From a6f661b2ee62ca6352045186440ee2242f3ba04c Mon Sep 17 00:00:00 2001 From: csavelief Date: Fri, 25 Oct 2024 17:43:56 +0200 Subject: [PATCH] Backport suspicious activity. --- app/Models/YnhOsquery.php | 4 +- app/View/Components/BigNumber.php | 3 + app/View/Components/SuspiciousActivity.php | 37 +++++ resources/lang/fr.json | 11 ++ resources/views/components/overview.blade.php | 33 ++-- .../components/suspicious-activity.blade.php | 154 ++++++++++++++++++ 6 files changed, 226 insertions(+), 16 deletions(-) create mode 100644 app/View/Components/SuspiciousActivity.php create mode 100644 resources/views/components/suspicious-activity.blade.php diff --git a/app/Models/YnhOsquery.php b/app/Models/YnhOsquery.php index b5d8585..42dded1 100644 --- a/app/Models/YnhOsquery.php +++ b/app/Models/YnhOsquery.php @@ -462,7 +462,7 @@ public static function suspiciousEvents(Collection $servers, Carbon $cutOffTime) (Str::startsWith($event->columns['path'], '/run/docker/') && $event->columns['type'] === 'nsfs'); if (!$isDockerMountEvent) { // drop Docker-generated 'mounts' events - if ($event->action === 'added') { + /* if ($event->action === 'added') { return [ 'id' => $event->id, 'timestamp' => $event->calendar_time->format('Y-m-d H:i:s'), @@ -478,7 +478,7 @@ public static function suspiciousEvents(Collection $servers, Carbon $cutOffTime) 'ip' => $event->server->ip(), 'message' => "Le répertoire {$event->columns['path']} ne pointe maintenant plus vers un système de fichiers de type {$event->columns['type']}.", ]; - } + } */ } } elseif ($event->name === 'shell_check' || $event->name === 'sudoers_shell' || $event->name === 'sudoers_sha1') { return [ diff --git a/app/View/Components/BigNumber.php b/app/View/Components/BigNumber.php index c079fb4..d2b5806 100644 --- a/app/View/Components/BigNumber.php +++ b/app/View/Components/BigNumber.php @@ -36,6 +36,9 @@ private function icon(string $icon): string if ($icon === 'dns') { return ''; } + if ($icon === 'world') { + return ''; + } if ($icon === 'server') { return ''; } diff --git a/app/View/Components/SuspiciousActivity.php b/app/View/Components/SuspiciousActivity.php new file mode 100644 index 0000000..dbdb017 --- /dev/null +++ b/app/View/Components/SuspiciousActivity.php @@ -0,0 +1,37 @@ +subDay(); + $this->events = YnhOsquery::suspiciousEvents($servers, $cutOffTime); + $this->metrics = YnhOsquery::suspiciousMetrics($servers, $cutOffTime); + $this->assetsDiscovered = Asset::where('created_at', '>=', $cutOffTime)->orderBy('asset')->get(); + } + + public function render(): View|Closure|string + { + return view('components.suspicious-activity'); + } +} diff --git a/resources/lang/fr.json b/resources/lang/fr.json index 6c446da..4c2a52a 100644 --- a/resources/lang/fr.json +++ b/resources/lang/fr.json @@ -23,7 +23,10 @@ "Apply": "Appliquer", "Are you sure you want to delete this chunk?": "Êtes-vous sûr de vouloir supprimer ce chunk?", "Are you sure you want to delete this prompt?": "Êtes-vous sûr de vouloir supprimer ce prompt?", + "Asset": "Actif", + "Asset Type": "Type d'actif", "Assets": "Actifs", + "Assets Discovered During The Last 24 Hours": "Actifs découverts durant les dernières 24 heures", "Attackers": "Attaquants", "Authorized Keys (last :count events)": "Authorized Keys (:count derniers évènements)", "Backups": "Sauvegardes", @@ -52,6 +55,8 @@ "Delete": "Supprimer", "Deploy": "Déployer", "Desktop": "Bureau", + "Discovered Assets": "Actifs découverts", + "Discovery Date": "Date de découverte", "DNS Monitored": "DNS surveillés", "Domain": "Domaine", "Domains": "Domaines", @@ -84,6 +89,8 @@ "If you did not request a password reset, no further action is required.": "Si vous n'avez pas demandé de réinitialisation de mot de passe, vous pouvez ignorer ce message.", "If you're having trouble clicking the \":actionText\" button, copy and paste the URL below\ninto your web browser:": "Si vous avez des difficultés à cliquer sur le bouton \":actionText\", copiez et collez l'URL ci-dessous\ndans votre navigateur Web :", "Import your documents !": "Importez vos documents !", + "Important Metrics": "Métriques importantes", + "Important Metrics From The Last 24 Hours": "Métriques importantes des dernières 24h", "Imported At": "Importé le", "Imported By": "Importé par", "Integration Status": "Statut de l'intégration", @@ -151,11 +158,13 @@ "Reset Password Notification": "Notification de réinitialisation du mot de passe", "Resources Usage": "Utilisation des ressources", "results": "résultats", + "Scan Status": "Statut du scan", "Security": "Sécurité", "Security Rules": "Règles de sécurité", "Select or create collection...": "Sélectionnez ou créez une collection...", "Send Password Reset Link": "Envoyer le lien de réinitialisation du mot de passe", "Sentinel protects your internal perimeter": "Sentinel protège votre périmètre interne", + "Server": "Serveur", "Server Error": "Erreur serveur", "Server Settings": "Paramètres serveurs", "Servers": "Serveurs", @@ -176,6 +185,8 @@ "Subscriptions": "Souscriptions", "SUID Binaries (last :count events)": "Binaires SUID (:count derniers évènements)", "Summary": "Récapitulatif", + "Suspicious Activity From The Last 24 Hours": "Activité suspect des dernières 24h", + "Suspicious Events": "Évènements suspects", "System logins and logouts.": "Connexions et déconnexions système.", "Tax no.": "Numéro de TVA", "Terms": "Mentions Légales", diff --git a/resources/views/components/overview.blade.php b/resources/views/components/overview.blade.php index 6cee204..c572959 100644 --- a/resources/views/components/overview.blade.php +++ b/resources/views/components/overview.blade.php @@ -25,7 +25,7 @@
- +
- +
- +
- +
- +
- +
- +
- +
+ @if(App\Modules\AdversaryMeter\Models\Asset::exists() > 0 || App\Models\YnhServer::exists() > 0) +
+ +
+ @endif
@if(Auth::user()->canUseAdversaryMeter())
diff --git a/resources/views/components/suspicious-activity.blade.php b/resources/views/components/suspicious-activity.blade.php new file mode 100644 index 0000000..78597fc --- /dev/null +++ b/resources/views/components/suspicious-activity.blade.php @@ -0,0 +1,154 @@ +
+
+
+ +
+
+ +
+
+ +
+
+
+
+
{{ __('Assets Discovered During The Last 24 Hours') }}
+ @if($assetsDiscovered->isEmpty()) +
+
+ {{ __('None.') }} +
+
+ @else + + + + + + + + + + + @foreach($assetsDiscovered as $asset) + + + + + + + @endforeach + +
{{ __('Discovery Date') }}{{ __('Asset Type') }}{{ __('Asset') }}{{ __('Scan Status') }}
+ {{ $asset->created_at->format('Y-m-d H:i') }} + + + {{ $asset->type }} + + + {{ $asset->asset }} + + @if($asset->scanInProgress()->isEmpty()) + + scan terminé + + @else + + scan en cours + + @endif +
+ @endif +
+
+
+
+
{{ __('Suspicious Activity From The Last 24 Hours') }}
+ @if($events->isEmpty()) +
+
+ {{ __('None.') }} +
+
+ @else + + + + + + + + + + + + @foreach($events as $event) + + + + + + + + @endforeach + +
{{ __('Date') }}{{ __('Server') }}{{ __('IP') }}{{ __('Message') }}{{ __('Event Id') }}
{{ $event['timestamp'] }}{{ $event['server'] }}{{ $event['ip'] }}{{ $event['message'] }} + + {{ Illuminate\Support\Number::format($event['id'], locale:'sv') }} + +
+ @endif +
+
+
+
+
{{ __('Important Metrics From The Last 24 Hours') }}
+ @if($metrics->isEmpty()) +
+
+ {{ __('None.') }} +
+
+ @else + + + + + + + + + + + + @foreach($metrics as $metric) + + + + + + + + @endforeach + +
{{ __('Date') }}{{ __('Server') }}{{ __('IP') }}{{ __('Message') }}{{ __('Metric Id') }}
{{ $metric['timestamp'] }}{{ $metric['server'] }}{{ $metric['ip'] }}{{ $metric['message'] }} + + {{ Illuminate\Support\Number::format($metric['id'], locale:'sv') }} + +
+ @endif +
+
+