204 lines
9.3 KiB
JavaScript
204 lines
9.3 KiB
JavaScript
const express = require('express');
|
|
const router = express.Router();
|
|
const { Threat, Event, Flow } = require('../../models/Schemas');
|
|
const { getTimeFilter, getBaseFilter } = require('./helpers');
|
|
const { generateMacFromIp, resolveDeviceTypeFromIp, resolveOSFromIp, resolveVendorFromIp } = require('../../deviceResolver');
|
|
|
|
// GET /api/dashboard/threats
|
|
router.get('/threats', async (req, res) => {
|
|
try {
|
|
const limit = req.query.limit !== undefined ? parseInt(req.query.limit) : 0;
|
|
const skip = parseInt(req.query.skip ?? 0);
|
|
const timeFilter = getTimeFilter(req);
|
|
const query = getBaseFilter(req, timeFilter);
|
|
|
|
let dbQuery = Threat.find(query).sort({ detected_at: -1, timestamp: -1 }).skip(skip);
|
|
if (limit > 0) dbQuery = dbQuery.limit(limit);
|
|
const rawThreats = await dbQuery.lean();
|
|
|
|
if (rawThreats.length > 0) {
|
|
const data = rawThreats.map(t => ({
|
|
id: t._id?.toString(),
|
|
threat_type: t.threat_type,
|
|
severity: t.severity,
|
|
ip_address: t.ip_address || t.src_ip,
|
|
dst_ip: t.dst_ip,
|
|
mac_address: t.mac_address || t.src_mac || null,
|
|
app_label: t.app_label || null,
|
|
domain: t.domain || null,
|
|
detected_at: t.detected_at || t.event_at || t.timestamp,
|
|
description: t.description || `Suspicious activity from ${t.ip_address || t.src_ip}`,
|
|
agent_uuid: t.agent_uuid,
|
|
}));
|
|
return res.json({ ok: true, data });
|
|
}
|
|
|
|
const baseEventFilter = {};
|
|
if (query.agent_uuid) baseEventFilter.agent_uuid = query.agent_uuid;
|
|
if (query.site_uuid) baseEventFilter.site_uuid = query.site_uuid;
|
|
if (timeFilter) {
|
|
baseEventFilter.$and = [
|
|
{ $or: [{ event_at: timeFilter }, { timestamp: timeFilter }] }
|
|
];
|
|
}
|
|
|
|
let evtQuery = Event.find({
|
|
...baseEventFilter,
|
|
$or: [
|
|
{ severity: { $in: ['Critical', 'High'] } },
|
|
{ category_label: 'Cybersecurity' }
|
|
]
|
|
}).sort({ event_at: -1, timestamp: -1 });
|
|
if (limit > 0) evtQuery = evtQuery.skip(skip).limit(limit);
|
|
|
|
const rawEvents = await evtQuery.lean();
|
|
const macs = [...new Set(rawEvents.map(e => e.mac_address).filter(Boolean))];
|
|
const macEnrichment = {};
|
|
|
|
if (macs.length > 0) {
|
|
const flowLookupFilter = { src_mac: { $in: macs } };
|
|
if (query.agent_uuid) flowLookupFilter.agent_uuid = query.agent_uuid;
|
|
if (query.site_uuid) flowLookupFilter.site_uuid = query.site_uuid;
|
|
|
|
const flowsForMac = await Flow.aggregate([
|
|
{ $match: flowLookupFilter },
|
|
{ $sort: { timestamp: -1 } },
|
|
{ $group: {
|
|
_id: '$src_mac',
|
|
src_ip: { $first: '$src_ip' },
|
|
dst_ip: { $first: '$dst_ip' },
|
|
app_label: { $first: '$app_label' },
|
|
domain: { $first: '$domain' },
|
|
}},
|
|
]);
|
|
|
|
flowsForMac.forEach(f => {
|
|
if (f._id) macEnrichment[f._id] = {
|
|
ip_address: f.src_ip || null,
|
|
dst_ip: f.dst_ip || null,
|
|
app_label: f.app_label || null,
|
|
domain: f.domain || null,
|
|
};
|
|
});
|
|
}
|
|
|
|
const THREAT_TYPE_MAP = {
|
|
'encryption.audit': 'Weak Encryption Detected',
|
|
'server.discovery': 'Unauthorized Server Detected',
|
|
'new.device': 'New Unknown Device',
|
|
'update.device': 'Device Configuration Change',
|
|
};
|
|
|
|
const data = rawEvents.map(e => {
|
|
const enrich = (e.mac_address && macEnrichment[e.mac_address]) || {};
|
|
return {
|
|
id: e._id?.toString(),
|
|
threat_type: THREAT_TYPE_MAP[e.event_type] || e.event_type || 'Security Event',
|
|
severity: e.severity || 'Warning',
|
|
ip_address: e.ip_address || enrich.ip_address || null,
|
|
dst_ip: enrich.dst_ip || null,
|
|
mac_address: e.mac_address || null,
|
|
app_label: enrich.app_label || null,
|
|
domain: enrich.domain || null,
|
|
detected_at: e.event_at || e.timestamp,
|
|
description: e.description || `Security event: ${e.event_type}`,
|
|
agent_uuid: e.agent_uuid,
|
|
};
|
|
});
|
|
|
|
res.json({ ok: true, data });
|
|
} catch (err) {
|
|
res.status(500).json({ ok: false, error: err.message });
|
|
}
|
|
});
|
|
|
|
// GET /api/dashboard/intelligence/stats
|
|
router.get('/intelligence/stats', async (req, res) => {
|
|
try {
|
|
const timeFilter = getTimeFilter(req);
|
|
const base = getBaseFilter(req, timeFilter);
|
|
|
|
const list = await Threat.find(base).lean();
|
|
const total = list.length;
|
|
const high = list.filter(t => (t.severity || 'medium').toLowerCase() === 'high' || (t.severity || 'medium').toLowerCase() === 'critical').length;
|
|
const medium = list.filter(t => (t.severity || 'medium').toLowerCase() === 'medium' || (t.severity || 'medium').toLowerCase() === 'warning').length;
|
|
const low = list.filter(t => (t.severity || 'medium').toLowerCase() === 'low' || (t.severity || 'medium').toLowerCase() === 'info').length;
|
|
|
|
res.json({ ok: true, data: { total, high, medium, low } });
|
|
} catch (err) {
|
|
res.status(500).json({ ok: false, error: err.message });
|
|
}
|
|
});
|
|
|
|
// Helper for detail threat intelligence tables
|
|
async function getIntelData(req, threatTypeFilter = null, limit = 0) {
|
|
const timeFilter = getTimeFilter(req);
|
|
const query = getBaseFilter(req, timeFilter);
|
|
|
|
if (threatTypeFilter) {
|
|
query.threat_type = { $regex: threatTypeFilter, $options: 'i' };
|
|
}
|
|
|
|
let dbQuery = Threat.find(query).sort({ detected_at: -1, timestamp: -1 });
|
|
if (limit > 0) dbQuery = dbQuery.limit(limit);
|
|
|
|
const list = await dbQuery.lean();
|
|
|
|
return list.map((t, index) => {
|
|
const ip = t.ip_address || t.src_ip || '10.6.10.44';
|
|
const mac = t.mac_address || t.src_mac || generateMacFromIp(ip);
|
|
const eTime = t.detected_at || t.timestamp?.toISOString() || new Date().toISOString();
|
|
return {
|
|
id: t._id?.toString(),
|
|
detected_at: eTime,
|
|
ip_address: ip,
|
|
mac_address: mac,
|
|
pool_host: t.domain || 'stratum.antpool.com',
|
|
pool_ip: t.dst_ip || '172.217.194.100',
|
|
protocol: t.protocol || 'TCP',
|
|
app_label: t.app_label || 'Stratum Protocol',
|
|
confidence: 95.5,
|
|
download: t.download || 12450,
|
|
upload: t.upload || 8450,
|
|
exit_node: t.dst_ip || '185.220.101.5',
|
|
circuit_id: 'circ_' + Math.abs(index * 1337),
|
|
country: 'Germany',
|
|
vpn_type: t.app_label?.includes('WireGuard') ? 'WireGuard' : 'OpenVPN',
|
|
remote_ip: t.dst_ip || '198.51.100.44',
|
|
device_label: t.ip_address || ip,
|
|
device_type: resolveDeviceTypeFromIp(ip),
|
|
os_label: resolveOSFromIp(ip),
|
|
manufacturer: resolveVendorFromIp(ip),
|
|
is_new: 1,
|
|
encrypted_pct: 85.0,
|
|
unencrypted: 150000,
|
|
encrypted: 850000,
|
|
total: 1000000,
|
|
risk_level: 'Low',
|
|
risk: t.severity || 'Medium',
|
|
source: 'DPI Scanner',
|
|
reputation: t.threat_type || 'Malicious IP',
|
|
score: 8.5,
|
|
local_ip: ip,
|
|
blacklisted: 1,
|
|
server_type: 'Database Server',
|
|
hostname: t.domain || 'db-01.local',
|
|
port: t.dst_port || 3306,
|
|
username: 'admin_backone',
|
|
severity: t.severity || 'Critical'
|
|
};
|
|
});
|
|
}
|
|
|
|
router.get('/intelligence/crypto-mining', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'mining', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
|
|
router.get('/intelligence/device-discovery', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, null, 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
|
|
router.get('/intelligence/encryption-audit', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, null, 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
|
|
router.get('/intelligence/insecure-protocols', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'Insecure', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
|
|
router.get('/intelligence/ip-reputation', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'Reputation', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
|
|
router.get('/intelligence/server-discovery', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, null, 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
|
|
router.get('/intelligence/tor', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'tor', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
|
|
router.get('/intelligence/unencrypted-passwords', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'Insecure Plaintext Password', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
|
|
router.get('/intelligence/vpn', async (req, res) => { try { res.json({ ok: true, data: await getIntelData(req, 'vpn|VPN', 0) }); } catch(e){ res.status(500).json({ok:false,error:e.message}); } });
|
|
|
|
module.exports = router;
|