vanne
26179a0270
- Add DeviceDetailModal with 8 tabs (Info, Flows, Apps, Encryption, Servers, Password Leaks, IP Reputation, VPN & Events) - Make device cards in AgentDetailModal clickable (nested modal drill-down) - Expand fetchDeviceDetails backend to query all 10 correlated tables (devices, flows, intel_device_discovery, intel_encryption_audit, intel_server_discovery, intel_unencrypted_passwords, intel_ip_reputation, intel_vpn_detection, events, mac_bandwidth) - Smart combined app/domain display: prioritize actual domain names over port-only labels (Port 443 -> scontent.fcgk42-1.fna.fbcdn.net) - Update Flows tab: domain shown in teal monospace, protocols in purple, port-only entries muted - Add 10 new TypeScript interfaces for device detail data types - Add MAC address fallback queries (by MAC when IP yields no results) - Fix fmtBytes for very large values
2741 lines
112 KiB
JavaScript
2741 lines
112 KiB
JavaScript
// backend/netify.js
|
|
const path = require('path');
|
|
require('dotenv').config({ path: path.join(__dirname, '..', '.env.local') });
|
|
const axios = require('axios');
|
|
|
|
const BASE_URL = 'https://informatics.netify.ai/api/v1';
|
|
const JWT_TOKEN = process.env.NETIFY_JWT_TOKEN;
|
|
const SITE_UUID = process.env.NETIFY_SITE_UUID;
|
|
|
|
function headersSite(useApiKey = false) {
|
|
const token = process.env.NETIFY_API_KEY || JWT_TOKEN;
|
|
const headers = { 'x-api-key': token, 'Accept': 'application/json' };
|
|
if (SITE_UUID) {
|
|
headers['x-net-site'] = SITE_UUID;
|
|
}
|
|
return headers;
|
|
}
|
|
|
|
function getMockDataForPath(path, params = {}) {
|
|
if (path.includes('/data/stats/top/application/download')) {
|
|
return [
|
|
{ application: { id: 1, label: 'YouTube', tag: 'video', category: { label: 'Streaming' } }, download: Math.floor(Math.random() * 50000000) + 10000000, flows: Math.floor(Math.random() * 200) + 50 },
|
|
{ application: { id: 2, label: 'Netflix', tag: 'video', category: { label: 'Streaming' } }, download: Math.floor(Math.random() * 40000000) + 8000000, flows: Math.floor(Math.random() * 100) + 30 },
|
|
{ application: { id: 3, label: 'Web Browsing', tag: 'web', category: { label: 'General' } }, download: Math.floor(Math.random() * 30000000) + 5000000, flows: Math.floor(Math.random() * 500) + 200 },
|
|
{ application: { id: 4, label: 'Google Services', tag: 'google', category: { label: 'Tech' } }, download: Math.floor(Math.random() * 25000000) + 4000000, flows: Math.floor(Math.random() * 400) + 150 },
|
|
{ application: { id: 5, label: 'WhatsApp', tag: 'im', category: { label: 'Chat' } }, download: Math.floor(Math.random() * 15000000) + 2000000, flows: Math.floor(Math.random() * 300) + 100 },
|
|
{ application: { id: 6, label: 'Spotify', tag: 'music', category: { label: 'Streaming' } }, download: Math.floor(Math.random() * 12000000) + 1000000, flows: Math.floor(Math.random() * 80) + 20 },
|
|
{ application: { id: 7, label: 'GitHub', tag: 'developer', category: { label: 'General' } }, download: Math.floor(Math.random() * 8000000) + 500000, flows: Math.floor(Math.random() * 120) + 40 },
|
|
{ application: { id: 8, label: 'OpenVPN', tag: 'vpn', category: { label: 'Security' } }, download: Math.floor(Math.random() * 5000000) + 300000, flows: Math.floor(Math.random() * 50) + 10 },
|
|
{ application: { id: 9, label: 'BitTorrent', tag: 'p2p', category: { label: 'File Sharing' } }, download: Math.floor(Math.random() * 20000000) + 500000, flows: Math.floor(Math.random() * 300) + 50 }
|
|
];
|
|
}
|
|
if (path.includes('/data/stats/top/application/upload')) {
|
|
return [
|
|
{ application: { id: 1 }, upload: Math.floor(Math.random() * 5000000) + 1000000 },
|
|
{ application: { id: 2 }, upload: Math.floor(Math.random() * 2000000) + 500000 },
|
|
{ application: { id: 3 }, upload: Math.floor(Math.random() * 6000000) + 2000000 },
|
|
{ application: { id: 4 }, upload: Math.floor(Math.random() * 4000000) + 1000000 },
|
|
{ application: { id: 5 }, upload: Math.floor(Math.random() * 8000000) + 3000000 },
|
|
{ application: { id: 6 }, upload: Math.floor(Math.random() * 1000000) + 200000 },
|
|
{ application: { id: 7 }, upload: Math.floor(Math.random() * 3000000) + 800000 },
|
|
{ application: { id: 8 }, upload: Math.floor(Math.random() * 4000000) + 1000000 },
|
|
{ application: { id: 9 }, upload: Math.floor(Math.random() * 18000000) + 2000000 }
|
|
];
|
|
}
|
|
if (path.includes('/intelligence/discovery/devices')) {
|
|
return [
|
|
{ ip: { address: '192.168.1.10' }, mac_address: 'E4:5F:01:23:45:67', mac_vendor: 'Raspberry Pi', device: { label: 'Home Server' }, discovery_type: { label: 'Server' }, discovery_os: { label: 'Linux' }, last_seen_at: { date: new Date().toISOString() } },
|
|
{ ip: { address: '192.168.1.25' }, mac_address: 'B4:FB:E4:88:99:AA', mac_vendor: 'Samsung', device: { label: 'Smart TV' }, discovery_type: { label: 'TV' }, discovery_os: { label: 'Tizen' }, last_seen_at: { date: new Date().toISOString() } },
|
|
{ ip: { address: '192.168.1.100' }, mac_address: '3C:28:6D:AA:BB:CC', mac_vendor: 'Apple', device: { label: 'iPhone User' }, discovery_type: { label: 'Mobile' }, discovery_os: { label: 'iOS' }, last_seen_at: { date: new Date().toISOString() } },
|
|
{ ip: { address: '192.168.1.101' }, mac_address: '28:31:52:DD:EE:FF', mac_vendor: 'Xiaomi', device: { label: 'Redmi Phone' }, discovery_type: { label: 'Mobile' }, discovery_os: { label: 'Android' }, last_seen_at: { date: new Date().toISOString() } },
|
|
{ ip: { address: '192.168.1.102' }, mac_address: '00:15:5D:11:22:33', mac_vendor: 'Microsoft Hyper-V', device: { label: 'Windows PC' }, discovery_type: { label: 'Desktop' }, discovery_os: { label: 'Windows' }, last_seen_at: { date: new Date().toISOString() } }
|
|
];
|
|
}
|
|
if (path.includes('/data/stats/top/local_ip/download')) {
|
|
return [
|
|
{ local_ip: { address: '192.168.1.100' }, download: Math.floor(Math.random() * 40000000) + 10000000 },
|
|
{ local_ip: { address: '192.168.1.102' }, download: Math.floor(Math.random() * 30000000) + 8000000 },
|
|
{ local_ip: { address: '192.168.1.101' }, download: Math.floor(Math.random() * 15000000) + 3000000 },
|
|
{ local_ip: { address: '192.168.1.25' }, download: Math.floor(Math.random() * 25000000) + 5000000 },
|
|
{ local_ip: { address: '192.168.1.10' }, download: Math.floor(Math.random() * 8000000) + 2000000 }
|
|
];
|
|
}
|
|
if (path.includes('/data/stats/top/local_ip/upload')) {
|
|
return [
|
|
{ local_ip: { address: '192.168.1.100' }, upload: Math.floor(Math.random() * 5000000) + 1000000 },
|
|
{ local_ip: { address: '192.168.1.102' }, upload: Math.floor(Math.random() * 8000000) + 2000000 },
|
|
{ local_ip: { address: '192.168.1.101' }, upload: Math.floor(Math.random() * 2000000) + 500000 },
|
|
{ local_ip: { address: '192.168.1.25' }, upload: Math.floor(Math.random() * 1000000) + 100000 },
|
|
{ local_ip: { address: '192.168.1.10' }, upload: Math.floor(Math.random() * 4000000) + 1000000 }
|
|
];
|
|
}
|
|
if (path.includes('/data/stats/top/protocol/download')) {
|
|
return [
|
|
{ protocol: { id: 6, label: 'TCP' }, download: Math.floor(Math.random() * 100000000) + 40000000, flows: Math.floor(Math.random() * 1000) + 400 },
|
|
{ protocol: { id: 17, label: 'UDP' }, download: Math.floor(Math.random() * 30000000) + 10000000, flows: Math.floor(Math.random() * 800) + 200 }
|
|
];
|
|
}
|
|
if (path.includes('/data/stats/top/protocol/upload')) {
|
|
return [
|
|
{ protocol: { id: 6 }, upload: Math.floor(Math.random() * 20000000) + 5000000 },
|
|
{ protocol: { id: 17 }, upload: Math.floor(Math.random() * 10000000) + 2000000 }
|
|
];
|
|
}
|
|
if (path.includes('/data/stats/top/country/download')) {
|
|
return [
|
|
{ country: { code: 'US', label: 'United States' }, download: Math.floor(Math.random() * 60000000) + 20000000, flows: Math.floor(Math.random() * 500) + 200 },
|
|
{ country: { code: 'SG', label: 'Singapore' }, download: Math.floor(Math.random() * 40000000) + 10000000, flows: Math.floor(Math.random() * 300) + 100 },
|
|
{ country: { code: 'ID', label: 'Indonesia' }, download: Math.floor(Math.random() * 20000000) + 5000000, flows: Math.floor(Math.random() * 400) + 150 },
|
|
{ country: { code: 'NL', label: 'Netherlands' }, download: Math.floor(Math.random() * 10000000) + 2000000, flows: Math.floor(Math.random() * 100) + 30 }
|
|
];
|
|
}
|
|
if (path.includes('/data/stats/top/country/upload')) {
|
|
return [
|
|
{ country: { code: 'US' }, upload: Math.floor(Math.random() * 12000000) + 3000000 },
|
|
{ country: { code: 'SG' }, upload: Math.floor(Math.random() * 8000000) + 2000000 },
|
|
{ country: { code: 'ID' }, upload: Math.floor(Math.random() * 4000000) + 1000000 },
|
|
{ country: { code: 'NL' }, upload: Math.floor(Math.random() * 2000000) + 500000 }
|
|
];
|
|
}
|
|
if (path.includes('/data/stats/top/hostname/download')) {
|
|
return [
|
|
{ hostname: { name: 'youtube.com', application_name: 'YouTube', application_category_label: 'Streaming' }, download: Math.floor(Math.random() * 30000000) + 10000000, flows: Math.floor(Math.random() * 100) + 20 },
|
|
{ hostname: { name: 'netflix.com', application_name: 'Netflix', application_category_label: 'Streaming' }, download: Math.floor(Math.random() * 20000000) + 5000000, flows: Math.floor(Math.random() * 50) + 10 },
|
|
{ hostname: { name: 'google.com', application_name: 'Google', application_category_label: 'Web' }, download: Math.floor(Math.random() * 15000000) + 3000000, flows: Math.floor(Math.random() * 400) + 100 },
|
|
{ hostname: { name: 'github.com', application_name: 'GitHub', application_category_label: 'Web' }, download: Math.floor(Math.random() * 8000000) + 2000000, flows: Math.floor(Math.random() * 150) + 30 }
|
|
];
|
|
}
|
|
if (path.includes('/data/stats/top/hostname/upload')) {
|
|
return [
|
|
{ hostname: { name: 'youtube.com' }, upload: Math.floor(Math.random() * 2000000) + 500000 },
|
|
{ hostname: { name: 'netflix.com' }, upload: Math.floor(Math.random() * 1000000) + 200000 },
|
|
{ hostname: { name: 'google.com' }, upload: Math.floor(Math.random() * 3000000) + 500000 },
|
|
{ hostname: { name: 'github.com' }, upload: Math.floor(Math.random() * 2000000) + 400000 }
|
|
];
|
|
}
|
|
if (path.includes('/data/flows')) {
|
|
return [
|
|
{ flow_id: 'flow_1', local_ip: { address: '192.168.1.100' }, local_mac: '3C:28:6D:AA:BB:CC', remote_ip: { address: '172.217.194.95' }, remote_port: 443, ip_protocol: { label: 'TCP' }, download: Math.floor(Math.random() * 50000) + 5000, upload: Math.floor(Math.random() * 5000) + 500, first_seen_at: { date: new Date(Date.now() - 300000).toISOString() }, last_seen_at: { date: new Date().toISOString() } },
|
|
{ flow_id: 'flow_2', local_ip: { address: '192.168.1.102' }, local_mac: '00:15:5D:11:22:33', remote_ip: { address: '140.82.112.4' }, remote_port: 443, ip_protocol: { label: 'TCP' }, download: Math.floor(Math.random() * 20000) + 2000, upload: Math.floor(Math.random() * 10000) + 1000, first_seen_at: { date: new Date(Date.now() - 600000).toISOString() }, last_seen_at: { date: new Date().toISOString() } },
|
|
{ flow_id: 'flow_3', local_ip: { address: '192.168.1.101' }, local_mac: '28:31:52:DD:EE:FF', remote_ip: { address: '31.13.78.35' }, remote_port: 443, ip_protocol: { label: 'TCP' }, download: Math.floor(Math.random() * 15000) + 1000, upload: Math.floor(Math.random() * 2000) + 200, first_seen_at: { date: new Date(Date.now() - 120000).toISOString() }, last_seen_at: { date: new Date().toISOString() } },
|
|
{ flow_id: 'flow_4', local_ip: { address: '192.168.1.10' }, local_mac: 'E4:5F:01:23:45:67', remote_ip: { address: '8.8.8.8' }, remote_port: 53, ip_protocol: { label: 'UDP' }, download: Math.floor(Math.random() * 2000) + 200, upload: Math.floor(Math.random() * 2000) + 200, first_seen_at: { date: new Date(Date.now() - 50000).toISOString() }, last_seen_at: { date: new Date().toISOString() } }
|
|
];
|
|
}
|
|
if (path.includes('/event/events')) {
|
|
return [
|
|
{ id: Math.floor(Math.random() * 10000), basename: 'threat.cryptomining', severity: 30, label: 'Suspicious Cryptomining Activity', description: JSON.stringify({ default: 'Connection to mining pool detected from {{ device_ip }}', tags: { device_ip: '192.168.1.10' } }), created_at: { date: new Date().toISOString() } },
|
|
{ id: Math.floor(Math.random() * 10000), basename: 'threat.insecure', severity: 20, label: 'Insecure Cleartext Transmission', description: JSON.stringify({ default: 'Cleartext credentials transmitted by {{ device_ip }}', tags: { device_ip: '192.168.1.102' } }), created_at: { date: new Date(Date.now() - 300000).toISOString() } },
|
|
{ id: Math.floor(Math.random() * 10000), basename: 'new.device', severity: 10, label: 'New Device Discovered', description: JSON.stringify({ default: 'New device {{ device_label }} discovered at {{ device_ip }}', tags: { device_label: 'Redmi Phone', device_ip: '192.168.1.101' } }), created_at: { date: new Date(Date.now() - 600000).toISOString() } }
|
|
];
|
|
}
|
|
|
|
if (path.includes('/data/stats/top/')) {
|
|
const segments = path.split('/');
|
|
const fieldName = segments[segments.length - 2];
|
|
const direction = segments[segments.length - 1];
|
|
|
|
if (fieldName === 'application_category') {
|
|
const cats = ['Streaming', 'Social Media', 'Web Browsing', 'File Sharing', 'Communication', 'Collaboration', 'Security'];
|
|
return cats.map((c) => ({
|
|
application_category: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 40000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 10000000) + 1000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'continent') {
|
|
const conts = ['North America', 'Asia', 'Europe', 'Oceania'];
|
|
return conts.map((c) => ({
|
|
continent: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 50000000) + 10000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 15000000) + 2000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'region') {
|
|
const regs = ['California', 'Singapore Region', 'Jakarta Region', 'Frankfurt Region'];
|
|
return regs.map((c) => ({
|
|
region: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 30000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 10000000) + 1000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'city') {
|
|
const cities = ['San Francisco', 'Singapore', 'Jakarta', 'Frankfurt'];
|
|
return cities.map((c) => ({
|
|
city: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 30000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 10000000) + 1000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'vlan') {
|
|
const vlans = ['VLAN 1 (Default)', 'VLAN 10 (IoT)', 'VLAN 20 (Guest)'];
|
|
return vlans.map((c) => ({
|
|
vlan: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 50000000) + 10000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 15000000) + 2000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'interface') {
|
|
const ifaces = ['eth0 (WAN)', 'eth1 (LAN)', 'wlan0 (WiFi)'];
|
|
return ifaces.map((c) => ({
|
|
interface: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 60000000) + 10000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 20000000) + 2000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'flow_type') {
|
|
const types = ['HTTP/HTTPS', 'DNS', 'SSH', 'VPN', 'P2P'];
|
|
return types.map((c) => ({
|
|
flow_type: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 40000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 10000000) + 1000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'flow_origin') {
|
|
const origs = ['Local LAN', 'Inbound WAN'];
|
|
return origs.map((c) => ({
|
|
flow_origin: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 50000000) + 10000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 15000000) + 2000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'ip_version') {
|
|
const versions = ['IPv4', 'IPv6'];
|
|
return versions.map((c) => ({
|
|
ip_version: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 80000000) + 20000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 25000000) + 5000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'remote_ip') {
|
|
const ips = ['8.8.8.8', '1.1.1.1', '140.82.112.4', '172.217.194.95'];
|
|
return ips.map((c) => ({
|
|
remote_ip: { address: c, version: 4 },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 20000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 5000000) + 500000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'local_mac') {
|
|
const macs = ['3C:28:6D:AA:BB:CC', '00:15:5D:11:22:33', '28:31:52:DD:EE:FF', 'E4:5F:01:23:45:67'];
|
|
return macs.map((c) => ({
|
|
local_mac: c,
|
|
download: direction === 'download' ? Math.floor(Math.random() * 30000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 10000000) + 1000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'discovery_os') {
|
|
const oss = ['iOS', 'Android', 'Windows', 'Linux', 'macOS'];
|
|
return oss.map((c) => ({
|
|
discovery_os: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 30000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 10000000) + 1000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'tls_version') {
|
|
const vers = ['TLS 1.3', 'TLS 1.2', 'TLS 1.1'];
|
|
return vers.map((c) => ({
|
|
tls_version: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 50000000) + 10000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 15000000) + 2000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'tls_cipher') {
|
|
const ciphers = ['TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256', 'ECDHE-RSA-AES128-GCM-SHA256'];
|
|
return ciphers.map((c) => ({
|
|
tls_cipher: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 40000000) + 10000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 12000000) + 2000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'tls_security') {
|
|
const secs = ['Modern (TLS 1.3)', 'Secure (TLS 1.2)', 'Weak'];
|
|
return secs.map((c) => ({
|
|
tls_security: { name: c, label: c, color: c === 'Weak' ? 'red' : 'green' },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 40000000) + 10000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 12000000) + 2000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'netbios_hostname') {
|
|
const hosts = ['DESKTOP-PC', 'NAS-SERVER', 'PRINTER-OFFICE'];
|
|
return hosts.map((c) => ({
|
|
netbios_hostname: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 10000000) + 2000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 4000000) + 500000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'dhcp_class') {
|
|
const classes = ['dhcpcd-9.4.1', 'MSFT 5.0', 'android-dhcp-10'];
|
|
return classes.map((c) => ({
|
|
dhcp_class: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 20000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 5000000) + 1000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'http_useragent') {
|
|
const uas = [
|
|
'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
|
|
'Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1',
|
|
'Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36'
|
|
];
|
|
return uas.map((c) => ({
|
|
http_useragent: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 30000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 10000000) + 1000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'https_sni_hostname') {
|
|
const snis = ['*.google.com', '*.netflix.com', 'github.com', '*.facebook.com'];
|
|
return snis.map((c) => ({
|
|
https_sni_hostname: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 30000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 10000000) + 1000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'ssl_server_cn') {
|
|
const cns = ['Google Internet Authority', 'DigiCert TLS RSA SHA256 2020 CA1', 'Let\'s Encrypt Authority X3'];
|
|
return cns.map((c) => ({
|
|
ssl_server_cn: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 40000000) + 10000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 12000000) + 2000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'quic_hostname') {
|
|
const quics = ['*.google.com', '*.youtube.com', 'instagram.com'];
|
|
return quics.map((c) => ({
|
|
quic_hostname: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 30000000) + 5000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 10000000) + 1000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'bittorrent_info_hash') {
|
|
const hashes = ['8f9e1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f', '1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9e1a'];
|
|
return hashes.map((c, i) => ({
|
|
bittorrent_info_hash: { hash: c, label: `Torrent_${i+1}` },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 10000000) + 2000000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 10000000) + 2000000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'ssh_client') {
|
|
const clients = ['SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5', 'SSH-2.0-PuTTY_Release_0.76'];
|
|
return clients.map((c) => ({
|
|
ssh_client: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 1000000) + 100000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 500000) + 50000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'ssh_server') {
|
|
const servers = ['SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5', 'SSH-2.0-dropbear_2019.78'];
|
|
return servers.map((c) => ({
|
|
ssh_server: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 1000000) + 100000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 500000) + 50000 : 0
|
|
}));
|
|
}
|
|
if (fieldName === 'mdns_hostname') {
|
|
const mdns = ['apple-tv.local', 'printer-office.local', 'nas-home.local'];
|
|
return mdns.map((c) => ({
|
|
mdns_hostname: { name: c, label: c },
|
|
download: direction === 'download' ? Math.floor(Math.random() * 5000000) + 500000 : 0,
|
|
upload: direction === 'upload' ? Math.floor(Math.random() * 2000000) + 200000 : 0
|
|
}));
|
|
}
|
|
}
|
|
return [];
|
|
}
|
|
|
|
async function netifyFetch(path, params = {}, useApiKey = false) {
|
|
if (!JWT_TOKEN || !SITE_UUID || JWT_TOKEN === 'YOUR_JWT_TOKEN' || SITE_UUID === 'YOUR_SITE_UUID' || JWT_TOKEN.startsWith('change_me') || JWT_TOKEN.startsWith('YOUR_')) {
|
|
return getMockDataForPath(path, params);
|
|
}
|
|
try {
|
|
const res = await axios.get(`${BASE_URL}${path}`, {
|
|
headers: headersSite(useApiKey), params, timeout: 30000,
|
|
});
|
|
const json = res.data;
|
|
if (json?.status_code !== 0) {
|
|
console.error(`[Netify] API Error ${json?.status_code} pada ${path}: ${json?.status_message}`);
|
|
return getMockDataForPath(path, params);
|
|
}
|
|
return json?.data ?? null;
|
|
} catch (err) {
|
|
const s = err.response?.status;
|
|
const msg = JSON.stringify(err.response?.data ?? err.message);
|
|
console.error(`[Netify] ${s ?? 'ERR'} ${path}: ${msg}. Falling back to mock data.`);
|
|
return getMockDataForPath(path, params);
|
|
}
|
|
}
|
|
|
|
// ─── TOP APPS: download + upload digabung ─────────────────────────────────────
|
|
async function fetchTopApps(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/application/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
|
|
// Buat map upload berdasarkan app_id
|
|
const ulMap = {};
|
|
if (ulData) {
|
|
for (const r of ulData) {
|
|
const id = r.application?.id;
|
|
if (id) ulMap[id] = r.upload ?? 0;
|
|
}
|
|
}
|
|
|
|
return dlData.map(r => ({
|
|
app_id : r.application?.id ?? null,
|
|
app_label : r.application?.label ?? 'Unknown',
|
|
app_tag : r.application?.tag ?? null,
|
|
category : r.application?.category?.label ?? null,
|
|
favicon : r.application?.favicon ?? null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.application?.id] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[r.application?.id] ?? 0),
|
|
flows : r.flows ?? 0,
|
|
}));
|
|
}
|
|
|
|
// ─── TOP DEVICES: download + upload digabung ──────────────────────────────────
|
|
async function fetchTopDevices(interval = 1440, limit = 50) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/local_ip/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/local_ip/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
|
|
// Map upload berdasarkan IP address
|
|
const ulMap = {};
|
|
if (ulData) {
|
|
for (const r of ulData) {
|
|
const ip = r.local_ip?.address ?? String(r.local_ip);
|
|
ulMap[ip] = r.upload ?? 0;
|
|
}
|
|
}
|
|
|
|
return dlData.map(r => {
|
|
const ip = r.local_ip?.address ?? String(r.local_ip ?? '');
|
|
return {
|
|
ip_address : ip,
|
|
mac_address : null,
|
|
device_label : ip,
|
|
device_type : null,
|
|
os_label : null,
|
|
manufacturer : null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[ip] ?? 0,
|
|
last_seen : null,
|
|
};
|
|
});
|
|
}
|
|
|
|
// ─── PORT-TO-SERVICE MAPPING — untuk enrichment flows ────────────────────────
|
|
const PORT_SERVICE_MAP = {
|
|
80: 'HTTP', 443: 'HTTPS / TLS', 8080: 'HTTP Alt', 8443: 'HTTPS Alt',
|
|
53: 'DNS', 5353: 'mDNS', 853: 'DNS-over-TLS',
|
|
25: 'SMTP', 587: 'SMTP TLS', 465: 'SMTPS', 110: 'POP3', 143: 'IMAP',
|
|
22: 'SSH', 23: 'Telnet', 3389: 'RDP', 5900: 'VNC',
|
|
21: 'FTP', 20: 'FTP Data', 989: 'FTPS', 990: 'FTPS Control',
|
|
3306: 'MySQL', 5432: 'PostgreSQL', 6379: 'Redis', 27017: 'MongoDB',
|
|
1194: 'OpenVPN', 51820: 'WireGuard', 500: 'IPSec IKE', 4500: 'IPSec NAT-T',
|
|
1723: 'PPTP', 1701: 'L2TP',
|
|
67: 'DHCP', 68: 'DHCP Client', 123: 'NTP',
|
|
161: 'SNMP', 162: 'SNMP Trap', 514: 'Syslog',
|
|
6881: 'BitTorrent', 6882: 'BitTorrent', 6883: 'BitTorrent',
|
|
9993: 'ZeroTier VPN', 3478: 'STUN/TURN', 5004: 'RTP Media',
|
|
5060: 'SIP', 5061: 'SIP TLS',
|
|
8883: 'MQTT TLS', 1883: 'MQTT',
|
|
179: 'BGP', 520: 'RIP',
|
|
};
|
|
|
|
// ─── FLOWS: endpoint /data/flows dengan enrichment app/domain ─────────────────
|
|
// NOTE: API flows tidak punya field app/domain — enrichment dilakukan via:
|
|
// 1. PORT_SERVICE_MAP (reliable, berdasarkan dst port)
|
|
// 2. tls_sni field (satu-satunya SNI field valid, tapi nilai sering kosong)
|
|
async function fetchFlows(limit = 500) {
|
|
// Hanya fetch flows + tls_sni (satu-satunya SNI field yang valid = bukan 422)
|
|
const [raw, tslSniRaw] = await Promise.all([
|
|
netifyFetch('/data/flows', { settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/tls_sni/download', { filter_interval: 1440, settings_limit: 50 }),
|
|
]);
|
|
|
|
if (!raw || !Array.isArray(raw)) return null;
|
|
|
|
// Build TLS SNI lookup — filter yang tidak kosong
|
|
const sniList = [];
|
|
if (tslSniRaw && Array.isArray(tslSniRaw)) {
|
|
for (const r of tslSniRaw) {
|
|
const sni = r.tls_sni;
|
|
if (sni && sni.trim() !== '') {
|
|
sniList.push(sni.replace(/^\*\./, '').trim());
|
|
}
|
|
}
|
|
}
|
|
|
|
return raw.map(r => {
|
|
const port = r.remote_port ?? null;
|
|
// Primary enrichment: port → service name
|
|
const portService = port ? (PORT_SERVICE_MAP[port] ?? `Port ${port}`) : null;
|
|
|
|
let domain = null;
|
|
let appLabel = portService;
|
|
|
|
// Secondary enrichment: for HTTPS flows, use SNI list if available
|
|
if ((port === 443 || port === 8443) && sniList.length > 0) {
|
|
domain = sniList[0];
|
|
}
|
|
|
|
return {
|
|
flow_id : String(r.flow_id ?? ''),
|
|
src_ip : r.local_ip?.address ?? null,
|
|
src_mac : r.local_mac ?? r.mac?.address ?? null,
|
|
dst_ip : r.remote_ip?.address ?? null,
|
|
dst_port : port,
|
|
protocol : r.ip_protocol?.label ?? null,
|
|
app_label : appLabel,
|
|
domain : domain,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
first_seen : r.first_seen_at?.date ?? null,
|
|
last_seen : r.last_seen_at?.date ?? null,
|
|
};
|
|
});
|
|
}
|
|
|
|
|
|
// ─── PROTOCOLS ────────────────────────────────────────────────────────────────
|
|
async function fetchTopProtocols(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/protocol/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/protocol/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
|
|
const ulMap = {};
|
|
if (ulData) {
|
|
for (const r of ulData) {
|
|
const id = r.protocol?.id;
|
|
if (id) ulMap[id] = r.upload ?? 0;
|
|
}
|
|
}
|
|
|
|
return dlData.map(r => ({
|
|
protocol_id : r.protocol?.id ?? null,
|
|
protocol_label : r.protocol?.label ?? 'Unknown',
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.protocol?.id] ?? 0,
|
|
flows : r.flows ?? 0,
|
|
}));
|
|
}
|
|
|
|
// ─── COUNTRIES ────────────────────────────────────────────────────────────────
|
|
async function fetchTopCountries(interval = 1440, limit = 15) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/country/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/country/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
|
|
const ulMap = {};
|
|
if (ulData) {
|
|
for (const r of ulData) {
|
|
const code = r.country?.code;
|
|
if (code) ulMap[code] = r.upload ?? 0;
|
|
}
|
|
}
|
|
|
|
return dlData.map(r => ({
|
|
country_code : r.country?.code ?? null,
|
|
country_name : r.country?.label ?? 'Unknown',
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.country?.code] ?? 0,
|
|
flows : r.flows ?? 0,
|
|
}));
|
|
}
|
|
|
|
// ─── DNS/HOSTNAME — gunakan tls_sni karena hostname endpoint timeout ──────────
|
|
async function fetchTopDomains(interval = 1440, limit = 50) {
|
|
// NOTE: /data/stats/top/hostname/download selalu timeout
|
|
// Gunakan tls_sni yang confirmed bekerja di API ini
|
|
const raw = await netifyFetch('/data/stats/top/tls_sni/download', {
|
|
filter_interval: interval, settings_limit: limit,
|
|
});
|
|
if (!raw) return null;
|
|
|
|
return raw
|
|
.filter(r => r.tls_sni && r.tls_sni.trim() !== '')
|
|
.map(r => ({
|
|
domain : r.tls_sni.replace(/^\*\./, '').trim(),
|
|
app_label : null,
|
|
category : 'HTTPS/TLS',
|
|
download : r.download ?? 0,
|
|
query_count : r.download ?? 0,
|
|
}));
|
|
}
|
|
|
|
|
|
// ─── BANDWIDTH SUMMARY untuk timeline ─────────────────────────────────────────
|
|
async function fetchBandwidthSummary(interval = 30) {
|
|
// Pakai interval PENDEK (30 menit) untuk timeline supaya ada variasi naik turun
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application/download', { filter_interval: interval, settings_limit: 100 }),
|
|
netifyFetch('/data/stats/top/application/upload', { filter_interval: interval, settings_limit: 100 }),
|
|
]);
|
|
|
|
const download = (dlData ?? []).reduce((s, r) => s + (r.download ?? 0), 0);
|
|
const upload = (ulData ?? []).reduce((s, r) => s + (r.upload ?? 0), 0);
|
|
const flows = (dlData ?? []).reduce((s, r) => s + (r.flows ?? 0), 0);
|
|
|
|
return { download, upload, flows, devices: dlData?.length ?? 0 };
|
|
}
|
|
|
|
// ─── THREATS — gunakan flows dengan filter anomali sebagai fallback ────────────
|
|
async function fetchCyberThreats(limit = 50) {
|
|
// Events/threats belum ada di v1 — return array kosong agar tidak error
|
|
// Akan diisi saat endpoint ditemukan
|
|
return [];
|
|
}
|
|
|
|
// ─── EVENTS ───────────────────────────────────────────────────────────────────
|
|
async function fetchEvents(limit = 50) {
|
|
const raw = await netifyFetch('/event/events', { settings_limit: limit });
|
|
if (!raw || !Array.isArray(raw)) return [];
|
|
|
|
return raw.map(r => {
|
|
let msg = r.label || '';
|
|
if (r.description) {
|
|
try {
|
|
const descObj = JSON.parse(r.description);
|
|
msg = descObj.default || r.label || '';
|
|
if (descObj.tags) {
|
|
for (const k in descObj.tags) {
|
|
const val = Array.isArray(descObj.tags[k]) ? descObj.tags[k][0] : descObj.tags[k];
|
|
msg = msg.replace(`{{ ${k} }}`, val).replace(`{{${k}}}`, val);
|
|
}
|
|
}
|
|
} catch (e) {
|
|
msg = r.description;
|
|
}
|
|
}
|
|
|
|
let sevLabel = 'Info';
|
|
if (r.severity >= 30) sevLabel = 'Critical';
|
|
else if (r.severity >= 20) sevLabel = 'High';
|
|
else if (r.severity >= 10) sevLabel = 'Warning';
|
|
|
|
let srcIp = null;
|
|
if (r.description) {
|
|
try {
|
|
const descObj = JSON.parse(r.description);
|
|
srcIp = descObj.tags?.device_ip || descObj.tags?.ip || null;
|
|
} catch {}
|
|
}
|
|
|
|
return {
|
|
event_id: r.id || null,
|
|
event_type: r.basename || 'unknown',
|
|
severity: sevLabel,
|
|
mac_address: r.additional?.device?.mac?.address || null,
|
|
ip_address: srcIp,
|
|
description: msg,
|
|
event_at: r.created_at?.date || new Date().toISOString()
|
|
};
|
|
});
|
|
}
|
|
|
|
async function fetchDiscoveredDevices(interval = 1440, limit = 500) {
|
|
// Ambil lebih banyak bandwidth data (limit x2) supaya coverage IP lebih luas
|
|
const [intelRaw, dlData, ulData, flowsRaw] = await Promise.all([
|
|
netifyFetch('/intelligence/discovery/devices', { settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/local_ip/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/local_ip/upload', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
]);
|
|
|
|
if (!intelRaw || !Array.isArray(intelRaw)) return [];
|
|
|
|
// Map bandwidth per IP
|
|
const dlMap = {};
|
|
const ulMap = {};
|
|
if (dlData) {
|
|
for (const r of dlData) {
|
|
const ip = r.local_ip?.address ?? String(r.local_ip);
|
|
if (ip) dlMap[ip] = r.download ?? 0;
|
|
}
|
|
}
|
|
if (ulData) {
|
|
for (const r of ulData) {
|
|
const ip = r.local_ip?.address ?? String(r.local_ip);
|
|
if (ip) ulMap[ip] = r.upload ?? 0;
|
|
}
|
|
}
|
|
|
|
// Enrich bandwidth from flows — aggregate per local_ip as fallback
|
|
// Bagi device yang IP-nya tidak ada di top stats (traffic kecil)
|
|
const dlFlowMap = {};
|
|
const ulFlowMap = {};
|
|
if (flowsRaw && Array.isArray(flowsRaw)) {
|
|
for (const f of flowsRaw) {
|
|
const ip = f.local_ip?.address;
|
|
if (!ip) continue;
|
|
if (!dlMap[ip]) {
|
|
dlFlowMap[ip] = (dlFlowMap[ip] ?? 0) + (f.download ?? 0);
|
|
}
|
|
if (!ulMap[ip]) {
|
|
ulFlowMap[ip] = (ulFlowMap[ip] ?? 0) + (f.upload ?? 0);
|
|
}
|
|
}
|
|
}
|
|
|
|
return intelRaw.map(r => {
|
|
const ip = r.ip?.address ?? null;
|
|
const mac = r.mac_address ?? r.discovery_mac?.address ?? null;
|
|
const oui = mac ? mac.substring(0, 8).toUpperCase() : null;
|
|
const mfr = r.mac_vendor !== 'Unknown' && r.mac_vendor !== 'Local' ? r.mac_vendor : (OUI_MAP[oui] ?? r.mac_vendor ?? null);
|
|
|
|
// Get device_type — prefer discovery_type if meaningful, else device_type
|
|
const rawType = r.discovery_type?.label;
|
|
const deviceType = (rawType && rawType !== 'Unknown' && rawType !== 'Unclassified')
|
|
? rawType
|
|
: (r.device_type?.label && r.device_type.label !== 'Unclassified' ? r.device_type.label : rawType ?? null);
|
|
|
|
// Get OS — prefer discovery_os if meaningful, else device_os
|
|
const rawOs = r.discovery_os?.label;
|
|
const osLabel = (rawOs && rawOs !== 'Unknown' && rawOs !== 'Unclassified')
|
|
? rawOs
|
|
: (r.device_os?.label && r.device_os.label !== 'Unclassified' ? r.device_os.label : rawOs ?? null);
|
|
|
|
// Bandwidth: prioritize top stats, fallback to flows aggregation
|
|
const dl = ip ? (dlMap[ip] ?? dlFlowMap[ip] ?? 0) : 0;
|
|
const ul = ip ? (ulMap[ip] ?? ulFlowMap[ip] ?? 0) : 0;
|
|
|
|
return {
|
|
ip_address : ip,
|
|
mac_address : mac,
|
|
device_label : r.device?.label || r.discovery_mac?.discovery_hardware || ip || 'Unknown',
|
|
device_type : deviceType,
|
|
os_label : osLabel,
|
|
manufacturer : mfr,
|
|
download : dl,
|
|
upload : ul,
|
|
last_seen : r.last_seen_at?.date || r.discovery_mac?.last_seen_at?.date || null,
|
|
};
|
|
}).sort((a, b) => (b.download + b.upload) - (a.download + a.upload));
|
|
}
|
|
|
|
// OUI lookup — manufacturer dari 3 oktet pertama MAC
|
|
const OUI_MAP = {
|
|
'60:BE:B4' : 'Ruckus Networks',
|
|
'74:6F:88' : 'Ruckus Networks',
|
|
'04:F4:1C' : 'MikroTik',
|
|
'F4:6D:3F' : 'TP-Link',
|
|
'B8:27:EB' : 'Raspberry Pi',
|
|
'DC:A6:32' : 'Raspberry Pi',
|
|
'E4:5F:01' : 'Raspberry Pi',
|
|
'00:50:56' : 'VMware',
|
|
'08:00:27' : 'VirtualBox',
|
|
'AC:17:02' : 'ASUSTek',
|
|
'B4:2E:99' : 'ASUSTek',
|
|
'18:31:BF' : 'ASUSTek',
|
|
'74:D0:2B' : 'Cisco',
|
|
'F8:72:EA' : 'Cisco',
|
|
'00:1A:A0' : 'Cisco',
|
|
'FC:FB:FB' : 'Cisco Meraki',
|
|
'88:15:44' : 'Cisco Meraki',
|
|
'00:18:0A' : 'Ubiquiti',
|
|
'04:18:D6' : 'Ubiquiti',
|
|
'24:A4:3C' : 'Ubiquiti',
|
|
'78:8A:20' : 'Ubiquiti',
|
|
'DC:9F:DB' : 'Ubiquiti',
|
|
'80:2A:A8' : 'Ubiquiti',
|
|
'FC:EC:DA' : 'Ubiquiti',
|
|
'00:27:22' : 'Ubiquiti',
|
|
'B4:FB:E4' : 'Samsung',
|
|
'8C:79:F0' : 'Samsung',
|
|
'F0:25:B7' : 'Samsung',
|
|
'78:BD:BC' : 'Samsung',
|
|
'3C:28:6D' : 'Apple',
|
|
'A4:C3:F0' : 'Apple',
|
|
'F8:FF:C2' : 'Apple',
|
|
'98:01:A7' : 'Apple',
|
|
'3C:22:FB' : 'Apple',
|
|
'F0:DB:F8' : 'Huawei',
|
|
'00:E0:FC' : 'Huawei',
|
|
'54:89:98' : 'Huawei',
|
|
'28:31:52' : 'Xiaomi',
|
|
'64:09:80' : 'Xiaomi',
|
|
'AC:C1:EE' : 'Xiaomi',
|
|
'50:64:2B' : 'Xiaomi',
|
|
'00:0C:29' : 'VMware',
|
|
'00:15:5D' : 'Microsoft Hyper-V',
|
|
'52:54:00' : 'QEMU/KVM',
|
|
};
|
|
|
|
// ─── TAMBAHAN FITUR 1-11 ──────────────────────────────────────────────────────
|
|
|
|
// 1. Top Application Category
|
|
async function fetchTopAppCategories(interval = 1440, limit = 15) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application_category/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/application_category/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.application_category?.label ?? r.application_category;
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.application_category?.label ?? String(r.application_category ?? 'Unknown');
|
|
return {
|
|
category_label : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 2. Top Continent
|
|
async function fetchTopContinents(interval = 1440, limit = 10) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/continent/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/continent/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.continent?.label ?? String(r.continent ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.continent?.label ?? String(r.continent ?? 'Unknown');
|
|
return {
|
|
continent_name : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 3. Top Region
|
|
async function fetchTopRegions(interval = 1440, limit = 20) {
|
|
const raw = await netifyFetch('/data/stats/top/region/download', {
|
|
filter_interval: interval, settings_limit: limit,
|
|
});
|
|
if (!raw) return null;
|
|
return raw.map(r => ({
|
|
region_name : r.region?.region_name?.trim() || '(Unknown Region)',
|
|
region_code : r.region?.region_code?.trim() || null,
|
|
country_name : r.region?.country_name ?? null,
|
|
country_code : r.region?.country_code ?? null,
|
|
download : r.download ?? 0,
|
|
}));
|
|
}
|
|
|
|
// 4. Top City
|
|
async function fetchTopCities(interval = 1440, limit = 20) {
|
|
const raw = await netifyFetch('/data/stats/top/city/download', {
|
|
filter_interval: interval, settings_limit: limit,
|
|
});
|
|
if (!raw) return null;
|
|
return raw.map(r => ({
|
|
city_name : r.city?.city?.trim() || '(Unknown City)',
|
|
region_name : r.city?.region_name?.trim() || null,
|
|
country_name : r.city?.country_name ?? null,
|
|
country_code : r.city?.country_code ?? null,
|
|
download : r.download ?? 0,
|
|
}));
|
|
}
|
|
|
|
// 5. Top VLAN
|
|
async function fetchTopVLANs(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/vlan/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/vlan/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.vlan?.id ?? 0;
|
|
ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => ({
|
|
vlan_id : r.vlan?.id ?? 0,
|
|
vlan_label : r.vlan?.label ?? `VLAN ${r.vlan?.id ?? 0}`,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.vlan?.id ?? 0] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[r.vlan?.id ?? 0] ?? 0),
|
|
}));
|
|
}
|
|
|
|
// 6. Top Interface
|
|
async function fetchTopInterfaces(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/interface/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/interface/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.interface?.id;
|
|
if (key !== undefined) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => ({
|
|
iface_id : r.interface?.id ?? null,
|
|
iface_name : r.interface?.name ?? 'Unknown',
|
|
iface_role : r.interface?.role ?? null,
|
|
agent_id : r.interface?.agent_id ?? null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.interface?.id] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[r.interface?.id] ?? 0),
|
|
}));
|
|
}
|
|
|
|
// 7. Top Flow Type
|
|
async function fetchTopFlowTypes(interval = 1440, limit = 10) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/flow_type/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/flow_type/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.flow_type?.label ?? String(r.flow_type ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.flow_type?.label ?? String(r.flow_type ?? 'Unknown');
|
|
return {
|
|
flow_type_label : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 8. Top Flow Origin
|
|
async function fetchTopFlowOrigins(interval = 1440, limit = 10) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/flow_origin/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/flow_origin/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.flow_origin?.label ?? String(r.flow_origin ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.flow_origin?.label ?? String(r.flow_origin ?? 'Unknown');
|
|
return {
|
|
flow_origin_label : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 9. Top IP Version
|
|
async function fetchTopIPVersions(interval = 1440, limit = 5) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/ip_version/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/ip_version/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.ip_version?.label ?? String(r.ip_version ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.ip_version?.label ?? String(r.ip_version ?? 'Unknown');
|
|
return {
|
|
ip_version_label : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 10. Top Remote IP
|
|
async function fetchTopRemoteIPs(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/remote_ip/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/remote_ip/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.remote_ip?.address ?? String(r.remote_ip ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const addr = r.remote_ip?.address ?? String(r.remote_ip ?? 'Unknown');
|
|
return {
|
|
remote_ip : addr,
|
|
ip_version : r.remote_ip?.version ?? null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[addr] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[addr] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 11. Top Local MAC + Discovery OS
|
|
async function fetchTopLocalMACs(interval = 1440, limit = 50) {
|
|
const [dlData, ulData, osData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/local_mac/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/local_mac/upload', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/discovery_os/download', { filter_interval: interval, settings_limit: 20 }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
if (r.local_mac) ulMap[r.local_mac] = r.upload ?? 0;
|
|
}
|
|
// OS summary untuk info panel
|
|
const osList = (osData ?? []).map(r => ({
|
|
os_label : r.discovery_os?.label ?? String(r.discovery_os ?? 'Unknown'),
|
|
download : r.download ?? 0,
|
|
}));
|
|
return dlData.map(r => {
|
|
const mac = r.local_mac ?? 'Unknown';
|
|
const oui = mac.substring(0, 8).toUpperCase();
|
|
return {
|
|
mac_address : mac,
|
|
manufacturer : OUI_MAP[oui] ?? null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[mac] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[mac] ?? 0),
|
|
_os_summary : osList, // disertakan di item pertama saja
|
|
};
|
|
});
|
|
}
|
|
|
|
// ─── DISCOVERY OS (standalone) ───────────────────────────────────────────────
|
|
async function fetchTopDiscoveryOS(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/discovery_os/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/discovery_os/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.discovery_os?.label ?? String(r.discovery_os ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.discovery_os?.label ?? String(r.discovery_os ?? 'Unknown');
|
|
return {
|
|
os_label : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// ─── DPI FIELDS ───────────────────────────────────────────────────────────────
|
|
|
|
// TLS Version
|
|
async function fetchTLSVersions(interval = 1440, limit = 10) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/tls_version/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/tls_version/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.tls_version?.label ?? String(r.tls_version ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.tls_version?.label ?? String(r.tls_version ?? 'Unknown');
|
|
return {
|
|
tls_version : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// TLS Cipher
|
|
async function fetchTLSCiphers(interval = 1440, limit = 15) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/tls_cipher/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/tls_cipher/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.tls_cipher?.label ?? String(r.tls_cipher ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.tls_cipher?.label ?? String(r.tls_cipher ?? 'Unknown');
|
|
return {
|
|
tls_cipher : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// TLS Security Level
|
|
async function fetchTLSSecurity(interval = 1440, limit = 10) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/tls_security/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/tls_security/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.tls_security?.label ?? String(r.tls_security ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.tls_security?.label ?? String(r.tls_security ?? 'Unknown');
|
|
// Assign warna berdasarkan label untuk UI
|
|
const color = label === 'Recommended' ? 'green'
|
|
: label === 'Secure' ? 'blue'
|
|
: label === 'Weak' ? 'orange'
|
|
: label === 'Insecure' ? 'red'
|
|
: 'gray';
|
|
return {
|
|
tls_security : label,
|
|
color : color,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// NetBIOS Hostname (nama PC Windows)
|
|
async function fetchNetBIOSHostnames(interval = 1440, limit = 30) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/netbios_hostname/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/netbios_hostname/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.netbios_hostname?.name ?? String(r.netbios_hostname ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const name = r.netbios_hostname?.name ?? String(r.netbios_hostname ?? 'Unknown');
|
|
return {
|
|
hostname : name,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[name] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[name] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
async function fetchLookupApplications(page = 1, limit = 50, search = '') {
|
|
if (!JWT_TOKEN || !SITE_UUID || JWT_TOKEN === 'YOUR_JWT_TOKEN' || SITE_UUID === 'YOUR_SITE_UUID' || JWT_TOKEN.startsWith('change_me') || JWT_TOKEN.startsWith('YOUR_')) {
|
|
return {
|
|
applications: [
|
|
{ id: 1, label: 'YouTube', tag: 'video', category: { label: 'Streaming' } },
|
|
{ id: 2, label: 'Netflix', tag: 'video', category: { label: 'Streaming' } },
|
|
{ id: 3, label: 'Web Browsing', tag: 'web', category: { label: 'General' } },
|
|
{ id: 4, label: 'Google Services', tag: 'google', category: { label: 'Tech' } },
|
|
{ id: 5, label: 'WhatsApp', tag: 'im', category: { label: 'Chat' } }
|
|
],
|
|
pagination: { total_records: 5, current_page: 1, total_pages: 1 }
|
|
};
|
|
}
|
|
const params = {
|
|
settings_page: page,
|
|
settings_limit: limit,
|
|
};
|
|
if (search) {
|
|
params.filter_application = search;
|
|
}
|
|
try {
|
|
const res = await axios.get(`${BASE_URL}/lookup/applications`, {
|
|
headers: headersSite(true), params, timeout: 30000,
|
|
});
|
|
const json = res.data;
|
|
if (json?.status_code !== 0) {
|
|
console.error(`[Netify] API Error ${json?.status_code}: ${json?.status_message}`);
|
|
return { applications: [], pagination: {} };
|
|
}
|
|
return {
|
|
applications: json.data || [],
|
|
pagination: json.data_info || {}
|
|
};
|
|
} catch (err) {
|
|
console.error('[Netify] Lookup error:', err.message);
|
|
return { applications: [], pagination: {} };
|
|
}
|
|
}
|
|
|
|
// ─── DETAIL FETCHERS FOR INTERACTIVE MODALS (DB-BASED — API ignores filter params) ─────────
|
|
//
|
|
// NOTE: Netify Informatics API does NOT filter by filter_agent / filter_local_ip —
|
|
// all filter params are silently ignored and global data is returned.
|
|
// All detail queries therefore use the local SQLite DB (flows, devices tables).
|
|
//
|
|
// Agent ↔ src_mac mapping (determined empirically from flows data):
|
|
// 2F-TF-1D-GK (JRP Cibubur) → src_mac '60:be:b4:1f:05:96' (IPs 10.1.x.x, 10.0.x.x)
|
|
// 8A-V3-PB-85 (IFG LT.18) → src_mac '04:f4:1c:ce:c2:e6' (IPs 10.6.x.x, 192.168.9.x)
|
|
// F6-2V-DT-8A (CPI Balaraja) → src_mac '2c:7b:a0:d8:86:91', '16:11:ac:73:34:1d', etc (IPs 10.250.x.x)
|
|
|
|
const AGENT_LABELS = {
|
|
'2F-TF-1D-GK': 'JRP Cibubur',
|
|
'8A-V3-PB-85': 'IFG LT.18',
|
|
'F6-2V-DT-8A': 'CPI Balaraja',
|
|
};
|
|
|
|
// Maps each agent UUID to its gateway/interface MAC address(es) in flows
|
|
const AGENT_MAC_MAP = {
|
|
'2F-TF-1D-GK': ['60:be:b4:1f:05:96'],
|
|
'8A-V3-PB-85': ['04:f4:1c:ce:c2:e6'],
|
|
'F6-2V-DT-8A': ['2c:7b:a0:d8:86:91', '16:11:ac:73:34:1d', 'bc:45:5b:ca:d5:be',
|
|
'de:ed:cc:57:58:34', 'f4:6d:3f:ef:01:a0', '60:be:b4:29:d3:36'],
|
|
};
|
|
|
|
// Build SQL IN clause placeholders
|
|
function inClause(arr) {
|
|
return arr.map(() => '?').join(',');
|
|
}
|
|
|
|
// Fetch all data for a specific agent (by UUID) — from local DB flows
|
|
async function fetchAgentDetails(agentUuid) {
|
|
const db = require('./database');
|
|
const d = db.getDB();
|
|
|
|
const label = AGENT_LABELS[agentUuid] || agentUuid;
|
|
const macs = AGENT_MAC_MAP[agentUuid];
|
|
|
|
const emptyResult = { agent_uuid: agentUuid, agent_label: label, summary: null, devices: [], flows: [], top_apps: [], security: { encryption_audit: [], insecure_protocols: [], unencrypted_passwords: [], ip_reputation: [], tor_detections: [], vpn_detections: [] }, events: [], mac_bandwidth: [], server_discovery: [] };
|
|
|
|
if (!macs || macs.length === 0) return emptyResult;
|
|
|
|
const ph = inClause(macs);
|
|
|
|
// ── 1. Top apps by this agent (from flows) ─────────────────────────────────
|
|
const appRows = d.prepare(`
|
|
SELECT app_label,
|
|
SUM(bytes_download) AS download,
|
|
SUM(bytes_upload) AS upload,
|
|
COUNT(*) AS flow_count
|
|
FROM flows
|
|
WHERE src_mac IN (${ph})
|
|
AND app_label IS NOT NULL
|
|
GROUP BY app_label
|
|
ORDER BY download DESC
|
|
LIMIT 15
|
|
`).all(...macs);
|
|
|
|
const top_apps = appRows.map(r => ({
|
|
app_id : null,
|
|
app_label : r.app_label,
|
|
category : null,
|
|
favicon : null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
}));
|
|
|
|
// ── 2. Distinct devices for this agent ─────────────────────────────────────
|
|
const devRows = d.prepare(`
|
|
SELECT f.src_ip AS ip_address,
|
|
f.src_mac AS mac_address,
|
|
d.device_label,
|
|
d.device_type,
|
|
d.os_label,
|
|
d.manufacturer,
|
|
SUM(f.bytes_download) AS dl,
|
|
SUM(f.bytes_upload) AS ul,
|
|
MAX(f.last_seen) AS last_seen
|
|
FROM flows f
|
|
LEFT JOIN (
|
|
SELECT ip_address, device_label, device_type, os_label, manufacturer
|
|
FROM devices
|
|
GROUP BY ip_address
|
|
) d ON d.ip_address = f.src_ip
|
|
WHERE f.src_mac IN (${ph})
|
|
GROUP BY f.src_ip
|
|
ORDER BY dl DESC
|
|
LIMIT 100
|
|
`).all(...macs);
|
|
|
|
const agentIPs = [...new Set(devRows.map(r => r.ip_address).filter(Boolean))];
|
|
const phIPs = agentIPs.length > 0 ? agentIPs.map(() => '?').join(',') : null;
|
|
|
|
const latestEncAudit = d.prepare(`SELECT MAX(fetched_at) AS t FROM intel_encryption_audit`).get()?.t;
|
|
const riskMap = {};
|
|
if (latestEncAudit) {
|
|
const riskRows = d.prepare(`SELECT ip_address, encrypted_pct, risk_level FROM intel_encryption_audit WHERE fetched_at = ?`).all(latestEncAudit);
|
|
for (const r of riskRows) {
|
|
if (r.ip_address) riskMap[r.ip_address] = { encrypted_pct: r.encrypted_pct, risk_level: r.risk_level };
|
|
}
|
|
}
|
|
|
|
const insecureIPs = new Set(
|
|
phIPs ? d.prepare(`SELECT DISTINCT ip_address FROM intel_insecure_protocols WHERE ip_address IN (${phIPs})`).all(...agentIPs).map(r => r.ip_address) : []
|
|
);
|
|
|
|
const devices = devRows.map(r => ({
|
|
ip_address : r.ip_address,
|
|
mac_address : r.mac_address,
|
|
device_label : r.device_label || r.ip_address || 'Unknown',
|
|
device_type : r.device_type || null,
|
|
os_label : r.os_label || null,
|
|
manufacturer : r.manufacturer || null,
|
|
last_seen : r.last_seen || null,
|
|
download : r.dl ?? 0,
|
|
upload : r.ul ?? 0,
|
|
encrypted_pct: riskMap[r.ip_address]?.encrypted_pct ?? null,
|
|
risk_level : riskMap[r.ip_address]?.risk_level ?? null,
|
|
has_insecure : insecureIPs.has(r.ip_address),
|
|
}));
|
|
|
|
// ── 3. Recent flows for this agent ─────────────────────────────────────────
|
|
const flowRows = d.prepare(`
|
|
SELECT src_ip, dst_ip, dst_port, protocol, app_label, domain,
|
|
bytes_download AS download, bytes_upload AS upload, last_seen
|
|
FROM flows
|
|
WHERE src_mac IN (${ph})
|
|
ORDER BY last_seen DESC
|
|
LIMIT 100
|
|
`).all(...macs);
|
|
|
|
const flows = flowRows.map(r => ({
|
|
src_ip : r.src_ip,
|
|
dst_ip : r.dst_ip,
|
|
dst_port : r.dst_port,
|
|
protocol : r.protocol,
|
|
app_label : r.app_label,
|
|
domain : r.domain,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
last_seen : r.last_seen,
|
|
}));
|
|
|
|
// ── 4. Summary stats ────────────────────────────────────────────────────────
|
|
const sumRow = d.prepare(`
|
|
SELECT COUNT(DISTINCT src_ip) AS device_count,
|
|
COUNT(*) AS flow_count,
|
|
SUM(bytes_download) AS total_download,
|
|
SUM(bytes_upload) AS total_upload
|
|
FROM flows
|
|
WHERE src_mac IN (${ph})
|
|
`).get(...macs);
|
|
|
|
const summary = sumRow ? {
|
|
total_devices : sumRow.device_count ?? 0,
|
|
active_flows : sumRow.flow_count ?? 0,
|
|
bandwidth_down : sumRow.total_download ?? 0,
|
|
bandwidth_up : sumRow.total_upload ?? 0,
|
|
} : null;
|
|
|
|
// ── 5. Security Intel filtered by agent IPs & MACs ─────────────────────────
|
|
const encryptionRows = (latestEncAudit && phIPs)
|
|
? d.prepare(`SELECT ip_address, mac_address, device_label, encrypted_pct, unencrypted, encrypted, total, risk_level, detected_at FROM intel_encryption_audit WHERE fetched_at = ? AND ip_address IN (${phIPs}) ORDER BY CASE risk_level WHEN 'Rawan' THEN 1 WHEN 'Sedang' THEN 2 ELSE 3 END`).all(latestEncAudit, ...agentIPs)
|
|
: [];
|
|
|
|
const insecureProtoRows = phIPs
|
|
? d.prepare(`SELECT ip_address, mac_address, protocol, risk, app_label, dst_ip, dst_port, download, upload, detected_at FROM intel_insecure_protocols WHERE ip_address IN (${phIPs}) ORDER BY detected_at DESC LIMIT 50`).all(...agentIPs)
|
|
: [];
|
|
|
|
let unencPwdRows = d.prepare(`SELECT ip_address, mac_address, dst_ip, dst_port, protocol, username, severity, download, upload, detected_at FROM intel_unencrypted_passwords WHERE mac_address IN (${ph}) ORDER BY detected_at DESC LIMIT 50`).all(...macs);
|
|
if (unencPwdRows.length === 0 && phIPs) {
|
|
unencPwdRows = d.prepare(`SELECT ip_address, mac_address, dst_ip, dst_port, protocol, username, severity, download, upload, detected_at FROM intel_unencrypted_passwords WHERE ip_address IN (${phIPs}) ORDER BY detected_at DESC LIMIT 50`).all(...agentIPs);
|
|
}
|
|
|
|
const latestRepSnap = d.prepare(`SELECT MAX(fetched_at) AS t FROM intel_ip_reputation`).get()?.t;
|
|
const ipReputRows = (latestRepSnap && phIPs)
|
|
? d.prepare(`SELECT ip_address, local_ip, mac_address, reputation, score, country, app_label, blacklisted, download, upload, detected_at FROM intel_ip_reputation WHERE fetched_at = ? AND (local_ip IN (${phIPs}) OR ip_address IN (${phIPs})) ORDER BY score DESC LIMIT 50`).all(latestRepSnap, ...agentIPs, ...agentIPs)
|
|
: [];
|
|
|
|
let torRows = d.prepare(`SELECT ip_address, mac_address, exit_node, circuit_id, country, download, upload, detected_at FROM intel_tor_detection WHERE mac_address IN (${ph}) ORDER BY detected_at DESC LIMIT 20`).all(...macs);
|
|
if (torRows.length === 0 && phIPs) {
|
|
torRows = d.prepare(`SELECT ip_address, mac_address, exit_node, circuit_id, country, download, upload, detected_at FROM intel_tor_detection WHERE ip_address IN (${phIPs}) ORDER BY detected_at DESC LIMIT 20`).all(...agentIPs);
|
|
}
|
|
|
|
let vpnRows = d.prepare(`SELECT ip_address, mac_address, vpn_type, remote_ip, protocol, country, confidence, download, upload, detected_at FROM intel_vpn_detection WHERE mac_address IN (${ph}) ORDER BY detected_at DESC LIMIT 20`).all(...macs);
|
|
if (vpnRows.length === 0 && phIPs) {
|
|
vpnRows = d.prepare(`SELECT ip_address, mac_address, vpn_type, remote_ip, protocol, country, confidence, download, upload, detected_at FROM intel_vpn_detection WHERE ip_address IN (${phIPs}) ORDER BY detected_at DESC LIMIT 20`).all(...agentIPs);
|
|
}
|
|
|
|
const serverDiscRows = phIPs
|
|
? d.prepare(`SELECT ip_address, mac_address, server_type, hostname, port, protocol, os_label, download, upload, detected_at FROM intel_server_discovery WHERE ip_address IN (${phIPs}) ORDER BY detected_at DESC LIMIT 50`).all(...agentIPs)
|
|
: [];
|
|
|
|
const security = {
|
|
encryption_audit : encryptionRows,
|
|
insecure_protocols : insecureProtoRows,
|
|
unencrypted_passwords: unencPwdRows,
|
|
ip_reputation : ipReputRows,
|
|
tor_detections : torRows,
|
|
vpn_detections : vpnRows,
|
|
};
|
|
|
|
// ── 6. Events filtered by agent IPs & MACs ─────────────────────────────────
|
|
const eventsByIP = phIPs ? d.prepare(`SELECT event_id, event_type, severity, ip_address, mac_address, description, event_at FROM events WHERE ip_address IN (${phIPs}) ORDER BY event_at DESC LIMIT 100`).all(...agentIPs) : [];
|
|
const eventsByMAC = d.prepare(`SELECT event_id, event_type, severity, ip_address, mac_address, description, event_at FROM events WHERE mac_address IN (${ph}) ORDER BY event_at DESC LIMIT 100`).all(...macs);
|
|
|
|
const seenEvt = new Set();
|
|
const allEvents = [];
|
|
for (const r of [...eventsByIP, ...eventsByMAC]) {
|
|
const key = r.event_id || `${r.ip_address}:${r.event_at}`;
|
|
if (!seenEvt.has(key)) {
|
|
seenEvt.add(key);
|
|
allEvents.push({ event_id: r.event_id, event_type: r.event_type, severity: r.severity, ip_address: r.ip_address, mac_address: r.mac_address, description: r.description, event_at: r.event_at });
|
|
}
|
|
}
|
|
allEvents.sort((a, b) => (b.event_at || '').localeCompare(a.event_at || ''));
|
|
const events = allEvents.slice(0, 100);
|
|
|
|
// ── 7. MAC bandwidth for this agent's MACs ──────────────────────────────────
|
|
const latestMacSnap = d.prepare(`SELECT MAX(fetched_at) AS t FROM mac_bandwidth`).get()?.t;
|
|
const mac_bandwidth = latestMacSnap
|
|
? d.prepare(`SELECT mac_address, manufacturer, download, upload, total FROM mac_bandwidth WHERE fetched_at = ? AND mac_address IN (${ph}) ORDER BY download DESC`).all(latestMacSnap, ...macs)
|
|
: [];
|
|
|
|
return {
|
|
agent_uuid : agentUuid,
|
|
agent_label : label,
|
|
summary,
|
|
devices,
|
|
flows,
|
|
top_apps,
|
|
security,
|
|
events,
|
|
mac_bandwidth,
|
|
server_discovery: serverDiscRows,
|
|
};
|
|
}
|
|
|
|
// Fetch data for a specific device IP — from local DB (all 10 correlated tables)
|
|
async function fetchDeviceDetails(ip) {
|
|
const db = require('./database');
|
|
const d = db.getDB();
|
|
|
|
// ── 0. Resolve MAC from flows (most recent) ──────────────────────────────
|
|
const macRow = d.prepare(`SELECT src_mac FROM flows WHERE src_ip = ? AND src_mac IS NOT NULL ORDER BY last_seen DESC LIMIT 1`).get(ip);
|
|
const mac = macRow?.src_mac || null;
|
|
|
|
// ── 1. Device info from devices table ────────────────────────────────────
|
|
const deviceRow = d.prepare(`
|
|
SELECT device_label, device_type, os_label, manufacturer, download, upload, last_seen
|
|
FROM devices
|
|
WHERE ip_address = ?
|
|
ORDER BY fetched_at DESC
|
|
LIMIT 1
|
|
`).get(ip);
|
|
|
|
// ── 2. Discovery info (may differ from devices table) ────────────────────
|
|
const discRow = d.prepare(`
|
|
SELECT device_type, os_label, manufacturer, device_label, is_new
|
|
FROM intel_device_discovery
|
|
WHERE ip_address = ?
|
|
ORDER BY fetched_at DESC
|
|
LIMIT 1
|
|
`).get(ip);
|
|
|
|
const device_info = {
|
|
device_label : deviceRow?.device_label || discRow?.device_label || null,
|
|
device_type : deviceRow?.device_type || discRow?.device_type || null,
|
|
os_label : deviceRow?.os_label || discRow?.os_label || null,
|
|
manufacturer : deviceRow?.manufacturer || discRow?.manufacturer || null,
|
|
mac_address : mac,
|
|
is_new : discRow?.is_new ?? null,
|
|
};
|
|
|
|
// ── 3. Named apps (exclude "Port XXX" port-only entries) ─────────────────
|
|
const namedAppRows = d.prepare(`
|
|
SELECT app_label,
|
|
SUM(bytes_download) AS download,
|
|
SUM(bytes_upload) AS upload,
|
|
COUNT(*) AS flow_count
|
|
FROM flows
|
|
WHERE src_ip = ?
|
|
AND app_label IS NOT NULL
|
|
AND app_label NOT LIKE 'Port %'
|
|
GROUP BY app_label
|
|
ORDER BY download DESC
|
|
LIMIT 20
|
|
`).all(ip);
|
|
|
|
// ── 4. Top domains accessed by this device ─────────────────────────────
|
|
const domainRows = d.prepare(`
|
|
SELECT domain,
|
|
-- use app_label that appeared most with this domain
|
|
(SELECT app_label FROM flows
|
|
WHERE src_ip = f.src_ip AND domain = f.domain
|
|
AND app_label IS NOT NULL
|
|
ORDER BY bytes_download DESC LIMIT 1) AS app_label,
|
|
-- extract root domain for display
|
|
domain AS display_name,
|
|
SUM(bytes_download) AS download,
|
|
SUM(bytes_upload) AS upload,
|
|
COUNT(*) AS flow_count
|
|
FROM flows f
|
|
WHERE src_ip = ?
|
|
AND domain IS NOT NULL
|
|
GROUP BY domain
|
|
ORDER BY download DESC
|
|
LIMIT 30
|
|
`).all(ip);
|
|
|
|
// ── 5. Smart combined: flows with BOTH domain and app_label, or just one ─
|
|
// Build combined display list:
|
|
// Priority 1 = rows with actual domain (show domain as label)
|
|
// Priority 2 = rows with named app (not port-only)
|
|
// Merge & de-duplicate by display name
|
|
const combinedMap = new Map();
|
|
|
|
// Add domains first (higher priority)
|
|
for (const r of domainRows) {
|
|
combinedMap.set('domain:' + r.domain, {
|
|
label : r.domain, // the actual website/domain
|
|
sub_label : r.app_label || null, // protocol (HTTPS/TLS etc)
|
|
type : 'domain',
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
flow_count : r.flow_count,
|
|
});
|
|
}
|
|
|
|
// Add named apps that don't duplicate a domain entry
|
|
for (const r of namedAppRows) {
|
|
const key = 'app:' + r.app_label;
|
|
if (!combinedMap.has(key)) {
|
|
combinedMap.set(key, {
|
|
label : r.app_label, // protocol name (DNS, HTTPS/TLS, etc)
|
|
sub_label : null,
|
|
type : 'protocol',
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
flow_count : r.flow_count,
|
|
});
|
|
}
|
|
}
|
|
|
|
// If neither domain nor named app found, fall back to ALL app_labels incl Port XXX
|
|
const top_apps = combinedMap.size > 0
|
|
? [...combinedMap.values()].sort((a, b) => b.download - a.download).slice(0, 25)
|
|
: d.prepare(`
|
|
SELECT app_label AS label, NULL AS sub_label, 'port' AS type,
|
|
SUM(bytes_download) AS download, SUM(bytes_upload) AS upload, COUNT(*) AS flow_count
|
|
FROM flows WHERE src_ip = ? AND app_label IS NOT NULL
|
|
GROUP BY app_label ORDER BY download DESC LIMIT 25
|
|
`).all(ip).map(r => ({ label: r.label, sub_label: null, type: 'port', download: r.download ?? 0, upload: r.upload ?? 0, flow_count: r.flow_count }));
|
|
|
|
// top_domains: keep simple list for Info tab
|
|
const top_domains = domainRows.map(r => ({
|
|
domain : r.domain,
|
|
app_label : r.app_label,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
flow_count : r.flow_count,
|
|
}));
|
|
|
|
// ── 5. Recent flows ────────────────────────────────────────────────────
|
|
const flowRows = d.prepare(`
|
|
SELECT dst_ip, dst_port, protocol, app_label, domain,
|
|
bytes_download AS download, bytes_upload AS upload, last_seen
|
|
FROM flows
|
|
WHERE src_ip = ?
|
|
ORDER BY last_seen DESC
|
|
LIMIT 100
|
|
`).all(ip);
|
|
|
|
const flows = flowRows.map(r => ({
|
|
dst_ip : r.dst_ip,
|
|
dst_port : r.dst_port,
|
|
protocol : r.protocol,
|
|
app_label : r.app_label,
|
|
domain : r.domain,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
last_seen : r.last_seen,
|
|
}));
|
|
|
|
// ── 6. Totals ─────────────────────────────────────────────────────────
|
|
const sumRow = d.prepare(`
|
|
SELECT SUM(bytes_download) AS total_download,
|
|
SUM(bytes_upload) AS total_upload,
|
|
COUNT(*) AS flow_count
|
|
FROM flows
|
|
WHERE src_ip = ?
|
|
`).get(ip);
|
|
|
|
// ── 7. Encryption audit (latest snapshot) ─────────────────────────────
|
|
const latestAudit = d.prepare(`SELECT MAX(fetched_at) AS t FROM intel_encryption_audit`).get()?.t;
|
|
const encRow = latestAudit
|
|
? d.prepare(`
|
|
SELECT encrypted_pct, encrypted, unencrypted, total, risk_level, mac_address
|
|
FROM intel_encryption_audit
|
|
WHERE fetched_at = ? AND ip_address = ?
|
|
LIMIT 1
|
|
`).get(latestAudit, ip)
|
|
: null;
|
|
|
|
// Also try fallback by MAC if not found by IP
|
|
const encRowMac = (!encRow && mac && latestAudit)
|
|
? d.prepare(`
|
|
SELECT encrypted_pct, encrypted, unencrypted, total, risk_level, ip_address
|
|
FROM intel_encryption_audit
|
|
WHERE fetched_at = ? AND mac_address = ?
|
|
ORDER BY detected_at DESC
|
|
LIMIT 1
|
|
`).get(latestAudit, mac)
|
|
: null;
|
|
|
|
const encFinal = encRow || encRowMac;
|
|
|
|
const encryption = encFinal ? {
|
|
encrypted_pct : encFinal.encrypted_pct ?? null,
|
|
encrypted_bytes : encFinal.encrypted ?? null,
|
|
unencrypted_bytes: encFinal.unencrypted ?? null,
|
|
total_bytes : encFinal.total ?? null,
|
|
risk_level : encFinal.risk_level ?? null,
|
|
} : null;
|
|
|
|
// ── 8. Server discovery (servers this device accessed) ─────────────────
|
|
const serverRows = d.prepare(`
|
|
SELECT DISTINCT server_type, hostname, port, protocol, os_label,
|
|
MAX(download) AS download, MAX(upload) AS upload, MAX(detected_at) AS detected_at
|
|
FROM intel_server_discovery
|
|
WHERE ip_address = ?
|
|
GROUP BY server_type, port, protocol
|
|
ORDER BY download DESC
|
|
LIMIT 50
|
|
`).all(ip);
|
|
|
|
// fallback by MAC if no rows by IP
|
|
const serverRowsMac = (serverRows.length === 0 && mac)
|
|
? d.prepare(`
|
|
SELECT DISTINCT server_type, hostname, port, protocol, os_label,
|
|
MAX(download) AS download, MAX(upload) AS upload, MAX(detected_at) AS detected_at
|
|
FROM intel_server_discovery
|
|
WHERE mac_address = ?
|
|
GROUP BY server_type, port, protocol
|
|
ORDER BY download DESC
|
|
LIMIT 50
|
|
`).all(mac)
|
|
: [];
|
|
|
|
const server_discovery = (serverRows.length > 0 ? serverRows : serverRowsMac).map(r => ({
|
|
server_type : r.server_type,
|
|
hostname : r.hostname || null,
|
|
port : r.port,
|
|
protocol : r.protocol,
|
|
os_label : r.os_label || null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
detected_at : r.detected_at,
|
|
}));
|
|
|
|
// ── 9. Unencrypted passwords ───────────────────────────────────────────
|
|
let pwdRows = d.prepare(`
|
|
SELECT dst_ip, dst_port, protocol, username, severity, download, upload, detected_at
|
|
FROM intel_unencrypted_passwords
|
|
WHERE ip_address = ?
|
|
ORDER BY detected_at DESC
|
|
LIMIT 50
|
|
`).all(ip);
|
|
|
|
if (pwdRows.length === 0 && mac) {
|
|
pwdRows = d.prepare(`
|
|
SELECT dst_ip, dst_port, protocol, username, severity, download, upload, detected_at
|
|
FROM intel_unencrypted_passwords
|
|
WHERE mac_address = ?
|
|
ORDER BY detected_at DESC
|
|
LIMIT 50
|
|
`).all(mac);
|
|
}
|
|
|
|
const unencrypted_passwords = pwdRows.map(r => ({
|
|
dst_ip : r.dst_ip,
|
|
dst_port : r.dst_port,
|
|
protocol : r.protocol,
|
|
username : r.username,
|
|
severity : r.severity,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
detected_at : r.detected_at,
|
|
}));
|
|
|
|
// ── 10. IP Reputation (latest snapshot, this device's local_ip) ─────────
|
|
const latestRepSnap = d.prepare(`SELECT MAX(fetched_at) AS t FROM intel_ip_reputation`).get()?.t;
|
|
const repRows = latestRepSnap
|
|
? d.prepare(`
|
|
SELECT ip_address, local_ip, reputation, score, country, app_label, blacklisted, download, upload
|
|
FROM intel_ip_reputation
|
|
WHERE fetched_at = ? AND (local_ip = ? OR ip_address = ?)
|
|
ORDER BY score DESC NULLS LAST
|
|
LIMIT 30
|
|
`).all(latestRepSnap, ip, ip)
|
|
: [];
|
|
|
|
const ip_reputation = repRows.map(r => ({
|
|
remote_ip : r.ip_address,
|
|
local_ip : r.local_ip,
|
|
reputation : r.reputation,
|
|
score : r.score,
|
|
country : r.country,
|
|
app_label : r.app_label,
|
|
blacklisted : !!r.blacklisted,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
}));
|
|
|
|
// ── 11. VPN detection ─────────────────────────────────────────────────
|
|
let vpnRows = d.prepare(`
|
|
SELECT vpn_type, remote_ip, protocol, country, confidence, download, upload, detected_at
|
|
FROM intel_vpn_detection
|
|
WHERE ip_address = ?
|
|
ORDER BY detected_at DESC
|
|
LIMIT 20
|
|
`).all(ip);
|
|
|
|
if (vpnRows.length === 0 && mac) {
|
|
vpnRows = d.prepare(`
|
|
SELECT vpn_type, remote_ip, protocol, country, confidence, download, upload, detected_at
|
|
FROM intel_vpn_detection
|
|
WHERE mac_address = ?
|
|
ORDER BY detected_at DESC
|
|
LIMIT 20
|
|
`).all(mac);
|
|
}
|
|
|
|
const vpn_detections = vpnRows.map(r => ({
|
|
vpn_type : r.vpn_type,
|
|
remote_ip : r.remote_ip,
|
|
protocol : r.protocol,
|
|
country : r.country,
|
|
confidence : r.confidence,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
detected_at : r.detected_at,
|
|
}));
|
|
|
|
// ── 12. Events ────────────────────────────────────────────────────────
|
|
const evtByIP = d.prepare(`SELECT event_type, severity, ip_address, mac_address, description, event_at FROM events WHERE ip_address = ? ORDER BY event_at DESC LIMIT 50`).all(ip);
|
|
const evtByMAC = mac ? d.prepare(`SELECT event_type, severity, ip_address, mac_address, description, event_at FROM events WHERE mac_address = ? ORDER BY event_at DESC LIMIT 50`).all(mac) : [];
|
|
|
|
const seenEvt = new Set();
|
|
const evtMerged = [];
|
|
for (const r of [...evtByIP, ...evtByMAC]) {
|
|
const key = `${r.event_type}:${r.event_at}`;
|
|
if (!seenEvt.has(key)) {
|
|
seenEvt.add(key);
|
|
evtMerged.push({ event_type: r.event_type, severity: r.severity, ip_address: r.ip_address, mac_address: r.mac_address, description: r.description, event_at: r.event_at });
|
|
}
|
|
}
|
|
evtMerged.sort((a, b) => (b.event_at || '').localeCompare(a.event_at || ''));
|
|
const events = evtMerged.slice(0, 100);
|
|
|
|
// ── 13. MAC bandwidth (latest snapshot) ───────────────────────────────
|
|
const latestMacSnap = d.prepare(`SELECT MAX(fetched_at) AS t FROM mac_bandwidth`).get()?.t;
|
|
const macBwRow = (latestMacSnap && mac)
|
|
? d.prepare(`SELECT manufacturer, download, upload, total FROM mac_bandwidth WHERE fetched_at = ? AND mac_address = ? LIMIT 1`).get(latestMacSnap, mac)
|
|
: null;
|
|
|
|
const mac_bandwidth = macBwRow ? {
|
|
mac_address : mac,
|
|
manufacturer : macBwRow.manufacturer,
|
|
download : macBwRow.download ?? 0,
|
|
upload : macBwRow.upload ?? 0,
|
|
total : macBwRow.total ?? 0,
|
|
} : null;
|
|
|
|
return {
|
|
ip,
|
|
mac_address : mac,
|
|
total_download : sumRow?.total_download ?? 0,
|
|
total_upload : sumRow?.total_upload ?? 0,
|
|
flow_count : sumRow?.flow_count ?? 0,
|
|
device_info,
|
|
top_apps,
|
|
top_domains : domainRows.map(r => ({ domain: r.domain, download: r.download ?? 0, upload: r.upload ?? 0, flow_count: r.flow_count })),
|
|
flows,
|
|
encryption,
|
|
server_discovery,
|
|
unencrypted_passwords,
|
|
ip_reputation,
|
|
vpn_detections,
|
|
events,
|
|
mac_bandwidth,
|
|
};
|
|
}
|
|
|
|
// Fetch data for a specific application// Fetch data for a specific application — from local DB
|
|
async function fetchAppDetails(appLabel) {
|
|
const db = require('./database');
|
|
const d = db.getDB();
|
|
|
|
// ── Totals: from flows (protocol-level) OR bandwidth_apps (brand-level) ──
|
|
// IMPORTANT: use MAX(download) from latest snapshot — NOT SUM() of all history!
|
|
const flowTotalRow = d.prepare(`
|
|
SELECT SUM(bytes_download) AS download,
|
|
SUM(bytes_upload) AS upload,
|
|
COUNT(*) AS flow_count
|
|
FROM flows
|
|
WHERE app_label = ?
|
|
`).get(appLabel);
|
|
|
|
let total_download = flowTotalRow?.download ?? 0;
|
|
let total_upload = flowTotalRow?.upload ?? 0;
|
|
let data_source = 'flows'; // track where totals came from
|
|
|
|
// If no flows data (brand-name app like YouTube), use LATEST bandwidth_apps snapshot
|
|
if (total_download === 0 && total_upload === 0) {
|
|
const latestSnap = d.prepare(`SELECT MAX(fetched_at) AS t FROM bandwidth_apps WHERE app_label = ?`).get(appLabel)?.t;
|
|
if (latestSnap) {
|
|
const bwRow = d.prepare(`
|
|
SELECT download, upload
|
|
FROM bandwidth_apps
|
|
WHERE app_label = ? AND fetched_at = ?
|
|
LIMIT 1
|
|
`).get(appLabel, latestSnap);
|
|
if (bwRow) {
|
|
total_download = bwRow.download ?? 0;
|
|
total_upload = bwRow.upload ?? 0;
|
|
data_source = 'bandwidth_apps';
|
|
}
|
|
}
|
|
}
|
|
|
|
// ── Top IPs accessing this app (from flows — protocol-level labels) ──
|
|
const ipRows = d.prepare(`
|
|
SELECT src_ip AS ip_address,
|
|
SUM(bytes_download) AS download,
|
|
SUM(bytes_upload) AS upload,
|
|
COUNT(*) AS flow_count
|
|
FROM flows
|
|
WHERE app_label = ?
|
|
GROUP BY src_ip
|
|
ORDER BY download DESC
|
|
LIMIT 20
|
|
`).all(appLabel);
|
|
|
|
// ── Domain-based per-IP breakdown (bridges HTTPS/TLS → brand name) ──
|
|
// Build keyword map for common brand names
|
|
const DOMAIN_KEYWORDS = {
|
|
'YouTube' : ['youtube', 'googlevideo', 'ytimg', 'yt3.ggpht'],
|
|
'Facebook' : ['facebook', 'fbcdn', 'fb.com', 'fbsbx'],
|
|
'WhatsApp' : ['whatsapp', 'wa.me'],
|
|
'Instagram' : ['instagram', 'cdninstagram'],
|
|
'TikTok' : ['tiktok', 'tiktokcdn', 'tiktokv'],
|
|
'Netflix' : ['netflix', 'nflxvideo', 'nflximg'],
|
|
'Google' : ['google.com', 'googleapis', 'gstatic', 'googlesyndication'],
|
|
'Microsoft' : ['microsoft', 'msftncsi', 'live.com', 'office365', 'sharepoint'],
|
|
'Zoom' : ['zoom.us', 'zoomgov'],
|
|
'Spotify' : ['spotify', 'scdn.co'],
|
|
};
|
|
|
|
let domain_breakdown = [];
|
|
const kws = DOMAIN_KEYWORDS[appLabel];
|
|
if (kws && kws.length > 0) {
|
|
// Build WHERE clause for domain keywords
|
|
const likeClause = kws.map(() => `LOWER(domain) LIKE ?`).join(' OR ');
|
|
const likeParams = kws.map(k => `%${k}%`);
|
|
const domRows = d.prepare(`
|
|
SELECT src_ip AS ip_address,
|
|
SUM(bytes_download) AS download,
|
|
SUM(bytes_upload) AS upload,
|
|
COUNT(*) AS flow_count
|
|
FROM flows
|
|
WHERE domain IS NOT NULL AND (${likeClause})
|
|
GROUP BY src_ip
|
|
ORDER BY download DESC
|
|
LIMIT 20
|
|
`).all(...likeParams);
|
|
domain_breakdown = domRows.map(r => ({
|
|
ip_address : r.ip_address,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
flow_count : r.flow_count ?? 0,
|
|
}));
|
|
}
|
|
|
|
// ── Threat flags: cross-reference top IPs with intel_ip_reputation ──
|
|
const latestRepSnap = d.prepare(`SELECT MAX(fetched_at) AS t FROM intel_ip_reputation`).get()?.t;
|
|
const threatMap = {};
|
|
if (latestRepSnap) {
|
|
const repRows = d.prepare(`
|
|
SELECT local_ip, ip_address, reputation, blacklisted
|
|
FROM intel_ip_reputation
|
|
WHERE fetched_at = ?
|
|
`).all(latestRepSnap);
|
|
for (const r of repRows) {
|
|
const key = r.local_ip || r.ip_address;
|
|
if (key) threatMap[key] = { reputation: r.reputation, blacklisted: r.blacklisted };
|
|
}
|
|
}
|
|
|
|
const allIpRows = domain_breakdown.length > 0 ? domain_breakdown : ipRows;
|
|
const top_ips = allIpRows.map(r => ({
|
|
ip_address : r.ip_address,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
flow_count : r.flow_count ?? 0,
|
|
reputation : threatMap[r.ip_address]?.reputation ?? null,
|
|
blacklisted : threatMap[r.ip_address]?.blacklisted ?? false,
|
|
}));
|
|
|
|
// ── Per-agent breakdown using MAC-based grouping in flows ──
|
|
const agent_scorecard = Object.entries(AGENT_MAC_MAP).map(([uuid, macs]) => {
|
|
const ph = inClause(macs);
|
|
const likeParams2 = kws ? kws.map(k => `%${k}%`) : [];
|
|
let row;
|
|
if (likeParams2.length > 0) {
|
|
// For brand-name apps: query by domain keywords filtered by agent MAC
|
|
const likeClause2 = likeParams2.map(() => `LOWER(domain) LIKE ?`).join(' OR ');
|
|
row = d.prepare(`
|
|
SELECT SUM(bytes_download) AS download,
|
|
SUM(bytes_upload) AS upload,
|
|
COUNT(*) AS flow_count
|
|
FROM flows
|
|
WHERE src_mac IN (${ph})
|
|
AND domain IS NOT NULL
|
|
AND (${likeClause2})
|
|
`).get(...macs, ...likeParams2);
|
|
} else {
|
|
row = d.prepare(`
|
|
SELECT SUM(bytes_download) AS download,
|
|
SUM(bytes_upload) AS upload,
|
|
COUNT(*) AS flow_count
|
|
FROM flows
|
|
WHERE app_label = ?
|
|
AND src_mac IN (${ph})
|
|
`).get(appLabel, ...macs);
|
|
}
|
|
return {
|
|
agent_uuid : uuid,
|
|
agent_label : AGENT_LABELS[uuid] || uuid,
|
|
download : row?.download ?? 0,
|
|
upload : row?.upload ?? 0,
|
|
flow_count : row?.flow_count ?? 0,
|
|
};
|
|
}).filter(a => a.download > 0 || a.upload > 0);
|
|
|
|
return {
|
|
app_label : appLabel,
|
|
total_download,
|
|
total_upload,
|
|
data_source,
|
|
agent_scorecard,
|
|
top_ips,
|
|
has_domain_breakdown: domain_breakdown.length > 0,
|
|
};
|
|
}
|
|
|
|
|
|
// Fetch security device risk overview — encryption audit + insecure protocols per device
|
|
async function fetchSecurityDevices() {
|
|
const db = require('./database');
|
|
const d = db.getDB();
|
|
|
|
const latestFetch = d.prepare(`SELECT MAX(fetched_at) AS t FROM intel_encryption_audit`).get()?.t;
|
|
const encryptRows = latestFetch
|
|
? d.prepare(`SELECT * FROM intel_encryption_audit WHERE fetched_at = ?`).all(latestFetch)
|
|
: [];
|
|
|
|
const insecureRows = d.prepare(`SELECT DISTINCT ip_address FROM intel_insecure_protocols`).all();
|
|
const insecureIPs = new Set(insecureRows.map(r => r.ip_address).filter(Boolean));
|
|
|
|
// Compute risk per device
|
|
const deviceMap = {};
|
|
for (const r of encryptRows) {
|
|
const ip = r.ip_address;
|
|
if (!ip) continue;
|
|
const encPct = r.encrypted_pct ?? 100;
|
|
let riskLevel;
|
|
if (encPct < 50 || insecureIPs.has(ip)) {
|
|
riskLevel = 'Rawan';
|
|
} else if (encPct < 80) {
|
|
riskLevel = 'Sedang';
|
|
} else {
|
|
riskLevel = 'Aman';
|
|
}
|
|
if (!deviceMap[ip] || deviceMap[ip].encrypted_pct < encPct) {
|
|
deviceMap[ip] = {
|
|
ip_address : ip,
|
|
mac_address : r.mac_address ?? null,
|
|
device_label : r.device_label ?? null,
|
|
encrypted_pct : encPct,
|
|
unencrypted : r.unencrypted ?? 0,
|
|
encrypted : r.encrypted ?? 0,
|
|
total : r.total ?? 0,
|
|
risk_level : riskLevel,
|
|
has_insecure : insecureIPs.has(ip),
|
|
};
|
|
}
|
|
}
|
|
|
|
// Try to get device info (type, OS) from discovery data — table may not exist
|
|
const discMap = {};
|
|
try {
|
|
const discRows = d.prepare(`SELECT DISTINCT ip_address, device_type, os_label, manufacturer FROM devices`).all();
|
|
for (const r of discRows) {
|
|
if (r.ip_address) discMap[r.ip_address] = r;
|
|
}
|
|
} catch (_) {
|
|
// devices table doesn't exist yet — skip enrichment
|
|
}
|
|
|
|
|
|
const devices = Object.values(deviceMap).map(dev => ({
|
|
...dev,
|
|
device_type : discMap[dev.ip_address]?.device_type ?? null,
|
|
os_label : discMap[dev.ip_address]?.os_label ?? null,
|
|
manufacturer : discMap[dev.ip_address]?.manufacturer ?? null,
|
|
}));
|
|
|
|
// Sort: Rawan first, then Sedang, then Aman
|
|
const ORDER = { Rawan: 0, Sedang: 1, Aman: 2 };
|
|
devices.sort((a, b) => (ORDER[a.risk_level] ?? 3) - (ORDER[b.risk_level] ?? 3));
|
|
|
|
return devices;
|
|
}
|
|
|
|
module.exports = {
|
|
fetchLookupApplications,
|
|
fetchTopApps, fetchTopDevices, fetchTopProtocols, fetchTopCountries,
|
|
fetchTopDomains, fetchBandwidthSummary, fetchDiscoveredDevices,
|
|
fetchCyberThreats, fetchFlows, fetchEvents,
|
|
fetchTopAppCategories, fetchTopContinents, fetchTopRegions, fetchTopCities,
|
|
fetchTopVLANs, fetchTopInterfaces, fetchTopFlowTypes, fetchTopFlowOrigins,
|
|
fetchTopIPVersions, fetchTopRemoteIPs, fetchTopLocalMACs,
|
|
fetchTopDiscoveryOS,
|
|
fetchTLSVersions, fetchTLSCiphers, fetchTLSSecurity, fetchNetBIOSHostnames,
|
|
// DPI 12-21 (field name sudah diperbaiki sesuai dokumentasi resmi)
|
|
fetchDHCPClassFingerprints,
|
|
fetchHTTPUserAgents,
|
|
fetchSNIHostnames,
|
|
fetchSSLServerCN,
|
|
fetchQUICHostnames,
|
|
fetchBitTorrentInfoHashes,
|
|
fetchSSHClients,
|
|
fetchSSHServers,
|
|
fetchMDNSHostnames,
|
|
// Intelligence 22-30 (derive dari data yang tersedia)
|
|
fetchCryptoMining,
|
|
fetchDeviceDiscovery,
|
|
fetchEncryptionAudit,
|
|
fetchInsecureProtocols,
|
|
fetchIPReputation,
|
|
fetchServerDiscovery,
|
|
fetchTorDetection,
|
|
fetchUnencryptedPasswords,
|
|
fetchVPNDetection,
|
|
// Interactive detail fetchers
|
|
fetchAgentDetails,
|
|
fetchDeviceDetails,
|
|
fetchAppDetails,
|
|
fetchSecurityDevices,
|
|
};
|
|
|
|
// ─── DPI FIELDS 12-21 — FIELD NAMES DIPERBAIKI SESUAI DOCS ──────────────────
|
|
// Sumber: https://www.netify.ai/documentation/informatics/v2/data/fields
|
|
//
|
|
// Field yang SALAH sebelumnya → yang BENAR:
|
|
// dhcp_fingerprint → dhcp_class
|
|
// user_agent → http_useragent
|
|
// ssl_cn → https_sni_hostname
|
|
// ssl_server_cn → ssl_server_cn ✓ (sudah benar)
|
|
// quic_hostname → quic_hostname ✓ (sudah benar, mungkin belum aktif di akun)
|
|
// bt_info_hash → bittorrent_info_hash
|
|
// ssh_version → ssh_client / ssh_server (2 field terpisah)
|
|
// mdns_hostname → mdns_hostname ✓ (sudah benar, mungkin belum aktif di akun)
|
|
|
|
// Helper builder untuk DPI single-field
|
|
async function _dpiTopField(fieldName, interval, limit) {
|
|
const [dl, ul] = await Promise.all([
|
|
netifyFetch(`/data/stats/top/${fieldName}/download`, { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch(`/data/stats/top/${fieldName}/upload`, { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dl) return null;
|
|
const ulMap = {};
|
|
if (ul) for (const r of ul) {
|
|
const key = r[fieldName]?.name ?? r[fieldName]?.label ?? String(r[fieldName] ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return { dl, ulMap };
|
|
}
|
|
|
|
// 12. DHCP Class (field: dhcp_class)
|
|
async function fetchDHCPClassFingerprints(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('dhcp_class', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const label = r.dhcp_class?.name ?? r.dhcp_class?.label ?? String(r.dhcp_class ?? 'Unknown');
|
|
return {
|
|
fingerprint : label,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 13. HTTP User-Agent (field: http_useragent)
|
|
async function fetchHTTPUserAgents(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('http_useragent', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const label = r.http_useragent?.name ?? r.http_useragent?.label ?? String(r.http_useragent ?? 'Unknown');
|
|
return {
|
|
user_agent : label,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 14. HTTPS SNI Hostname (field: https_sni_hostname)
|
|
async function fetchSNIHostnames(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('https_sni_hostname', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const name = r.https_sni_hostname?.name ?? r.https_sni_hostname?.label ?? String(r.https_sni_hostname ?? 'Unknown');
|
|
return {
|
|
sni_hostname : name,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[name] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[name] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 15. SSL Server Common Name (field: ssl_server_cn)
|
|
async function fetchSSLServerCN(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('ssl_server_cn', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const name = r.ssl_server_cn?.name ?? r.ssl_server_cn?.label ?? String(r.ssl_server_cn ?? 'Unknown');
|
|
return {
|
|
ssl_server_cn : name,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[name] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[name] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 17. QUIC Hostname (field: quic_hostname)
|
|
async function fetchQUICHostnames(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('quic_hostname', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const name = r.quic_hostname?.name ?? r.quic_hostname?.label ?? String(r.quic_hostname ?? 'Unknown');
|
|
return {
|
|
quic_hostname : name,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[name] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[name] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 18. BitTorrent Info Hash (field: bittorrent_info_hash)
|
|
async function fetchBitTorrentInfoHashes(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('bittorrent_info_hash', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const hash = r.bittorrent_info_hash?.hash ?? r.bittorrent_info_hash?.name ?? String(r.bittorrent_info_hash ?? 'Unknown');
|
|
const label = r.bittorrent_info_hash?.label ?? hash;
|
|
return {
|
|
info_hash : hash,
|
|
label : label,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[hash] ?? res.ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[hash] ?? res.ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 19a. SSH Client (field: ssh_client)
|
|
async function fetchSSHClients(interval = 1440, limit = 20) {
|
|
const res = await _dpiTopField('ssh_client', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const label = r.ssh_client?.name ?? r.ssh_client?.label ?? String(r.ssh_client ?? 'Unknown');
|
|
return {
|
|
ssh_version : label,
|
|
direction : 'client',
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 19b. SSH Server (field: ssh_server)
|
|
async function fetchSSHServers(interval = 1440, limit = 20) {
|
|
const res = await _dpiTopField('ssh_server', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const label = r.ssh_server?.name ?? r.ssh_server?.label ?? String(r.ssh_server ?? 'Unknown');
|
|
return {
|
|
ssh_version : label,
|
|
direction : 'server',
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 21. mDNS Hostname (field: mdns_hostname)
|
|
async function fetchMDNSHostnames(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('mdns_hostname', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const name = r.mdns_hostname?.name ?? r.mdns_hostname?.label ?? String(r.mdns_hostname ?? 'Unknown');
|
|
return {
|
|
mdns_hostname : name,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[name] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[name] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// ─── INTELLIGENCE 22-30 — DERIVE DARI DATA YANG SUDAH ADA ────────────────────
|
|
// Endpoint /intelligence/* dan /events/* semua 404 di akun ini.
|
|
// Semua fungsi berikut meng-DERIVE data dari endpoint yang sudah confirmed bekerja:
|
|
// /data/stats/top/*, /data/flows
|
|
// Ini memberikan data nyata, bukan mock/dummy.
|
|
|
|
// 22. Cryptocurrency Mining — derive dari apps dengan nama mengandung "crypto" / "mining"
|
|
// + flows ke port mining pool (3333, 4444, 8333, 9999, 14444)
|
|
async function fetchCryptoMining(interval = 1440, limit = 50) {
|
|
const MINING_POOLS_PORTS = new Set([3333, 4444, 5555, 7777, 8333, 9332, 9999, 14444, 45560, 45700]);
|
|
const MINING_APPS = ['bitcoin', 'crypto', 'mining', 'monero', 'ethereum', 'nicehash', 'nanopool', 'f2pool', 'antpool', 'slushpool'];
|
|
|
|
const [appData, flowsRaw] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application/download', { filter_interval: interval, settings_limit: 100 }),
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
]);
|
|
|
|
const results = [];
|
|
|
|
// Derive dari aplikasi
|
|
if (appData) {
|
|
for (const r of appData) {
|
|
const name = (r.application?.label ?? '').toLowerCase();
|
|
const tag = (r.application?.tag ?? '').toLowerCase();
|
|
if (MINING_APPS.some(k => name.includes(k) || tag.includes(k))) {
|
|
results.push({
|
|
detected_at : null,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
pool_host : r.application?.label ?? null,
|
|
pool_ip : null,
|
|
protocol : null,
|
|
app_label : r.application?.label ?? null,
|
|
confidence : 0.7,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
source : 'derived:app',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
// Derive dari flows ke port mining
|
|
if (flowsRaw) {
|
|
for (const r of flowsRaw) {
|
|
const port = r.remote_port ?? 0;
|
|
if (MINING_POOLS_PORTS.has(port)) {
|
|
results.push({
|
|
detected_at : r.first_seen_at?.date ?? null,
|
|
ip_address : r.local_ip?.address ?? null,
|
|
mac_address : r.local_mac ?? null,
|
|
pool_host : null,
|
|
pool_ip : r.remote_ip?.address ?? null,
|
|
protocol : r.ip_protocol?.label ?? null,
|
|
app_label : null,
|
|
confidence : 0.85,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
source : 'derived:flow',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return results.slice(0, limit);
|
|
}
|
|
|
|
// 23. Device Discovery — derive dari flows (perangkat unik dengan MAC)
|
|
async function fetchDeviceDiscovery(limit = 100) {
|
|
const [flowsRaw, dlData] = await Promise.all([
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
netifyFetch('/data/stats/top/local_ip/download', { filter_interval: 1440, settings_limit: 200 }),
|
|
]);
|
|
|
|
const seen = new Map();
|
|
if (flowsRaw) {
|
|
for (const r of flowsRaw) {
|
|
const ip = r.local_ip?.address;
|
|
const mac = r.local_mac;
|
|
if (!ip) continue;
|
|
if (!seen.has(ip)) {
|
|
seen.set(ip, {
|
|
detected_at : r.first_seen_at?.date ?? null,
|
|
ip_address : ip,
|
|
mac_address : mac ?? null,
|
|
device_label : r.device?.label ?? null,
|
|
device_type : r.mac?.discovery_hardware ?? null,
|
|
os_label : r.discovery_os?.label ?? null,
|
|
manufacturer : mac ? (OUI_MAP[mac.substring(0,8).toUpperCase()] ?? null) : null,
|
|
is_new : true,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
// Tambah IP yang punya bandwidth tapi tidak ada di flows
|
|
if (dlData) {
|
|
for (const r of dlData) {
|
|
const ip = r.local_ip?.address ?? String(r.local_ip ?? '');
|
|
if (ip && !seen.has(ip)) {
|
|
seen.set(ip, {
|
|
detected_at : null,
|
|
ip_address : ip,
|
|
mac_address : null,
|
|
device_label : null,
|
|
device_type : null,
|
|
os_label : null,
|
|
manufacturer : null,
|
|
is_new : true,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return Array.from(seen.values()).slice(0, limit);
|
|
}
|
|
|
|
// 24. Encryption Audit — derive dari TLS security per-IP dari flows
|
|
async function fetchEncryptionAudit(limit = 50) {
|
|
const [tlsSec, flowsRaw] = await Promise.all([
|
|
netifyFetch('/data/stats/top/tls_security/download', { filter_interval: 1440, settings_limit: 10 }),
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
]);
|
|
|
|
// Hitung per-IP: encrypted vs unencrypted flows
|
|
const ipStats = {};
|
|
if (flowsRaw) {
|
|
for (const r of flowsRaw) {
|
|
const ip = r.local_ip?.address;
|
|
const port = r.remote_port ?? 0;
|
|
const mac = r.local_mac ?? null;
|
|
if (!ip) continue;
|
|
if (!ipStats[ip]) ipStats[ip] = { mac, encrypted: 0, unencrypted: 0, total_bytes: 0 };
|
|
const bytes = (r.download ?? 0) + (r.upload ?? 0);
|
|
// Port 443, 8443, 465, 993, 995, 22 = encrypted
|
|
const isEnc = [443, 8443, 465, 993, 995, 22, 853].includes(port);
|
|
if (isEnc) ipStats[ip].encrypted += bytes;
|
|
else ipStats[ip].unencrypted += bytes;
|
|
ipStats[ip].total_bytes += bytes;
|
|
}
|
|
}
|
|
|
|
return Object.entries(ipStats)
|
|
.map(([ip, s]) => {
|
|
const total = s.encrypted + s.unencrypted;
|
|
const enc_pct = total > 0 ? (s.encrypted / total) * 100 : null;
|
|
const risk = enc_pct === null ? null
|
|
: enc_pct >= 90 ? 'Low'
|
|
: enc_pct >= 60 ? 'Medium'
|
|
: enc_pct >= 30 ? 'High'
|
|
: 'Critical';
|
|
const oui = s.mac ? s.mac.substring(0,8).toUpperCase() : null;
|
|
return {
|
|
ip_address : ip,
|
|
mac_address : s.mac,
|
|
device_label : OUI_MAP[oui] ?? null,
|
|
encrypted_pct : enc_pct != null ? Math.round(enc_pct * 10) / 10 : null,
|
|
encrypted : s.encrypted,
|
|
unencrypted : s.unencrypted,
|
|
total : total,
|
|
risk_level : risk,
|
|
detected_at : null,
|
|
};
|
|
})
|
|
.sort((a, b) => (a.encrypted_pct ?? 101) - (b.encrypted_pct ?? 101))
|
|
.slice(0, limit);
|
|
}
|
|
|
|
// 25. Insecure Protocols — derive dari top protocols (confirmed bekerja)
|
|
async function fetchInsecureProtocols(interval = 1440, limit = 50) {
|
|
const INSECURE = {
|
|
'HTTP' : { port: 80, risk: 'High' },
|
|
'FTP' : { port: 21, risk: 'Critical' },
|
|
'Telnet' : { port: 23, risk: 'Critical' },
|
|
'SMTP' : { port: 25, risk: 'Medium' },
|
|
'POP3' : { port: 110, risk: 'Medium' },
|
|
'IMAP' : { port: 143, risk: 'Medium' },
|
|
'DNS' : { port: 53, risk: 'Low' },
|
|
'SNMP' : { port: 161, risk: 'High' },
|
|
'LDAP' : { port: 389, risk: 'High' },
|
|
'RDP' : { port: 3389, risk: 'High' },
|
|
'NTP' : { port: 123, risk: 'Low' },
|
|
'TFTP' : { port: 69, risk: 'High' },
|
|
'rsh' : { port: 514, risk: 'Critical' },
|
|
'rlogin' : { port: 513, risk: 'Critical' },
|
|
};
|
|
|
|
const [protoData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/protocol/download', { filter_interval: interval, settings_limit: 100 }),
|
|
netifyFetch('/data/stats/top/protocol/upload', { filter_interval: interval, settings_limit: 100 }),
|
|
]);
|
|
if (!protoData) return [];
|
|
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const id = r.protocol?.id;
|
|
if (id) ulMap[id] = r.upload ?? 0;
|
|
}
|
|
|
|
return protoData
|
|
.filter(r => INSECURE[r.protocol?.label])
|
|
.map(r => {
|
|
const label = r.protocol?.label ?? 'Unknown';
|
|
const info = INSECURE[label];
|
|
return {
|
|
protocol : label,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
dst_ip : null,
|
|
dst_port : info.port,
|
|
app_label : null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.protocol?.id] ?? 0,
|
|
risk : info.risk,
|
|
detected_at : null,
|
|
source : 'derived',
|
|
};
|
|
})
|
|
.slice(0, limit);
|
|
}
|
|
|
|
// 26. IP Reputation — derive dari top remote_ip + cross-check negara berisiko tinggi
|
|
async function fetchIPReputation(limit = 50) {
|
|
// Negara dengan risiko tinggi berdasarkan threat intel umum
|
|
const HIGH_RISK_COUNTRIES = new Set([
|
|
'China', 'Russia', 'Iran', 'North Korea', 'Nigeria', 'Romania',
|
|
'Brazil', 'Ukraine', 'Vietnam', 'Indonesia',
|
|
]);
|
|
|
|
const [ipData, countryData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/remote_ip/download', { filter_interval: 1440, settings_limit: 100 }),
|
|
netifyFetch('/data/stats/top/country/download', { filter_interval: 1440, settings_limit: 50 }),
|
|
]);
|
|
|
|
const results = [];
|
|
|
|
if (ipData) {
|
|
// Tandai IP dari negara berisiko (informasi negara tidak ada per-IP dari API,
|
|
// jadi kita pakai country data untuk konteks)
|
|
for (const r of ipData) {
|
|
const ip = r.remote_ip?.address ?? String(r.remote_ip ?? '');
|
|
if (!ip) continue;
|
|
results.push({
|
|
ip_address : ip,
|
|
local_ip : null,
|
|
mac_address : null,
|
|
reputation : 'Unknown',
|
|
score : null,
|
|
country : null,
|
|
app_label : null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
detected_at : null,
|
|
blacklisted : false,
|
|
source : 'derived:top_ip',
|
|
});
|
|
}
|
|
}
|
|
|
|
// Tambah entri untuk negara berisiko yang terdeteksi
|
|
if (countryData) {
|
|
for (const r of countryData) {
|
|
const country = r.country?.label ?? '';
|
|
if (HIGH_RISK_COUNTRIES.has(country)) {
|
|
results.push({
|
|
ip_address : null,
|
|
local_ip : null,
|
|
mac_address : null,
|
|
reputation : 'High-Risk Country',
|
|
score : 0.7,
|
|
country : country,
|
|
app_label : null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
detected_at : null,
|
|
blacklisted : false,
|
|
source : 'derived:country',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return results.slice(0, limit);
|
|
}
|
|
|
|
// 27. Server Discovery — derive dari flows dengan flow_origin=Server + port well-known server
|
|
async function fetchServerDiscovery(limit = 100) {
|
|
const SERVER_PORTS = {
|
|
80: 'HTTP', 443: 'HTTPS', 22: 'SSH', 21: 'FTP', 25: 'SMTP',
|
|
110: 'POP3', 143: 'IMAP', 3306: 'MySQL', 5432: 'PostgreSQL',
|
|
6379: 'Redis', 27017: 'MongoDB', 8080: 'HTTP-Alt', 8443: 'HTTPS-Alt',
|
|
53: 'DNS', 3389: 'RDP', 5900: 'VNC', 161: 'SNMP', 123: 'NTP',
|
|
389: 'LDAP', 636: 'LDAPS', 5060: 'SIP', 1194: 'OpenVPN',
|
|
};
|
|
|
|
const [flowOriginData, flowsRaw] = await Promise.all([
|
|
netifyFetch('/data/stats/top/flow_origin/download', { filter_interval: 1440, settings_limit: 10 }),
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
]);
|
|
|
|
const serverMap = {};
|
|
if (flowsRaw) {
|
|
for (const r of flowsRaw) {
|
|
const localIP = r.local_ip?.address;
|
|
const localPort = r.local_port ?? r.remote_port;
|
|
const proto = r.ip_protocol?.label ?? null;
|
|
const mac = r.local_mac ?? null;
|
|
if (!localIP) continue;
|
|
|
|
// Deteksi server: local device listening di port well-known
|
|
const svcName = SERVER_PORTS[localPort] ?? SERVER_PORTS[r.remote_port];
|
|
if (svcName) {
|
|
const key = `${localIP}:${localPort ?? r.remote_port}`;
|
|
if (!serverMap[key]) {
|
|
const oui = mac ? mac.substring(0,8).toUpperCase() : null;
|
|
serverMap[key] = {
|
|
detected_at : r.first_seen_at?.date ?? null,
|
|
ip_address : localIP,
|
|
mac_address : mac,
|
|
server_type : svcName,
|
|
hostname : r.device?.label ?? null,
|
|
port : localPort ?? r.remote_port,
|
|
protocol : proto,
|
|
os_label : null,
|
|
download : 0,
|
|
upload : 0,
|
|
};
|
|
}
|
|
serverMap[key].download += r.download ?? 0;
|
|
serverMap[key].upload += r.upload ?? 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
return Object.values(serverMap)
|
|
.sort((a, b) => (b.download + b.upload) - (a.download + a.upload))
|
|
.slice(0, limit);
|
|
}
|
|
|
|
// 28. Tor Detection — derive dari top remote_ip + app/hostname matching Tor
|
|
async function fetchTorDetection(limit = 50) {
|
|
const TOR_INDICATORS = ['tor', '.onion', 'torproject', 'torbrowser'];
|
|
|
|
const [appData, domainData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application/download', { filter_interval: 1440, settings_limit: 100 }),
|
|
netifyFetch('/data/stats/top/hostname/download', { filter_interval: 1440, settings_limit: 100 }),
|
|
]);
|
|
|
|
const results = [];
|
|
|
|
if (appData) {
|
|
for (const r of appData) {
|
|
const name = (r.application?.label ?? '').toLowerCase();
|
|
const tag = (r.application?.tag ?? '').toLowerCase();
|
|
if (TOR_INDICATORS.some(k => name.includes(k) || tag.includes(k))) {
|
|
results.push({
|
|
detected_at : null,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
exit_node : null,
|
|
circuit_id : null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
country : null,
|
|
source : 'derived:app',
|
|
label : r.application?.label,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
if (domainData) {
|
|
for (const r of domainData) {
|
|
const host = (r.hostname?.name ?? '').toLowerCase();
|
|
if (TOR_INDICATORS.some(k => host.includes(k))) {
|
|
results.push({
|
|
detected_at : null,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
exit_node : null,
|
|
circuit_id : null,
|
|
download : r.download ?? 0,
|
|
upload : 0,
|
|
country : null,
|
|
source : 'derived:hostname',
|
|
label : r.hostname?.name,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return results.slice(0, limit);
|
|
}
|
|
|
|
// 29. Unencrypted Passwords — derive dari flows ke port cleartext auth
|
|
async function fetchUnencryptedPasswords(limit = 50) {
|
|
// Port yang dikenal mengirim kredensial cleartext
|
|
const CLEARTEXT_AUTH_PORTS = {
|
|
21 : { protocol: 'FTP', severity: 'Critical' },
|
|
23 : { protocol: 'Telnet', severity: 'Critical' },
|
|
25 : { protocol: 'SMTP', severity: 'High' },
|
|
80 : { protocol: 'HTTP', severity: 'High' },
|
|
110 : { protocol: 'POP3', severity: 'High' },
|
|
143 : { protocol: 'IMAP', severity: 'High' },
|
|
389 : { protocol: 'LDAP', severity: 'Critical' },
|
|
512 : { protocol: 'rexec', severity: 'Critical' },
|
|
513 : { protocol: 'rlogin', severity: 'Critical' },
|
|
514 : { protocol: 'rsh', severity: 'Critical' },
|
|
};
|
|
|
|
const flowsRaw = await netifyFetch('/data/flows', { settings_limit: 500 });
|
|
if (!flowsRaw) return [];
|
|
|
|
const seen = new Map();
|
|
for (const r of flowsRaw) {
|
|
const port = r.remote_port ?? 0;
|
|
const info = CLEARTEXT_AUTH_PORTS[port];
|
|
if (!info) continue;
|
|
|
|
const key = `${r.local_ip?.address}:${r.remote_ip?.address}:${port}`;
|
|
if (!seen.has(key)) {
|
|
seen.set(key, {
|
|
detected_at : r.first_seen_at?.date ?? null,
|
|
ip_address : r.local_ip?.address ?? null,
|
|
mac_address : r.local_mac ?? null,
|
|
dst_ip : r.remote_ip?.address ?? null,
|
|
dst_port : port,
|
|
protocol : info.protocol,
|
|
username : null,
|
|
download : 0,
|
|
upload : 0,
|
|
severity : info.severity,
|
|
});
|
|
}
|
|
seen.get(key).download += r.download ?? 0;
|
|
seen.get(key).upload += r.upload ?? 0;
|
|
}
|
|
|
|
return Array.from(seen.values())
|
|
.sort((a, b) => (b.download + b.upload) - (a.download + a.upload))
|
|
.slice(0, limit);
|
|
}
|
|
|
|
// 30. VPN Detection — derive dari apps/protocols/hostnames yang mengindikasikan VPN
|
|
async function fetchVPNDetection(limit = 50) {
|
|
const VPN_APPS = [
|
|
'openvpn', 'wireguard', 'nordvpn', 'expressvpn', 'surfshark', 'tunnelbear',
|
|
'mullvad', 'protonvpn', 'ipvanish', 'pia', 'private internet access',
|
|
'hotspot shield', 'cyberghost', 'vpn', 'pptp', 'l2tp', 'ipsec', 'sstp',
|
|
'shadowsocks', 'v2ray', 'trojan', 'outline',
|
|
];
|
|
const VPN_PROTOCOLS = new Set(['OpenVPN', 'WireGuard', 'IPSec', 'PPTP', 'L2TP', 'GRE', 'SSTP']);
|
|
// Port yang umum digunakan VPN
|
|
const VPN_PORTS = new Set([1194, 51820, 500, 4500, 1701, 1723, 8388, 443]);
|
|
|
|
const [appData, protoData, flowsRaw] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application/download', { filter_interval: 1440, settings_limit: 100 }),
|
|
netifyFetch('/data/stats/top/protocol/download', { filter_interval: 1440, settings_limit: 50 }),
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
]);
|
|
|
|
const results = [];
|
|
|
|
if (appData) {
|
|
for (const r of appData) {
|
|
const name = (r.application?.label ?? '').toLowerCase();
|
|
const tag = (r.application?.tag ?? '').toLowerCase();
|
|
if (VPN_APPS.some(k => name.includes(k) || tag.includes(k))) {
|
|
results.push({
|
|
detected_at : null,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
vpn_type : r.application?.label ?? 'Unknown VPN',
|
|
remote_ip : null,
|
|
protocol : null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
country : null,
|
|
confidence : 0.9,
|
|
source : 'derived:app',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
if (protoData) {
|
|
for (const r of protoData) {
|
|
const label = r.protocol?.label ?? '';
|
|
if (VPN_PROTOCOLS.has(label)) {
|
|
results.push({
|
|
detected_at : null,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
vpn_type : label,
|
|
remote_ip : null,
|
|
protocol : label,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
country : null,
|
|
confidence : 0.85,
|
|
source : 'derived:protocol',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
if (flowsRaw) {
|
|
const portSeen = new Set();
|
|
for (const r of flowsRaw) {
|
|
const port = r.remote_port ?? 0;
|
|
if (VPN_PORTS.has(port) && !portSeen.has(port)) {
|
|
portSeen.add(port);
|
|
results.push({
|
|
detected_at : r.first_seen_at?.date ?? null,
|
|
ip_address : r.local_ip?.address ?? null,
|
|
mac_address : r.local_mac ?? null,
|
|
vpn_type : `Port ${port}`,
|
|
remote_ip : r.remote_ip?.address ?? null,
|
|
protocol : r.ip_protocol?.label ?? null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
country : null,
|
|
confidence : 0.75,
|
|
source : 'derived:port',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return results.slice(0, limit);
|
|
} |