def _setNavPrev(self, offset):
if offset:
self.dataset["nav.first"] = utils.create_link(self.view_path, self.parameters - [ "offset" ])
self.dataset["nav.prev"] = utils.create_link(self.view_path,
self.parameters +
{ "offset": offset - self.parameters["limit"] })
else:
self.dataset["nav.prev"] = None
def _setNavNext(self, offset, count):
if count > offset + self.parameters["limit"]:
offset = offset + self.parameters["limit"]
self.dataset["nav.next"] = utils.create_link(self.view_path, self.parameters + { "offset": offset })
offset = count - ((count % self.parameters["limit"]) or self.parameters["limit"])
self.dataset["nav.last"] = utils.create_link(self.view_path, self.parameters + { "offset": offset })
else:
self.dataset["nav.next"] = None
def _get_analyzers(self):
criteria = None
if "filter_path" in self.parameters:
criteria = "%s == '%s'" % (self.parameters["filter_path"],
utils.escape_criteria(self.parameters["filter_value"]))
for (analyzerid,) in env.idmef_db.getValues(["heartbeat.analyzer(-1).analyzerid/group_by"], criteria):
analyzer, heartbeat = env.idmef_db.getAnalyzer(analyzerid)
status, status_text = utils.get_analyzer_status_from_latest_heartbeat(
heartbeat, self._heartbeat_error_margin
)
if self.parameters["status"] and status not in self.parameters["status"]:
continue
delta = float(heartbeat.get("create_time")) - time.time()
parameters = {"heartbeat.analyzer(-1).analyzerid": analyzerid}
heartbeat_listing = utils.create_link(view.getViewPath("HeartbeatListing"), parameters)
parameters = {"analyzer_object_0": "alert.analyzer.analyzerid",
"analyzer_operator_0": "=",
"analyzer_value_0": analyzerid}
alert_listing = utils.create_link(view.getViewPath("AlertListing"), parameters)
parameters = {"analyzerid": analyzerid}
heartbeat_analyze = utils.create_link(self.view_path + "/HeartbeatAnalyze", parameters)
node_name = analyzer["node.name"] or _("Node name n/a")
osversion = analyzer["osversion"] or _("OS version n/a")
ostype = analyzer["ostype"] or _("OS type n/a")
yield {"id": analyzerid,
"label": "%s - %s %s" % (node_name, ostype, osversion),
"location": analyzer["node.location"] or _("Node location n/a"),
"node": node_name,
"name": analyzer["name"],
"model": analyzer["model"],
"class": analyzer["class"],
"version": analyzer["version"],
"latest_heartbeat": localization.format_timedelta(delta, add_direction=True),
"status": status,
"status_text": status_text,
"links": [
{"text": _("Alert listing"), "link": alert_listing},
{"text": _("Heartbeat listing"), "link": heartbeat_listing},
{"text": _("Heartbeat analysis"), "link": heartbeat_analyze,
"class": "widget-link", "title": _("Heartbeat analysis")},
]}
def _setupDataSet(self, dataset, request, user, view=None, parameters={}):
init_dataset(dataset, self._env.config, request)
sections = prewikka.views.events_section, prewikka.views.agents_section, prewikka.views.stats_section, prewikka.views.settings_section, \
prewikka.views.about_section
section_to_tabs = { }
dataset["interface.sections"] = [ ]
for section_name, tabs in sections:
first_tab = None
for tab_name, views in tabs:
view_name = views[0]
if not user or user.has(self._views[view_name]["permissions"]):
if not first_tab:
first_tab = view_name
section_to_tabs[section_name] = []
section_to_tabs[section_name] += [ ((tab_name, utils.create_link(views[0]))) ]
if first_tab:
dataset["interface.sections"].append( (section_name, utils.create_link(first_tab)) )
if isinstance(parameters, prewikka.view.RelativeViewParameters) and parameters.has_key("origin"):
view_name = parameters["origin"]
elif view:
view_name = view["name"]
else:
view_name = None
if view_name and self._view_to_section.has_key(view_name):
active_section = self._view_to_section[view_name]
active_tab = self._view_to_tab[view_name]
tabs = section_to_tabs.get(active_section, [])
else:
active_section, tabs, active_tab = "", [ ], ""
dataset["interface.tabs"] = tabs
dataset["prewikka.user"] = user
if user:
dataset["prewikka.userlink"] = "<b><a href=\"%s\">%s</a></b>" % (utils.create_link("user_settings_display"), utils.escape_html_string(user.login))
dataset["interface.active_tab"] = active_tab
dataset["interface.active_section"] = active_section
dataset["prewikka.logout_link"] = (user and self._env.auth.canLogout()) and utils.create_link("logout") or None
def _set_timeline(self, start, end):
for unit in "minute", "hour", "day", "month", "year", "unlimited":
self.dataset["timeline.%s_selected" % unit] = ""
self.dataset["timeline.%s_selected" % self.parameters["timeline_unit"]] = "selected='selected'"
tzobj = None
if self.parameters["timezone"] == "utc":
tzobj = utils.timeutil.tzutc()
self.dataset["timeline.range_timezone"] = "UTC"
else:
tzobj = utils.timeutil.tzlocal()
self.dataset["timeline.range_timezone"] = _("localtime")
if not start and not end:
return
self.dataset["timeline.start"] = localization.format_datetime(start.astimezone(tzobj), format="medium")
self.dataset["timeline.end"] = localization.format_datetime(end.astimezone(tzobj), format="medium")
self.dataset["timeline.current"] = utils.create_link(self.main.view_path, self.parameters - ["timeline_end"])
timeunit = self.parameters["timeline_unit"]
if timeunit != "unlimited":
delta = relativedelta(**{timeunit + "s": self.parameters["timeline_value"]})
self._set_timeline_link("next", end, end + delta)
self._set_timeline_link("prev", start - delta, start)
def _setTimeline(self, start, end):
for t in "time_desc", "time_asc", "count_desc", "count_asc":
self.dataset["timeline.%s_selected" % t] = ""
self.dataset["timeline.%s_selected" % self.parameters["orderby"]] = "selected='selected'"
for unit in "min", "hour", "day", "month", "year", "unlimited":
self.dataset["timeline.%s_selected" % unit] = ""
self.dataset["timeline.value"] = self.parameters["timeline_value"]
self.dataset["timeline.%s_selected" % self.parameters["timeline_unit"]] = "selected='selected'"
if self.parameters["timezone"] == "utc":
func = time.gmtime
self.dataset["timeline.range_timezone"] = "UTC"
else:
func = time.localtime
self.dataset["timeline.range_timezone"] = "%+.2d:%.2d" % utils.get_gmt_offset()
if not start and not end:
return
self.dataset["timeline.start"] = utils.time_to_ymdhms(func(int(start)))
self.dataset["timeline.end"] = utils.time_to_ymdhms(func(int(end)))
self.dataset["timeline.current"] = utils.create_link(self.view_name, self.parameters - ["timeline_end"])
if not self.parameters.has_key("timeline_end") and self.parameters["timeline_unit"] in ("min", "hour"):
tmp = copy.copy(end)
tmp.round(self.parameters["timeline_unit"])
tmp = tmp[self.parameters["timeline_unit"]] - 1
self._setTimelineNext(tmp[self.parameters["timeline_unit"]] + self.parameters["timeline_value"])
self._setTimelinePrev(tmp[self.parameters["timeline_unit"]] - (self.parameters["timeline_value"] - 1))
else:
self._setTimelineNext(end[self.parameters["timeline_unit"]] + self.parameters["timeline_value"])
self._setTimelinePrev(end[self.parameters["timeline_unit"]] - self.parameters["timeline_value"])
def _generateTimeline(self, user, width, height):
start, end, step, format, zoom_view, timeline_type, timeline_time = self._getStep(self.parameters["timeline_type"])
timeline = self._newTimeline(user, width, height)
if timeline_type != "custom":
base_parameters = { "timeline_unit": "min" }
else:
base_parameters = { "timeline_type": timeline_type }
self.dataset["timeline_user_type"] = self.parameters.get("timeline_type")
while start < end:
c = self._getTimeCrit(start, step) + self._criteria
if timeline_type != "custom":
base_parameters["timeline_start"] = long(time.mktime(start.timetuple())) #long(start)
else:
self._setTimelineZoom(base_parameters, start, start + step)
link = utils.create_link(zoom_view, base_parameters)
count = self._getAlertCount(c, link, zoom_view)
label = start.strftime(format)
start += step
timeline.addLabelValuePair(label, count, link)
return timeline
def createHostField(self, object, value, category=None, direction=None, dns=True):
field = self.createInlineFilteredField(object, value, direction)
field["host_links"] = [ ]
field["category"] = category
field["url_infos"] = utils.create_link("hostinfoajax", {"host": value}) if "HOOK_HOST_TOOLTIP" in hookmanager.hookmgr else None
field["url_popup"] = utils.create_link("AjaxHostURL", {"host": value})
if value and dns is True:
field["hostname"] = resolve.AddressResolve(value)
else:
field["hostname"] = value or _("n/a")
if not value:
return field
for typ, linkname, link, widget in hookmanager.trigger("HOOK_LINK", value):
if typ == "host":
field["host_links"].append((linkname, link, widget))
return field
def buildAlertIdent(self, alert, parent):
calist = { }
for alertident in parent["alertident"]:
# IDMEF draft 14 page 27
# If the "analyzerid" is not provided, the alert is assumed to have come
# from the same analyzer that is sending the Alert.
analyzerid = alertident["analyzerid"]
if not analyzerid:
for a in alert["analyzer"]:
if a["analyzerid"]:
analyzerid = a["analyzerid"]
break
if not calist.has_key(analyzerid):
calist[analyzerid] = []
calist[analyzerid].append(alertident["alertident"])
idx = 1
for analyzerid in calist.keys():
content = ""
missing = 0
for ident in calist[analyzerid]:
criteria = "alert.analyzer.analyzerid = '%s' && alert.messageid = '%s'" % (analyzerid, ident)
results = env.idmef_db.getAlertIdents(criteria)
if len(results) == 0:
missing += 1
#content += "<li>" + _("Invalid 'analyzerid:messageid' pair, '%(analyzerid):%(messageid)'") % { "analyzerid": analyzerid, "messageid": ident } + "</li>"
else:
alert = env.idmef_db.getAlert(results[0], htmlsafe=True)["alert"]
link = utils.create_link("/".join(self.request.getViewElements()[:2] + [self.view_id]), {"ident": results[0]})
content += "<li><a href=\"%s\">%s</a></li>" % (link, alert["classification.text"])
if missing > 0:
content += "<li>" + (_("%d linked alerts missing (probably deleted)") % missing) + "</li>"
self.newTableCol(idx, "<ul style='padding: 0px; margin: 0px 0px 0px 10px;'>%s</ul>" % content)
self.buildAnalyzer(alert["analyzer(-1)"])
self.newTableRow()
idx += 1
def render(self):
self.dataset["backend_can_create"] = self.env.auth.canCreateUser()
self.dataset["backend_can_delete"] = self.env.auth.canDeleteUser()
self.dataset["add_form_hiddens"] = [("view", "user_add_form")]
self.dataset["permissions"] = User.ALL_PERMISSIONS
self.dataset["can_set_password"] = self.env.auth and self.env.auth.canSetPassword()
self.dataset["users"] = [ ]
logins = self.env.auth.getUserLogins()
logins.sort()
for login in logins:
permissions = self.env.db.getPermissions(login)
tmp = { }
tmp["login"] = login
tmp["settings_link"] = utils.create_link("user_settings_display", { "login": login, "origin": self.view_name })
tmp["permissions"] = map(lambda perm: self.hasPermission(perm, permissions), User.ALL_PERMISSIONS)
self.dataset["users"].append(tmp)
def createHostField(self, object, value, category=None, direction=None, dns=True):
field = self.createInlineFilteredField(object, value, direction)
field["host_commands"] = [ ]
field["category"] = category
if value and dns is True:
field["hostname"] = resolve.AddressResolve(value)
else:
field["hostname"] = value or _("n/a")
if not value:
return field
for command in self.env.host_commands.keys():
field["host_commands"].append((command.capitalize(),
utils.create_link("Command",
{ "origin": self.view_name, "command": command, "host": value })))
return field
def _getBaseURL(self):
start = long(time.mktime(self._period_start))
if self.parameters["timeline_type"] in ("month", "day", "hour"):
unit = self.parameters["timeline_type"]
value = 1
else:
delta = long(time.mktime(self._period_end)) - start
if delta > 3600:
unit = "day"
value = delta / (24 * 3600) + 1
else:
unit = "hour"
value = delta / 3600 + 1
filter_str = ""
if self.parameters.has_key("filter"):
filter_str = "&" + urllib.urlencode({"filter": self.parameters["filter"]})
return utils.create_link("alert_listing", { "timeline_unit": unit,
"timeline_value": value,
"timeline_start": start }) + filter_str
def createInlineFilteredField(self, path, value, direction=None, real_value=None):
if type(path) is not list and type(path) is not tuple:
path = [ path ]
else:
if not path:
return { "value": None, "inline_filter": None, "already_filtered": False }
if type(value) is not list and type(value) is not tuple:
if not real_value:
real_value = value
value = [ value ]
extra = { }
alreadyf = None
for p, v in zip(path, value):
if direction:
if v is not None:
operator = "="
else:
operator = "!"
if alreadyf is not False:
alreadyf = self._isAlreadyFiltered(direction, p, operator, v or "")
index = self.parameters.max_index
extra["%s_object_%d" % (direction, index)] = p
extra["%s_operator_%d" % (direction, index)] = operator
extra["%s_value_%d" % (direction, index)] = v or ""
self.parameters.max_index += 1
else:
if alreadyf is not False and (self.parameters.has_key(p) and self.parameters[p] == [v]):
alreadyf = True
extra[p] = v or ""
link = utils.create_link(self.view_path, self.parameters + extra - [ "offset" ])
return { "value": utils.escape_html_string(real_value), "inline_filter": link, "already_filtered": alreadyf }
def _render(self, dataset, request, user):
interface = env.config.interface
# The database attribute might be None in case of initialisation error
# FIXME: move me to a plugin !
try:
theme_name = user.get_property("theme", default=env.config.default_theme)
except:
theme_name = env.config.default_theme
dataset["document.title"] = interface.getOptionValue("browser_title", "Prelude SIEM")
dataset["document.css_files"] = [ "prewikka/css/jquery-ui.min.css" , "prewikka/css/demo_table_jui.css", "prewikka/css/jquery.jstree.css", "prewikka/css/themes/%s.css" % theme_name ]
dataset["document.js_files"] = [ "prewikka/js/jquery.js", "prewikka/js/functions.js", "prewikka/js/ajax.js",
"prewikka/js/underscore-min.js",
"prewikka/js/jquery-ui.min.js", "prewikka/js/jquery.jstree.js" ]
dataset["prewikka.software"] = interface.getOptionValue("software", "<img src='prewikka/images/prelude-logo.png' alt='Prelude' />")
dataset["prewikka.place"] = interface.getOptionValue("place", "")
dataset["prewikka.date"] = localization.format_date()
if user:
if interface.getOptionValue("user_display") == "name":
dataset["prewikka.user_display"] = user.get_property("fullname", default=user.name)
else:
dataset["prewikka.user_display"] = user.name
dataset["prewikka.logout_link"] = (user and env.session.can_logout()) and utils.create_link("logout") or None
try:
paths = request.getViewElements()
active_section, active_tab = paths[0], paths[1]
except:
active_section, active_tab = "", ""
dataset["interface.active_tab"] = active_tab
dataset["interface.active_section"] = active_section
dataset["interface.sections"] = env.viewmanager.getSections(user) if env.viewmanager else {}
dataset["toplayout_extra_content"] = ""
all(env.hookmgr.trigger("HOOK_TOPLAYOUT_EXTRA_CONTENT", request, user, dataset))
def createMessageIdentLink(self, messageid, view):
return utils.create_link(view, { "origin": self.view_name, "messageid": messageid })
def render(self):
analyzers = { }
criteria = None
if self.parameters.has_key("filter_path"):
criteria = "%s == '%s'" % (self.parameters["filter_path"],
utils.escape_criteria(self.parameters["filter_value"]))
locations = { }
nodes = { }
for (analyzerid,) in env.idmef_db.getValues(["heartbeat.analyzer(-1).analyzerid/group_by"], criteria):
analyzer, heartbeat = env.idmef_db.getAnalyzer(analyzerid)
parameters = { "analyzerid": analyzer["analyzerid"] }
analyzer.alert_listing = utils.create_link(view.getViewPath("SensorAlertListing"), parameters)
analyzer.heartbeat_listing = utils.create_link(view.getViewPath("SensorHeartbeatListing"), parameters)
analyzer.heartbeat_analyze = utils.create_link(self.view_path + "/HeartbeatAnalyze", parameters)
node_key = ""
addresses = []
for addr in analyzer["node.address(*).address"]:
node_key += addr
address = {}
address["value"] = addr
address["inline_filter"] = utils.create_link(self.view_path,
{ "filter_path": "heartbeat.analyzer(-1).node.address(*).address",
"filter_value": addr })
address["host_links"] = []
for typ, linkname, link, widget in env.hookmgr.trigger("HOOK_LINK", addr):
if typ == "host":
address["host_links"].append((linkname, link, widget))
if "host" in env.url:
for urlname, url in env.url["host"].items():
address["host_links"].append((urlname.capitalize(), url.replace("$host", addr), False))
addresses.append(address)
analyzer.model_inline_filter = utils.create_link(self.view_path, { "filter_path": "heartbeat.analyzer(-1).model",
"filter_value": analyzer["model"] })
analyzer.status, analyzer.status_meaning = \
get_analyzer_status_from_latest_heartbeat(heartbeat, self._heartbeat_error_margin)
delta = float(heartbeat.get("create_time")) - time.time()
analyzer.last_heartbeat_time = localization.format_timedelta(delta, add_direction=True)
node_location = analyzer["node.location"] or _("Node location n/a")
node_name = analyzer.get("node.name") or _("Node name n/a")
osversion = analyzer["osversion"] or _("OS version n/a")
ostype = analyzer["ostype"] or _("OS type n/a")
node_key = node_name + osversion + ostype
if not locations.has_key(node_location):
locations[node_location] = { "total": 1, "missing": 0, "unknown": 0, "offline": 0, "online": 0, "nodes": { } }
else:
locations[node_location]["total"] += 1
if not locations[node_location]["nodes"].has_key(node_key):
locations[node_location]["nodes"][node_key] = { "total": 1, "missing": 0, "unknown": 0, "offline": 0, "online": 0,
"analyzers": [ ],
"node.name": node_name, "node.location": node_location,
"ostype": ostype, "osversion": osversion,
"node_addresses": addresses }
else:
locations[node_location]["nodes"][node_key]["total"] += 1
locations[node_location][analyzer.status] += 1
locations[node_location]["nodes"][node_key][analyzer.status] += 1
if analyzer.status in ["missing", "unknown"]:
locations[node_location]["nodes"][node_key]["analyzers"].insert(0, analyzer)
else:
locations[node_location]["nodes"][node_key]["analyzers"].append(analyzer)
self.dataset["locations"] = locations
def _setTimelineNext(self, next):
parameters = self.parameters - [ "offset" ] + { "timeline_end": int(next) }
self.dataset["timeline.next"] = utils.create_link(self.view_name, parameters)
def createMessageLink(self, ident, view):
return utils.create_link("/".join((self.view_path, view)), { "ident": ident })
def createMessageIdentLink(self, messageid, view):
return utils.create_link("/".join((self.view_path, view)), { "messageid": messageid })
def render(self):
analyzers = { }
criteria = None
if self.parameters.has_key("filter_path"):
criteria = "%s == '%s'" % (self.parameters["filter_path"],
utils.escape_criteria(self.parameters["filter_value"]))
locations = { }
nodes = { }
for analyzerid in self.env.idmef_db.getAnalyzerids():
analyzer = self.env.idmef_db.getAnalyzer(analyzerid)
parameters = { "analyzerid": analyzer["analyzerid"] }
analyzer["alert_listing"] = utils.create_link("sensor_alert_listing", parameters)
analyzer["heartbeat_listing"] = utils.create_link("sensor_heartbeat_listing", parameters)
analyzer["heartbeat_analyze"] = utils.create_link("heartbeat_analyze", parameters)
if analyzer["node_name"]:
analyzer["node_name_link"] = utils.create_link(self.view_name,
{ "filter_path": "heartbeat.analyzer(-1).node.name",
"filter_value": analyzer["node_name"] })
if analyzer["node_location"]:
analyzer["node_location_link"] = utils.create_link(self.view_name,
{ "filter_path": "heartbeat.analyzer(-1).node.location",
"filter_value": analyzer["node_location"] })
node_key = ""
for i in range(len(analyzer["node_addresses"])):
addr = analyzer["node_addresses"][i]
node_key += addr
analyzer["node_addresses"][i] = {}
analyzer["node_addresses"][i]["value"] = addr
analyzer["node_addresses"][i]["inline_filter"] = utils.create_link(self.view_name,
{ "filter_path": "heartbeat.analyzer(-1).node.address.address",
"filter_value": addr })
analyzer["node_addresses"][i]["host_commands"] = []
for command in self.env.host_commands.keys():
analyzer["node_addresses"][i]["host_commands"].append((command.capitalize(),
utils.create_link("Command",
{ "origin": self.view_name,
"command": command, "host": addr })))
analyzer["status"], analyzer["status_meaning"] = \
get_analyzer_status_from_latest_heartbeat(analyzer["last_heartbeat_status"],
analyzer["last_heartbeat_time"],
analyzer["last_heartbeat_interval"],
self._heartbeat_error_margin)
analyzer["last_heartbeat_time"] = utils.time_to_ymdhms(time.localtime(int(analyzer["last_heartbeat_time"]))) + \
" %+.2d:%.2d" % utils.get_gmt_offset()
node_location = analyzer["node_location"] or _("Node location n/a")
node_name = analyzer.get("node_name") or _("Node name n/a")
osversion = analyzer["osversion"] or _("OS version n/a")
ostype = analyzer["ostype"] or _("OS type n/a")
addresses = analyzer["node_addresses"]
node_key = node_name + osversion + ostype
if not locations.has_key(node_location):
locations[node_location] = { "total": 1, "missing": 0, "unknown": 0, "offline": 0, "online": 0, "nodes": { } }
else:
locations[node_location]["total"] += 1
if not locations[node_location]["nodes"].has_key(node_key):
locations[node_location]["nodes"][node_key] = { "total": 1, "missing": 0, "unknown": 0, "offline": 0, "online": 0,
"analyzers": [ ],
"node_name": node_name, "node_location": node_location,
"ostype": ostype, "osversion": osversion,
"node_addresses": addresses, "node_key": node_key }
else:
locations[node_location]["nodes"][node_key]["total"] += 1
status = analyzer["status"]
locations[node_location][status] += 1
locations[node_location]["nodes"][node_key][status] += 1
if status == "missing" or status == "unknown":
locations[node_location]["nodes"][node_key]["analyzers"].insert(0, analyzer)
else:
locations[node_location]["nodes"][node_key]["analyzers"].append(analyzer)
self.dataset["locations"] = locations
def createMessageLink(self, ident, view):
return utils.create_link(view, { "origin": self.view_name, "ident": ident })
def _setTimelinePrev(self, prev):
parameters = self.parameters - [ "offset" ] + { "timeline_end": int(prev) }
self.dataset["timeline.prev"] = utils.create_link(self.view_name, parameters)
def _set_timeline_link(self, type, start, end):
parameters = self.parameters - [ "offset" ] + { "timeline_start": int(time.mktime(start.timetuple())),
"timeline_end": int(time.mktime(end.timetuple())) }
self.dataset["timeline.%s" % type] = utils.create_link(self.main.view_path, parameters)
