label:'State', key:'state'},
|
|
{label:'Streams', render:r => esc((r.streams || []).join(', ') || '-')},
|
|
{label:'Detectors', render:r => esc((r.detectors || []).join(', ') || '-')},
|
|
{label:'Open signals', key:'active_deviation_count'},
|
|
{label:'Why', render:r => esc((r.evidence || []).join('; ') || '-')},
|
|
{label:'Next', key:'next_action'}
|
|
], 'triage-queue');
|
|
const rawFieldRows = Object.entries(data.field_deviations || {}).flatMap(([entity, deviations]) => (deviations || []).map(item => ({entity, ...item, stream_title: item.stream_name || item.stream_title || streamTitles[item.stream_id] || item.stream_id})));
|
|
const fieldRowsCached = rawFieldRows.length === 0 && uiCache.fieldRows.length > 0;
|
|
const sourceFieldRows = rawFieldRows.length ? rawFieldRows : uiCache.fieldRows;
|
|
const showReviewed = document.getElementById('showReviewedFindings')?.checked;
|
|
const showLow = document.getElementById('showLowFindings')?.checked;
|
|
const fieldRows = sourceFieldRows
|
|
.filter(row => showReviewed || !['expected','false_positive'].includes(row.feedback || ''))
|
|
.filter(row => showLow || Number(row.score || 0) >= 35 || row.feedback === 'confirmed')
|
|
.sort((left, right) => Number(right.score || 0) - Number(left.score || 0))
|
|
.slice(0, 50);
|
|
document.getElementById('findingSummary').textContent = `${fieldRows.length} shown from ${sourceFieldRows.length} raw deviations. Reviewed and low-score findings are hidden by default.`;
|
|
if (rawFieldRows.length) uiCache.fieldRows = rawFieldRows;
|
|
document.getElementById('fieldDeviations').innerHTML = `${fieldRowsCached ? '<p class="muted">No current field deviations in this poll; showing cached findings from the last non-empty poll.</p>' : ''}` + table(fieldRows, [
|
|
{label:'Entity', key:'entity'}, {label:'Stream', key:'stream_title'}, {label:'Detector', key:'detector'}, {label:'Field', key:'field'}, {label:'Score', key:'score'}, {label:'Baseline', render:r => esc(`${r.confidence || '-'}; ${r.baseline_age_days ?? 0}d; ${r.baseline_samples || 0} samples`)}, {label:'Review', render:r => esc(r.feedback || 'unreviewed')}, {label:'Evidence', render:r => { const weighted = r.weight && r.weight !== 1 ? `; weighted ${r.base_score ?? r.score} x ${r.weight}` : ''; const summary=esc(`${r.reason}; current ${r.current ?? '-'} vs baseline ${r.baseline ?? '-'}; scope ${r.baseline_scope ?? '-'}${weighted}; values: ${(r.sample_values || []).join(', ') || '-'}`); const events=(r.sample_events || []).map(item => esc(`${item.timestamp} | ${item.source} -> ${item.destination} | ${item.action} ${item.service} | ${item.value} | ${item.message}`)).join('<br>'); const id=`deviation:${r.entity}:${r.stream_id}:${r.field}:${r.value || ''}`; return events ? `<details data-detail-id="${esc(id)}"><summary>${summary}</summary><p>${events}</p></details>` : summary; }}, {label:'Review action', render:r => `<div class="review-actions"><button class="feedback" data-status="expected" data-entity="${esc(r.entity)}" data-stream="${esc(r.stream_id)}" data-field="${esc(r.field)}" data-value="${esc(r.value || '')}">Expected</button><button class="feedback" data-status="false_positive" data-entity="${esc(r.entity)}" data-stream="${esc(r.stream_id)}" data-field="${esc(r.field)}" data-value="${esc(r.value || '')}">False positive</button><button class="feedback" data-status="confirmed" data-entity="${esc(r.entity)}" data-stream="${esc(r.stream_id)}" data-field="${esc(r.field)}" data-value="${esc(r.value || '')}">Confirm</button></div>`}
|
|
], 'field-deviations');
|
|
document.querySelectorAll('.feedback').forEach(button => button.addEventListener('click', async () => {
|
|
const note = prompt('Review note (optional):') || '';
|
|
const days = prompt('Expiry in days (0 = no expiry):', '0') || '0';
|
|
const response = await fetch('/api/feedback', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({status:button.dataset.status, entity:button.dataset.entity, stream_id:button.dataset.stream, field:button.dataset.field, value:button.dataset.value, note, expires_at: Number(days) > 0 ? Math.floor(Date.now()/1000) + Number(days) * 86400 : 0})});
|
|
document.getElementById('feedbackNotice').textContent = response.ok ? 'Review saved. The matching pattern will be labeled on the next refresh.' : 'Could not save review.';
|
|
refresh();
|
|
}));
|
|
const relatedGroups = compactRelatedActivity(relatedRows);
|
|
document.getElementById('relatedActivity').innerHTML = `<p class="muted">${relatedGroups.length} grouped rows shown from ${relatedRows.length} raw related events.</p>` + table(relatedGroups, [
|
|
{label:'Entity', key:'entity'},
|
|
{label:'Stream', key:'stream'},
|
|
{label:'Type', key:'type'},
|
|
{label:'Events', key:'count'},
|
|
{label:'Security', key:'security'},
|
|
{label:'Time range', render:r => esc(`${r.first || '-'} to ${r.last || '-'}`)},
|
|
{label:'Actions', render:r => esc([...r.actions].slice(0,4).join(', ') || '-')},
|
|
{label:'Destinations', render:r => esc([...r.destinations].slice(0,4).join(', ') || '-')},
|
|
{label:'Samples', render:r => { const rows=(r.samples || []).map(item => `${esc(`${item.timestamp || ''} | ${item.action || ''} | ${item.destination || ''} | ${item.service || ''} | ${item.context || ''}`)}${item.graylog_query ? `<br><code>${esc(item.graylog_query)}</code>` : ''}`).join('<br>'); const id=`related:${r.entity}:${r.stream}:${r.type}`; return rows ? `<details data-detail-id="${esc(id)}"><summary>show samples</summary><p>${rows}</p></details>` : '-'; }}
|
|
], 'related-activity');
|
|
document.getElementById('reputation').innerHTML = table(reputationRows, [
|
|
{label:'IP', key:'ip'},
|
|
{label:'Provider', key:'provider'},
|
|
{label:'Status', key:'status'},
|
|
{label:'Score', key:'score'},
|
|
{label:'Malicious', key:'malicious'},
|
|
{label:'Suspicious', key:'suspicious'}
|
|
], 'reputation');
|
|
document.getElementById('policies').innerHTML = table(data.policy_findings || [], [
|
|
{label:'Severity', render:r => `<span class="sev-${esc(r.severity)}">${esc(r.severity)}</span>`},
|
|
{label:'Reference', key:'reference'},
|
|
{label:'Title', key:'title'},
|
|
{label:'Detail', key:'detail'}
|
|
], 'policies');
|
|
const d = data.diagnostics || {};
|
|
const context = data.event_context || {};
|
|
const quality = data.data_quality || {};
|
|
const profileNames = Object.fromEntries((data.stream_profiles || []).map(item => [item.stream_id, item.name || item.stream_id]));
|
|
const profileReadiness = (data.profile_readiness || []).map(item => ({...item, profile_name: item.profile_name || profileNames[item.stream_id] || item.stream_id, stream_title: item.stream_name || item.stream_title || streamTitles[item.stream_id] || item.stream_id}));
|
|
document.getElementById('diagnostics').innerHTML =
|
|
'<h3>Stream Coverage</h3>' + table(streamCoverage, [{label:'Stream', key:'stream_name'}, {label:'Enabled', key:'enabled', render:r => r.enabled ? 'yes' : 'no'}, {label:'Profile', render:r => esc(r.profile || 'missing')}, {label:'Entity Field', key:'entity_field'}, {label:'Tracked Fields', key:'tracked_fields'}, {label:'Ready Fields', key:'readiness'}, {label:'Events', key:'events_fetched'}, {label:'Latest Event', key:'latest_event_time'}, {label:'Health', key:'health'}, {label:'Error', render:r => esc(r.error || '-')}], 'stream-coverage') +
|
|
'<h3>Cross-Source Correlations</h3>' + table(correlations, [{label:'Entity', key:'entity', render:r => esc(`${r.entity || r.source_ip} (${r.entity_type || 'ip'})`)}, {label:'Streams', render:r => esc((r.streams || []).join(', '))}, {label:'Events', key:'events'}, {label:'Security Events', key:'security_events'}], 'correlations') +
|
|
'<h3>Entities</h3>' + table(context.source_profiles || [], [{label:'Entity', key:'entity'}, {label:'Events', key:'events'}, {label:'UTM', key:'utm_events'}, {label:'Deny', key:'deny_or_threat_actions'}, {label:'Destinations', key:'distinct_destinations'}, {label:'Actions', render:r => esc((r.top_actions || []).join(', '))}], 'entities') +
|
|
'<h3>Profile Baseline Readiness</h3>' + table(profileReadiness, [{label:'Profile', key:'profile_name'}, {label:'Stream', key:'stream_title'}, {label:'Field', key:'field'}, {label:'Buckets', key:'buckets'}, {label:'Age days', key:'age_days'}, {label:'Training days', key:'training_days'}, {label:'Ready', key:'ready', render:r => r.ready ? 'ready' : 'learning'}], 'profile-readiness') +
|
|
'<h3>Data Quality</h3>' + table([quality], [{label:'Events', key:'events'}, {label:'Timestamp coverage', render:r => `${r.timestamp_coverage || 0}%`}, {label:'Source coverage', render:r => `${r.source_coverage || 0}%`}, {label:'Truncated streams', render:r => esc((r.truncated_streams || []).join(', ') || 'none')}]) +
|
|
'<h3>Security Event Samples</h3>' + table(context.security_event_samples || [], [{label:'Entity', key:'entity'}, {label:'Type', key:'type'}, {label:'Action', key:'action'}, {label:'Severity', key:'severity'}, {label:'Destination', key:'dst'}, {label:'Service', key:'service'}]) +
|
|
'<h3>Top Sources</h3>' + table(d.top_source_ips || [], [{label:'Value', key:'value'}, {label:'Count', key:'count'}]) +
|
|
'<h3>Top Destinations</h3>' + table(d.top_destination_ips || [], [{label:'Value', key:'value'}, {label:'Count', key:'count'}]) +
|
|
'<h3>Top Policy IDs</h3>' + table(d.top_policy_ids || [], [{label:'Value', key:'value'}, {label:'Count', key:'count'}]) +
|
|
'<h3>Top Destination Ports</h3>' + table(d.top_destination_ports || [], [{label:'Value', key:'value'}, {label:'Count', key:'count'}]) +
|
|
'<h3>Top Source Ports</h3>' + table(d.top_source_ports || [], [{label:'Value', key:'value'}, {label:'Count', key:'count'}]) +
|
|
'<h3>Top Services</h3>' + table(d.top_services || [], [{label:'Value', key:'value'}, {label:'Count', key:'count'}]) +
|
|
'<h3>Local-in Failures</h3>' + table(d.local_in_failures || [], [{label:'Source', key:'src_ip'}, {label:'Service', key:'service'}, {label:'Policy', key:'policy'}, {label:'Count', key:'count'}]);
|
|
document.querySelectorAll('details[data-detail-id]').forEach(item => { if (openDetails.has(item.dataset.detailId)) item.open = true; });
|
|
document.querySelectorAll('[data-sort-table]').forEach(button => button.addEventListener('click', () => { const current=tableSort[button.dataset.sortTable]; tableSort[button.dataset.sortTable]={key:button.dataset.sortKey,direction:current && current.key===button.dataset.sortKey ? -current.direction : 1}; refresh(); }));
|
|
document.querySelectorAll('.apply-suggested-profile').forEach(button => button.addEventListener('click', () => applySuggestedProfile(button.dataset.streamId)));
|
|
}
|
|
async function loadSettings() {
|
|
const config = await (await fetch('/api/config', {cache: 'no-store'})).json();
|
|
const form = document.getElementById('settingsForm');
|
|
for (const [key, value] of Object.entries(config)) {
|
|
const field = form.elements.namedItem(key);
|
|
if (!field) continue;
|
|
if (field.type === 'checkbox') field.checked = Boolean(value); else field.value = value || '';
|
|
}
|
|
const token = form.elements.namedItem('graylog_mcp_token');
|
|
token.placeholder = config.graylog_mcp_token_configured ? 'Token configured; leave blank to keep it' : 'Paste a read-only token';
|
|
const abuseKey = form.elements.namedItem('abuseipdb_api_key');
|
|
abuseKey.placeholder = config.abuseipdb_api_key_configured ? 'Key configured; leave blank to keep it' : 'Paste AbuseIPDB API key';
|
|
const vtKey = form.elements.namedItem('virustotal_api_key');
|
|
vtKey.placeholder = config.virustotal_api_key_configured ? 'Key configured; leave blank to keep it' : 'Paste VirusTotal API key';
|
|
window.streamProfiles = config.graylog_stream_profiles || [];
|
|
if (config.graylog_mcp_token_configured && config.graylog_mcp_url) loadStreams();
|
|
loadOllamaModels();
|
|
}
|
|
async function loadOllamaModels() {
|
|
const target = document.getElementById('ollamaModels');
|
|
try {
|
|
const payload = await (await fetch('/api/ollama/models', {cache: 'no-store'})).json();
|
|
if (!payload.models || payload.models.length === 0) {
|
|
target.textContent = payload.error || 'No local Ollama models found.';
|
|
return;
|
|
}
|
|
target.innerHTML = `<div class="model-list">${payload.models.map(model => `<button type="button" class="model-pill" data-model="${esc(model.name)}">${esc(model.name)}</button>`).join('')}</div><div class="muted">Click a model to fill Ollama model and profile advisor model fields.</div>`;
|
|
target.querySelectorAll('.model-pill').forEach(button => button.addEventListener('click', () => {
|
|
document.querySelector('[name="llm_model"]').value = button.dataset.model;
|
|
document.querySelector('[name="profile_advisor_model"]').value = button.dataset.model;
|
|
}));
|
|
} catch (error) {
|
|
target.textContent = `Could not load Ollama models: ${error}`;
|
|
}
|
|
}
|
|
async function loadStreams() {
|
|
const response = await fetch('/api/graylog/streams');
|
|
const payload = await response.json();
|
|
const selected = new Set((payload.selected || []).filter(item => item.enabled).map(item => item.id));
|
|
window.availableStreams = payload.streams || [];
|
|
document.getElementById('streamPicker').innerHTML = (payload.streams || []).map(stream => `<div class="stream-row"><label><input type="checkbox" class="graylog-stream" data-id="${esc(stream.id)}" data-title="${esc(stream.title)}" ${selected.has(stream.id) ? 'checked' : ''}> ${esc(stream.title)}</label> <button type="button" class="edit-profile" data-id="${esc(stream.id)}" data-title="${esc(stream.title)}">Edit profile</button></div>`).join('') || esc(payload.error || 'No streams found.');
|
|
}
|
|
document.getElementById('loadStreams').addEventListener('click', loadStreams);
|
|
async function applySuggestedProfile(streamId) {
|
|
const suggestion = (window.profileSuggestions || []).find(item => item.stream_id === streamId);
|
|
if (!suggestion || !suggestion.profile) return;
|
|
const config = await (await fetch('/api/config', {cache: 'no-store'})).json();
|
|
const profile = suggestion.profile;
|
|
const payload = {
|
|
graylog_stream_profiles: [...(config.graylog_stream_profiles || []).filter(item => item.stream_id !== profile.stream_id), profile],
|
|
graylog_streams: config.graylog_streams || [],
|
|
log_source: config.log_source || 'graylog_mcp',
|
|
graylog_mcp_url: config.graylog_mcp_url || '',
|
|
graylog_query: config.graylog_query || '*',
|
|
graylog_range_seconds: config.graylog_range_seconds || 300,
|
|
graylog_max_events_per_stream: config.graylog_max_events_per_stream || 5000,
|
|
graylog_field_mapping: config.graylog_field_mapping || '',
|
|
baseline_training_days: config.baseline_training_days || 7,
|
|
baseline_retention_days: config.baseline_retention_days || 14,
|
|
baseline_value_retention_days: config.baseline_value_retention_days || 7,
|
|
baseline_max_values_per_field: config.baseline_max_values_per_field || 2000,
|
|
llm_enabled: Boolean(config.llm_enabled),
|
|
llm_model: config.llm_model || '',
|
|
profile_advisor_enabled: Boolean(config.profile_advisor_enabled),
|
|
profile_advisor_model: config.profile_advisor_model || 'qwen3:8b',
|
|
profile_advisor_timeout: config.profile_advisor_timeout || 120,
|
|
threat_intel_enabled: Boolean(config.threat_intel_enabled),
|
|
threat_intel_provider: config.threat_intel_provider || 'auto',
|
|
threat_intel_daily_limit: config.threat_intel_daily_limit || 100,
|
|
threat_intel_ttl_seconds: config.threat_intel_ttl_seconds || 604800,
|
|
threat_intel_error_ttl_seconds: config.threat_intel_error_ttl_seconds || 3600,
|
|
abuseipdb_max_age_days: config.abuseipdb_max_age_days || 90
|
|
};
|
|
const response = await fetch('/api/config', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify(payload)});
|
|
document.getElementById('settingsResult').textContent = response.ok ? `Applied recommended profile for ${suggestion.stream_name || streamId}.` : 'Could not apply recommended profile.';
|
|
if (response.ok) loadSettings();
|
|
}
|
|
async function editStreamProfile(streamId, title) {
|
|
document.getElementById('profileEditorStatus').innerHTML = `Editing profile for <code>${esc(title || streamId)}</code>`;
|
|
document.getElementById('fieldPicker').textContent = 'Loading stream fields...';
|
|
const payload = await (await fetch(`/api/graylog/fields?stream_id=${encodeURIComponent(streamId)}`)).json();
|
|
const profile = (window.streamProfiles || []).find(item => item.stream_id === streamId) || {};
|
|
document.querySelector('[name="profile_name"]').value = profile.name || `${title || streamId} profile`;
|
|
document.querySelector('[name="profile_detectors"]').value = Object.keys(profile.detectors || {}).length ? JSON.stringify(profile.detectors, null, 2) : '';
|
|
document.querySelector('[name="profile_field_weights"]').value = Object.keys(profile.field_weights || {}).length ? JSON.stringify(profile.field_weights, null, 2) : '';
|
|
const entityFields = new Set(profile.entity_fields || (profile.entity_field ? [profile.entity_field] : []));
|
|
const rows = (payload.fields || []).map(field => { const name=field.name||field.field, type=(field.type||{}).type||'', props=(field.type||{}).properties||[]; return `<div class="field-row"><code>${esc(name)}</code><span>${esc(type)}</span><span>${esc(props.join(', '))}</span><div class="field-controls"><label><input class="profile-entity" type="checkbox" value="${esc(name)}" ${entityFields.has(name)?'checked':''}> Entity</label><label><input type="radio" name="profile_timestamp" value="${esc(name)}" ${profile.timestamp_field===name?'checked':''}> Time</label>${props.includes('enumerable')?`<label><input class="profile-categorical" type="checkbox" value="${esc(name)}" ${(profile.categorical_fields||[]).includes(name)?'checked':''}> Categorical</label>`:''}${props.includes('numeric')?`<label><input class="profile-numeric" type="checkbox" value="${esc(name)}" ${(profile.numeric_fields||[]).includes(name)?'checked':''}> Numeric</label>`:''}</div></div>`; }).join('');
|
|
document.getElementById('fieldPicker').innerHTML = rows ? `<div class="field-header"><span>Field</span><span>Type</span><span>Capabilities</span><span>Use In Profile</span></div>${rows}` : esc(payload.error || 'No fields found.');
|
|
window.activeProfileStream = streamId;
|
|
window.activeProfileTitle = title || streamId;
|
|
}
|
|
document.getElementById('streamPicker').addEventListener('click', event => {
|
|
const button = event.target.closest('.edit-profile');
|
|
if (!button) return;
|
|
editStreamProfile(button.dataset.id, button.dataset.title);
|
|
});
|
|
document.getElementById('loadFields').addEventListener('click', async () => {
|
|
if (window.activeProfileStream) { editStreamProfile(window.activeProfileStream, window.activeProfileTitle); return; }
|
|
const checked = [...document.querySelectorAll('.graylog-stream:checked')];
|
|
if (checked.length !== 1) { document.getElementById('fieldPicker').textContent = 'Click Edit profile on the stream you want to edit, or check exactly one stream first.'; return; }
|
|
editStreamProfile(checked[0].dataset.id, checked[0].dataset.title);
|
|
});
|
|
document.getElementById('settingsForm').addEventListener('submit', async event => {
|
|
event.preventDefault();
|
|
const form = event.currentTarget;
|
|
const values = Object.fromEntries(new FormData(form));
|
|
values.llm_enabled = form.elements.llm_enabled.checked;
|
|
values.profile_advisor_enabled = form.elements.profile_advisor_enabled.checked;
|
|
values.threat_intel_enabled = form.elements.threat_intel_enabled.checked;
|
|
values.graylog_streams = [...document.querySelectorAll('.graylog-stream')].map(item => ({id:item.dataset.id, title:item.dataset.title, enabled:item.checked}));
|
|
if (window.activeProfileStream) { let detectors={},fieldWeights={}; try { detectors=form.elements.profile_detectors.value.trim() ? JSON.parse(form.elements.profile_detectors.value) : {}; } catch { document.getElementById('settingsResult').textContent='Detector thresholds must be valid JSON.'; return; } try { fieldWeights=form.elements.profile_field_weights.value.trim() ? JSON.parse(form.elements.profile_field_weights.value) : {}; } catch { document.getElementById('settingsResult').textContent='Field weights must be valid JSON.'; return; } const entityFields=[...form.querySelectorAll('.profile-entity:checked')].map(item=>item.value); if (!entityFields.length) { document.getElementById('settingsResult').textContent='Select at least one Entity field for the active profile.'; return; } const profileTitle=window.activeProfileTitle || window.activeProfileStream; const profile={stream_id:window.activeProfileStream,name:form.elements.profile_name.value.trim() || `${profileTitle} profile`,entity_field:entityFields[0]||'',entity_fields:entityFields,timestamp_field:form.querySelector('[name="profile_timestamp"]:checked')?.value||'timestamp',categorical_fields:[...form.querySelectorAll('.profile-categorical:checked')].map(item=>item.value),numeric_fields:[...form.querySelectorAll('.profile-numeric:checked')].map(item=>item.value),detectors,field_weights:fieldWeights}; values.graylog_stream_profiles=[...(window.streamProfiles||[]).filter(item=>item.stream_id!==profile.stream_id),profile]; }
|
|
const savedProfile = window.activeProfileStream ? ` Profile saved for ${window.activeProfileTitle || window.activeProfileStream}.` : ' No profile editor active, so profiles were not changed.';
|
|
const response = await fetch('/api/config', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify(values)});
|
|
document.getElementById('settingsResult').textContent = response.ok ? `Saved enabled streams and global settings.${savedProfile} Monitor applies supported settings on its next cycle.` : 'Could not save configuration.';
|
|
if (response.ok) loadSettings();
|
|
});
|
|
document.querySelectorAll('.tab').forEach(button => button.addEventListener('click', () => {
|
|
document.querySelectorAll('.tab').forEach(item => item.classList.toggle('active', item === button));
|
|
document.querySelectorAll('[data-view]').forEach(view => view.classList.toggle('active', view.dataset.view === button.dataset.tab));
|
|
}));
|
|
['showReviewedFindings','showLowFindings'].forEach(id => document.getElementById(id)?.addEventListener('change', refresh));
|
|
refresh();
|
|
loadSettings();
|
|
setInterval(refresh, 5000);
|
|
</script>
|
|
</body>
|
|
</html>
|
|
"""
|
|
|
|
|
|
def serve_dashboard(host: str, port: int, status_file: str, *, image_dir: str | None = None, config_file: str = "state/fgai-config.json") -> None:
|
|
status_path = Path(status_file)
|
|
image_root = Path(image_dir) if image_dir else None
|
|
config_store = ConfigStore(config_file)
|
|
|
|
class Handler(BaseHTTPRequestHandler):
|
|
def do_GET(self) -> None:
|
|
if self.path == "/":
|
|
self._send(200, "text/html; charset=utf-8", HTML.encode("utf-8"))
|
|
return
|
|
if self.path == "/api/config":
|
|
self._send(200, "application/json", json.dumps(config_store.public()).encode("utf-8"))
|
|
return
|
|
if self.path == "/api/feedback":
|
|
self._send(200, "application/json", json.dumps(FeedbackStore().entries()).encode("utf-8"))
|
|
return
|
|
if self.path == "/api/incidents":
|
|
self._send(200, "application/json", json.dumps(IncidentStore().entries()).encode("utf-8"))
|
|
return
|
|
if self.path == "/api/ollama/models":
|
|
self._send(200, "application/json", json.dumps(_ollama_models()).encode("utf-8"))
|
|
return
|
|
if self.path == "/api/graylog/streams":
|
|
config = config_store.read()
|
|
try:
|
|
client = GraylogMcpClient(str(config.get("graylog_mcp_url", "")), str(config.get("graylog_mcp_token", "")))
|
|
client.probe()
|
|
result = client.call_tool("list_streams", {})
|
|
content = result.get("result", {}).get("content", [])
|
|
text = next((item.get("text", "") for item in content if isinstance(item, dict)), "")
|
|
if isinstance(result.get("result"), dict) and result["result"].get("isError"):
|
|
fallback = client.call_tool("list_resource", {"resource_type": "stream"})
|
|
resources = fallback.get("result", {}).get("structuredContent", {}).get("resources", [])
|
|
streams = [
|
|
{"id": str(item.get("uri", "")).rsplit(":", 1)[-1], "title": item.get("title", item.get("name", "")), "description": item.get("description", "")}
|
|
for item in resources if isinstance(item, dict) and item.get("uri")
|
|
]
|
|
else:
|
|
if not text:
|
|
raise RuntimeError("Graylog list_streams returned no text content")
|
|
streams = json.loads(text)
|
|
body = {"streams": streams, "selected": config.get("graylog_streams", [])}
|
|
self._send(200, "application/json", json.dumps(body).encode("utf-8"))
|
|
except Exception as exc:
|
|
self._send(400, "application/json", json.dumps({"error": str(exc)}).encode("utf-8"))
|
|
return
|
|
if self.path.startswith("/api/graylog/fields?"):
|
|
stream_id = self.path.split("stream_id=", 1)[-1].split("&", 1)[0]
|
|
config = config_store.read()
|
|
try:
|
|
client = GraylogMcpClient(str(config.get("graylog_mcp_url", "")), str(config.get("graylog_mcp_token", "")))
|
|
client.probe()
|
|
result = client.call_tool("list_fields", {"streams": [stream_id]})
|
|
content = result.get("result", {}).get("content", [])
|
|
text = next((item.get("text", "") for item in content if isinstance(item, dict)), "")
|
|
payload = json.loads(text)
|
|
fields = payload.get("fields", payload) if isinstance(payload, dict) else payload
|
|
self._send(200, "application/json", json.dumps({"fields": fields}).encode("utf-8"))
|
|
except Exception as exc:
|
|
self._send(400, "application/json", json.dumps({"error": str(exc)}).encode("utf-8"))
|
|
return
|
|
if self.path == "/api/status":
|
|
if status_path.exists():
|
|
body = status_path.read_bytes()
|
|
else:
|
|
body = json.dumps({"summary": {}, "anomalies": [], "block_candidates": []}).encode("utf-8")
|
|
self._send(200, "application/json", body)
|
|
return
|
|
if self.path.startswith("/api/export/incidents"):
|
|
parsed = urlparse(self.path)
|
|
params = parse_qs(parsed.query)
|
|
fmt = params.get("format", ["markdown"])[0]
|
|
incident_id = params.get("incident_id", [""])[0] or None
|
|
try:
|
|
status = json.loads(status_path.read_text(encoding="utf-8")) if status_path.exists() else {}
|
|
except json.JSONDecodeError:
|
|
status = {}
|
|
report = investigation_report(status, incident_id=incident_id)
|
|
if fmt == "json":
|
|
self._send(200, "application/json", json.dumps(report, indent=2, sort_keys=True).encode("utf-8"))
|
|
else:
|
|
self._send(200, "text/markdown; charset=utf-8", investigation_report_markdown(report).encode("utf-8"))
|
|
return
|
|
if self.path == "/metrics":
|
|
try:
|
|
status = json.loads(status_path.read_text(encoding="utf-8")) if status_path.exists() else {}
|
|
except json.JSONDecodeError:
|
|
status = {}
|
|
self._send(200, "text/plain; version=0.0.4; charset=utf-8", prometheus_metrics(status).encode("utf-8"))
|
|
return
|
|
if self.path.startswith("/images/") and image_root:
|
|
image_path = image_root / Path(self.path).name
|
|
if image_path.exists() and image_path.is_file():
|
|
content_type = "image/png" if image_path.suffix.lower() == ".png" else "application/octet-stream"
|
|
self._send(200, content_type, image_path.read_bytes())
|
|
return
|
|
self._send(404, "text/plain; charset=utf-8", b"not found")
|
|
|
|
def do_POST(self) -> None:
|
|
if self.path == "/api/feedback" and self._is_loopback_client():
|
|
try:
|
|
payload = json.loads(self.rfile.read(min(int(self.headers.get("Content-Length", "0")), 16_384)).decode("utf-8"))
|
|
self._send(200, "application/json", json.dumps(FeedbackStore().add(payload)).encode("utf-8"))
|
|
except (ValueError, json.JSONDecodeError) as exc:
|
|
self._send(400, "application/json", json.dumps({"error": str(exc)}).encode("utf-8"))
|
|
return
|
|
if self.path == "/api/incidents" and self._is_loopback_client():
|
|
try:
|
|
payload = json.loads(self.rfile.read(min(int(self.headers.get("Content-Length", "0")), 16_384)).decode("utf-8"))
|
|
self._send(200, "application/json", json.dumps(IncidentStore().update(str(payload.get("id", "")), str(payload.get("status", "")), str(payload.get("note", "")))).encode("utf-8"))
|
|
except (ValueError, json.JSONDecodeError) as exc:
|
|
self._send(400, "application/json", json.dumps({"error": str(exc)}).encode("utf-8"))
|
|
return
|
|
if self.path != "/api/config" or not self._is_loopback_client():
|
|
self._send(403, "application/json", b'{"error":"configuration is local-only"}')
|
|
return
|
|
try:
|
|
length = int(self.headers.get("Content-Length", "0"))
|
|
payload = json.loads(self.rfile.read(min(length, 32_768)).decode("utf-8"))
|
|
if not isinstance(payload, dict):
|
|
raise ValueError("configuration must be an object")
|
|
body = json.dumps(config_store.update(payload)).encode("utf-8")
|
|
except (ValueError, json.JSONDecodeError) as exc:
|
|
self._send(400, "application/json", json.dumps({"error": str(exc)}).encode("utf-8"))
|
|
return
|
|
self._send(200, "application/json", body)
|
|
|
|
def _is_loopback_client(self) -> bool:
|
|
return self.client_address[0] in {"127.0.0.1", "::1"}
|
|
|
|
def log_message(self, format: str, *args: object) -> None:
|
|
return
|
|
|
|
def _send(self, status: int, content_type: str, body: bytes) -> None:
|
|
self.send_response(status)
|
|
self.send_header("Content-Type", content_type)
|
|
self.send_header("Content-Length", str(len(body)))
|
|
self.end_headers()
|
|
self.wfile.write(body)
|
|
|
|
server = ThreadingHTTPServer((host, port), Handler)
|
|
print(f"Dashboard listening on http://{host}:{port}")
|
|
print(f"Reading status from {status_path}")
|
|
server.serve_forever()
|