mirror of
https://github.com/valitydev/wazuh-kibana-app.git
synced 2024-11-07 02:15:24 +00:00
725 lines
30 KiB
JavaScript
725 lines
30 KiB
JavaScript
|
// Require utils
|
||
|
|
var kwu = require('plugins/wazuh/utils/kibanaWazuhUtils.js');
|
||
|
|
var kuf = require('plugins/wazuh/utils/kibanaUrlFormatter.js');
|
||
|
|
var base64 = require('plugins/wazuh/utils/base64.js');
|
||
|
|
// Require config
|
||
|
|
var config = require('plugins/wazuh/config/config.js');
|
||
|
|
require('ui/notify');
|
||
|
|
var app = require('ui/modules').get('app/wazuh', [
|
||
|
|
'elasticsearch',
|
||
|
|
'ngRoute',
|
||
|
|
'kibana/courier',
|
||
|
|
'kibana/config',
|
||
|
|
'kibana/notify',
|
||
|
|
'kibana/typeahead'
|
||
|
|
]);
|
||
|
|
|
||
|
|
app.controller('rulesetController', function ($scope, $http, Notifier, $route, $q, alertify, $interval, sharedProperties, $location, apiCall, $sce) {
|
||
|
|
$scope.load = true;
|
||
|
|
$scope.decoderLoad = false;
|
||
|
|
// Load settings
|
||
|
|
kwu.getApiCredentials($q, $http).then(function (data) {
|
||
|
|
var authdata = data[0];
|
||
|
|
var api_url = data[1];
|
||
|
|
const notify = new Notifier({
|
||
|
|
location: 'Wazuh'
|
||
|
|
});
|
||
|
|
|
||
|
|
//RULES
|
||
|
|
|
||
|
|
//Rules - Fetch
|
||
|
|
|
||
|
|
$scope.fetchRulesList = function () {
|
||
|
|
var defered = $q.defer();
|
||
|
|
var promise = defered.promise;
|
||
|
|
|
||
|
|
apiCall.getApiCall(api_url, '/rules', authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
$scope.rules = data.data;
|
||
|
|
defered.resolve(1);
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
$scope.rules.length = 0;
|
||
|
|
defered.resolve(0);
|
||
|
|
});
|
||
|
|
return promise;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.fetchFilesList = function () {
|
||
|
|
var defered = $q.defer();
|
||
|
|
var promise = defered.promise;
|
||
|
|
|
||
|
|
apiCall.getApiCall(api_url, '/rules/files', authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
$scope.filesRules = data.data;
|
||
|
|
defered.resolve(1);
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
$scope.filesRules.length = 0;
|
||
|
|
defered.resolve(0);
|
||
|
|
});
|
||
|
|
return promise;
|
||
|
|
};
|
||
|
|
|
||
|
|
|
||
|
|
$scope.fetchGroupsList = function () {
|
||
|
|
var defered = $q.defer();
|
||
|
|
var promise = defered.promise;
|
||
|
|
|
||
|
|
apiCall.getApiCall(api_url, '/rules/groups', authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
$scope.groupsRules = data.data;
|
||
|
|
defered.resolve(1);
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
$scope.groupsRules.length = 0;
|
||
|
|
defered.resolve(0);
|
||
|
|
});
|
||
|
|
return promise;
|
||
|
|
};
|
||
|
|
|
||
|
|
|
||
|
|
$scope.fetchPCIGroupsList = function () {
|
||
|
|
var defered = $q.defer();
|
||
|
|
var promise = defered.promise;
|
||
|
|
|
||
|
|
apiCall.getApiCall(api_url, '/rules/pci', authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
$scope.pciGroupsRules = data.data;
|
||
|
|
defered.resolve(1);
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
$scope.pciGroupsRules.length = 0;
|
||
|
|
defered.resolve(0);
|
||
|
|
});
|
||
|
|
return promise;
|
||
|
|
};
|
||
|
|
|
||
|
|
//Rules - Filters
|
||
|
|
|
||
|
|
$scope.filterStatus = function (status) {
|
||
|
|
if ($scope.fileFilter && $scope.fileFilter !== '') {
|
||
|
|
$scope.fileFilter = '';
|
||
|
|
}
|
||
|
|
if ($scope.groupFilter && $scope.groupFilter !== '') {
|
||
|
|
$scope.groupFilter = '';
|
||
|
|
}
|
||
|
|
if ($scope.rulesetStatusFilter === status) {
|
||
|
|
$scope.rulesetStatusFilter = '';
|
||
|
|
} else {
|
||
|
|
$scope.rulesetStatusFilter = status;
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.setFileFilter = function (file) {
|
||
|
|
if ($scope.groupFilter !== '') {
|
||
|
|
$scope.groupFilter = '';
|
||
|
|
}
|
||
|
|
if ($scope.pciFilter !== '') {
|
||
|
|
$scope.pciFilter = '';
|
||
|
|
}
|
||
|
|
if ($scope.fileFilter === file) {
|
||
|
|
$scope.fileFilter = '';
|
||
|
|
} else {
|
||
|
|
$scope.fileFilter = file;
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.isSetFileFilter = function (file) {
|
||
|
|
return $scope.fileFilter === file;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.setGroupFilter = function (group) {
|
||
|
|
if ($scope.fileFilter !== '') {
|
||
|
|
$scope.fileFilter = '';
|
||
|
|
}
|
||
|
|
if ($scope.pciFilter !== '') {
|
||
|
|
$scope.pciFilter = '';
|
||
|
|
}
|
||
|
|
if ($scope.groupFilter === group) {
|
||
|
|
$scope.groupFilter = '';
|
||
|
|
} else {
|
||
|
|
$scope.groupFilter = group;
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.isSetGroupFilter = function (group) {
|
||
|
|
return $scope.groupFilter === group;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.setPciFilter = function (pci) {
|
||
|
|
if ($scope.fileFilter !== '') {
|
||
|
|
$scope.fileFilter = '';
|
||
|
|
}
|
||
|
|
if ($scope.groupFilter !== '') {
|
||
|
|
$scope.groupFilter = '';
|
||
|
|
}
|
||
|
|
if ($scope.pciFilter === pci) {
|
||
|
|
$scope.pciFilter = '';
|
||
|
|
} else {
|
||
|
|
$scope.pciFilter = pci;
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.isSetPciFilter = function (pci) {
|
||
|
|
return $scope.pciFilter === pci;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.setFileFilterOutside = function (file) {
|
||
|
|
$scope.setFileFilter(file);
|
||
|
|
$scope.setTabFilters(1);
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.setGroupFilterOutside = function (group) {
|
||
|
|
$scope.setGroupFilter(group);
|
||
|
|
$scope.setTabFilters(2);
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.setPciFilterOutside = function (pci) {
|
||
|
|
$scope.setPciFilter(pci);
|
||
|
|
$scope.setTabFilters(3);
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.filterLevel = function () {
|
||
|
|
var defered = $q.defer();
|
||
|
|
var promise = defered.promise;
|
||
|
|
|
||
|
|
if (($scope.minLevel == undefined) || ($scope.maxLevel == undefined)
|
||
|
|
|| ($scope.minLevel < 0 || $scope.minLevel > 15
|
||
|
|
|| $scope.maxLevel < 0 || $scope.maxLevel > 15)
|
||
|
|
|| ($scope.maxLevel < $scope.minLevel)) {
|
||
|
|
|
||
|
|
$scope.minLevel = 0;
|
||
|
|
$scope.maxLevel = 15;
|
||
|
|
$scope.message = $sce.trustAsHtml('Invalid level filters');
|
||
|
|
}
|
||
|
|
|
||
|
|
apiCall.getApiCall(api_url, '/rules?level=' + $scope.minLevel + '-' + $scope.maxLevel, authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
$scope.rules = data.data;
|
||
|
|
defered.resolve(1);
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
$scope.rules.length = 0;
|
||
|
|
defered.resolve(0);
|
||
|
|
});
|
||
|
|
return promise;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.setFilterLevel = function (ruleLevel) {
|
||
|
|
$scope.minLevel = $scope.maxLevel = parseInt(ruleLevel);
|
||
|
|
$scope.filterLevel();
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.hasFileFilter = function () {
|
||
|
|
return ($scope.fileFilter) && ($scope.fileFilter !== '');
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.hasGroupFilter = function () {
|
||
|
|
return ($scope.groupFilter) && ($scope.groupFilter !== '');
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.hasPciFilter = function () {
|
||
|
|
return ($scope.pciFilter) && ($scope.pciFilter !== '');
|
||
|
|
};
|
||
|
|
|
||
|
|
//Rules - Other functions
|
||
|
|
|
||
|
|
|
||
|
|
$scope.getRuleStatusClass = function (rule) {
|
||
|
|
if (rule.details.overwrite) {
|
||
|
|
return "overwritten";
|
||
|
|
}
|
||
|
|
if (rule.status == 'enabled') {
|
||
|
|
if (rule.level == 0)
|
||
|
|
return "warning";
|
||
|
|
else
|
||
|
|
return "enabled";
|
||
|
|
} else {
|
||
|
|
return "disabled";
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.downloadRuleFile = function (fileName) {
|
||
|
|
if ($scope.encodedFile != '') {
|
||
|
|
(window.URL || window.webkitURL).revokeObjectURL($scope.encodedFile);
|
||
|
|
}
|
||
|
|
apiCall.getApiCall(api_url, '/rules/files?download=' + fileName, authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
var blob = new Blob([data], { type: 'text/xml' });
|
||
|
|
$scope.encodedFile = (window.URL || window.webkitURL).createObjectURL(blob);
|
||
|
|
}, function (data) {
|
||
|
|
if ((data.status > 299) || (200 > data.status)) {
|
||
|
|
$scope.message = $sce.trustAsHtml('Error creating the download link for ' + fileName + '. Please, check if the file exists.');
|
||
|
|
$scope.encodedFile = '';
|
||
|
|
} else {
|
||
|
|
var blob = new Blob([data], { type: 'text/xml' });
|
||
|
|
$scope.encodedFile = (window.URL || window.webkitURL).createObjectURL(blob);
|
||
|
|
}
|
||
|
|
});
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.getStatusTooltip = function (rule) {
|
||
|
|
if (rule.details.overwrite) {
|
||
|
|
return '<span style="width: 200px; display: inline-block; text-align: left;">The rule is overwriting rules with the same ID.</span>';
|
||
|
|
}
|
||
|
|
if (rule.status == 'enabled') {
|
||
|
|
if (rule.level == 0)
|
||
|
|
return '<span style="width: 200px; display: inline-block; text-align: left;">The rule is enabled, but it has alert level 0. Because this, the rule will never be triggered.</span>';
|
||
|
|
else
|
||
|
|
return '<span style="width: 200px; display: inline-block; text-align: left;">The rule is enabled.</span>';
|
||
|
|
} else {
|
||
|
|
return '<span style="width: 200px; display: inline-block; text-align: left;">The rule is not enabled.</span>';
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.rulesTooltips = function (key) {
|
||
|
|
var tooltip;
|
||
|
|
switch (key) {
|
||
|
|
case 'maxsize':
|
||
|
|
tooltip = 'Specifies the maximum size of the event.';
|
||
|
|
break;
|
||
|
|
case 'frequency':
|
||
|
|
tooltip = 'Specifies the number of times the rule must have matched before firing. The number that triggers the rule is actually 2 more than this setting.';
|
||
|
|
break;
|
||
|
|
case 'timeframe':
|
||
|
|
tooltip = 'The timeframe in seconds';
|
||
|
|
break;
|
||
|
|
case 'ignore':
|
||
|
|
tooltip = 'The time (in seconds) to ignore this rule after firing it (to avoid floods).';
|
||
|
|
break;
|
||
|
|
case 'overwrite':
|
||
|
|
tooltip = 'Used to supercede an OSSEC rule with local changes.';
|
||
|
|
break;
|
||
|
|
case 'match':
|
||
|
|
tooltip = 'Any string to match against the log event.';
|
||
|
|
break;
|
||
|
|
case 'regex':
|
||
|
|
tooltip = 'Any regex to match against the log event.';
|
||
|
|
break;
|
||
|
|
case 'decoded_as':
|
||
|
|
tooltip = 'Any decoder name.';
|
||
|
|
break;
|
||
|
|
case 'category':
|
||
|
|
tooltip = 'The decoded category to match (ids, syslog, firewall, web-log, squid or windows).';
|
||
|
|
break;
|
||
|
|
case 'srcip':
|
||
|
|
tooltip = 'Any IP address or CIDR block to be compared to an IP decoded as srcip.';
|
||
|
|
break;
|
||
|
|
case 'dstip':
|
||
|
|
tooltip = 'Any IP address or CIDR block to be compared to an IP decoded as dstip.';
|
||
|
|
break;
|
||
|
|
case 'extra_data':
|
||
|
|
tooltip = 'Any string that is decoded into the extra_data field.';
|
||
|
|
break;
|
||
|
|
case 'user':
|
||
|
|
tooltip = 'Any username (decoded as the username).';
|
||
|
|
break;
|
||
|
|
case 'program_name':
|
||
|
|
tooltip = 'Program name is decoded from syslog process name.';
|
||
|
|
break;
|
||
|
|
case 'hostname':
|
||
|
|
tooltip = 'Any hostname (decoded as the syslog hostname) or log file.';
|
||
|
|
break;
|
||
|
|
case 'time':
|
||
|
|
tooltip = 'Time that the event was generated.';
|
||
|
|
break;
|
||
|
|
case 'weekday':
|
||
|
|
tooltip = 'Week day that the event was generated.';
|
||
|
|
break;
|
||
|
|
case 'id':
|
||
|
|
tooltip = 'Any ID (decoded as the ID).';
|
||
|
|
break;
|
||
|
|
case 'url':
|
||
|
|
tooltip = 'Any URL (decoded as the URL).';
|
||
|
|
break;
|
||
|
|
case 'if_sid':
|
||
|
|
tooltip = 'Matches if the ID has matched.';
|
||
|
|
break;
|
||
|
|
case 'if_group':
|
||
|
|
tooltip = 'Matches if the group has matched before.';
|
||
|
|
break;
|
||
|
|
case 'if_level':
|
||
|
|
tooltip = 'Matches if the level has matched before.';
|
||
|
|
break;
|
||
|
|
case 'if_matched_sid':
|
||
|
|
tooltip = 'Matches if an alert of the defined ID has been triggered in a set number of seconds.';
|
||
|
|
break;
|
||
|
|
case 'if_matched_group':
|
||
|
|
tooltip = 'Matches if an alert of the defined group has been triggered in a set number of seconds.';
|
||
|
|
break;
|
||
|
|
case 'same_id':
|
||
|
|
tooltip = 'Specifies that the decoded id must be the same.';
|
||
|
|
break;
|
||
|
|
case 'same_source_ip':
|
||
|
|
tooltip = 'Specifies that the decoded source ip must be the same.';
|
||
|
|
break;
|
||
|
|
case 'same_source_port':
|
||
|
|
tooltip = 'Specifies that the decoded source port must be the same.';
|
||
|
|
break;
|
||
|
|
case 'same_dst_port':
|
||
|
|
tooltip = 'Specifies that the decoded destination port must be the same.';
|
||
|
|
break;
|
||
|
|
case 'same_location':
|
||
|
|
tooltip = 'Specifies that the location must be the same.';
|
||
|
|
break;
|
||
|
|
case 'same_user':
|
||
|
|
tooltip = 'Specifies that the decoded user must be the same.';
|
||
|
|
break;
|
||
|
|
case 'description':
|
||
|
|
tooltip = 'Rule description.';
|
||
|
|
break;
|
||
|
|
case 'list':
|
||
|
|
tooltip = 'Preform a CDB lookup using an ossec list. This is a fast on disk database which will always find keys within two seeks of the file.';
|
||
|
|
break;
|
||
|
|
case 'info':
|
||
|
|
tooltip = 'Extra information';
|
||
|
|
break;
|
||
|
|
case 'options':
|
||
|
|
tooltip = 'Additional rule options';
|
||
|
|
break;
|
||
|
|
case 'check_diff':
|
||
|
|
tooltip = 'Used to determine when the output of a command changes.';
|
||
|
|
break;
|
||
|
|
default:
|
||
|
|
tooltip = '';
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
return '<div style="width: 250px;">' + tooltip + '</div>';
|
||
|
|
};
|
||
|
|
|
||
|
|
//DECODERS
|
||
|
|
|
||
|
|
//Decoders - Fetch
|
||
|
|
|
||
|
|
$scope.fetchDecodersList = function () {
|
||
|
|
var defered = $q.defer();
|
||
|
|
var promise = defered.promise;
|
||
|
|
|
||
|
|
apiCall.getApiCall(api_url, '/decoders', authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
$scope.decoders = data.data;
|
||
|
|
defered.resolve(1);
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
$scope.decoders.length = 0;
|
||
|
|
defered.resolve(0);
|
||
|
|
});
|
||
|
|
return promise;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.fetchParentsDecodersList = function () {
|
||
|
|
var defered = $q.defer();
|
||
|
|
var promise = defered.promise;
|
||
|
|
|
||
|
|
apiCall.getApiCall(api_url, '/decoders/parents', authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
$scope.decoders = data.data;
|
||
|
|
defered.resolve(1);
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
$scope.decoders.length = 0;
|
||
|
|
defered.resolve(0);
|
||
|
|
});
|
||
|
|
return promise;
|
||
|
|
};
|
||
|
|
|
||
|
|
|
||
|
|
$scope.fetchDecodersFilesList = function () {
|
||
|
|
var defered = $q.defer();
|
||
|
|
var promise = defered.promise;
|
||
|
|
|
||
|
|
apiCall.getApiCall(api_url, '/decoders/files', authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
$scope.filesDecoders = data.data;
|
||
|
|
defered.resolve(1);
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
$scope.filesDecoders.length = 0;
|
||
|
|
defered.resolve(0);
|
||
|
|
});
|
||
|
|
return promise;
|
||
|
|
};
|
||
|
|
|
||
|
|
|
||
|
|
//Decoders - Filters
|
||
|
|
|
||
|
|
$scope.setDecoderFilterOutside = function (decoder) {
|
||
|
|
$scope.setTab(2);
|
||
|
|
$scope.setDecoderPathFilter(decoder);
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.setDecoderPathFilter = function (path) {
|
||
|
|
if ($scope.pathDecoderFilter === path) {
|
||
|
|
$scope.pathDecoderFilter = '';
|
||
|
|
} else {
|
||
|
|
$scope.pathDecoderFilter = path;
|
||
|
|
}
|
||
|
|
$scope.parent_filter = '';
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.isSetDecoderPathFilter = function (path) {
|
||
|
|
return $scope.pathDecoderFilter === path;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.hasDecoderFilter = function () {
|
||
|
|
return ($scope.pathDecoderFilter) && ($scope.pathDecoderFilter !== '');
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.filterDecoderParent = function (parent) {
|
||
|
|
if ($scope.parent_filter !== parent) {
|
||
|
|
$scope.parent_filter = parent;
|
||
|
|
} else {
|
||
|
|
$scope.parent_filter = '';
|
||
|
|
}
|
||
|
|
if ($scope.pathDecoderFilter !== '') {
|
||
|
|
$scope.pathDecoderFilter = '';
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.isSetParentFilter = function (parent) {
|
||
|
|
return $scope.parent_filter === parent;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.hasParentFilter = function () {
|
||
|
|
return ($scope.parent_filter) && ($scope.parent_filter !== '');
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.filterDecoderType = function (type) {
|
||
|
|
if (type === 'all') {
|
||
|
|
$scope.decoderType = 'all';
|
||
|
|
$scope.fetchDecodersList();
|
||
|
|
} else if (type === 'parents') {
|
||
|
|
$scope.decoderType = 'parents';
|
||
|
|
$scope.fetchParentsDecodersList();
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
//Decoders - Other functions
|
||
|
|
|
||
|
|
|
||
|
|
$scope.formatFile = function (file) {
|
||
|
|
return file.split("/").slice(-1)[0];
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.decoderTooltips = function (key) {
|
||
|
|
var tooltip;
|
||
|
|
switch (key) {
|
||
|
|
case 'prematch':
|
||
|
|
case 'regex':
|
||
|
|
tooltip = 'OS_Regex type (simple library for regular expressions in C).';
|
||
|
|
break;
|
||
|
|
case 'program_name':
|
||
|
|
tooltip = 'OS_Match type (supports simple string matching and the following special characters).';
|
||
|
|
break;
|
||
|
|
case 'accumulate':
|
||
|
|
tooltip = 'Allow OSSEC to track events over multiple log messages based on a decoded id.';
|
||
|
|
break;
|
||
|
|
case 'order':
|
||
|
|
tooltip = 'Extracted fields by decoder regex.';
|
||
|
|
break;
|
||
|
|
case 'fts':
|
||
|
|
tooltip = 'First time seen';
|
||
|
|
break;
|
||
|
|
default:
|
||
|
|
tooltip = '';
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
return '<div style="width: 250px;">' + tooltip + '</div>';
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.colorRegex = function (regex) {
|
||
|
|
regex = regex.toString();
|
||
|
|
var colors = ['blue', 'cadetblue', 'chocolate', 'darkgoldenrod', 'darkmagenta', 'darkred', 'darksalmon', 'dodgerblue', 'green',
|
||
|
|
'indigo', 'orange', 'purple', 'sienna', 'yellowgreen'];
|
||
|
|
var valuesArray = regex.match(/\(((?!<\/span>).)*?\)(?!<\/span>)/gmi);
|
||
|
|
var coloredString = regex;
|
||
|
|
for (var i = 0; i < valuesArray.length; i++) {
|
||
|
|
coloredString = coloredString.replace(/\(((?!<\/span>).)*?\)(?!<\/span>)/mi, '<span style="color: ' + colors[i] + ' ">' + valuesArray[i] + '</span>');
|
||
|
|
}
|
||
|
|
return $sce.trustAsHtml(coloredString);
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.colorOrder = function (order) {
|
||
|
|
order = order.toString();
|
||
|
|
var colors = ['blue', 'cadetblue', 'chocolate', 'darkgoldenrod', 'darkmagenta', 'darkred', 'darksalmon', 'dodgerblue', 'green',
|
||
|
|
'indigo', 'orange', 'purple', 'sienna', 'yellowgreen'];
|
||
|
|
var valuesArray = order.split(',');
|
||
|
|
var coloredString = order;
|
||
|
|
for (var i = 0; i < valuesArray.length; i++) {
|
||
|
|
coloredString = coloredString.replace(valuesArray[i], '<span style="color: ' + colors[i] + ' ">' + valuesArray[i] + '</span>');
|
||
|
|
}
|
||
|
|
return $sce.trustAsHtml(coloredString);
|
||
|
|
};
|
||
|
|
|
||
|
|
//UPDATER
|
||
|
|
|
||
|
|
$scope.selectUpdateType = function (type) {
|
||
|
|
$scope.updateType = type;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.updateRuleset = function () {
|
||
|
|
|
||
|
|
if (!$scope.updateType) {
|
||
|
|
alertify.delay(10000).closeLogOnClick(true).error('Select an update type');
|
||
|
|
}
|
||
|
|
if ($scope.updateForce) {
|
||
|
|
var template = 'Are you sure you want to update the ruleset?<ul style="text-align: left !important;"><li style="text-align: left !important;">The ruleset will be overwritten, except local_rules and local_decoders file.</li><li style="text-align: left !important;">OSSEC manager is going to be restarted.</li><li style="text-align: left !important;">Before the update, backup of the ruleset will be done.</li></ul>';
|
||
|
|
}
|
||
|
|
else {
|
||
|
|
var template = 'Are you sure you want to update the ruleset?<ul style="text-align: left !important;"><li style="text-align: left !important;">The ruleset will be overwritten, except local_rules and local_decoders file.</li><li style="text-align: left !important;">If any rule included in ossec.conf is updated, OSSEC manager will be restarted.</li><li style="text-align: left !important;">Before the update, backup of the ruleset will be done.</li></ul>';
|
||
|
|
}
|
||
|
|
|
||
|
|
alertify.confirm(template, function () {
|
||
|
|
|
||
|
|
if ($scope.updateForce) {
|
||
|
|
if ($scope.updateType == 'r') {
|
||
|
|
var path = '/manager/update-ruleset?force=yes&type=rules';
|
||
|
|
} else if ($scope.updateType == 'c') {
|
||
|
|
var path = '/manager/update-ruleset?force=yes&type=rootchecks';
|
||
|
|
} else {
|
||
|
|
var path = '/manager/update-ruleset?force=yes';
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
if ($scope.updateType == 'r') {
|
||
|
|
var path = '/manager/update-ruleset?type=rules';
|
||
|
|
} else if ($scope.updateType == 'c') {
|
||
|
|
var path = '/manager/update-ruleset?type=rootchecks';
|
||
|
|
} else {
|
||
|
|
var path = '/manager/update-ruleset';
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
apiCall.putApiCall(api_url, path, {}, authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
var alert = data.data.msg + '. ';
|
||
|
|
if (data.data.need_restart === 'yes' && (data.data.restarted === 'no' || data.data.restart_status === 'fail')) {
|
||
|
|
alert += "The manager needs to be manually restarted.";
|
||
|
|
} else if (data.data.restarted === 'yes') {
|
||
|
|
alert += "The manager has been restarted. ";
|
||
|
|
}
|
||
|
|
if (data.data.manual_steps !== 'no') {
|
||
|
|
alert += "The following manual steps are required: " + data.data.manual_steps_detail;
|
||
|
|
}
|
||
|
|
alertify.delay(10000).closeLogOnClick(true).success(alert);
|
||
|
|
}, function (data) {
|
||
|
|
alertify.delay(10000).closeLogOnClick(true).error('Ruleset not updated');
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
});
|
||
|
|
|
||
|
|
}, function () {
|
||
|
|
alertify.delay(10000).closeLogOnClick(true).log('Ruleset not updated');
|
||
|
|
});
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.fetchBackupsList = function () {
|
||
|
|
var defered = $q.defer();
|
||
|
|
var promise = defered.promise;
|
||
|
|
apiCall.getApiCall(api_url, '/manager/update-ruleset/backups', authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
$scope.backups = data.data;
|
||
|
|
defered.resolve(1);
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
$scope.backups.length = 0;
|
||
|
|
defered.resolve(0);
|
||
|
|
});
|
||
|
|
return promise;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.restoreBackup = function () {
|
||
|
|
alertify.confirm('Are you sure you want to restore this backup?<ul style="text-align: left !important;"><li style="text-align: left !important;">This action can not be undone.</li></ul>', function () {
|
||
|
|
apiCall.putApiCall(api_url, '/manager/update-ruleset/backups/' + $scope.selectedBackup, {}, authdata, $q, $http)
|
||
|
|
.then(function (data) {
|
||
|
|
var alert;
|
||
|
|
if (data.data.msg === 'Backup successfully') {
|
||
|
|
alert = 'Backup successfuly restored. ';
|
||
|
|
}
|
||
|
|
if (data.data.need_restart === 'yes' && (data.data.restarted === 'no' || data.data.restart_status === 'fail')) {
|
||
|
|
alert += "The manager needs to be manually restarted.";
|
||
|
|
} else if (data.data.restarted === 'yes') {
|
||
|
|
alert += "The manager has been restarted";
|
||
|
|
}
|
||
|
|
if (data.data.manual_steps !== 'no') {
|
||
|
|
alert += "The following manual steps are required: " + data.data.manual_steps_detail;
|
||
|
|
}
|
||
|
|
alertify.delay(10000).closeLogOnClick(true).success(alert);
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml(apiCall.errorControl(data));
|
||
|
|
alertify.delay(10000).closeLogOnClick(true).error('There was an error trying to restore the backup.');
|
||
|
|
});
|
||
|
|
}, function () {
|
||
|
|
alertify.delay(10000).closeLogOnClick(true).log('Backup not restored.');
|
||
|
|
});
|
||
|
|
};
|
||
|
|
|
||
|
|
//TABS
|
||
|
|
|
||
|
|
$scope.setTab = function (newTab) {
|
||
|
|
$scope.tab = newTab;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.isSet = function (tabNum) {
|
||
|
|
return $scope.tab === tabNum;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.setTabFilters = function (newTab, index) {
|
||
|
|
$scope.tabFilters[index] = newTab;
|
||
|
|
};
|
||
|
|
|
||
|
|
$scope.isSetFilters = function (tabNum, index) {
|
||
|
|
return $scope.tabFilters[index] === tabNum;
|
||
|
|
};
|
||
|
|
|
||
|
|
|
||
|
|
//Load the page
|
||
|
|
$scope.rules = [];
|
||
|
|
$scope.backups = [];
|
||
|
|
$scope.decoders = [];
|
||
|
|
$scope.groupsRules = [];
|
||
|
|
$scope.pciGroupsRules = [];
|
||
|
|
$scope.fetchRulesList().then(function (data) {
|
||
|
|
$scope.fetchFilesList().then(function (data) {
|
||
|
|
$scope.fetchGroupsList().then(function (data) {
|
||
|
|
$scope.fetchPCIGroupsList().then(function (data) {
|
||
|
|
|
||
|
|
$scope.rulesetStatusFilter = 'enabled';
|
||
|
|
$scope.tab = [];
|
||
|
|
$scope.tabFilters = [];
|
||
|
|
$scope.setTab(1);
|
||
|
|
$scope.setTabFilters(1);
|
||
|
|
|
||
|
|
$scope.maxLevel = 15;
|
||
|
|
$scope.minLevel = 0;
|
||
|
|
|
||
|
|
$scope.updateType = 'b';
|
||
|
|
$scope.updateForce = false;
|
||
|
|
|
||
|
|
$scope.decoderType = 'all';
|
||
|
|
|
||
|
|
$scope.fetchBackupsList();
|
||
|
|
|
||
|
|
$scope.fetchDecodersList().then(function (data) {
|
||
|
|
$scope.fetchDecodersFilesList().then(function (data) {
|
||
|
|
$scope.decoderLoad = true;
|
||
|
|
$scope.load = false;
|
||
|
|
});
|
||
|
|
});
|
||
|
|
|
||
|
|
|
||
|
|
if (sharedProperties.getRuleFileName() && (sharedProperties.getRuleFileName() != '') && sharedProperties.getIsRule()) {
|
||
|
|
$scope.setFileFilterOutside(sharedProperties.getRuleFileName());
|
||
|
|
sharedProperties.setRuleFileName('');
|
||
|
|
} else if (sharedProperties.getRuleFileName() && (sharedProperties.getRuleFileName() != '')) {
|
||
|
|
$scope.setDecoderFilterOutside(sharedProperties.getRuleFileName());
|
||
|
|
sharedProperties.setRuleFileName('');
|
||
|
|
}
|
||
|
|
});
|
||
|
|
});
|
||
|
|
});
|
||
|
|
});
|
||
|
|
|
||
|
|
}, function (data) {
|
||
|
|
$scope.message = $sce.trustAsHtml('Could not get the API credentials. Is elasticsearch working?');
|
||
|
|
})
|
||
|
|
});
|