220 lines
35 KiB
HTML
220 lines
35 KiB
HTML
<!doctype html>
|
|
<html lang="en" class="dark">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
|
<meta name="color-scheme" content="dark">
|
|
<title>MikroSuricata · Network Security</title>
|
|
<link rel="stylesheet" href="/static/libs/tailwindcss/tailwind.min.css">
|
|
<link rel="stylesheet" href="/static/css/app.css">
|
|
</head>
|
|
<body class="bg-zinc-950 text-zinc-100 antialiased">
|
|
<div class="app-shell">
|
|
<aside class="sidebar">
|
|
<div class="brand"><div><strong>MikroSuricata</strong><span>Suricata / RouterOS</span></div></div>
|
|
<nav class="nav" aria-label="Primary">
|
|
<button class="nav-item active" data-view="overview"><span class="nav-icon">⌁</span>Overview</button>
|
|
<button class="nav-item" data-view="live"><span class="nav-icon">↯</span>Live Sessions</button>
|
|
<button class="nav-item" data-view="security"><span class="nav-icon">◇</span>Security</button>
|
|
<button class="nav-item" data-view="intelligence"><span class="nav-icon">◎</span>Intelligence</button>
|
|
<button class="nav-item" data-view="blocks"><span class="nav-icon">⊘</span>Blocks</button>
|
|
<button class="nav-item" data-view="reports"><span class="nav-icon">⌗</span>Reports</button>
|
|
<button class="nav-item" data-view="feeds"><span class="nav-icon">↓</span>Signature Feeds</button>
|
|
<button class="nav-item" data-view="rules"><span class="nav-icon">≡</span>Rules</button>
|
|
<button class="nav-item" data-view="system"><span class="nav-icon" aria-hidden="true"><svg class="nav-svg" viewBox="0 0 20 20"><path d="M3 5h8M15 5h2M3 10h2M9 10h8M3 15h7M14 15h3"/><circle cx="13" cy="5" r="2"/><circle cx="7" cy="10" r="2"/><circle cx="12" cy="15" r="2"/></svg></span>System</button>
|
|
</nav>
|
|
<div class="sidebar-footer">
|
|
<div class="health-line"><span id="sideHealthDot" class="status-dot"></span><span id="sideHealth">Loading status</span></div>
|
|
<div id="sideUptime" class="text-xs text-zinc-500">—</div>
|
|
</div>
|
|
</aside>
|
|
|
|
<main class="workspace">
|
|
<header class="topbar">
|
|
<button id="mobileMenu" class="mobile-menu-btn" type="button" aria-label="Open navigation" aria-expanded="false">☰</button>
|
|
<div>
|
|
<div class="eyebrow">NETWORK INTELLIGENCE</div>
|
|
<h1 id="pageTitle">Overview</h1>
|
|
</div>
|
|
<div class="top-actions">
|
|
<label class="global-search"><span>⌕</span><input id="globalSearch" type="search" placeholder="Search IP, domain, signature…"><kbd>/</kbd></label>
|
|
<select id="windowSelect" class="control compact" aria-label="Time window">
|
|
<option value="900">15 min</option><option value="3600" selected>1 hour</option><option value="21600">6 hours</option><option value="86400">24 hours</option>
|
|
</select>
|
|
<span id="wsBadge" class="connection-badge offline"><span class="status-dot"></span>Offline</span>
|
|
<button id="accountButton" class="account-button" type="button">Sign in</button>
|
|
</div>
|
|
</header>
|
|
|
|
<div id="notice" class="notice hidden"></div>
|
|
|
|
<section id="view-overview" class="view active">
|
|
<div class="metric-grid overview-metrics">
|
|
<article class="metric-card"><div class="metric-label">Events</div><div id="metricEvents" class="metric-value">0</div><div id="metricEventRate" class="metric-sub">0 / min</div></article>
|
|
<article class="metric-card"><div class="metric-label">Inspected throughput</div><div id="metricThroughput" class="metric-value">0 bps</div><div id="metricThroughputSplit" class="metric-sub">IN 0 bps · OUT 0 bps · 0 pps</div><div id="metricThroughputQuality" class="metric-sub">Rust TZSP · waiting for sample</div></article>
|
|
<article class="metric-card"><div class="metric-label">Observed traffic</div><div id="metricBytes" class="metric-value">0 B</div><div class="metric-sub">Ethernet frame bytes delivered to Suricata in selected range</div></article>
|
|
<article class="metric-card"><div class="metric-label">Peak throughput</div><div id="metricPeakThroughput" class="metric-value">0 bps</div><div class="metric-sub">Selected time range</div></article>
|
|
<article class="metric-card"><div class="metric-label">Threats</div><div id="metricAlerts" class="metric-value">0</div><div id="metricIncidents" class="metric-sub">0 incidents</div></article>
|
|
<article class="metric-card"><div class="metric-label">Blocked</div><div id="metricBlocked" class="metric-value">0</div><div id="metricBlockRate" class="metric-sub">Policy actions</div></article>
|
|
</div>
|
|
<div class="grid-main">
|
|
<article class="panel chart-panel span-2"><div class="panel-head"><div><h2>Traffic throughput</h2><p>Total, inbound and outbound speed from the Rust TZSP data-plane; 1 s samples are retained in Redis.</p></div><div class="chart-head-meta"><span id="snapshotMeta" class="status-chip">loading</span><div class="legend"><span><i class="legend-amber"></i>Total</span><span><i class="legend-blue"></i>Inbound</span><span><i class="legend-green"></i>Outbound</span></div></div></div><canvas id="throughputChart" height="230"></canvas></article>
|
|
<article class="panel donut-panel"><div class="panel-head"><div><h2>Traffic direction</h2><p>Inbound / outbound / internal</p></div></div><canvas id="directionDonut" height="230"></canvas></article>
|
|
<article class="panel chart-panel span-2"><div class="panel-head"><div><h2>Events & alerts</h2><p>Complete retained event history for the selected time range.</p></div><div class="legend"><span><i class="legend-green"></i>Events</span><span><i class="legend-red"></i>Alerts</span></div></div><canvas id="trafficChart" height="220"></canvas></article>
|
|
<article class="panel donut-panel"><div class="panel-head"><div><h2>Event mix</h2><p>Flow, DNS, TLS, HTTP and alerts</p></div></div><canvas id="eventTypeDonut" height="220"></canvas></article>
|
|
<article class="panel"><div class="panel-head"><div><h2>Top applications</h2><p>Unique detected flows; failed/unknown classifications are excluded.</p></div></div><div id="topApps" class="rank-list"></div></article>
|
|
<article class="panel"><div class="panel-head"><div><h2>Top local clients</h2><p>Traffic volume by monitored endpoint</p></div></div><div id="topClients" class="rank-list"></div></article>
|
|
<article class="panel"><div class="panel-head"><div><h2>Top remote peers</h2><p>Traffic volume by external endpoint</p></div></div><div id="topSources" class="rank-list"></div></article>
|
|
</div>
|
|
<div class="insight-grid mt-4">
|
|
<article class="metric-card insight-card"><div class="metric-label">Protocol anomalies</div><div id="metricAnomalies" class="metric-value small-value">0</div><div class="metric-sub">Parser / stream anomalies</div></article>
|
|
<article class="metric-card insight-card"><div class="metric-label">DNS NXDOMAIN</div><div id="metricNxdomain" class="metric-value small-value">0</div><div class="metric-sub">Failed DNS resolutions</div></article>
|
|
<article class="metric-card insight-card"><div class="metric-label">Encrypted sessions</div><div id="metricEncrypted" class="metric-value small-value">0</div><div class="metric-sub">TLS / QUIC / SSH</div></article>
|
|
<article class="metric-card insight-card"><div class="metric-label">Cleartext sessions</div><div id="metricCleartext" class="metric-value small-value">0</div><div class="metric-sub">HTTP / FTP / SMTP / Telnet</div></article>
|
|
<article class="metric-card insight-card"><div class="metric-label">Local clients</div><div id="metricLocalClients" class="metric-value small-value">0</div><div class="metric-sub">Unique monitored endpoints</div></article>
|
|
<article class="metric-card insight-card"><div class="metric-label">Remote peers</div><div id="metricRemotePeers" class="metric-value small-value">0</div><div class="metric-sub">Unique external endpoints</div></article>
|
|
</div>
|
|
<article class="panel mt-4"><div class="panel-head"><div><h2>Recent activity snapshot</h2><p>Small bounded snapshot. Continuous live streaming is disabled until you start it.</p></div><button class="btn ghost small" data-nav="live">Open Live Sessions</button></div><div class="table-wrap overview-snapshot"><table><thead><tr><th>Time</th><th>Type</th><th>Source</th><th>Destination</th><th>Application</th><th>Details</th><th>Bytes</th></tr></thead><tbody id="overviewLiveRows"></tbody></table></div></article>
|
|
</section>
|
|
|
|
<section id="view-live" class="view">
|
|
<div class="section-bar"><div><h2>Live Sessions</h2><p>Continuous streaming is off by default. Capture and Redis history continue independently.</p></div><div class="inline-actions"><span id="liveModeBadge" class="connection-badge idle"><span class="status-dot"></span>Live off</span><button id="toggleLive" class="btn">Start live</button><button id="pauseLive" class="btn ghost" disabled>Pause display</button><button id="clearLiveView" class="btn ghost">Clear view</button></div></div>
|
|
<div class="live-hint">The browser receives coalesced batches instead of every packet/update. Filters are applied server-side while live mode is active.</div>
|
|
<div class="filter-bar">
|
|
<input id="liveSearch" class="control grow" type="search" placeholder="IP, host, domain, signature, flow ID…">
|
|
<select id="liveType" class="control"><option value="flow" selected>Sessions / flow</option><option value="">All event types</option><option>dns</option><option>mdns</option><option>http</option><option>http2</option><option>doh2</option><option>tls</option><option>ssh</option><option>rdp</option><option>smb</option><option>quic</option><option>dhcp</option><option>arp</option><option>krb5</option><option>dcerpc</option><option>ldap</option><option>nfs</option><option>snmp</option><option>rfb</option><option>sip</option><option>ike</option><option>mqtt</option><option>ftp</option><option>ftp_data</option><option>smtp</option><option>pop3</option><option>tftp</option><option>websocket</option><option>alert</option><option>fileinfo</option><option>anomaly</option></select>
|
|
<select id="liveProto" class="control"><option value="">All protocols</option><option>TCP</option><option>UDP</option><option>ICMP</option><option>ICMPV6</option></select>
|
|
<select id="liveDirection" class="control"><option value="">Any direction</option><option>inbound</option><option>outbound</option><option>internal</option><option>external</option></select>
|
|
<select id="liveLimit" class="control" aria-label="Visible rows"><option value="100">100 rows</option><option value="200" selected>200 rows</option><option value="300">300 rows</option><option value="500">500 rows</option></select>
|
|
<button id="loadHistory" class="btn ghost">Search history</button>
|
|
</div>
|
|
<div class="live-stats"><span id="liveVisibleCount">0 visible</span><span id="liveBufferedCount">0 buffered</span><span id="liveRate">0 batches/s</span><span id="liveDropped">0 UI drops</span></div>
|
|
<div class="table-wrap panel flat live-table-wrap"><table class="dense"><thead><tr><th>Time</th><th>Type</th><th>Direction</th><th>Source</th><th>Destination</th><th>Protocol</th><th>App</th><th>Details</th><th class="right">Bytes</th><th></th></tr></thead><tbody id="liveRows"></tbody></table></div>
|
|
</section>
|
|
|
|
<section id="view-security" class="view">
|
|
<div class="section-bar"><div><h2>Security incidents</h2><p>Durable Suricata detections, analytics and security telemetry.</p></div><div class="pill" id="securityWindow">Last 24 hours</div></div>
|
|
<div class="subtabs" role="tablist" aria-label="Security sections">
|
|
<button class="subtab-button active" type="button" role="tab" aria-selected="true" data-subtab-group="security" data-subtab="incidents">Incidents</button>
|
|
<button class="subtab-button" type="button" role="tab" aria-selected="false" data-subtab-group="security" data-subtab="analytics">Analytics</button>
|
|
<button class="subtab-button" type="button" role="tab" aria-selected="false" data-subtab-group="security" data-subtab="telemetry">Telemetry</button>
|
|
</div>
|
|
<div class="subtab-panel active" data-subtab-panel="security:incidents">
|
|
<div class="metric-grid compact-grid"><article class="metric-card"><div class="metric-label">Alerts / 24h</div><div id="alerts24h" class="metric-value small-value">0</div></article><article class="metric-card"><div class="metric-label">Unique signatures</div><div id="uniqueSignatures" class="metric-value small-value">0</div></article><article class="metric-card"><div class="metric-label">Sources / 24h</div><div id="sources24h" class="metric-value small-value">0</div></article><article class="metric-card"><div class="metric-label">Filtered noise</div><div id="filteredCount" class="metric-value small-value">0</div></article></div>
|
|
<div class="filter-bar"><input id="incidentSearch" class="control grow" type="search" placeholder="Filter incidents in table…"><select id="severityFilter" class="control"><option value="">All severities</option><option value="1">Severity 1</option><option value="2">Severity 2</option><option value="3">Severity 3</option></select></div>
|
|
<div class="table-wrap panel flat"><table><thead><tr><th>Last seen</th><th>Hits</th><th>Severity</th><th>Signature</th><th>Source</th><th>Destination</th><th>Action</th><th></th></tr></thead><tbody id="incidentRows"></tbody></table></div>
|
|
</div>
|
|
<div class="subtab-panel" data-subtab-panel="security:analytics">
|
|
<div class="grid-main"><article class="panel"><div class="panel-head"><div><h2>Top signatures</h2><p>Most frequent detections in the selected traffic window</p></div></div><div id="securitySignatures" class="rank-list"></div></article><article class="panel donut-panel"><div class="panel-head"><div><h2>Alert severity mix</h2><p>Suricata priority distribution</p></div></div><canvas id="severityDonut" height="220"></canvas></article><article class="panel"><div class="panel-head"><div><h2>Detection coverage</h2><p>Core IDS telemetry visible in the selected window</p></div></div><div id="coverageStatus" class="kv-list"></div></article></div>
|
|
</div>
|
|
<div class="subtab-panel" data-subtab-panel="security:telemetry">
|
|
<div class="grid-main"><article class="panel span-2"><div class="panel-head"><div><h2>Encrypted client fingerprints</h2><p>JA4 / JA3 / HASSH fingerprints observed in TLS, QUIC and SSH telemetry</p></div></div><div id="fingerprintRank" class="rank-list"></div></article><article class="panel"><div class="panel-head"><div><h2>Correlation identifiers</h2><p>Flow/community IDs stay searchable in Live Sessions for cross-tool investigation.</p></div></div><div class="kv-list"><div class="kv-row"><span>Community ID</span><span>indexed in history</span></div><div class="kv-row"><span>Flow ID</span><span>indexed in history</span></div><div class="kv-row"><span>Transaction ID</span><span>indexed in history</span></div></div></article></div>
|
|
<div class="grid-main mt-4"><article class="panel"><div class="panel-head"><div><h2>Observed asset identities</h2><p>DHCP, ARP and passive Ethernet IP/MAC observations</p></div></div><div id="assetRank" class="rank-list"></div></article><article class="panel span-2"><div class="panel-head"><div><h2>File activity</h2><p>Suricata fileinfo names and hashes when available</p></div></div><div id="fileRank" class="rank-list"></div></article></div>
|
|
</div>
|
|
</section>
|
|
|
|
<section id="view-intelligence" class="view">
|
|
<div class="section-bar"><div><h2>MikroSuricata NDR</h2><p>Correlated incidents, asset behavior, threat intelligence and forensic evidence.</p></div><button id="refreshIntelligence" class="btn ghost">Refresh</button></div>
|
|
<div class="subtabs" role="tablist" aria-label="Intelligence sections">
|
|
<button class="subtab-button active" type="button" role="tab" aria-selected="true" data-subtab-group="intelligence" data-subtab="incidents">Incidents</button>
|
|
<button class="subtab-button" type="button" role="tab" aria-selected="false" data-subtab-group="intelligence" data-subtab="assets">Assets</button>
|
|
<button class="subtab-button" type="button" role="tab" aria-selected="false" data-subtab-group="intelligence" data-subtab="threat-intel">Threat intel</button>
|
|
<button class="subtab-button" type="button" role="tab" aria-selected="false" data-subtab-group="intelligence" data-subtab="forensics">Forensics</button>
|
|
</div>
|
|
<div class="subtab-panel active" data-subtab-panel="intelligence:incidents">
|
|
<div class="metric-grid compact-grid">
|
|
<article class="metric-card"><div class="metric-label">Open incidents</div><div id="ndrOpen" class="metric-value small-value">0</div></article>
|
|
<article class="metric-card"><div class="metric-label">High risk ≥80</div><div id="ndrHighRisk" class="metric-value small-value">0</div></article>
|
|
<article class="metric-card"><div class="metric-label">Known assets</div><div id="ndrAssets" class="metric-value small-value">0</div></article>
|
|
<article class="metric-card"><div class="metric-label">IOC hits</div><div id="ndrIocHits" class="metric-value small-value">0</div></article>
|
|
</div>
|
|
<div class="grid-main">
|
|
<article class="panel span-2"><div class="panel-head"><div><h2>Correlated incidents</h2><p>Multi-stage evidence grouped around the affected local asset.</p></div></div><div class="table-wrap"><table><thead><tr><th>Risk</th><th>Last seen</th><th>Asset</th><th class="stages-col">Stages</th><th>ATT&CK</th><th>Summary</th><th>Signals</th><th>Status</th><th></th></tr></thead><tbody id="ndrIncidentRows"></tbody></table></div></article>
|
|
<article class="panel"><div class="panel-head"><div><h2>Incident evidence</h2><p id="ndrEvidenceTitle">Select an incident.</p></div></div><div class="table-wrap evidence-table"><table><thead><tr><th>Time</th><th>Stage</th><th>Risk</th><th>ATT&CK</th><th>Evidence</th></tr></thead><tbody id="ndrEvidenceRows"><tr><td colspan="5" class="empty">No incident selected.</td></tr></tbody></table></div></article>
|
|
</div>
|
|
</div>
|
|
<div class="subtab-panel" data-subtab-panel="intelligence:assets">
|
|
<article class="panel"><div class="panel-head"><div><h2>Asset intelligence</h2><p>Passive Suricata identity enriched with RouterOS ARP/DHCP data.</p></div></div><div class="table-wrap"><table><thead><tr><th>Risk</th><th>IP</th><th>Identity</th><th>Protocols</th><th>Outbound ports</th><th>Alerts</th><th>Last seen</th></tr></thead><tbody id="assetRows"></tbody></table></div></article>
|
|
</div>
|
|
<div class="subtab-panel" data-subtab-panel="intelligence:threat-intel">
|
|
<div class="grid-main intelligence-grid">
|
|
<article class="panel"><div class="panel-head"><div><h2>Add IOC</h2><p>Saved persistently and synchronized into Suricata datasets.</p></div></div><div class="form-stack">
|
|
<label>Type<select id="iocType" class="control"><option value="ip">IP</option><option value="domain">Domain</option><option value="sha256">SHA-256</option><option value="ja3">JA3</option><option value="ja4">JA4</option><option value="hassh">HASSH</option></select></label>
|
|
<label>Indicator<input id="iocIndicator" class="control" placeholder="203.0.113.10 or example.test"></label>
|
|
<label>Confidence<input id="iocConfidence" class="control" type="number" min="0" max="100" value="80"></label>
|
|
<label>Source<input id="iocSource" class="control" value="manual" placeholder="manual / feed name"></label>
|
|
<button id="addIoc" class="btn">Add & reload</button>
|
|
</div></article>
|
|
<article class="panel"><div class="panel-head"><div><h2>Bulk IOC import</h2><p>One indicator per line, or type,indicator,confidence,source,note.</p></div></div><textarea id="iocBulk" class="code-editor compact-editor" spellcheck="false" placeholder="domain,bad.example,90,internal-feed
|
|
198.51.100.50"></textarea><div class="panel-actions"><button id="importIocs" class="btn">Import & reload</button></div></article>
|
|
<article class="panel"><div class="panel-head"><div><h2>Detection engines</h2><p>Signals combined into NDR risk.</p></div></div><div class="kv-list"><div class="kv-row"><span>Suricata signatures</span><span>enabled</span></div><div class="kv-row"><span>Threat intelligence</span><span>datasets + app matching</span></div><div class="kv-row"><span>Behavior baseline</span><span>apps / ports / identity</span></div><div class="kv-row"><span>Beaconing</span><span>periodicity detector</span></div><div class="kv-row"><span>DNS anomaly</span><span>entropy / NXDOMAIN / tunnel</span></div><div class="kv-row"><span>Lateral movement</span><span>fan-out + xbits</span></div><div class="kv-row"><span>MITRE ATT&CK</span><span>network-evidence mapping</span></div><div class="kv-row"><span>Egress analytics</span><span>large outbound transfers</span></div></div></article>
|
|
</div>
|
|
<article class="panel mt-4"><div class="panel-head"><div><h2>Threat intelligence repository</h2><p>IOC hits increase incident risk and remain persistent in SQLite.</p></div></div><div class="table-wrap"><table><thead><tr><th>Type</th><th>Indicator</th><th>Confidence</th><th>Severity</th><th>Source</th><th>Hits</th><th>Last hit</th><th></th></tr></thead><tbody id="iocRows"></tbody></table></div></article>
|
|
</div>
|
|
<div class="subtab-panel" data-subtab-panel="intelligence:forensics">
|
|
<article class="panel"><div class="panel-head"><div><h2>Forensic PCAP</h2><p id="pcapMeta">Persistent evidence mode is loading…</p></div></div><div class="table-wrap"><table><thead><tr><th>File</th><th>Size</th><th>Modified</th><th></th></tr></thead><tbody id="pcapRows"></tbody></table></div></article>
|
|
</div>
|
|
</section>
|
|
|
|
<section id="view-blocks" class="view">
|
|
<div class="section-bar"><div><h2>RouterOS blocks</h2><p>Manual and automatic entries in the configured address-list.</p></div><button id="refreshBlocks" class="btn ghost">Refresh</button></div>
|
|
<div class="grid-main blocks-grid">
|
|
<article class="panel"><div class="panel-head"><div><h2>Add block</h2><p>Requires an authenticated session and RouterOS REST credentials.</p></div></div><div class="form-stack"><label>IP address<input id="blockAddress" class="control" placeholder="203.0.113.10"></label><label>Timeout<input id="blockTimeout" class="control" value="1h" placeholder="1h"></label><label>Comment<input id="blockComment" class="control" placeholder="Manual block from dashboard"></label><button id="addBlock" class="btn danger-soft">Block address</button></div></article>
|
|
<article class="panel span-2"><div class="panel-head"><div><h2>Active address-list</h2><p id="blocksMeta">RouterOS status not loaded.</p></div></div><div class="table-wrap"><table><thead><tr><th>Address</th><th>Timeout</th><th>Created</th><th>Comment</th><th>Type</th><th></th></tr></thead><tbody id="blockRows"></tbody></table></div></article>
|
|
</div>
|
|
</section>
|
|
|
|
<section id="view-reports" class="view">
|
|
<div class="section-bar"><div><h2>Reports</h2><p>All report widgets use the global time range and are generated from the same backend snapshot.</p></div><div class="inline-actions"><span id="reportWindowBadge" class="pill">Last 1 hour</span><span id="reportState" class="status-chip">loading</span><button id="refreshReports" class="btn ghost">Refresh</button><button id="downloadReport" class="btn">Download CSV</button></div></div>
|
|
<div class="metric-grid compact-grid"><article class="metric-card"><div class="metric-label">Events</div><div id="reportEvents" class="metric-value small-value">—</div><div class="metric-sub">selected range</div></article><article class="metric-card"><div class="metric-label">Traffic</div><div id="reportBytes" class="metric-value small-value">—</div><div class="metric-sub">observed bytes</div></article><article class="metric-card"><div class="metric-label">Alerts</div><div id="reportAlerts" class="metric-value small-value">—</div><div class="metric-sub">Suricata detections</div></article><article class="metric-card"><div class="metric-label">Local clients</div><div id="reportClients" class="metric-value small-value">—</div><div class="metric-sub">unique endpoints</div></article></div>
|
|
<div class="grid-main"><article class="panel span-2 chart-panel"><div class="panel-head"><div><h2>Events over time</h2><p>Alerts overlaid on total events</p></div></div><canvas id="eventsChart" height="240"></canvas></article><article class="panel donut-panel"><div class="panel-head"><div><h2>Protocols</h2><p>Transport protocol distribution</p></div></div><canvas id="protocolDonut" height="240"></canvas></article></div>
|
|
<div class="grid-main mt-4"><article class="panel donut-panel"><div class="panel-head"><div><h2>Directions</h2><p>Relative to monitored networks</p></div></div><canvas id="reportDirectionDonut" height="220"></canvas></article><article class="panel donut-panel"><div class="panel-head"><div><h2>Applications</h2><p>Unique detected flows; failed/unknown classifications excluded.</p></div></div><canvas id="appDonut" height="220"></canvas></article><article class="panel donut-panel"><div class="panel-head"><div><h2>Event types</h2><p>EVE event distribution</p></div></div><canvas id="reportEventDonut" height="220"></canvas></article></div>
|
|
<div class="grid-main mt-4"><article class="panel"><div class="panel-head"><div><h2>Local clients</h2><p>Endpoints inside monitored networks</p></div></div><div id="reportSources" class="rank-list"></div></article><article class="panel"><div class="panel-head"><div><h2>Remote peers</h2><p>External endpoints seen by local clients</p></div></div><div id="reportDestinations" class="rank-list"></div></article><article class="panel"><div class="panel-head"><div><h2>Raw event sources</h2><p>Unclassified source addresses for diagnostics</p></div></div><div id="eventTypes" class="rank-list"></div></article></div>
|
|
</section>
|
|
|
|
<section id="view-feeds" class="view">
|
|
<div class="section-bar"><div><h2>Signature Feeds</h2><p>Download signatures from the OISF catalog or add an arbitrary public feed URL.</p></div><div class="inline-actions"><button id="loadRuleSources" class="btn ghost">Reload list</button><button id="refreshRuleSources" class="btn ghost">Refresh provider catalog</button><button id="updateRules" class="btn">Download active feeds</button></div></div>
|
|
<div class="feed-summary"><div><span>Catalog</span><strong>OISF suricata-update</strong></div><div><span>Mode</span><strong>OISF free + manual URLs</strong></div><div><span>Active merged rules</span><strong id="feedRuleCount">—</strong></div><div><span>Automatic update</span><strong id="ruleUpdateSchedule">Every 24h</strong></div><div><span>Activation</span><strong>Validated before reload</strong></div></div>
|
|
<article class="panel"><div class="panel-head"><div><h2>Add signature feed by URL</h2><p>For sources not present in the public OISF list. The source is stored in persistent suricata-update state.</p></div></div><div class="filter-bar"><input id="manualSourceName" class="control" placeholder="Source name, e.g. vendor/community"><input id="manualSourceUrl" class="control" type="url" placeholder="https://example.org/rules.tar.gz"><label class="check-label"><input id="manualSourceNoChecksum" type="checkbox" checked> Skip checksum URL</label><button id="addManualSource" class="btn">Add & download</button></div></article>
|
|
<article class="panel mt-4"><div class="panel-head"><div><h2>Providers and rulesets</h2><p id="sourceMeta">Loading available signature sources…</p></div><button class="btn ghost small" id="feedLoginButton">Admin login</button></div><div class="feed-queue-toolbar"><div class="inline-actions"><button id="selectVisibleSources" class="btn ghost small">Select visible</button><button id="selectAllFreeSources" class="btn ghost small">Select all free</button><button id="clearSourceSelection" class="btn ghost small">Clear</button><button id="queueSelectedSources" class="btn small">Queue selected</button></div><div id="sourceQueueStatus" class="source-queue-status">Queue idle</div></div><div class="panel-filter"><input id="sourceFilter" class="control" type="search" placeholder="Search provider, source, license or tag…"></div><div class="table-wrap"><table><thead><tr><th class="select-col">Select</th><th>Source</th><th>Vendor</th><th>License</th><th>Tags</th><th>Status</th><th>Action</th></tr></thead><tbody id="ruleSourceRows"></tbody></table></div></article>
|
|
</section>
|
|
|
|
<section id="view-rules" class="view">
|
|
<div class="section-bar"><div><h2>Rules</h2><p>Custom signatures, thresholds and suppressions.</p></div><div class="inline-actions"><button class="btn ghost" data-nav="feeds">Signature feeds</button><button id="loadRules" class="btn ghost">Load editors</button><button id="reloadRules" class="btn">Reload</button></div></div>
|
|
<div class="grid-main"><article class="panel"><div class="panel-head"><div><h2>Custom Suricata signatures</h2><p>Validated before replacing the active ruleset.</p></div><button id="saveCustomRules" class="btn small">Save & reload</button></div><textarea id="customRules" class="code-editor" spellcheck="false" placeholder="Load editor first…"></textarea></article><article class="panel"><div class="panel-head"><div><h2>Threshold / suppress</h2><p>Noise controls and scoped suppression entries.</p></div><button id="saveThresholds" class="btn small">Save & reload</button></div><textarea id="thresholdConfig" class="code-editor" spellcheck="false" placeholder="Load editor first…"></textarea></article></div>
|
|
<details id="mergedRulesPanel" class="panel mt-4 collapsible-panel"><summary class="collapsible-panel-summary"><div><h2>Merged public feed rules</h2><p id="mergedRuleMeta">Browse the active rules merged from all enabled signature feeds.</p></div><div class="inline-actions"><span id="mergedRuleCount" class="pill">— active rules</span><span id="mergedRuleMatchCount" class="pill hidden">— matching</span><span class="collapse-indicator" aria-hidden="true">⌄</span></div></summary><div class="collapsible-panel-body"><div class="filter-bar"><input id="mergedRuleSearch" class="control" type="search" placeholder="Search SID, signature, content or rule text…"><button id="searchMergedRules" class="btn ghost small">Search</button><button id="loadMergedRules" class="btn ghost small">Reload</button></div><textarea id="mergedRules" class="code-editor" spellcheck="false" readonly placeholder="Load merged rules…"></textarea><div class="inline-actions mt-2"><button id="loadMoreMergedRules" class="btn ghost small" disabled>Load more</button></div></div></details>
|
|
<div class="grid-main mt-4">
|
|
<article class="panel span-2"><div class="panel-head"><div><h2>Adaptive rule intelligence</h2><p>Observed alert noise and concentration. Recommendations never disable signatures automatically.</p></div><div class="inline-actions"><select id="ruleIntelHours" class="control compact"><option value="24">24h</option><option value="72">3d</option><option value="168">7d</option><option value="720">30d</option></select><button id="loadRuleIntelligence" class="btn ghost small">Analyze</button></div></div><div class="table-wrap"><table><thead><tr><th>Noise</th><th>SID</th><th>Hits</th><th>Incidents</th><th>Signature</th><th>Recommendation</th><th></th></tr></thead><tbody id="ruleIntelRows"><tr><td colspan="7" class="empty">Open Rules to analyze recent signatures.</td></tr></tbody></table></div></article>
|
|
<article class="panel"><div class="panel-head"><div><h2>Ruleset snapshots</h2><p>Local rules, thresholds, merged vendor rules and enabled source state.</p></div><button id="createRuleSnapshot" class="btn ghost small">Create snapshot</button></div><div class="table-wrap"><table><thead><tr><th>Created</th><th>Reason</th><th>Size</th><th></th></tr></thead><tbody id="ruleSnapshotRows"><tr><td colspan="4" class="empty">No snapshots loaded.</td></tr></tbody></table></div></article>
|
|
</div>
|
|
</section>
|
|
|
|
<section id="view-system" class="view">
|
|
<div class="section-bar"><div><h2>System</h2><p>Pipeline, storage and maintenance state.</p></div></div>
|
|
<div class="grid-main"><article class="panel span-2"><div class="panel-head"><div><h2>Services</h2></div></div><div class="table-wrap"><table><thead><tr><th>Component</th><th>Status</th><th>Details</th></tr></thead><tbody id="serviceRows"></tbody></table></div></article><div class="panel-stack"><article class="panel"><div class="panel-head"><div><h2>Redis</h2><p>Persistent traffic history and dashboard cache.</p></div><span id="redisStateBadge" class="status-chip">loading</span></div><div id="redisStatus" class="kv-list"></div></article><article class="panel"><div class="panel-head"><div><h2>Traffic history</h2></div></div><div id="historyStatus" class="kv-list"></div></article></div></div>
|
|
<div class="grid-main mt-4"><article class="panel span-2"><div class="panel-head"><div><h2>Ports</h2></div></div><div class="table-wrap"><table><thead><tr><th>Service</th><th>Direction</th><th>Protocol</th><th>Address</th><th>Port</th><th>Status</th></tr></thead><tbody id="portRows"></tbody></table></div></article><article class="panel"><div class="panel-head"><div><h2>Maintenance</h2><p>Destructive actions require an authenticated admin session.</p></div></div><div class="form-stack"><div id="sessionStatus" class="session-status">Not signed in</div><button id="systemLoginButton" class="btn ghost">Sign in</button><button id="resetCounters" class="btn ghost">Reset runtime counters</button><button id="clearTraffic" class="btn ghost">Clear traffic history</button><button id="vacuumDb" class="btn ghost">Compact incident DB</button><button id="clearAlerts" class="btn danger-soft">Delete all incidents</button></div></article></div>
|
|
<div class="grid-main mt-4">
|
|
<article class="panel span-2"><div class="panel-head"><div><h2>Persistent backups</h2><p>SQLite and IDS configuration only; Redis runtime data, logs and forensic PCAP are excluded.</p></div><div class="inline-actions"><button id="refreshSystemState" class="btn ghost small">Refresh</button><button id="createBackup" class="btn small">Create backup</button></div></div><div class="table-wrap"><table><thead><tr><th>Created</th><th>File</th><th>Size</th><th></th></tr></thead><tbody id="backupRows"><tr><td colspan="4" class="empty">No backups loaded.</td></tr></tbody></table></div></article>
|
|
<article class="panel"><div class="panel-head"><div><h2>Audit log</h2><p>Administrative actions recorded in SQLite.</p></div></div><div class="table-wrap audit-table"><table><thead><tr><th>Time</th><th>User</th><th>Action</th><th>Target</th><th>Result</th></tr></thead><tbody id="auditRows"><tr><td colspan="5" class="empty">No audit events loaded.</td></tr></tbody></table></div></article>
|
|
</div>
|
|
</section>
|
|
</main>
|
|
</div>
|
|
<button id="mobileBackdrop" class="mobile-backdrop" type="button" aria-label="Close navigation"></button>
|
|
<div id="authModal" class="auth-modal hidden" role="dialog" aria-modal="true" aria-labelledby="authTitle">
|
|
<div class="auth-card">
|
|
<div class="auth-brand"><div><strong id="authTitle">MikroSuricata login</strong><span>Protected IDS console</span></div></div>
|
|
<form id="loginForm" class="auth-form">
|
|
<label>Username<input id="loginUsername" class="control" autocomplete="username" required></label>
|
|
<label>Password<input id="loginPassword" class="control" type="password" autocomplete="current-password" required></label>
|
|
<div id="loginError" class="auth-error hidden"></div>
|
|
<button id="loginSubmit" class="btn" type="submit">Sign in</button>
|
|
</form>
|
|
<p id="authHint" class="auth-hint">Session is stored in an HttpOnly browser cookie and survives page reloads.</p>
|
|
</div>
|
|
</div>
|
|
<script src="/static/js/charts.js" defer></script>
|
|
<script src="/static/js/app.js" defer></script>
|
|
</body>
|
|
</html>
|