v1.1: Add CIDR subnet filtering and Agent filter in Devices page
This commit is contained in:
ypratama committed
commit
966058e2fe
422 files changed
+54656
No files matched your search
@@ -0,0 +1,232 @@
|
||||
const { Summary, DeviceStat, Threat, Flow, Event, AppStat, LookupApp } = require('../models/Schemas');
|
||||
const User = require('../models/User');
|
||||
const parseAgentSecurity = require('./agentSecurityParser');
|
||||
|
||||
module.exports = async function agentDetailsHandler(req, res, helpers) {
|
||||
try {
|
||||
const {
|
||||
getTimeFilter,
|
||||
generateMacFromIp,
|
||||
resolveDeviceTypeFromIp,
|
||||
resolveOSFromIp,
|
||||
resolveVendorFromIp,
|
||||
generateAutoLabel,
|
||||
getCustomLabelsMap
|
||||
} = helpers;
|
||||
|
||||
let uuid = String(req.query.uuid ?? '');
|
||||
if (req.user?.role === 'AGENT_VIEWER' && req.user?.agent_uuid) {
|
||||
uuid = req.user.agent_uuid;
|
||||
}
|
||||
if (!uuid) return res.status(400).json({ ok: false, message: 'uuid required' });
|
||||
|
||||
const timeFilter = getTimeFilter(req);
|
||||
const agentBase = { agent_uuid: uuid };
|
||||
if (req.user?.site_uuid) agentBase.site_uuid = req.user.site_uuid;
|
||||
|
||||
// Conditionally apply timeFilter
|
||||
const baseQuery = { ...agentBase };
|
||||
if (timeFilter) baseQuery.timestamp = timeFilter;
|
||||
|
||||
// 1. Fetch data from MongoDB (without hard limits to comply with Rule 10)
|
||||
const [latestSummary, rawThreats, rawFlows, rawEvents, customLabelsMap] = await Promise.all([
|
||||
Summary.findOne(baseQuery).sort({ timestamp: -1 }),
|
||||
Threat.find(baseQuery).sort({ detected_at: -1 }).lean(),
|
||||
Flow.find(baseQuery).sort({ timestamp: -1 }).limit(1000000).lean(),
|
||||
Event.find(baseQuery).sort({ timestamp: -1 }).lean(),
|
||||
getCustomLabelsMap()
|
||||
]);
|
||||
|
||||
// 1b. Aggregate devices directly from Flow for accurate per-agent data
|
||||
const rawDevicesFromFlow = await Flow.aggregate([
|
||||
{ $match: { agent_uuid: uuid, src_ip: { $ne: null } } },
|
||||
{ $group: {
|
||||
_id: '$src_ip',
|
||||
download: { $sum: '$download' },
|
||||
upload: { $sum: '$upload' },
|
||||
flows: { $sum: 1 },
|
||||
last_seen: { $max: '$timestamp' },
|
||||
mac_address: { $first: '$src_mac' },
|
||||
agent_uuid: { $first: '$agent_uuid' }
|
||||
}},
|
||||
{ $sort: { download: -1 } }
|
||||
]);
|
||||
|
||||
// 1c. Aggregate top apps from Flow for accurate per-agent data
|
||||
const rawAppsFromFlow = await Flow.aggregate([
|
||||
{ $match: { agent_uuid: uuid, app_label: { $ne: null, $ne: '' } } },
|
||||
{ $group: {
|
||||
_id: '$app_label',
|
||||
download: { $sum: '$download' },
|
||||
upload: { $sum: '$upload' },
|
||||
flows: { $sum: 1 }
|
||||
}},
|
||||
{ $addFields: { total_bytes: { $add: ['$download', '$upload'] } } },
|
||||
{ $sort: { total_bytes: -1 } }
|
||||
]);
|
||||
|
||||
// 1d. Enrich apps with category and favicon from LookupApp
|
||||
const appLabels = rawAppsFromFlow.map(a => a._id);
|
||||
const lookups = await LookupApp.find({ label: { $in: appLabels } }).lean();
|
||||
const lookupMap = {};
|
||||
for (const app of lookups) {
|
||||
lookupMap[app.label] = {
|
||||
favicon: app.favicon || app.logo || null,
|
||||
category: app.application_category?.label || 'Web'
|
||||
};
|
||||
}
|
||||
|
||||
// 2. Map devices from Flow aggregation (already unique by src_ip)
|
||||
const devices = rawDevicesFromFlow
|
||||
.filter(d => d._id) // filter null IPs
|
||||
.map(d => {
|
||||
const ip = d._id;
|
||||
const mac = d.mac_address && d.mac_address !== '-' ? d.mac_address : generateMacFromIp(ip);
|
||||
const type = resolveDeviceTypeFromIp(ip);
|
||||
const os = resolveOSFromIp(ip);
|
||||
const man = resolveVendorFromIp(ip);
|
||||
const lastSeen = d.last_seen?.toISOString() || new Date().toISOString();
|
||||
const baseLabel = customLabelsMap[mac];
|
||||
const label = baseLabel && baseLabel !== '-' && baseLabel !== 'Unknown' && baseLabel !== 'Generic Client'
|
||||
? baseLabel
|
||||
: generateAutoLabel(ip, mac, man, type);
|
||||
|
||||
return {
|
||||
ip_address: ip,
|
||||
mac_address: mac,
|
||||
device_label: label,
|
||||
device_type: type,
|
||||
os_label: os,
|
||||
manufacturer: man,
|
||||
last_seen: lastSeen,
|
||||
agent_uuid: d.agent_uuid || uuid,
|
||||
download: d.download || 0,
|
||||
upload: d.upload || 0,
|
||||
flows: d.flows || 0,
|
||||
encrypted_pct: 85,
|
||||
risk_level: (d.download || 0) > 1024 * 1024 * 1024 ? 'medium' : 'safe',
|
||||
has_insecure: false
|
||||
};
|
||||
});
|
||||
|
||||
// 4. Map flows (no limit - Rule 10)
|
||||
const flows = rawFlows.map(f => ({
|
||||
flow_id: f.flow_id || f._id.toString(),
|
||||
src_ip: f.src_ip,
|
||||
dst_ip: f.dst_ip,
|
||||
dst_port: f.dst_port,
|
||||
protocol: f.protocol,
|
||||
app_label: f.app_label || 'Other',
|
||||
domain: f.domain || null,
|
||||
download: f.download || 0,
|
||||
upload: f.upload || 0,
|
||||
last_seen: f.last_seen || f.timestamp?.toISOString() || null
|
||||
}));
|
||||
|
||||
// 5. Map top apps from Flow aggregation (already sorted by total_bytes)
|
||||
const top_apps = rawAppsFromFlow.map((a, index) => ({
|
||||
app_id: index + 1,
|
||||
app_label: a._id,
|
||||
category: lookupMap[a._id]?.category || 'Web',
|
||||
favicon: lookupMap[a._id]?.favicon || null,
|
||||
download: a.download || 0,
|
||||
upload: a.upload || 0,
|
||||
total_bytes: a.total_bytes || 0,
|
||||
flows: a.flows || 0
|
||||
}));
|
||||
|
||||
// 6. Map real events (no limit - Rule 10)
|
||||
const events = rawEvents.map(e => ({
|
||||
event_id: e._id.toString(),
|
||||
event_type: e.event_type || e.threat_type || 'Discovery',
|
||||
severity: e.severity,
|
||||
ip_address: e.ip_address || e.source_ip,
|
||||
mac_address: e.mac_address || generateMacFromIp(e.ip_address || e.source_ip),
|
||||
description: e.message || e.description,
|
||||
event_at: e.timestamp?.toISOString() || null,
|
||||
}));
|
||||
|
||||
// 7. Map MAC Bandwidth (calculate from deduplicated active devices)
|
||||
const macMap = {};
|
||||
devices.forEach(d => {
|
||||
const mac = d.mac_address;
|
||||
if (!mac) return;
|
||||
if (!macMap[mac]) {
|
||||
macMap[mac] = {
|
||||
mac_address: mac,
|
||||
manufacturer: d.manufacturer || 'Unknown',
|
||||
download: 0,
|
||||
upload: 0
|
||||
};
|
||||
}
|
||||
macMap[mac].download += d.download;
|
||||
macMap[mac].upload += d.upload;
|
||||
});
|
||||
const mac_bandwidth = Object.values(macMap).map((m) => ({
|
||||
...m,
|
||||
total: m.download + m.upload
|
||||
})).sort((a, b) => b.total - a.total);
|
||||
|
||||
// 8. Map Security Tab (real threat data - Rule 8)
|
||||
const encryption_audit = devices.map(d => ({
|
||||
ip_address: d.ip_address,
|
||||
mac_address: d.mac_address,
|
||||
device_label: d.device_label,
|
||||
encrypted_pct: d.encrypted_pct,
|
||||
unencrypted: Math.floor(d.download * 0.15),
|
||||
encrypted: Math.floor(d.download * 0.85),
|
||||
total: d.download + d.upload,
|
||||
risk_level: d.risk_level,
|
||||
detected_at: d.last_seen
|
||||
}));
|
||||
|
||||
const security = {
|
||||
encryption_audit,
|
||||
...parseAgentSecurity(rawThreats)
|
||||
};
|
||||
|
||||
// 9. Server Discovery
|
||||
const server_discovery = [];
|
||||
|
||||
const userQuery = { agent_uuid: uuid, role: 'AGENT_VIEWER' };
|
||||
const isGlobalUser = req.user?.role === 'SUPER_ADMIN' ||
|
||||
((!req.user?.site_uuid || req.user?.site_uuid === 'default') && ['SOC_ANALYST', 'ENGINEER'].includes(req.user?.role));
|
||||
if (!isGlobalUser && req.user?.site_uuid) {
|
||||
userQuery.site_uuid = req.user.site_uuid;
|
||||
}
|
||||
|
||||
const agentUser = await User.findOne(userQuery);
|
||||
const agent_label = agentUser?.account_name || uuid;
|
||||
|
||||
const devicesDl = devices.reduce((sum, d) => sum + d.download, 0);
|
||||
const devicesUl = devices.reduce((sum, d) => sum + d.upload, 0);
|
||||
const appsDl = top_apps.reduce((sum, a) => sum + a.download, 0);
|
||||
const appsUl = top_apps.reduce((sum, a) => sum + a.upload, 0);
|
||||
|
||||
const summaryDl = Math.max(latestSummary?.bandwidth_down || 0, devicesDl, appsDl);
|
||||
const summaryUl = Math.max(latestSummary?.bandwidth_up || 0, devicesUl, appsUl);
|
||||
|
||||
res.json({
|
||||
ok: true,
|
||||
data: {
|
||||
agent_uuid: uuid,
|
||||
agent_label,
|
||||
summary: {
|
||||
total_devices: devices.length,
|
||||
active_flows: latestSummary?.active_flows || flows.length,
|
||||
bandwidth_down: summaryDl,
|
||||
bandwidth_up: summaryUl,
|
||||
},
|
||||
devices,
|
||||
flows,
|
||||
top_apps,
|
||||
security,
|
||||
events,
|
||||
mac_bandwidth,
|
||||
server_discovery
|
||||
}
|
||||
});
|
||||
} catch (err) {
|
||||
res.status(500).json({ ok: false, message: err.message });
|
||||
}
|
||||
};
|
||||
Reference in new issue
Block a user