ypratama/Deep-Package-Inspection
2
0 Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(site): implement dynamic site selection dropdown in sidebar and enable multi-site monitoring

Browse Source
This commit is contained in:
Rafif-Riqullah-Siregar committed 2026-07-13 16:57:45 +07:00
1 parent be6bc14190
commit 4882108068
125 files changed
+5666 -4305
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/routes/dashboard/apps.js
+49 -8
View File
@@ -1,6 +1,6 @@
const express = require('express');
const router = express.Router();
const { AppStat, ProtocolStat, AppCategoryStat } = require('../../models/Schemas');
const { AppStat, ProtocolStat, AppCategoryStat, LookupApp } = require('../../models/Schemas');
const { getTimeFilter, getBaseFilter } = require('./helpers');
// GET /api/dashboard/apps
@@ -102,16 +102,57 @@ router.get('/app-categories', async (req, res) => {
// GET /api/dashboard/lookup/applications
router.get('/lookup/applications', async (req, res) => {
try {
const q = String(req.query.q || '').trim();
if (!q) return res.json({ ok: true, data: [] });
const search = String(req.query.search || req.query.q || '').trim();
const category = String(req.query.category || '').trim();
const page = Math.max(1, parseInt(req.query.page) || 1);
const limit = Math.max(1, parseInt(req.query.limit) || 25);
const skip = (page - 1) * limit;
const baseFilter = getBaseFilter(req, null);
const apps = await AppStat.distinct('app_label', {
...baseFilter,
app_label: { $regex: q, $options: 'i' }
let filter = {};
if (search) {
filter.$or = [
{ label: { $regex: search, $options: 'i' } },
{ name: { $regex: search, $options: 'i' } },
{ tag: { $regex: search, $options: 'i' } }
];
}
if (category) {
filter['application_category.label'] = category;
}
const [applications, total_records] = await Promise.all([
LookupApp.find(filter).sort({ label: 1 }).skip(skip).limit(limit).lean(),
LookupApp.countDocuments(filter)
]);
const total_pages = Math.ceil(total_records / limit) || 1;
res.json({
ok: true,
data: {
applications,
pagination: {
total_records,
total_pages,
current_page: page,
start: skip,
length: applications.length,
limit
}
}
});
} catch (err) {
res.status(500).json({ ok: false, error: err.message });
}
});
res.json({ ok: true, data: apps.map(name => ({ label: name, value: name })) });
// GET /api/dashboard/lookup/categories
router.get('/lookup/categories', async (req, res) => {
try {
const categories = await LookupApp.distinct('application_category.label');
const validCategories = categories.filter(c => c).sort();
res.json({ ok: true, data: validCategories });
} catch (err) {
res.status(500).json({ ok: false, error: err.message });
}
backend/routes/dashboard/devices.js
+16 -7
View File
@@ -12,16 +12,23 @@ router.get('/devices', async (req, res) => {
const timeFilter = getTimeFilter(req);
const query = getBaseFilter(req, timeFilter);
let dbQuery = DeviceStat.find(query).sort({ timestamp: -1, download: -1 }).skip(skip);
if (limit > 0) dbQuery = dbQuery.limit(limit);
const pipeline = [
{ $match: query },
{ $sort: { timestamp: -1 } },
{ $group: { _id: "$ip_address", doc: { $first: "$$ROOT" } } },
{ $replaceRoot: { newRoot: "$doc" } },
{ $sort: { timestamp: -1, download: -1 } }
];
if (skip > 0) pipeline.push({ $skip: skip });
if (limit > 0) pipeline.push({ $limit: limit });
const [data, customLabelsMap] = await Promise.all([
dbQuery,
DeviceStat.aggregate(pipeline),
getCustomLabelsMap()
]);
const mapped = data.map(d => {
const obj = d.toObject();
const mapped = data.map(obj => {
const ip = obj.ip_address;
const mac = obj.mac_address && obj.mac_address !== '-' ? obj.mac_address : generateMacFromIp(ip);
@@ -125,7 +132,7 @@ router.get('/security-devices', async (req, res) => {
const baseFilter = getBaseFilter(req, timeFilter);
const uniqueDevices = await DeviceStat.aggregate([
{ $match: { site_uuid: baseFilter.site_uuid } },
{ $match: baseFilter },
{ $sort: { timestamp: -1 } },
{ $group: {
_id: '$ip_address',
@@ -173,6 +180,7 @@ router.get('/security-devices', async (req, res) => {
const label = baseLabel && baseLabel !== '-' && baseLabel !== 'Unknown' && baseLabel !== 'Generic Client'
? baseLabel
: generateAutoLabel(ip, mac, man, type);
const lastSeen = obj.last_seen || obj.timestamp || new Date().toISOString();
const fStat = flowMap[ip] || { total: 0, encrypted: 0 };
const encrypted = fStat.encrypted;
@@ -197,7 +205,8 @@ router.get('/security-devices', async (req, res) => {
unencrypted,
encrypted_pct,
risk_level,
has_insecure: unencrypted > encrypted * 2
has_insecure: unencrypted > encrypted * 2,
timestamp: lastSeen
};
});
backend/routes/dashboard/events.js
+35 -2
View File
@@ -1,14 +1,16 @@
const express = require('express');
const router = express.Router();
const { Event } = require('../../models/Schemas');
const { Event, DeviceStat, Flow } = require('../../models/Schemas');
const { getTimeFilter, getBaseFilter } = require('./helpers');
// GET /api/dashboard/events
router.get('/events', async (req, res) => {
try {
console.log('[/events] Request received. Query:', req.query);
const limit = parseInt(req.query.limit ?? 0);
const timeFilter = getTimeFilter(req);
const base = getBaseFilter(req, timeFilter);
console.log('[/events] Event base filter:', base);
let query = Event.find(base).sort({ timestamp: -1 });
if (limit > 0) {
@@ -17,12 +19,43 @@ router.get('/events', async (req, res) => {
const events = await query.lean();
// Collect all MAC addresses for events missing IP addresses
const missingIpMacs = [...new Set(events.filter(e => !e.ip_address && e.mac_address).map(e => e.mac_address))];
// Lookup DeviceStat for these MACs
let macToIpMap = {};
if (missingIpMacs.length > 0) {
const baseFilterNull = getBaseFilter(req, null);
console.log('[/events] getBaseFilter(req, null) returned:', baseFilterNull);
const filterForDevices = {
mac_address: { $in: missingIpMacs },
...baseFilterNull
};
console.log('[/events] DEBUG filterForDevices:', filterForDevices);
const devices = await DeviceStat.find(filterForDevices).lean();
for (const d of devices) {
macToIpMap[d.mac_address] = d.ip_address;
}
// Fallback: Query Flow collection for remaining unresolved MACs
const unresolvedMacs = missingIpMacs.filter(mac => !macToIpMap[mac]);
if (unresolvedMacs.length > 0) {
for (const mac of unresolvedMacs) {
const flow = await Flow.findOne({ src_mac: mac, ...baseFilterNull }).sort({ timestamp: -1 }).lean();
if (flow && flow.src_ip) {
macToIpMap[mac] = flow.src_ip;
}
}
}
}
const data = events.map(e => ({
id: e._id?.toString() || e.event_id,
event_type: e.event_type,
severity: e.severity,
message: e.description || 'System event triggered',
source_ip: e.ip_address || null,
source_ip: e.ip_address || macToIpMap[e.mac_address] || null,
mac_address: e.mac_address || null,
timestamp: e.timestamp,
}));
backend/routes/dashboard/flows.js
+1 -1
View File
@@ -217,7 +217,7 @@ router.get('/ip-versions', async (req, res) => {
const timeFilter = getTimeFilter(req);
const matchBase = getBaseFilter(req, timeFilter);
const flows = await Flow.find({ ...matchBase, dst_ip: { $ne: null } }, { dst_ip: 1, download: 1, upload: 1 }).lean();
const flows = await Flow.find({ ...matchBase, dst_ip: { $ne: null } }, { dst_ip: 1, download: 1, upload: 1 }).limit(20000).lean();
let ipv4Total = 0, ipv6Total = 0;
for (const f of flows) {
const size = (f.download || 0) + (f.upload || 0);
backend/routes/dashboard/geo.js
+14 -6
View File
@@ -134,24 +134,32 @@ router.get('/dns', async (req, res) => {
const limit = req.query.limit !== undefined ? parseInt(req.query.limit) : 0;
const timeFilter = getTimeFilter(req);
const matchBase = getBaseFilter(req, timeFilter);
const { SniHostnameStat } = require('../../models/SchemasTelemetry');
const pipeline = [
{ $match: { ...matchBase, domain: { $ne: null } } },
{ $match: { ...matchBase, sni_hostname: { $ne: null } } },
{ $group: {
_id: '$domain',
_id: '$sni_hostname',
download: { $sum: '$download' },
upload: { $sum: '$upload' },
count: { $sum: 1 },
app_label: { $last: '$app_label' },
count: { $sum: '$flows' }
}},
{ $project: {
domain: '$_id',
query_count: '$count',
download: 1,
upload: 1,
app_label: { $literal: null },
category: { $literal: null },
_id: 0
}},
{ $project: { domain: '$_id', query_count: '$count', download: 1, upload: 1, app_label: 1, category: { $literal: null }, _id: 0 } },
{ $sort: { query_count: -1 } },
];
if (limit > 0) {
pipeline.push({ $limit: limit });
}
const data = await Flow.aggregate(pipeline);
const data = await SniHostnameStat.aggregate(pipeline);
res.json({ ok: true, data });
} catch (err) {
res.status(500).json({ ok: false, error: err.message });
backend/routes/dashboard/helpers.js
+12 -1
View File
@@ -18,7 +18,18 @@ function getTimeFilter(req) {
function getBaseFilter(req, timeFilter = null) {
const filter = {};
if (timeFilter) filter.timestamp = timeFilter;
if (req.user?.site_uuid) filter.site_uuid = req.user.site_uuid;
const requestedSiteUuid = req.headers['x-backone-site-uuid'];
console.log('[DEBUG] getBaseFilter headers:', Object.keys(req.headers), 'x-backone-site-uuid:', requestedSiteUuid, 'role:', req.user?.role);
const hasSwitcherRole = ['SUPER_ADMIN', 'SOC_ANALYST', 'ENGINEER'].includes(req.user?.role);
if (hasSwitcherRole && requestedSiteUuid) {
filter.site_uuid = requestedSiteUuid;
} else if (req.user?.site_uuid) {
filter.site_uuid = req.user.site_uuid;
}
if (req.user?.role === 'AGENT_VIEWER' && req.user?.agent_uuid) {
filter.agent_uuid = req.user.agent_uuid;
} else if (req.query?.agent_uuid) {
backend/routes/dashboard/sslSan.js
+4
View File
@@ -24,6 +24,7 @@ router.get('/ssl-subject-alt-names', async (req, res) => {
download: { $sum: '$download' },
upload: { $sum: '$upload' },
flows: { $sum: '$flows' },
timestamp: { $max: '$timestamp' },
}},
{ $project: {
alt_name: '$_id',
@@ -31,6 +32,7 @@ router.get('/ssl-subject-alt-names', async (req, res) => {
upload: 1,
flows: 1,
total: { $add: ['$download', '$upload'] },
timestamp: 1,
_id: 0
}},
{ $sort: { total: -1 } },
@@ -46,6 +48,7 @@ router.get('/ssl-subject-alt-names', async (req, res) => {
download: { $sum: '$download' },
upload: { $sum: '$upload' },
flows: { $sum: '$flows' },
timestamp: { $max: '$timestamp' },
}},
{ $project: {
alt_name: '$_id',
@@ -53,6 +56,7 @@ router.get('/ssl-subject-alt-names', async (req, res) => {
upload: 1,
flows: 1,
total: { $add: ['$download', '$upload'] },
timestamp: 1,
_id: 0
}},
{ $sort: { total: -1 } },
backend/routes/dashboard/summary.js
+11 -4
View File
@@ -29,7 +29,7 @@ router.get('/summary', async (req, res) => {
activeFlowsCount = summaries.reduce((s, r) => s + (r.active_flows ?? 0), 0);
}
const [fallbackDevices, fallbackFlows, fallbackFlowBandwidth, realThreatsCount, realEventsCount] = await Promise.all([
const [fallbackDevices, fallbackFlows, fallbackFlowBandwidth, realThreatsCount, realEventsCount, fallbackThreatsCount] = await Promise.all([
DeviceStat.distinct('ip_address', base).then(r => r.length),
Flow.countDocuments(base),
Flow.aggregate([
@@ -37,7 +37,14 @@ router.get('/summary', async (req, res) => {
{ $group: { _id: null, down: { $sum: '$download' }, up: { $sum: '$upload' } } }
]),
Threat.countDocuments(base),
Event.countDocuments(base)
Event.countDocuments(base),
Event.countDocuments({
...base,
$or: [
{ severity: { $in: ['Critical', 'High'] } },
{ category_label: 'Cybersecurity' }
]
})
]);
const flowDown = fallbackFlowBandwidth[0]?.down || 0;
@@ -45,7 +52,7 @@ router.get('/summary', async (req, res) => {
let finalDown = bandwidthDown > 0 ? bandwidthDown : flowDown;
let finalUp = bandwidthUp > 0 ? bandwidthUp : flowUp;
let finalDevices = totalDevicesCount > 0 ? totalDevicesCount : fallbackDevices;
let finalDevices = fallbackDevices;
let finalActiveFlows = activeFlowsCount > 0 ? activeFlowsCount : fallbackFlows;
const range = req.query.timeRange || '1d';
@@ -67,7 +74,7 @@ router.get('/summary', async (req, res) => {
ok: true,
data: {
total_devices: finalDevices,
total_threats: realThreatsCount,
total_threats: realThreatsCount > 0 ? realThreatsCount : fallbackThreatsCount,
total_events: realEventsCount,
last_fetch: latestTime || new Date(),
bandwidth_down: finalDown,
backend/routes/dashboard/telemetry.js
+9 -9
View File
@@ -126,7 +126,7 @@ router.get('/sni-hostnames', async (req, res) => {
{ $group: { _id: '$sni_hostname', download: { $sum: '$download' }, upload: { $sum: '$upload' }, flows: { $sum: '$flows' } } },
{ $project: { sni_hostname: '$_id', total: { $add: ['$download', '$upload'] }, download: 1, upload: 1, flows: 1, _id: 0 } },
{ $sort: { total: -1 } },
{ $limit: limit },
]);
if (raw.length === 0) {
@@ -137,7 +137,7 @@ router.get('/sni-hostnames', async (req, res) => {
{ $group: { _id: '$domain', download: { $sum: '$download' }, upload: { $sum: '$upload' }, flows: { $sum: 1 } } },
{ $project: { sni_hostname: '$_id', total: { $add: ['$download', '$upload'] }, download: 1, upload: 1, flows: 1, _id: 0 } },
{ $sort: { total: -1 } },
{ $limit: limit },
]);
raw = raw.filter(r => r.sni_hostname && !String(r.sni_hostname).startsWith('Port '));
}
@@ -160,7 +160,7 @@ router.get('/ssl-server-cn', async (req, res) => {
{ $group: { _id: '$ssl_server_cn', download: { $sum: '$download' }, upload: { $sum: '$upload' }, flows: { $sum: '$flows' } } },
{ $project: { ssl_server_cn: '$_id', total: { $add: ['$download', '$upload'] }, download: 1, upload: 1, flows: 1, _id: 0 } },
{ $sort: { total: -1 } },
{ $limit: limit },
]);
if (raw.length === 0) {
@@ -171,7 +171,7 @@ router.get('/ssl-server-cn', async (req, res) => {
{ $group: { _id: '$domain', download: { $sum: '$download' }, upload: { $sum: '$upload' }, flows: { $sum: 1 } } },
{ $project: { ssl_server_cn: '$_id', total: { $add: ['$download', '$upload'] }, download: 1, upload: 1, flows: 1, _id: 0 } },
{ $sort: { total: -1 } },
{ $limit: limit },
]);
raw = flowRaw.filter(r => r.ssl_server_cn && !String(r.ssl_server_cn).startsWith('Port '));
}
@@ -194,7 +194,7 @@ router.get('/quic-hostnames', async (req, res) => {
{ $group: { _id: '$quic_hostname', download: { $sum: '$download' }, upload: { $sum: '$upload' }, flows: { $sum: '$flows' } } },
{ $project: { quic_hostname: '$_id', total: { $add: ['$download', '$upload'] }, download: 1, upload: 1, flows: 1, _id: 0 } },
{ $sort: { total: -1 } },
{ $limit: limit },
]);
if (raw.length === 0) {
@@ -205,7 +205,7 @@ router.get('/quic-hostnames', async (req, res) => {
{ $group: { _id: '$domain', download: { $sum: '$download' }, upload: { $sum: '$upload' }, flows: { $sum: 1 } } },
{ $project: { quic_hostname: '$_id', total: { $add: ['$download', '$upload'] }, download: 1, upload: 1, flows: 1, _id: 0 } },
{ $sort: { total: -1 } },
{ $limit: limit },
]);
raw = flowRaw.filter(r => r.quic_hostname && !String(r.quic_hostname).startsWith('Port '));
}
@@ -255,14 +255,14 @@ router.get('/ssh-versions', async (req, res) => {
{ $group: { _id: '$ssh_client', download: { $sum: '$download' }, upload: { $sum: '$upload' }, flows: { $sum: '$flows' } } },
{ $project: { ssh_version: '$_id', total: { $add: ['$download', '$upload'] }, download: 1, upload: 1, flows: 1, _id: 0 } },
{ $sort: { total: -1 } },
{ $limit: limit },
]),
SshServerStat.aggregate([
{ $match: matchBase },
{ $group: { _id: '$ssh_server', download: { $sum: '$download' }, upload: { $sum: '$upload' }, flows: { $sum: '$flows' } } },
{ $project: { ssh_version: '$_id', total: { $add: ['$download', '$upload'] }, download: 1, upload: 1, flows: 1, _id: 0 } },
{ $sort: { total: -1 } },
{ $limit: limit },
]),
]);
@@ -294,7 +294,7 @@ router.get('/mdns-hostnames', async (req, res) => {
{ $group: { _id: '$mdns_hostname', download: { $sum: '$download' }, upload: { $sum: '$upload' }, flows: { $sum: '$flows' } } },
{ $project: { mdns_hostname: '$_id', total: { $add: ['$download', '$upload'] }, download: 1, upload: 1, flows: 1, _id: 0 } },
{ $sort: { total: -1 } },
{ $limit: limit },
]);
res.json({ ok: true, data: raw });
} catch (err) {
backend/routes/dashboard/threats.js
+172 -48
View File
@@ -1,6 +1,6 @@
const express = require('express');
const router = express.Router();
const { Threat, Event, Flow } = require('../../models/Schemas');
const { Threat, Event, Flow, DeviceStat } = require('../../models/Schemas');
const { getTimeFilter, getBaseFilter } = require('./helpers');
const { generateMacFromIp, resolveDeviceTypeFromIp, resolveOSFromIp, resolveVendorFromIp } = require('../../deviceResolver');
@@ -118,25 +118,56 @@ router.get('/intelligence/stats', async (req, res) => {
const timeFilter = getTimeFilter(req);
const base = getBaseFilter(req, timeFilter);
const list = await Threat.find(base).lean();
const total = list.length;
const high = list.filter(t => (t.severity || 'medium').toLowerCase() === 'high' || (t.severity || 'medium').toLowerCase() === 'critical').length;
const medium = list.filter(t => (t.severity || 'medium').toLowerCase() === 'medium' || (t.severity || 'medium').toLowerCase() === 'warning').length;
const low = list.filter(t => (t.severity || 'medium').toLowerCase() === 'low' || (t.severity || 'medium').toLowerCase() === 'info').length;
// Get real counts for all 9 categories
const [
intel_crypto_mining,
intel_tor_detection,
intel_vpn_detection,
intel_ip_reputation,
intel_insecure_protocols,
intel_unencrypted_passwords,
rawDevices,
intel_server_discovery
] = await Promise.all([
Threat.countDocuments({ ...base, threat_type: /mining/i }),
Threat.countDocuments({ ...base, threat_type: /tor/i }),
Threat.countDocuments({ ...base, threat_type: /vpn/i }),
Threat.countDocuments({ ...base, threat_type: /reputation/i }),
Threat.countDocuments({ ...base, threat_type: /insecure/i, $nor: [{ threat_type: /password/i }] }),
Threat.countDocuments({ ...base, threat_type: /password/i }),
DeviceStat.distinct('ip_address', base),
Event.countDocuments({ ...base, event_type: 'server.discovery' })
]);
res.json({ ok: true, data: { total, high, medium, low } });
const intel_device_discovery = rawDevices.length;
const intel_encryption_audit = rawDevices.length; // Same as devices for now, as each device is audited
res.json({
ok: true,
data: {
intel_crypto_mining,
intel_tor_detection,
intel_vpn_detection,
intel_ip_reputation,
intel_insecure_protocols,
intel_unencrypted_passwords,
intel_encryption_audit,
intel_device_discovery,
intel_server_discovery
}
});
} catch (err) {
res.status(500).json({ ok: false, error: err.message });
}
});
// Helper for detail threat intelligence tables
async function getIntelData(req, threatTypeFilter = null, limit = 0) {
async function getIntelData(req, threatTypeRegex = null, limit = 0) {
const timeFilter = getTimeFilter(req);
const query = getBaseFilter(req, timeFilter);
if (threatTypeFilter) {
query.threat_type = { $regex: threatTypeFilter, $options: 'i' };
if (threatTypeRegex) {
query.threat_type = { $regex: threatTypeRegex, $options: 'i' };
}
let dbQuery = Threat.find(query).sort({ detected_at: -1, timestamp: -1 });
@@ -144,60 +175,153 @@ async function getIntelData(req, threatTypeFilter = null, limit = 0) {
const list = await dbQuery.lean();
return list.map((t, index) => {
const ip = t.ip_address || t.src_ip || '10.6.10.44';
const mac = t.mac_address || t.src_mac || generateMacFromIp(ip);
return list.map((t) => {
const ip = t.ip_address || t.src_ip;
const mac = t.mac_address || t.src_mac;
const eTime = t.detected_at || t.timestamp?.toISOString() || new Date().toISOString();
return {
id: t._id?.toString(),
detected_at: eTime,
ip_address: ip,
mac_address: mac,
pool_host: t.domain || 'stratum.antpool.com',
pool_ip: t.dst_ip || '172.217.194.100',
pool_host: t.domain || null,
pool_ip: t.dst_ip || null,
protocol: t.protocol || 'TCP',
app_label: t.app_label || 'Stratum Protocol',
confidence: 95.5,
download: t.download || 12450,
upload: t.upload || 8450,
exit_node: t.dst_ip || '185.220.101.5',
circuit_id: 'circ_' + Math.abs(index * 1337),
country: 'Germany',
vpn_type: t.app_label?.includes('WireGuard') ? 'WireGuard' : 'OpenVPN',
remote_ip: t.dst_ip || '198.51.100.44',
device_label: t.ip_address || ip,
device_type: resolveDeviceTypeFromIp(ip),
os_label: resolveOSFromIp(ip),
manufacturer: resolveVendorFromIp(ip),
is_new: 1,
encrypted_pct: 85.0,
unencrypted: 150000,
encrypted: 850000,
total: 1000000,
risk_level: 'Low',
app_label: t.app_label || 'Unknown',
confidence: t.severity === 'Critical' ? 99 : (t.severity === 'High' ? 90 : 75),
download: t.download || 0,
upload: t.upload || 0,
exit_node: t.dst_ip || null,
circuit_id: t.flow_id || null,
country: 'Unknown', // Geo IP not in Threat schema yet
vpn_type: t.app_label || 'Unknown VPN',
remote_ip: t.dst_ip || null,
device_label: ip,
device_type: 'Unknown',
os_label: 'Unknown',
manufacturer: 'Unknown',
risk_level: t.severity || 'Medium',
risk: t.severity || 'Medium',
source: 'DPI Scanner',
reputation: t.threat_type || 'Malicious IP',
score: 8.5,
local_ip: ip,
blacklisted: 1,
server_type: 'Database Server',
hostname: t.domain || 'db-01.local',
port: t.dst_port || 3306,
username: 'admin_backone',
severity: t.severity || 'Critical'
severity: t.severity || 'Warning'
};
});
}
router.get('/intelligence/crypto-mining', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'mining', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
router.get('/intelligence/device-discovery', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, null, 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
router.get('/intelligence/encryption-audit', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, null, 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
router.get('/intelligence/insecure-protocols', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'Insecure', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
router.get('/intelligence/ip-reputation', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'Reputation', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
router.get('/intelligence/server-discovery', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, null, 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
router.get('/intelligence/tor', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'tor', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
router.get('/intelligence/unencrypted-passwords', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'Insecure Plaintext Password', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
router.get('/intelligence/vpn', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'vpn|VPN', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
router.get('/intelligence/unencrypted-passwords', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'password', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
router.get('/intelligence/vpn', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'vpn', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
// Specialized Intelligence Data
router.get('/intelligence/device-discovery', async (req, res) => {
try {
const timeFilter = getTimeFilter(req);
const query = getBaseFilter(req, timeFilter);
const devices = await require('../../models/Schemas').DeviceStat.find(query).sort({ timestamp: -1 }).lean();
const uniqueMap = new Map();
devices.forEach(d => {
if (!uniqueMap.has(d.ip_address)) {
uniqueMap.set(d.ip_address, {
id: d._id?.toString(),
ip_address: d.ip_address,
mac_address: d.mac_address || '-',
device_type: d.device_type || 'Unknown',
os_label: d.os_label || 'Unknown',
manufacturer: d.manufacturer || 'Unknown',
download: d.download || 0,
upload: d.upload || 0,
last_seen: d.timestamp || new Date()
});
}
});
res.json({ ok: true, data: Array.from(uniqueMap.values()) });
} catch(e) { res.status(500).json({ ok: false, error: e.message }); }
});
router.get('/intelligence/encryption-audit', async (req, res) => {
try {
const timeFilter = getTimeFilter(req);
const query = getBaseFilter(req, timeFilter);
const devices = await require('../../models/Schemas').DeviceStat.find(query).sort({ timestamp: -1 }).lean();
const uniqueMap = new Map();
devices.forEach(d => {
if (!uniqueMap.has(d.ip_address)) {
const download = d.download || 0;
const upload = d.upload || 0;
uniqueMap.set(d.ip_address, {
id: d._id?.toString(),
ip_address: d.ip_address,
mac_address: d.mac_address || '-',
device_label: d.device_label || d.ip_address,
encrypted_pct: 85, // Default for now as per DPI capability
unencrypted: Math.floor(download * 0.15),
encrypted: Math.floor(download * 0.85),
total: download + upload,
risk_level: download > 1024 * 1024 * 1024 ? 'medium' : 'safe',
last_seen: d.last_seen || d.timestamp || new Date().toISOString()
});
}
});
res.json({ ok: true, data: Array.from(uniqueMap.values()) });
} catch(e) { res.status(500).json({ ok: false, error: e.message }); }
});
router.get('/intelligence/server-discovery', async (req, res) => {
try {
const timeFilter = getTimeFilter(req);
const query = getBaseFilter(req, timeFilter);
query.event_type = 'server.discovery';
const events = await Event.find(query).sort({ timestamp: -1 }).lean();
// Resolve IPs using DeviceStat
const macs = events.map(e => e.mac_address).filter(Boolean);
const devices = await DeviceStat.find({ mac_address: { $in: macs } }).lean();
const macMap = {};
devices.forEach(d => {
macMap[d.mac_address] = d;
});
const data = events.map(e => {
let serverType = e.category_label || 'Local Server';
let osLabel = 'Unknown';
let port = 0;
// Parse description: "Detected DHCP server on External Gateway"
const match = e.description?.match(/Detected (.*?) server on (.*)/i);
if (match) {
serverType = match[1].trim();
osLabel = match[2].trim();
}
// Infer Port
const sTypeUpper = serverType.toUpperCase();
if (sTypeUpper.includes('DHCP')) port = 67;
else if (sTypeUpper.includes('DNS')) port = 53;
else if (sTypeUpper.includes('SSH')) port = 22;
else if (sTypeUpper.includes('HTTP')) port = 80;
else if (sTypeUpper.includes('HTTPS')) port = 443;
else if (sTypeUpper.includes('FTP')) port = 21;
const device = macMap[e.mac_address] || {};
return {
id: e._id?.toString(),
ip_address: e.ip_address || device.ip_address || null,
mac_address: e.mac_address,
server_type: serverType,
port: port,
os_label: osLabel !== 'Unknown' ? osLabel : (device.os_label || 'Unknown'),
last_seen: e.event_at || e.timestamp || device.last_seen || device.timestamp || new Date().toISOString()
};
});
res.json({ ok: true, data });
} catch(e) { res.status(500).json({ ok: false, error: e.message }); }
});
module.exports = router;
backend/routes/dashboard/tls.js
+32 -5
View File
@@ -3,6 +3,26 @@ const router = express.Router();
const { TlsVersionStat, TlsCipherStat, TlsSecurityStat } = require('../../models/Schemas');
const { getTimeFilter, getBaseFilter } = require('./helpers');
function analyzeCipherSuite(cipher) {
if (!cipher || cipher === '-' || cipher === 'Unknown') return { status: 'Unknown', description: 'Cipher suite information not available.' };
const c = cipher.toUpperCase();
if (c.includes('NULL') || c.includes('RC4') || c.includes('DES') || c.includes('MD5') || c.includes('EXP') || c.includes('ANON')) {
return { status: 'Vulnerable', description: 'Uses obsolete and highly insecure cryptographic algorithms. Must be disabled immediately.' };
}
if (c.includes('CBC') || c.includes('SHA1') || c.startsWith('TLS_RSA_WITH') || (!c.includes('GCM') && !c.includes('POLY1305'))) {
return { status: 'Weak', description: 'Uses legacy algorithms that are theoretically breakable or lack modern forward secrecy.' };
}
if ((c.includes('GCM') || c.includes('POLY1305')) && (c.includes('AES') || c.includes('CHACHA20'))) {
return { status: 'Secure', description: 'Modern, robust authenticated encryption providing forward secrecy.' };
}
return { status: 'Moderate', description: 'Standard encryption but may lack the strongest current security guarantees.' };
}
// GET /api/dashboard/tls-versions
router.get('/tls-versions', async (req, res) => {
try {
@@ -16,13 +36,13 @@ router.get('/tls-versions', async (req, res) => {
_id: '$tls_version',
download: { $sum: '$download' },
upload: { $sum: '$upload' },
timestamp: { $max: '$timestamp' },
}},
{ $project: { tls_version: '$_id', download: 1, upload: 1, total: { $add: ['$download', '$upload'] }, _id: 0 } },
{ $project: { tls_version: '$_id', download: 1, upload: 1, total: { $add: ['$download', '$upload'] }, timestamp: 1, _id: 0 } },
{ $sort: { total: -1 } },
]);
const finalData = limit > 0 ? data.slice(0, limit) : data;
res.json({ ok: true, data: finalData });
res.json({ ok: true, data });
} catch (err) {
res.status(500).json({ ok: false, error: err.message });
}
@@ -41,12 +61,17 @@ router.get('/tls-ciphers', async (req, res) => {
_id: '$tls_cipher',
download: { $sum: '$download' },
upload: { $sum: '$upload' },
timestamp: { $max: '$timestamp' },
}},
{ $project: { tls_cipher: '$_id', download: 1, upload: 1, total: { $add: ['$download', '$upload'] }, _id: 0 } },
{ $project: { tls_cipher: '$_id', download: 1, upload: 1, total: { $add: ['$download', '$upload'] }, timestamp: 1, _id: 0 } },
{ $sort: { total: -1 } },
]);
const finalData = limit > 0 ? data.slice(0, limit) : data;
let finalData = data.map(d => {
const { status, description } = analyzeCipherSuite(d.tls_cipher);
return { ...d, security_status: status, description };
});
res.json({ ok: true, data: finalData });
} catch (err) {
res.status(500).json({ ok: false, error: err.message });
@@ -65,12 +90,14 @@ router.get('/tls-security', async (req, res) => {
_id: '$tls_security',
download: { $sum: '$download' },
upload: { $sum: '$upload' },
timestamp: { $max: '$timestamp' },
}},
{ $project: {
tls_security: '$_id',
download: 1,
upload: 1,
total: { $add: ['$download', '$upload'] },
timestamp: 1,
_id: 0
}},
{ $sort: { total: -1 } }