1476 lines
53 KiB
JavaScript
1476 lines
53 KiB
JavaScript
// backend/netify.js
|
|
const path = require('path');
|
|
require('dotenv').config({ path: path.join(__dirname, '..', '.env.local') });
|
|
const axios = require('axios');
|
|
|
|
const BASE_URL = 'https://informatics.netify.ai/api/v1';
|
|
const JWT_TOKEN = process.env.NETIFY_JWT_TOKEN;
|
|
const SITE_UUID = process.env.NETIFY_SITE_UUID;
|
|
|
|
function headersSite(useApiKey = false) {
|
|
const token = useApiKey ? process.env.NETIFY_API_KEY : JWT_TOKEN;
|
|
const headers = { 'x-api-key': token, 'Accept': 'application/json' };
|
|
if (!useApiKey) {
|
|
headers['x-net-site'] = SITE_UUID;
|
|
}
|
|
return headers;
|
|
}
|
|
|
|
async function netifyFetch(path, params = {}, useApiKey = false) {
|
|
try {
|
|
const res = await axios.get(`${BASE_URL}${path}`, {
|
|
headers: headersSite(useApiKey), params, timeout: 30000,
|
|
});
|
|
const json = res.data;
|
|
if (json?.status_code !== 0) {
|
|
console.error(`[Netify] API Error ${json?.status_code} pada ${path}: ${json?.status_message}`);
|
|
return null;
|
|
}
|
|
return json?.data ?? null;
|
|
} catch (err) {
|
|
const s = err.response?.status;
|
|
const msg = JSON.stringify(err.response?.data ?? err.message);
|
|
console.error(`[Netify] ${s ?? 'ERR'} ${path}: ${msg}`);
|
|
return null;
|
|
}
|
|
}
|
|
|
|
// ─── TOP APPS: download + upload digabung ─────────────────────────────────────
|
|
async function fetchTopApps(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/application/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
|
|
// Buat map upload berdasarkan app_id
|
|
const ulMap = {};
|
|
if (ulData) {
|
|
for (const r of ulData) {
|
|
const id = r.application?.id;
|
|
if (id) ulMap[id] = r.upload ?? 0;
|
|
}
|
|
}
|
|
|
|
return dlData.map(r => ({
|
|
app_id : r.application?.id ?? null,
|
|
app_label : r.application?.label ?? 'Unknown',
|
|
app_tag : r.application?.tag ?? null,
|
|
category : r.application?.category?.label ?? null,
|
|
favicon : r.application?.favicon ?? null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.application?.id] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[r.application?.id] ?? 0),
|
|
flows : r.flows ?? 0,
|
|
}));
|
|
}
|
|
|
|
// ─── TOP DEVICES: download + upload digabung ──────────────────────────────────
|
|
async function fetchTopDevices(interval = 1440, limit = 50) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/local_ip/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/local_ip/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
|
|
// Map upload berdasarkan IP address
|
|
const ulMap = {};
|
|
if (ulData) {
|
|
for (const r of ulData) {
|
|
const ip = r.local_ip?.address ?? String(r.local_ip);
|
|
ulMap[ip] = r.upload ?? 0;
|
|
}
|
|
}
|
|
|
|
return dlData.map(r => {
|
|
const ip = r.local_ip?.address ?? String(r.local_ip ?? '');
|
|
return {
|
|
ip_address : ip,
|
|
mac_address : null,
|
|
device_label : ip,
|
|
device_type : null,
|
|
os_label : null,
|
|
manufacturer : null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[ip] ?? 0,
|
|
last_seen : null,
|
|
};
|
|
});
|
|
}
|
|
|
|
// ─── FLOWS: endpoint /data/flows yang sudah confirmed ada ────────────────────
|
|
async function fetchFlows(limit = 500) {
|
|
const raw = await netifyFetch('/data/flows', { settings_limit: limit });
|
|
if (!raw || !Array.isArray(raw)) return null;
|
|
|
|
return raw.map(r => ({
|
|
flow_id : String(r.flow_id ?? ''),
|
|
src_ip : r.local_ip?.address ?? null,
|
|
src_mac : r.local_mac ?? r.mac?.address ?? null,
|
|
dst_ip : r.remote_ip?.address ?? null,
|
|
dst_port : r.remote_port ?? null,
|
|
protocol : r.ip_protocol?.label ?? null,
|
|
app_label : null, // tidak tersedia di API flows
|
|
domain : null, // tidak tersedia di API flows
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
first_seen : r.first_seen_at?.date ?? null,
|
|
last_seen : r.last_seen_at?.date ?? null,
|
|
}));
|
|
}
|
|
|
|
// ─── PROTOCOLS ────────────────────────────────────────────────────────────────
|
|
async function fetchTopProtocols(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/protocol/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/protocol/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
|
|
const ulMap = {};
|
|
if (ulData) {
|
|
for (const r of ulData) {
|
|
const id = r.protocol?.id;
|
|
if (id) ulMap[id] = r.upload ?? 0;
|
|
}
|
|
}
|
|
|
|
return dlData.map(r => ({
|
|
protocol_id : r.protocol?.id ?? null,
|
|
protocol_label : r.protocol?.label ?? 'Unknown',
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.protocol?.id] ?? 0,
|
|
flows : r.flows ?? 0,
|
|
}));
|
|
}
|
|
|
|
// ─── COUNTRIES ────────────────────────────────────────────────────────────────
|
|
async function fetchTopCountries(interval = 1440, limit = 15) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/country/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/country/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
|
|
const ulMap = {};
|
|
if (ulData) {
|
|
for (const r of ulData) {
|
|
const code = r.country?.code;
|
|
if (code) ulMap[code] = r.upload ?? 0;
|
|
}
|
|
}
|
|
|
|
return dlData.map(r => ({
|
|
country_code : r.country?.code ?? null,
|
|
country_name : r.country?.label ?? 'Unknown',
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.country?.code] ?? 0,
|
|
flows : r.flows ?? 0,
|
|
}));
|
|
}
|
|
|
|
// ─── DNS/HOSTNAME ─────────────────────────────────────────────────────────────
|
|
async function fetchTopDomains(interval = 1440, limit = 20) {
|
|
const raw = await netifyFetch('/data/stats/top/hostname/download', {
|
|
filter_interval: interval, settings_limit: limit,
|
|
});
|
|
if (!raw) return null;
|
|
|
|
return raw.map(r => ({
|
|
domain : r.hostname?.name ?? null,
|
|
app_label : r.hostname?.application_name ?? null,
|
|
category : r.hostname?.application_category_label ?? null,
|
|
download : r.download ?? 0,
|
|
query_count : r.flows ?? r.download ?? 0,
|
|
}));
|
|
}
|
|
|
|
// ─── BANDWIDTH SUMMARY untuk timeline ─────────────────────────────────────────
|
|
async function fetchBandwidthSummary(interval = 30) {
|
|
// Pakai interval PENDEK (30 menit) untuk timeline supaya ada variasi naik turun
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application/download', { filter_interval: interval, settings_limit: 100 }),
|
|
netifyFetch('/data/stats/top/application/upload', { filter_interval: interval, settings_limit: 100 }),
|
|
]);
|
|
|
|
const download = (dlData ?? []).reduce((s, r) => s + (r.download ?? 0), 0);
|
|
const upload = (ulData ?? []).reduce((s, r) => s + (r.upload ?? 0), 0);
|
|
const flows = (dlData ?? []).reduce((s, r) => s + (r.flows ?? 0), 0);
|
|
|
|
return { download, upload, flows, devices: dlData?.length ?? 0 };
|
|
}
|
|
|
|
// ─── THREATS — gunakan flows dengan filter anomali sebagai fallback ────────────
|
|
async function fetchCyberThreats(limit = 50) {
|
|
// Events/threats belum ada di v1 — return array kosong agar tidak error
|
|
// Akan diisi saat endpoint ditemukan
|
|
return [];
|
|
}
|
|
|
|
// ─── EVENTS ───────────────────────────────────────────────────────────────────
|
|
async function fetchEvents(limit = 50) {
|
|
const raw = await netifyFetch('/event/events', { settings_limit: limit });
|
|
if (!raw || !Array.isArray(raw)) return [];
|
|
|
|
return raw.map(r => {
|
|
let msg = r.label || '';
|
|
if (r.description) {
|
|
try {
|
|
const descObj = JSON.parse(r.description);
|
|
msg = descObj.default || r.label || '';
|
|
if (descObj.tags) {
|
|
for (const k in descObj.tags) {
|
|
const val = Array.isArray(descObj.tags[k]) ? descObj.tags[k][0] : descObj.tags[k];
|
|
msg = msg.replace(`{{ ${k} }}`, val).replace(`{{${k}}}`, val);
|
|
}
|
|
}
|
|
} catch (e) {
|
|
msg = r.description;
|
|
}
|
|
}
|
|
|
|
let sevLabel = 'Info';
|
|
if (r.severity >= 30) sevLabel = 'Critical';
|
|
else if (r.severity >= 20) sevLabel = 'High';
|
|
else if (r.severity >= 10) sevLabel = 'Warning';
|
|
|
|
let srcIp = null;
|
|
if (r.description) {
|
|
try {
|
|
const descObj = JSON.parse(r.description);
|
|
srcIp = descObj.tags?.device_ip || descObj.tags?.ip || null;
|
|
} catch {}
|
|
}
|
|
|
|
return {
|
|
event_id: r.id || null,
|
|
event_type: r.basename || 'unknown',
|
|
severity: sevLabel,
|
|
mac_address: r.additional?.device?.mac?.address || null,
|
|
ip_address: srcIp,
|
|
description: msg,
|
|
event_at: r.created_at?.date || new Date().toISOString()
|
|
};
|
|
});
|
|
}
|
|
|
|
async function fetchDiscoveredDevices(interval = 1440, limit = 500) {
|
|
const [intelRaw, dlData, ulData] = await Promise.all([
|
|
netifyFetch('/intelligence/discovery/devices', { settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/local_ip/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/local_ip/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
|
|
if (!intelRaw || !Array.isArray(intelRaw)) return [];
|
|
|
|
// Map bandwidth per IP
|
|
const dlMap = {};
|
|
const ulMap = {};
|
|
if (dlData) {
|
|
for (const r of dlData) {
|
|
const ip = r.local_ip?.address ?? String(r.local_ip);
|
|
dlMap[ip] = r.download ?? 0;
|
|
}
|
|
}
|
|
if (ulData) {
|
|
for (const r of ulData) {
|
|
const ip = r.local_ip?.address ?? String(r.local_ip);
|
|
ulMap[ip] = r.upload ?? 0;
|
|
}
|
|
}
|
|
|
|
return intelRaw.map(r => {
|
|
const ip = r.ip?.address ?? null;
|
|
const mac = r.mac_address ?? r.discovery_mac?.address ?? null;
|
|
const oui = mac ? mac.substring(0, 8).toUpperCase() : null;
|
|
const mfr = r.mac_vendor !== 'Unknown' && r.mac_vendor !== 'Local' ? r.mac_vendor : (OUI_MAP[oui] ?? r.mac_vendor ?? null);
|
|
|
|
return {
|
|
ip_address : ip,
|
|
mac_address : mac,
|
|
device_label : r.device?.label || r.discovery_mac?.discovery_hardware || ip || 'Unknown',
|
|
device_type : r.discovery_type?.label || null,
|
|
os_label : r.discovery_os?.label || null,
|
|
manufacturer : mfr,
|
|
download : ip ? (dlMap[ip] ?? 0) : 0,
|
|
upload : ip ? (ulMap[ip] ?? 0) : 0,
|
|
last_seen : r.last_seen_at?.date || r.discovery_mac?.last_seen_at?.date || null,
|
|
};
|
|
}).sort((a, b) => b.download - a.download);
|
|
}
|
|
|
|
// OUI lookup — manufacturer dari 3 oktet pertama MAC
|
|
const OUI_MAP = {
|
|
'60:BE:B4' : 'Ruckus Networks',
|
|
'74:6F:88' : 'Ruckus Networks',
|
|
'04:F4:1C' : 'MikroTik',
|
|
'F4:6D:3F' : 'TP-Link',
|
|
'B8:27:EB' : 'Raspberry Pi',
|
|
'DC:A6:32' : 'Raspberry Pi',
|
|
'E4:5F:01' : 'Raspberry Pi',
|
|
'00:50:56' : 'VMware',
|
|
'08:00:27' : 'VirtualBox',
|
|
'AC:17:02' : 'ASUSTek',
|
|
'B4:2E:99' : 'ASUSTek',
|
|
'18:31:BF' : 'ASUSTek',
|
|
'74:D0:2B' : 'Cisco',
|
|
'F8:72:EA' : 'Cisco',
|
|
'00:1A:A0' : 'Cisco',
|
|
'FC:FB:FB' : 'Cisco Meraki',
|
|
'88:15:44' : 'Cisco Meraki',
|
|
'00:18:0A' : 'Ubiquiti',
|
|
'04:18:D6' : 'Ubiquiti',
|
|
'24:A4:3C' : 'Ubiquiti',
|
|
'78:8A:20' : 'Ubiquiti',
|
|
'DC:9F:DB' : 'Ubiquiti',
|
|
'80:2A:A8' : 'Ubiquiti',
|
|
'FC:EC:DA' : 'Ubiquiti',
|
|
'00:27:22' : 'Ubiquiti',
|
|
'B4:FB:E4' : 'Samsung',
|
|
'8C:79:F0' : 'Samsung',
|
|
'F0:25:B7' : 'Samsung',
|
|
'78:BD:BC' : 'Samsung',
|
|
'3C:28:6D' : 'Apple',
|
|
'A4:C3:F0' : 'Apple',
|
|
'F8:FF:C2' : 'Apple',
|
|
'98:01:A7' : 'Apple',
|
|
'3C:22:FB' : 'Apple',
|
|
'F0:DB:F8' : 'Huawei',
|
|
'00:E0:FC' : 'Huawei',
|
|
'54:89:98' : 'Huawei',
|
|
'28:31:52' : 'Xiaomi',
|
|
'64:09:80' : 'Xiaomi',
|
|
'AC:C1:EE' : 'Xiaomi',
|
|
'50:64:2B' : 'Xiaomi',
|
|
'00:0C:29' : 'VMware',
|
|
'00:15:5D' : 'Microsoft Hyper-V',
|
|
'52:54:00' : 'QEMU/KVM',
|
|
};
|
|
|
|
// ─── TAMBAHAN FITUR 1-11 ──────────────────────────────────────────────────────
|
|
|
|
// 1. Top Application Category
|
|
async function fetchTopAppCategories(interval = 1440, limit = 15) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application_category/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/application_category/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.application_category?.label ?? r.application_category;
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.application_category?.label ?? String(r.application_category ?? 'Unknown');
|
|
return {
|
|
category_label : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 2. Top Continent
|
|
async function fetchTopContinents(interval = 1440, limit = 10) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/continent/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/continent/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.continent?.label ?? String(r.continent ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.continent?.label ?? String(r.continent ?? 'Unknown');
|
|
return {
|
|
continent_name : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 3. Top Region
|
|
async function fetchTopRegions(interval = 1440, limit = 20) {
|
|
const raw = await netifyFetch('/data/stats/top/region/download', {
|
|
filter_interval: interval, settings_limit: limit,
|
|
});
|
|
if (!raw) return null;
|
|
return raw.map(r => ({
|
|
region_name : r.region?.region_name?.trim() || '(Unknown Region)',
|
|
region_code : r.region?.region_code?.trim() || null,
|
|
country_name : r.region?.country_name ?? null,
|
|
country_code : r.region?.country_code ?? null,
|
|
download : r.download ?? 0,
|
|
}));
|
|
}
|
|
|
|
// 4. Top City
|
|
async function fetchTopCities(interval = 1440, limit = 20) {
|
|
const raw = await netifyFetch('/data/stats/top/city/download', {
|
|
filter_interval: interval, settings_limit: limit,
|
|
});
|
|
if (!raw) return null;
|
|
return raw.map(r => ({
|
|
city_name : r.city?.city?.trim() || '(Unknown City)',
|
|
region_name : r.city?.region_name?.trim() || null,
|
|
country_name : r.city?.country_name ?? null,
|
|
country_code : r.city?.country_code ?? null,
|
|
download : r.download ?? 0,
|
|
}));
|
|
}
|
|
|
|
// 5. Top VLAN
|
|
async function fetchTopVLANs(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/vlan/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/vlan/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.vlan?.id ?? 0;
|
|
ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => ({
|
|
vlan_id : r.vlan?.id ?? 0,
|
|
vlan_label : r.vlan?.label ?? `VLAN ${r.vlan?.id ?? 0}`,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.vlan?.id ?? 0] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[r.vlan?.id ?? 0] ?? 0),
|
|
}));
|
|
}
|
|
|
|
// 6. Top Interface
|
|
async function fetchTopInterfaces(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/interface/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/interface/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.interface?.id;
|
|
if (key !== undefined) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => ({
|
|
iface_id : r.interface?.id ?? null,
|
|
iface_name : r.interface?.name ?? 'Unknown',
|
|
iface_role : r.interface?.role ?? null,
|
|
agent_id : r.interface?.agent_id ?? null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.interface?.id] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[r.interface?.id] ?? 0),
|
|
}));
|
|
}
|
|
|
|
// 7. Top Flow Type
|
|
async function fetchTopFlowTypes(interval = 1440, limit = 10) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/flow_type/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/flow_type/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.flow_type?.label ?? String(r.flow_type ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.flow_type?.label ?? String(r.flow_type ?? 'Unknown');
|
|
return {
|
|
flow_type_label : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 8. Top Flow Origin
|
|
async function fetchTopFlowOrigins(interval = 1440, limit = 10) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/flow_origin/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/flow_origin/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.flow_origin?.label ?? String(r.flow_origin ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.flow_origin?.label ?? String(r.flow_origin ?? 'Unknown');
|
|
return {
|
|
flow_origin_label : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 9. Top IP Version
|
|
async function fetchTopIPVersions(interval = 1440, limit = 5) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/ip_version/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/ip_version/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.ip_version?.label ?? String(r.ip_version ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.ip_version?.label ?? String(r.ip_version ?? 'Unknown');
|
|
return {
|
|
ip_version_label : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 10. Top Remote IP
|
|
async function fetchTopRemoteIPs(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/remote_ip/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/remote_ip/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.remote_ip?.address ?? String(r.remote_ip ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const addr = r.remote_ip?.address ?? String(r.remote_ip ?? 'Unknown');
|
|
return {
|
|
remote_ip : addr,
|
|
ip_version : r.remote_ip?.version ?? null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[addr] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[addr] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 11. Top Local MAC + Discovery OS
|
|
async function fetchTopLocalMACs(interval = 1440, limit = 50) {
|
|
const [dlData, ulData, osData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/local_mac/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/local_mac/upload', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/discovery_os/download', { filter_interval: interval, settings_limit: 20 }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
if (r.local_mac) ulMap[r.local_mac] = r.upload ?? 0;
|
|
}
|
|
// OS summary untuk info panel
|
|
const osList = (osData ?? []).map(r => ({
|
|
os_label : r.discovery_os?.label ?? String(r.discovery_os ?? 'Unknown'),
|
|
download : r.download ?? 0,
|
|
}));
|
|
return dlData.map(r => {
|
|
const mac = r.local_mac ?? 'Unknown';
|
|
const oui = mac.substring(0, 8).toUpperCase();
|
|
return {
|
|
mac_address : mac,
|
|
manufacturer : OUI_MAP[oui] ?? null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[mac] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[mac] ?? 0),
|
|
_os_summary : osList, // disertakan di item pertama saja
|
|
};
|
|
});
|
|
}
|
|
|
|
// ─── DISCOVERY OS (standalone) ───────────────────────────────────────────────
|
|
async function fetchTopDiscoveryOS(interval = 1440, limit = 20) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/discovery_os/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/discovery_os/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.discovery_os?.label ?? String(r.discovery_os ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.discovery_os?.label ?? String(r.discovery_os ?? 'Unknown');
|
|
return {
|
|
os_label : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// ─── DPI FIELDS ───────────────────────────────────────────────────────────────
|
|
|
|
// TLS Version
|
|
async function fetchTLSVersions(interval = 1440, limit = 10) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/tls_version/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/tls_version/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.tls_version?.label ?? String(r.tls_version ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.tls_version?.label ?? String(r.tls_version ?? 'Unknown');
|
|
return {
|
|
tls_version : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// TLS Cipher
|
|
async function fetchTLSCiphers(interval = 1440, limit = 15) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/tls_cipher/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/tls_cipher/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.tls_cipher?.label ?? String(r.tls_cipher ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.tls_cipher?.label ?? String(r.tls_cipher ?? 'Unknown');
|
|
return {
|
|
tls_cipher : label,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// TLS Security Level
|
|
async function fetchTLSSecurity(interval = 1440, limit = 10) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/tls_security/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/tls_security/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.tls_security?.label ?? String(r.tls_security ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const label = r.tls_security?.label ?? String(r.tls_security ?? 'Unknown');
|
|
// Assign warna berdasarkan label untuk UI
|
|
const color = label === 'Recommended' ? 'green'
|
|
: label === 'Secure' ? 'blue'
|
|
: label === 'Weak' ? 'orange'
|
|
: label === 'Insecure' ? 'red'
|
|
: 'gray';
|
|
return {
|
|
tls_security : label,
|
|
color : color,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// NetBIOS Hostname (nama PC Windows)
|
|
async function fetchNetBIOSHostnames(interval = 1440, limit = 30) {
|
|
const [dlData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/netbios_hostname/download', { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch('/data/stats/top/netbios_hostname/upload', { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dlData) return null;
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const key = r.netbios_hostname?.name ?? String(r.netbios_hostname ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return dlData.map(r => {
|
|
const name = r.netbios_hostname?.name ?? String(r.netbios_hostname ?? 'Unknown');
|
|
return {
|
|
hostname : name,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[name] ?? 0,
|
|
total : (r.download ?? 0) + (ulMap[name] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
async function fetchLookupApplications(page = 1, limit = 50, search = '') {
|
|
const params = {
|
|
settings_page: page,
|
|
settings_limit: limit,
|
|
};
|
|
if (search) {
|
|
params.filter_application = search;
|
|
}
|
|
try {
|
|
const res = await axios.get(`${BASE_URL}/lookup/applications`, {
|
|
headers: headersSite(true), params, timeout: 30000,
|
|
});
|
|
const json = res.data;
|
|
if (json?.status_code !== 0) {
|
|
console.error(`[Netify] API Error ${json?.status_code}: ${json?.status_message}`);
|
|
return { applications: [], pagination: {} };
|
|
}
|
|
return {
|
|
applications: json.data || [],
|
|
pagination: json.data_info || {}
|
|
};
|
|
} catch (err) {
|
|
console.error('[Netify] Lookup error:', err.message);
|
|
return { applications: [], pagination: {} };
|
|
}
|
|
}
|
|
|
|
module.exports = {
|
|
fetchLookupApplications,
|
|
fetchTopApps, fetchTopDevices, fetchTopProtocols, fetchTopCountries,
|
|
fetchTopDomains, fetchBandwidthSummary, fetchDiscoveredDevices,
|
|
fetchCyberThreats, fetchFlows, fetchEvents,
|
|
fetchTopAppCategories, fetchTopContinents, fetchTopRegions, fetchTopCities,
|
|
fetchTopVLANs, fetchTopInterfaces, fetchTopFlowTypes, fetchTopFlowOrigins,
|
|
fetchTopIPVersions, fetchTopRemoteIPs, fetchTopLocalMACs,
|
|
fetchTopDiscoveryOS,
|
|
fetchTLSVersions, fetchTLSCiphers, fetchTLSSecurity, fetchNetBIOSHostnames,
|
|
// DPI 12-21 (field name sudah diperbaiki sesuai dokumentasi resmi)
|
|
fetchDHCPClassFingerprints,
|
|
fetchHTTPUserAgents,
|
|
fetchSNIHostnames,
|
|
fetchSSLServerCN,
|
|
fetchQUICHostnames,
|
|
fetchBitTorrentInfoHashes,
|
|
fetchSSHClients,
|
|
fetchSSHServers,
|
|
fetchMDNSHostnames,
|
|
// Intelligence 22-30 (derive dari data yang tersedia)
|
|
fetchCryptoMining,
|
|
fetchDeviceDiscovery,
|
|
fetchEncryptionAudit,
|
|
fetchInsecureProtocols,
|
|
fetchIPReputation,
|
|
fetchServerDiscovery,
|
|
fetchTorDetection,
|
|
fetchUnencryptedPasswords,
|
|
fetchVPNDetection,
|
|
};
|
|
|
|
// ─── DPI FIELDS 12-21 — FIELD NAMES DIPERBAIKI SESUAI DOCS ──────────────────
|
|
// Sumber: https://www.netify.ai/documentation/informatics/v2/data/fields
|
|
//
|
|
// Field yang SALAH sebelumnya → yang BENAR:
|
|
// dhcp_fingerprint → dhcp_class
|
|
// user_agent → http_useragent
|
|
// ssl_cn → https_sni_hostname
|
|
// ssl_server_cn → ssl_server_cn ✓ (sudah benar)
|
|
// quic_hostname → quic_hostname ✓ (sudah benar, mungkin belum aktif di akun)
|
|
// bt_info_hash → bittorrent_info_hash
|
|
// ssh_version → ssh_client / ssh_server (2 field terpisah)
|
|
// mdns_hostname → mdns_hostname ✓ (sudah benar, mungkin belum aktif di akun)
|
|
|
|
// Helper builder untuk DPI single-field
|
|
async function _dpiTopField(fieldName, interval, limit) {
|
|
const [dl, ul] = await Promise.all([
|
|
netifyFetch(`/data/stats/top/${fieldName}/download`, { filter_interval: interval, settings_limit: limit }),
|
|
netifyFetch(`/data/stats/top/${fieldName}/upload`, { filter_interval: interval, settings_limit: limit }),
|
|
]);
|
|
if (!dl) return null;
|
|
const ulMap = {};
|
|
if (ul) for (const r of ul) {
|
|
const key = r[fieldName]?.name ?? r[fieldName]?.label ?? String(r[fieldName] ?? '');
|
|
if (key) ulMap[key] = r.upload ?? 0;
|
|
}
|
|
return { dl, ulMap };
|
|
}
|
|
|
|
// 12. DHCP Class (field: dhcp_class)
|
|
async function fetchDHCPClassFingerprints(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('dhcp_class', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const label = r.dhcp_class?.name ?? r.dhcp_class?.label ?? String(r.dhcp_class ?? 'Unknown');
|
|
return {
|
|
fingerprint : label,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 13. HTTP User-Agent (field: http_useragent)
|
|
async function fetchHTTPUserAgents(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('http_useragent', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const label = r.http_useragent?.name ?? r.http_useragent?.label ?? String(r.http_useragent ?? 'Unknown');
|
|
return {
|
|
user_agent : label,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 14. HTTPS SNI Hostname (field: https_sni_hostname)
|
|
async function fetchSNIHostnames(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('https_sni_hostname', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const name = r.https_sni_hostname?.name ?? r.https_sni_hostname?.label ?? String(r.https_sni_hostname ?? 'Unknown');
|
|
return {
|
|
sni_hostname : name,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[name] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[name] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 15. SSL Server Common Name (field: ssl_server_cn)
|
|
async function fetchSSLServerCN(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('ssl_server_cn', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const name = r.ssl_server_cn?.name ?? r.ssl_server_cn?.label ?? String(r.ssl_server_cn ?? 'Unknown');
|
|
return {
|
|
ssl_server_cn : name,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[name] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[name] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 17. QUIC Hostname (field: quic_hostname)
|
|
async function fetchQUICHostnames(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('quic_hostname', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const name = r.quic_hostname?.name ?? r.quic_hostname?.label ?? String(r.quic_hostname ?? 'Unknown');
|
|
return {
|
|
quic_hostname : name,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[name] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[name] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 18. BitTorrent Info Hash (field: bittorrent_info_hash)
|
|
async function fetchBitTorrentInfoHashes(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('bittorrent_info_hash', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const hash = r.bittorrent_info_hash?.hash ?? r.bittorrent_info_hash?.name ?? String(r.bittorrent_info_hash ?? 'Unknown');
|
|
const label = r.bittorrent_info_hash?.label ?? hash;
|
|
return {
|
|
info_hash : hash,
|
|
label : label,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[hash] ?? res.ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[hash] ?? res.ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 19a. SSH Client (field: ssh_client)
|
|
async function fetchSSHClients(interval = 1440, limit = 20) {
|
|
const res = await _dpiTopField('ssh_client', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const label = r.ssh_client?.name ?? r.ssh_client?.label ?? String(r.ssh_client ?? 'Unknown');
|
|
return {
|
|
ssh_version : label,
|
|
direction : 'client',
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 19b. SSH Server (field: ssh_server)
|
|
async function fetchSSHServers(interval = 1440, limit = 20) {
|
|
const res = await _dpiTopField('ssh_server', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const label = r.ssh_server?.name ?? r.ssh_server?.label ?? String(r.ssh_server ?? 'Unknown');
|
|
return {
|
|
ssh_version : label,
|
|
direction : 'server',
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[label] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[label] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// 21. mDNS Hostname (field: mdns_hostname)
|
|
async function fetchMDNSHostnames(interval = 1440, limit = 30) {
|
|
const res = await _dpiTopField('mdns_hostname', interval, limit);
|
|
if (!res) return null;
|
|
return res.dl.map(r => {
|
|
const name = r.mdns_hostname?.name ?? r.mdns_hostname?.label ?? String(r.mdns_hostname ?? 'Unknown');
|
|
return {
|
|
mdns_hostname : name,
|
|
download : r.download ?? 0,
|
|
upload : res.ulMap[name] ?? 0,
|
|
total : (r.download ?? 0) + (res.ulMap[name] ?? 0),
|
|
};
|
|
});
|
|
}
|
|
|
|
// ─── INTELLIGENCE 22-30 — DERIVE DARI DATA YANG SUDAH ADA ────────────────────
|
|
// Endpoint /intelligence/* dan /events/* semua 404 di akun ini.
|
|
// Semua fungsi berikut meng-DERIVE data dari endpoint yang sudah confirmed bekerja:
|
|
// /data/stats/top/*, /data/flows
|
|
// Ini memberikan data nyata, bukan mock/dummy.
|
|
|
|
// 22. Cryptocurrency Mining — derive dari apps dengan nama mengandung "crypto" / "mining"
|
|
// + flows ke port mining pool (3333, 4444, 8333, 9999, 14444)
|
|
async function fetchCryptoMining(interval = 1440, limit = 50) {
|
|
const MINING_POOLS_PORTS = new Set([3333, 4444, 5555, 7777, 8333, 9332, 9999, 14444, 45560, 45700]);
|
|
const MINING_APPS = ['bitcoin', 'crypto', 'mining', 'monero', 'ethereum', 'nicehash', 'nanopool', 'f2pool', 'antpool', 'slushpool'];
|
|
|
|
const [appData, flowsRaw] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application/download', { filter_interval: interval, settings_limit: 100 }),
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
]);
|
|
|
|
const results = [];
|
|
|
|
// Derive dari aplikasi
|
|
if (appData) {
|
|
for (const r of appData) {
|
|
const name = (r.application?.label ?? '').toLowerCase();
|
|
const tag = (r.application?.tag ?? '').toLowerCase();
|
|
if (MINING_APPS.some(k => name.includes(k) || tag.includes(k))) {
|
|
results.push({
|
|
detected_at : null,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
pool_host : r.application?.label ?? null,
|
|
pool_ip : null,
|
|
protocol : null,
|
|
app_label : r.application?.label ?? null,
|
|
confidence : 0.7,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
source : 'derived:app',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
// Derive dari flows ke port mining
|
|
if (flowsRaw) {
|
|
for (const r of flowsRaw) {
|
|
const port = r.remote_port ?? 0;
|
|
if (MINING_POOLS_PORTS.has(port)) {
|
|
results.push({
|
|
detected_at : r.first_seen_at?.date ?? null,
|
|
ip_address : r.local_ip?.address ?? null,
|
|
mac_address : r.local_mac ?? null,
|
|
pool_host : null,
|
|
pool_ip : r.remote_ip?.address ?? null,
|
|
protocol : r.ip_protocol?.label ?? null,
|
|
app_label : null,
|
|
confidence : 0.85,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
source : 'derived:flow',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return results.slice(0, limit);
|
|
}
|
|
|
|
// 23. Device Discovery — derive dari flows (perangkat unik dengan MAC)
|
|
async function fetchDeviceDiscovery(limit = 100) {
|
|
const [flowsRaw, dlData] = await Promise.all([
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
netifyFetch('/data/stats/top/local_ip/download', { filter_interval: 1440, settings_limit: 200 }),
|
|
]);
|
|
|
|
const seen = new Map();
|
|
if (flowsRaw) {
|
|
for (const r of flowsRaw) {
|
|
const ip = r.local_ip?.address;
|
|
const mac = r.local_mac;
|
|
if (!ip) continue;
|
|
if (!seen.has(ip)) {
|
|
seen.set(ip, {
|
|
detected_at : r.first_seen_at?.date ?? null,
|
|
ip_address : ip,
|
|
mac_address : mac ?? null,
|
|
device_label : r.device?.label ?? null,
|
|
device_type : r.mac?.discovery_hardware ?? null,
|
|
os_label : r.discovery_os?.label ?? null,
|
|
manufacturer : mac ? (OUI_MAP[mac.substring(0,8).toUpperCase()] ?? null) : null,
|
|
is_new : true,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
// Tambah IP yang punya bandwidth tapi tidak ada di flows
|
|
if (dlData) {
|
|
for (const r of dlData) {
|
|
const ip = r.local_ip?.address ?? String(r.local_ip ?? '');
|
|
if (ip && !seen.has(ip)) {
|
|
seen.set(ip, {
|
|
detected_at : null,
|
|
ip_address : ip,
|
|
mac_address : null,
|
|
device_label : null,
|
|
device_type : null,
|
|
os_label : null,
|
|
manufacturer : null,
|
|
is_new : true,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return Array.from(seen.values()).slice(0, limit);
|
|
}
|
|
|
|
// 24. Encryption Audit — derive dari TLS security per-IP dari flows
|
|
async function fetchEncryptionAudit(limit = 50) {
|
|
const [tlsSec, flowsRaw] = await Promise.all([
|
|
netifyFetch('/data/stats/top/tls_security/download', { filter_interval: 1440, settings_limit: 10 }),
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
]);
|
|
|
|
// Hitung per-IP: encrypted vs unencrypted flows
|
|
const ipStats = {};
|
|
if (flowsRaw) {
|
|
for (const r of flowsRaw) {
|
|
const ip = r.local_ip?.address;
|
|
const port = r.remote_port ?? 0;
|
|
const mac = r.local_mac ?? null;
|
|
if (!ip) continue;
|
|
if (!ipStats[ip]) ipStats[ip] = { mac, encrypted: 0, unencrypted: 0, total_bytes: 0 };
|
|
const bytes = (r.download ?? 0) + (r.upload ?? 0);
|
|
// Port 443, 8443, 465, 993, 995, 22 = encrypted
|
|
const isEnc = [443, 8443, 465, 993, 995, 22, 853].includes(port);
|
|
if (isEnc) ipStats[ip].encrypted += bytes;
|
|
else ipStats[ip].unencrypted += bytes;
|
|
ipStats[ip].total_bytes += bytes;
|
|
}
|
|
}
|
|
|
|
return Object.entries(ipStats)
|
|
.map(([ip, s]) => {
|
|
const total = s.encrypted + s.unencrypted;
|
|
const enc_pct = total > 0 ? (s.encrypted / total) * 100 : null;
|
|
const risk = enc_pct === null ? null
|
|
: enc_pct >= 90 ? 'Low'
|
|
: enc_pct >= 60 ? 'Medium'
|
|
: enc_pct >= 30 ? 'High'
|
|
: 'Critical';
|
|
const oui = s.mac ? s.mac.substring(0,8).toUpperCase() : null;
|
|
return {
|
|
ip_address : ip,
|
|
mac_address : s.mac,
|
|
device_label : OUI_MAP[oui] ?? null,
|
|
encrypted_pct : enc_pct != null ? Math.round(enc_pct * 10) / 10 : null,
|
|
encrypted : s.encrypted,
|
|
unencrypted : s.unencrypted,
|
|
total : total,
|
|
risk_level : risk,
|
|
detected_at : null,
|
|
};
|
|
})
|
|
.sort((a, b) => (a.encrypted_pct ?? 101) - (b.encrypted_pct ?? 101))
|
|
.slice(0, limit);
|
|
}
|
|
|
|
// 25. Insecure Protocols — derive dari top protocols (confirmed bekerja)
|
|
async function fetchInsecureProtocols(interval = 1440, limit = 50) {
|
|
const INSECURE = {
|
|
'HTTP' : { port: 80, risk: 'High' },
|
|
'FTP' : { port: 21, risk: 'Critical' },
|
|
'Telnet' : { port: 23, risk: 'Critical' },
|
|
'SMTP' : { port: 25, risk: 'Medium' },
|
|
'POP3' : { port: 110, risk: 'Medium' },
|
|
'IMAP' : { port: 143, risk: 'Medium' },
|
|
'DNS' : { port: 53, risk: 'Low' },
|
|
'SNMP' : { port: 161, risk: 'High' },
|
|
'LDAP' : { port: 389, risk: 'High' },
|
|
'RDP' : { port: 3389, risk: 'High' },
|
|
'NTP' : { port: 123, risk: 'Low' },
|
|
'TFTP' : { port: 69, risk: 'High' },
|
|
'rsh' : { port: 514, risk: 'Critical' },
|
|
'rlogin' : { port: 513, risk: 'Critical' },
|
|
};
|
|
|
|
const [protoData, ulData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/protocol/download', { filter_interval: interval, settings_limit: 100 }),
|
|
netifyFetch('/data/stats/top/protocol/upload', { filter_interval: interval, settings_limit: 100 }),
|
|
]);
|
|
if (!protoData) return [];
|
|
|
|
const ulMap = {};
|
|
if (ulData) for (const r of ulData) {
|
|
const id = r.protocol?.id;
|
|
if (id) ulMap[id] = r.upload ?? 0;
|
|
}
|
|
|
|
return protoData
|
|
.filter(r => INSECURE[r.protocol?.label])
|
|
.map(r => {
|
|
const label = r.protocol?.label ?? 'Unknown';
|
|
const info = INSECURE[label];
|
|
return {
|
|
protocol : label,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
dst_ip : null,
|
|
dst_port : info.port,
|
|
app_label : null,
|
|
download : r.download ?? 0,
|
|
upload : ulMap[r.protocol?.id] ?? 0,
|
|
risk : info.risk,
|
|
detected_at : null,
|
|
source : 'derived',
|
|
};
|
|
})
|
|
.slice(0, limit);
|
|
}
|
|
|
|
// 26. IP Reputation — derive dari top remote_ip + cross-check negara berisiko tinggi
|
|
async function fetchIPReputation(limit = 50) {
|
|
// Negara dengan risiko tinggi berdasarkan threat intel umum
|
|
const HIGH_RISK_COUNTRIES = new Set([
|
|
'China', 'Russia', 'Iran', 'North Korea', 'Nigeria', 'Romania',
|
|
'Brazil', 'Ukraine', 'Vietnam', 'Indonesia',
|
|
]);
|
|
|
|
const [ipData, countryData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/remote_ip/download', { filter_interval: 1440, settings_limit: 100 }),
|
|
netifyFetch('/data/stats/top/country/download', { filter_interval: 1440, settings_limit: 50 }),
|
|
]);
|
|
|
|
const results = [];
|
|
|
|
if (ipData) {
|
|
// Tandai IP dari negara berisiko (informasi negara tidak ada per-IP dari API,
|
|
// jadi kita pakai country data untuk konteks)
|
|
for (const r of ipData) {
|
|
const ip = r.remote_ip?.address ?? String(r.remote_ip ?? '');
|
|
if (!ip) continue;
|
|
results.push({
|
|
ip_address : ip,
|
|
local_ip : null,
|
|
mac_address : null,
|
|
reputation : 'Unknown',
|
|
score : null,
|
|
country : null,
|
|
app_label : null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
detected_at : null,
|
|
blacklisted : false,
|
|
source : 'derived:top_ip',
|
|
});
|
|
}
|
|
}
|
|
|
|
// Tambah entri untuk negara berisiko yang terdeteksi
|
|
if (countryData) {
|
|
for (const r of countryData) {
|
|
const country = r.country?.label ?? '';
|
|
if (HIGH_RISK_COUNTRIES.has(country)) {
|
|
results.push({
|
|
ip_address : null,
|
|
local_ip : null,
|
|
mac_address : null,
|
|
reputation : 'High-Risk Country',
|
|
score : 0.7,
|
|
country : country,
|
|
app_label : null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
detected_at : null,
|
|
blacklisted : false,
|
|
source : 'derived:country',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return results.slice(0, limit);
|
|
}
|
|
|
|
// 27. Server Discovery — derive dari flows dengan flow_origin=Server + port well-known server
|
|
async function fetchServerDiscovery(limit = 100) {
|
|
const SERVER_PORTS = {
|
|
80: 'HTTP', 443: 'HTTPS', 22: 'SSH', 21: 'FTP', 25: 'SMTP',
|
|
110: 'POP3', 143: 'IMAP', 3306: 'MySQL', 5432: 'PostgreSQL',
|
|
6379: 'Redis', 27017: 'MongoDB', 8080: 'HTTP-Alt', 8443: 'HTTPS-Alt',
|
|
53: 'DNS', 3389: 'RDP', 5900: 'VNC', 161: 'SNMP', 123: 'NTP',
|
|
389: 'LDAP', 636: 'LDAPS', 5060: 'SIP', 1194: 'OpenVPN',
|
|
};
|
|
|
|
const [flowOriginData, flowsRaw] = await Promise.all([
|
|
netifyFetch('/data/stats/top/flow_origin/download', { filter_interval: 1440, settings_limit: 10 }),
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
]);
|
|
|
|
const serverMap = {};
|
|
if (flowsRaw) {
|
|
for (const r of flowsRaw) {
|
|
const localIP = r.local_ip?.address;
|
|
const localPort = r.local_port ?? r.remote_port;
|
|
const proto = r.ip_protocol?.label ?? null;
|
|
const mac = r.local_mac ?? null;
|
|
if (!localIP) continue;
|
|
|
|
// Deteksi server: local device listening di port well-known
|
|
const svcName = SERVER_PORTS[localPort] ?? SERVER_PORTS[r.remote_port];
|
|
if (svcName) {
|
|
const key = `${localIP}:${localPort ?? r.remote_port}`;
|
|
if (!serverMap[key]) {
|
|
const oui = mac ? mac.substring(0,8).toUpperCase() : null;
|
|
serverMap[key] = {
|
|
detected_at : r.first_seen_at?.date ?? null,
|
|
ip_address : localIP,
|
|
mac_address : mac,
|
|
server_type : svcName,
|
|
hostname : r.device?.label ?? null,
|
|
port : localPort ?? r.remote_port,
|
|
protocol : proto,
|
|
os_label : null,
|
|
download : 0,
|
|
upload : 0,
|
|
};
|
|
}
|
|
serverMap[key].download += r.download ?? 0;
|
|
serverMap[key].upload += r.upload ?? 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
return Object.values(serverMap)
|
|
.sort((a, b) => (b.download + b.upload) - (a.download + a.upload))
|
|
.slice(0, limit);
|
|
}
|
|
|
|
// 28. Tor Detection — derive dari top remote_ip + app/hostname matching Tor
|
|
async function fetchTorDetection(limit = 50) {
|
|
const TOR_INDICATORS = ['tor', '.onion', 'torproject', 'torbrowser'];
|
|
|
|
const [appData, domainData] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application/download', { filter_interval: 1440, settings_limit: 100 }),
|
|
netifyFetch('/data/stats/top/hostname/download', { filter_interval: 1440, settings_limit: 100 }),
|
|
]);
|
|
|
|
const results = [];
|
|
|
|
if (appData) {
|
|
for (const r of appData) {
|
|
const name = (r.application?.label ?? '').toLowerCase();
|
|
const tag = (r.application?.tag ?? '').toLowerCase();
|
|
if (TOR_INDICATORS.some(k => name.includes(k) || tag.includes(k))) {
|
|
results.push({
|
|
detected_at : null,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
exit_node : null,
|
|
circuit_id : null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
country : null,
|
|
source : 'derived:app',
|
|
label : r.application?.label,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
if (domainData) {
|
|
for (const r of domainData) {
|
|
const host = (r.hostname?.name ?? '').toLowerCase();
|
|
if (TOR_INDICATORS.some(k => host.includes(k))) {
|
|
results.push({
|
|
detected_at : null,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
exit_node : null,
|
|
circuit_id : null,
|
|
download : r.download ?? 0,
|
|
upload : 0,
|
|
country : null,
|
|
source : 'derived:hostname',
|
|
label : r.hostname?.name,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return results.slice(0, limit);
|
|
}
|
|
|
|
// 29. Unencrypted Passwords — derive dari flows ke port cleartext auth
|
|
async function fetchUnencryptedPasswords(limit = 50) {
|
|
// Port yang dikenal mengirim kredensial cleartext
|
|
const CLEARTEXT_AUTH_PORTS = {
|
|
21 : { protocol: 'FTP', severity: 'Critical' },
|
|
23 : { protocol: 'Telnet', severity: 'Critical' },
|
|
25 : { protocol: 'SMTP', severity: 'High' },
|
|
80 : { protocol: 'HTTP', severity: 'High' },
|
|
110 : { protocol: 'POP3', severity: 'High' },
|
|
143 : { protocol: 'IMAP', severity: 'High' },
|
|
389 : { protocol: 'LDAP', severity: 'Critical' },
|
|
512 : { protocol: 'rexec', severity: 'Critical' },
|
|
513 : { protocol: 'rlogin', severity: 'Critical' },
|
|
514 : { protocol: 'rsh', severity: 'Critical' },
|
|
};
|
|
|
|
const flowsRaw = await netifyFetch('/data/flows', { settings_limit: 500 });
|
|
if (!flowsRaw) return [];
|
|
|
|
const seen = new Map();
|
|
for (const r of flowsRaw) {
|
|
const port = r.remote_port ?? 0;
|
|
const info = CLEARTEXT_AUTH_PORTS[port];
|
|
if (!info) continue;
|
|
|
|
const key = `${r.local_ip?.address}:${r.remote_ip?.address}:${port}`;
|
|
if (!seen.has(key)) {
|
|
seen.set(key, {
|
|
detected_at : r.first_seen_at?.date ?? null,
|
|
ip_address : r.local_ip?.address ?? null,
|
|
mac_address : r.local_mac ?? null,
|
|
dst_ip : r.remote_ip?.address ?? null,
|
|
dst_port : port,
|
|
protocol : info.protocol,
|
|
username : null,
|
|
download : 0,
|
|
upload : 0,
|
|
severity : info.severity,
|
|
});
|
|
}
|
|
seen.get(key).download += r.download ?? 0;
|
|
seen.get(key).upload += r.upload ?? 0;
|
|
}
|
|
|
|
return Array.from(seen.values())
|
|
.sort((a, b) => (b.download + b.upload) - (a.download + a.upload))
|
|
.slice(0, limit);
|
|
}
|
|
|
|
// 30. VPN Detection — derive dari apps/protocols/hostnames yang mengindikasikan VPN
|
|
async function fetchVPNDetection(limit = 50) {
|
|
const VPN_APPS = [
|
|
'openvpn', 'wireguard', 'nordvpn', 'expressvpn', 'surfshark', 'tunnelbear',
|
|
'mullvad', 'protonvpn', 'ipvanish', 'pia', 'private internet access',
|
|
'hotspot shield', 'cyberghost', 'vpn', 'pptp', 'l2tp', 'ipsec', 'sstp',
|
|
'shadowsocks', 'v2ray', 'trojan', 'outline',
|
|
];
|
|
const VPN_PROTOCOLS = new Set(['OpenVPN', 'WireGuard', 'IPSec', 'PPTP', 'L2TP', 'GRE', 'SSTP']);
|
|
// Port yang umum digunakan VPN
|
|
const VPN_PORTS = new Set([1194, 51820, 500, 4500, 1701, 1723, 8388, 443]);
|
|
|
|
const [appData, protoData, flowsRaw] = await Promise.all([
|
|
netifyFetch('/data/stats/top/application/download', { filter_interval: 1440, settings_limit: 100 }),
|
|
netifyFetch('/data/stats/top/protocol/download', { filter_interval: 1440, settings_limit: 50 }),
|
|
netifyFetch('/data/flows', { settings_limit: 500 }),
|
|
]);
|
|
|
|
const results = [];
|
|
|
|
if (appData) {
|
|
for (const r of appData) {
|
|
const name = (r.application?.label ?? '').toLowerCase();
|
|
const tag = (r.application?.tag ?? '').toLowerCase();
|
|
if (VPN_APPS.some(k => name.includes(k) || tag.includes(k))) {
|
|
results.push({
|
|
detected_at : null,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
vpn_type : r.application?.label ?? 'Unknown VPN',
|
|
remote_ip : null,
|
|
protocol : null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
country : null,
|
|
confidence : 0.9,
|
|
source : 'derived:app',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
if (protoData) {
|
|
for (const r of protoData) {
|
|
const label = r.protocol?.label ?? '';
|
|
if (VPN_PROTOCOLS.has(label)) {
|
|
results.push({
|
|
detected_at : null,
|
|
ip_address : null,
|
|
mac_address : null,
|
|
vpn_type : label,
|
|
remote_ip : null,
|
|
protocol : label,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
country : null,
|
|
confidence : 0.85,
|
|
source : 'derived:protocol',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
if (flowsRaw) {
|
|
const portSeen = new Set();
|
|
for (const r of flowsRaw) {
|
|
const port = r.remote_port ?? 0;
|
|
if (VPN_PORTS.has(port) && !portSeen.has(port)) {
|
|
portSeen.add(port);
|
|
results.push({
|
|
detected_at : r.first_seen_at?.date ?? null,
|
|
ip_address : r.local_ip?.address ?? null,
|
|
mac_address : r.local_mac ?? null,
|
|
vpn_type : `Port ${port}`,
|
|
remote_ip : r.remote_ip?.address ?? null,
|
|
protocol : r.ip_protocol?.label ?? null,
|
|
download : r.download ?? 0,
|
|
upload : r.upload ?? 0,
|
|
country : null,
|
|
confidence : 0.75,
|
|
source : 'derived:port',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return results.slice(0, limit);
|
|
} |