diff --git a/SplunkAppForWazuh/appserver/controllers/api.py b/SplunkAppForWazuh/appserver/controllers/api.py index 45cf0b222..42400e13c 100644 --- a/SplunkAppForWazuh/appserver/controllers/api.py +++ b/SplunkAppForWazuh/appserver/controllers/api.py @@ -74,34 +74,42 @@ def getSelfAdminStanza(self): def clean_keys(self, response): """Hide sensible data from API response.""" try: - res = response["data"] hide = "********" - # Remove agent key - if "internal_key" in res: - res["internal_key"] = hide - # Remove cluster key (/come/cluster) - if "node_type" in res and "key" in res: - res["key"] = hide - # Remove cluster key (/manager/configuration) - if "cluster" in res: - if "node_type" in res["cluster"] and "key" in res["cluster"]: - res["cluster"]["key"] = hide - - # Remove AWS keys - if "wmodules" in res: - for wmod in res["wmodules"]: - if "aws-s3" in wmod: - if "buckets" in wmod["aws-s3"]: - for bucket in wmod["aws-s3"]["buckets"]: - bucket["access_key"] = hide - bucket["secret_key"] = hide - # Remove integrations keys - if "integration" in res: - for integ in res["integration"]: - integ["api_key"] = hide - response["data"] = res - return jsonbak.dumps(response) + if "data" in response and type(response["data"]) == dict: + # Remove agent key + if "internal_key" in response["data"]: + response["data"]["internal_key"] = hide + + # Remove cluster key (/come/cluster) + if "node_type" in response["data"]: + if "key" in response["data"]: + response["data"]["key"] = hide + + # Remove cluster key (/manager/configuration) + if "cluster" in response["data"]: + if "node_type" in response["data"]["cluster"] and "key" in response["data"]["cluster"]: + response["data"]["cluster"]["key"] = hide + + # Remove AWS keys + if "wmodules" in response["data"]: + for wmod in response["data"]["wmodules"]: + if "aws-s3" in wmod: + if "buckets" in wmod["aws-s3"]: + for bucket in wmod["aws-s3"]["buckets"]: + bucket["access_key"] = hide + bucket["secret_key"] = hide + if "services" in wmod["aws-s3"]: + for service in wmod["aws-s3"]["services"]: + service["access_key"] = hide + service["secret_key"] = hide + + # Remove integrations keys + if "integration" in response["data"]: + for integ in response["data"]["integration"]: + integ["api_key"] = hide + return response except Exception as e: + self.logger.error("Error while cleaning keys in request response: %s" % (e)) raise e def format_output(self, arr): @@ -187,7 +195,7 @@ def make_request(self, method, url, opt_endpoint, kwargs, auth, verify, counter return self.make_request(method, url, opt_endpoint, kwargs, auth, verify, counter - 1) else: raise Exception("Tried to execute %s %s three times with no success, aborted." % (method, opt_endpoint)) - return request + return self.clean_keys(request) except Exception as e: self.logger.error("Error while requesting to Wazuh API: %s" % (e)) raise e @@ -332,7 +340,7 @@ def csv(self, **kwargs): opt_base_url = api["data"]["url"] opt_base_port = api["data"]["portapi"] opt_endpoint = kwargs['path'] - url = opt_base_url + ":" + opt_base_port + url = str(opt_base_url) + ":" + str(opt_base_port) auth = requestsbak.auth.HTTPBasicAuth(opt_username, opt_password) verify = False # init csv writer diff --git a/SplunkAppForWazuh/appserver/static/css/images/loupe.png b/SplunkAppForWazuh/appserver/static/css/images/loupe.png new file mode 100644 index 000000000..83c9d7427 Binary files /dev/null and b/SplunkAppForWazuh/appserver/static/css/images/loupe.png differ diff --git a/SplunkAppForWazuh/appserver/static/css/styles/common.css b/SplunkAppForWazuh/appserver/static/css/styles/common.css index 566a4c102..31859cc9d 100644 --- a/SplunkAppForWazuh/appserver/static/css/styles/common.css +++ b/SplunkAppForWazuh/appserver/static/css/styles/common.css @@ -51,6 +51,13 @@ margin: 0px; } +.wz-menu-settings{ + min-width: 30px; + border-radius: 100px; + margin-left: 5px; + margin-right: 5px !important; +} + .addGroupInput { max-height: 20px !important; max-width: 181px !important; @@ -428,7 +435,7 @@ div.uil-ring-css { } .wz-margin-left-20 { - margin-left: 20px; + margin-left: 20px !important; } .wz-margin-left--10 { @@ -464,6 +471,9 @@ div.uil-ring-css { .wz-height-35 { height: 35px !important; } +.wz-height-20 { + height: 20px !important; +} .wz-width-85 { min-width: 85px; @@ -986,7 +996,7 @@ md-dialog{ .edit-cancel-button { border: none !important; color: rgb(0, 121, 165) !important; - background: white !important; + background: #fafafa !important; } .edit-cancel-button:hover { @@ -1094,6 +1104,18 @@ md-toast { padding-right: 40px !important; } +.wz-text-truncatable { + overflow: hidden; + white-space: nowrap; + text-overflow: ellipsis; +} + +.wz-text-truncatable-container { + overflow: hidden; + width: auto; + display: grid; +} + span.pass { background-color: green !important; color: white !important; @@ -1157,7 +1179,7 @@ span.wrong { } .table-width-id{ - width: 20px !important; + width: 60px !important; } .table-width-filename{ @@ -1525,7 +1547,6 @@ input:focus { } #dropDownInput button { - min-width: 100% !important; border: solid 1px #0079bb !important; color: #0079bb !important; background: white !important; @@ -1658,6 +1679,17 @@ input:focus { color: #1278b0 !important; } +.switch-log { + margin: 5px 10px; +} + +.wz-text-align-right { + text-align: right; +} + +.table-condensed td { + padding: 5px !important; +} /* Loading bar */ @@ -1694,3 +1726,79 @@ input:focus { to {left: 100%;} } + +/* eui spinner */ + +.euiLoadingSpinner--medium { + width: 16px; + height: 16px; + border-width: 1px; +} +.euiLoadingSpinner { + display: inline-block; + width: 32px; + height: 32px; + border-radius: 50%; + border: solid 2px #D3DAE6; + border-color: #006BB4 #D3DAE6 #D3DAE6 #D3DAE6; + -webkit-animation: euiLoadingSpinner .6s infinite linear; + animation: euiLoadingSpinner .6s infinite linear; +} + + +/* Do not show the last resize th */ +.table-resizable > thead th:last-child .ui-resizable-handle { + display: none !important; +} + + +.wz-breadcrumb-margin{ + margin-left:10px; + margin-top:12px; +} + + + +label.wz-icon-loupe { + position: relative; + width:100%; +} + +label.wz-icon-loupe:before { + content: ""; + position: absolute; + left: 10px; + bottom: 0; + width: 20px; + height: 40px; + background: url(/static/app/SplunkAppForWazuh/css/images/loupe.png) no-repeat; + background-size: 18px; +} + +label.wz-icon-loupe input { + padding: 0px 35px !important; + width:100%; +} + +.float_warning-icon { + margin-bottom: 5px; + margin-right: -5px; +} + +.noDot { + list-style-type: none !important; + margin-left: 0px !important; +} + +.orange { + color: #ff9999; +} + +.gray { + background-color: #5c6773 !important; +} + +.center { + margin: 0 auto !important; + text-align: center !important; +} \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/css/styles/component.css b/SplunkAppForWazuh/appserver/static/css/styles/component.css index bc94a4799..d191bdb9c 100644 --- a/SplunkAppForWazuh/appserver/static/css/styles/component.css +++ b/SplunkAppForWazuh/appserver/static/css/styles/component.css @@ -93,7 +93,8 @@ md-dialog-actions button { } .wz-white-background { - background-color:white !important; + /*background-color:white !important;*/ + background-color: #fafafa; } /* Custom switch styles */ diff --git a/SplunkAppForWazuh/appserver/static/css/styles/jquery-ui.css b/SplunkAppForWazuh/appserver/static/css/styles/jquery-ui.css new file mode 100644 index 000000000..719287fe6 --- /dev/null +++ b/SplunkAppForWazuh/appserver/static/css/styles/jquery-ui.css @@ -0,0 +1,1536 @@ +/*! jQuery UI - v1.11.0 - 2014-06-26 +* http://jqueryui.com +* Includes: core.css, accordion.css, autocomplete.css, button.css, datepicker.css, dialog.css, draggable.css, menu.css, progressbar.css, resizable.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css +* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=glass&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=glass&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=glass&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=flat&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=flat&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px +* Copyright 2014 jQuery Foundation and other contributors; Licensed MIT */ + +/* Layout helpers +----------------------------------*/ +.ui-helper-hidden { + display: none; +} +.ui-helper-hidden-accessible { + border: 0; + clip: rect(0 0 0 0); + height: 1px; + margin: -1px; + overflow: hidden; + padding: 0; + position: absolute; + width: 1px; +} +.ui-helper-reset { + margin: 0; + padding: 0; + border: 0; + outline: 0; + line-height: 1.3; + text-decoration: none; + font-size: 100%; + list-style: none; +} +.ui-helper-clearfix:before, +.ui-helper-clearfix:after { + content: ''; + display: table; + border-collapse: collapse; +} +.ui-helper-clearfix:after { + clear: both; +} +.ui-helper-clearfix { + min-height: 0; /* support: IE7 */ +} +.ui-helper-zfix { + width: 100%; + height: 100%; + top: 0; + left: 0; + position: absolute; + opacity: 0; + filter: Alpha(Opacity=0); +} + +.ui-front { + z-index: 100; +} + +/* Interaction Cues +----------------------------------*/ +.ui-state-disabled { + cursor: default !important; +} + +/* Icons +----------------------------------*/ + +/* states and images */ +.ui-icon { + display: block; + text-indent: -99999px; + overflow: hidden; + background-repeat: no-repeat; +} + +/* Misc visuals +----------------------------------*/ + +/* Overlays */ +.ui-widget-overlay { + position: fixed; + top: 0; + left: 0; + width: 100%; + height: 100%; +} +.ui-accordion .ui-accordion-header { + display: block; + cursor: pointer; + position: relative; + margin: 2px 0 0 0; + padding: 0.5em 0.5em 0.5em 0.7em; + min-height: 0; /* support: IE7 */ + font-size: 100%; +} +.ui-accordion .ui-accordion-icons { + padding-left: 2.2em; +} +.ui-accordion .ui-accordion-icons .ui-accordion-icons { + padding-left: 2.2em; +} +.ui-accordion .ui-accordion-header .ui-accordion-header-icon { + position: absolute; + left: 0.5em; + top: 50%; + margin-top: -8px; +} +.ui-accordion .ui-accordion-content { + padding: 1em 2.2em; + border-top: 0; + overflow: auto; +} +.ui-autocomplete { + position: absolute; + top: 0; + left: 0; + cursor: default; +} +.ui-button { + display: inline-block; + position: relative; + padding: 0; + line-height: normal; + margin-right: 0.1em; + cursor: pointer; + vertical-align: middle; + text-align: center; + overflow: visible; /* removes extra width in IE */ +} +.ui-button, +.ui-button:link, +.ui-button:visited, +.ui-button:hover, +.ui-button:active { + text-decoration: none; +} +/* to make room for the icon, a width needs to be set here */ +.ui-button-icon-only { + width: 2.2em; +} +/* button elements seem to need a little more width */ +button.ui-button-icon-only { + width: 2.4em; +} +.ui-button-icons-only { + width: 3.4em; +} +button.ui-button-icons-only { + width: 3.7em; +} + +/* button text element */ +.ui-button .ui-button-text { + display: block; + line-height: normal; +} +.ui-button-text-only .ui-button-text { + padding: 0.4em 1em; +} +.ui-button-icon-only .ui-button-text, +.ui-button-icons-only .ui-button-text { + padding: 0.4em; + text-indent: -9999999px; +} +.ui-button-text-icon-primary .ui-button-text, +.ui-button-text-icons .ui-button-text { + padding: 0.4em 1em 0.4em 2.1em; +} +.ui-button-text-icon-secondary .ui-button-text, +.ui-button-text-icons .ui-button-text { + padding: 0.4em 2.1em 0.4em 1em; +} +.ui-button-text-icons .ui-button-text { + padding-left: 2.1em; + padding-right: 2.1em; +} +/* no icon support for input elements, provide padding by default */ +input.ui-button { + padding: 0.4em 1em; +} + +/* button icon element(s) */ +.ui-button-icon-only .ui-icon, +.ui-button-text-icon-primary .ui-icon, +.ui-button-text-icon-secondary .ui-icon, +.ui-button-text-icons .ui-icon, +.ui-button-icons-only .ui-icon { + position: absolute; + top: 50%; + margin-top: -8px; +} +.ui-button-icon-only .ui-icon { + left: 50%; + margin-left: -8px; +} +.ui-button-text-icon-primary .ui-button-icon-primary, +.ui-button-text-icons .ui-button-icon-primary, +.ui-button-icons-only .ui-button-icon-primary { + left: 0.5em; +} +.ui-button-text-icon-secondary .ui-button-icon-secondary, +.ui-button-text-icons .ui-button-icon-secondary, +.ui-button-icons-only .ui-button-icon-secondary { + right: 0.5em; +} + +/* button sets */ +.ui-buttonset { + margin-right: 7px; +} +.ui-buttonset .ui-button { + margin-left: 0; + margin-right: -0.3em; +} + +/* workarounds */ +/* reset extra padding in Firefox, see h5bp.com/l */ +input.ui-button::-moz-focus-inner, +button.ui-button::-moz-focus-inner { + border: 0; + padding: 0; +} +.ui-datepicker { + width: 17em; + padding: 0.2em 0.2em 0; + display: none; +} +.ui-datepicker .ui-datepicker-header { + position: relative; + padding: 0.2em 0; +} +.ui-datepicker .ui-datepicker-prev, +.ui-datepicker .ui-datepicker-next { + position: absolute; + top: 2px; + width: 1.8em; + height: 1.8em; +} +.ui-datepicker .ui-datepicker-prev-hover, +.ui-datepicker .ui-datepicker-next-hover { + top: 1px; +} +.ui-datepicker .ui-datepicker-prev { + left: 2px; +} +.ui-datepicker .ui-datepicker-next { + right: 2px; +} +.ui-datepicker .ui-datepicker-prev-hover { + left: 1px; +} +.ui-datepicker .ui-datepicker-next-hover { + right: 1px; +} +.ui-datepicker .ui-datepicker-prev span, +.ui-datepicker .ui-datepicker-next span { + display: block; + position: absolute; + left: 50%; + margin-left: -8px; + top: 50%; + margin-top: -8px; +} +.ui-datepicker .ui-datepicker-title { + margin: 0 2.3em; + line-height: 1.8em; + text-align: center; +} +.ui-datepicker .ui-datepicker-title select { + font-size: 1em; + margin: 1px 0; +} +.ui-datepicker select.ui-datepicker-month, +.ui-datepicker select.ui-datepicker-year { + width: 49%; +} +.ui-datepicker table { + width: 100%; + font-size: 0.9em; + border-collapse: collapse; + margin: 0 0 0.4em; +} +.ui-datepicker th { + padding: 0.7em 0.3em; + text-align: center; + font-weight: bold; + border: 0; +} +.ui-datepicker td { + border: 0; + padding: 1px; +} +.ui-datepicker td span, +.ui-datepicker td a { + display: block; + padding: 0.2em; + text-align: right; + text-decoration: none; +} +.ui-datepicker .ui-datepicker-buttonpane { + background-image: none; + margin: 0.7em 0 0 0; + padding: 0 0.2em; + border-left: 0; + border-right: 0; + border-bottom: 0; +} +.ui-datepicker .ui-datepicker-buttonpane button { + float: right; + margin: 0.5em 0.2em 0.4em; + cursor: pointer; + padding: 0.2em 0.6em 0.3em 0.6em; + width: auto; + overflow: visible; +} +.ui-datepicker .ui-datepicker-buttonpane button.ui-datepicker-current { + float: left; +} + +/* with multiple calendars */ +.ui-datepicker.ui-datepicker-multi { + width: auto; +} +.ui-datepicker-multi .ui-datepicker-group { + float: left; +} +.ui-datepicker-multi .ui-datepicker-group table { + width: 95%; + margin: 0 auto 0.4em; +} +.ui-datepicker-multi-2 .ui-datepicker-group { + width: 50%; +} +.ui-datepicker-multi-3 .ui-datepicker-group { + width: 33.3%; +} +.ui-datepicker-multi-4 .ui-datepicker-group { + width: 25%; +} +.ui-datepicker-multi .ui-datepicker-group-last .ui-datepicker-header, +.ui-datepicker-multi .ui-datepicker-group-middle .ui-datepicker-header { + border-left-width: 0; +} +.ui-datepicker-multi .ui-datepicker-buttonpane { + clear: left; +} +.ui-datepicker-row-break { + clear: both; + width: 100%; + font-size: 0; +} + +/* RTL support */ +.ui-datepicker-rtl { + direction: rtl; +} +.ui-datepicker-rtl .ui-datepicker-prev { + right: 2px; + left: auto; +} +.ui-datepicker-rtl .ui-datepicker-next { + left: 2px; + right: auto; +} +.ui-datepicker-rtl .ui-datepicker-prev:hover { + right: 1px; + left: auto; +} +.ui-datepicker-rtl .ui-datepicker-next:hover { + left: 1px; + right: auto; +} +.ui-datepicker-rtl .ui-datepicker-buttonpane { + clear: right; +} +.ui-datepicker-rtl .ui-datepicker-buttonpane button { + float: left; +} +.ui-datepicker-rtl .ui-datepicker-buttonpane button.ui-datepicker-current, +.ui-datepicker-rtl .ui-datepicker-group { + float: right; +} +.ui-datepicker-rtl .ui-datepicker-group-last .ui-datepicker-header, +.ui-datepicker-rtl .ui-datepicker-group-middle .ui-datepicker-header { + border-right-width: 0; + border-left-width: 1px; +} +.ui-dialog { + overflow: hidden; + position: absolute; + top: 0; + left: 0; + padding: 0.2em; + outline: 0; +} +.ui-dialog .ui-dialog-titlebar { + padding: 0.4em 1em; + position: relative; +} +.ui-dialog .ui-dialog-title { + float: left; + margin: 0.1em 0; + white-space: nowrap; + width: 90%; + overflow: hidden; + text-overflow: ellipsis; +} +.ui-dialog .ui-dialog-titlebar-close { + position: absolute; + right: 0.3em; + top: 50%; + width: 20px; + margin: -10px 0 0 0; + padding: 1px; + height: 20px; +} +.ui-dialog .ui-dialog-content { + position: relative; + border: 0; + padding: 0.5em 1em; + background: none; + overflow: auto; +} +.ui-dialog .ui-dialog-buttonpane { + text-align: left; + border-width: 1px 0 0 0; + background-image: none; + margin-top: 0.5em; + padding: 0.3em 1em 0.5em 0.4em; +} +.ui-dialog .ui-dialog-buttonpane .ui-dialog-buttonset { + float: right; +} +.ui-dialog .ui-dialog-buttonpane button { + margin: 0.5em 0.4em 0.5em 0; + cursor: pointer; +} +.ui-dialog .ui-resizable-se { + width: 12px; + height: 12px; + right: -5px; + bottom: -5px; + background-position: 16px 16px; +} +.ui-draggable .ui-dialog-titlebar { + cursor: move; +} +.ui-draggable-handle { + -ms-touch-action: none; + touch-action: none; +} +.ui-menu { + list-style: none; + padding: 0; + margin: 0; + display: block; + outline: none; +} +.ui-menu .ui-menu { + position: absolute; +} +.ui-menu .ui-menu-item { + position: relative; + margin: 0; + padding: 3px 1em 3px 0.4em; + cursor: pointer; + min-height: 0; /* support: IE7 */ + /* support: IE10, see #8844 */ + list-style-image: url('data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7'); +} +.ui-menu .ui-menu-divider { + margin: 5px 0; + height: 0; + font-size: 0; + line-height: 0; + border-width: 1px 0 0 0; +} +.ui-menu .ui-state-focus, +.ui-menu .ui-state-active { + margin: -1px; +} + +/* icon support */ +.ui-menu-icons { + position: relative; +} +.ui-menu-icons .ui-menu-item { + padding-left: 2em; +} + +/* left-aligned */ +.ui-menu .ui-icon { + position: absolute; + top: 0; + bottom: 0; + left: 0.2em; + margin: auto 0; +} + +/* right-aligned */ +.ui-menu .ui-menu-icon { + left: auto; + right: 0; +} +.ui-progressbar { + height: 2em; + text-align: left; + overflow: hidden; +} +.ui-progressbar .ui-progressbar-value { + margin: -1px; + height: 100%; +} +.ui-progressbar-indeterminate .ui-progressbar-value { + background-image: none; +} +.ui-resizable { + position: relative; +} +.ui-resizable-handle { + position: absolute; + font-size: 0.1px; + display: block; + -ms-touch-action: none; + touch-action: none; +} +.ui-resizable-disabled .ui-resizable-handle, +.ui-resizable-autohide .ui-resizable-handle { + display: none; +} +.ui-resizable-handle:before { + background-color: transparent !important; + } +.ui-resizable-n { + cursor: n-resize; + height: 7px; + width: 100%; + top: -5px; + left: 0; +} +.ui-resizable-s { + cursor: s-resize; + height: 7px; + width: 100%; + bottom: -5px; + left: 0; +} +.ui-resizable-e { + cursor: e-resize; + width: 4px; + right: 0px; + top: 0; + height: 100%; + z-index: 10000 !important; +} +.ui-resizable-w { + cursor: w-resize; + width: 7px; + left: -5px; + top: 0; + height: 100%; +} +.ui-resizable-se { + cursor: se-resize; + width: 12px; + height: 12px; + right: 1px; + bottom: 1px; +} +.ui-resizable-sw { + cursor: sw-resize; + width: 9px; + height: 9px; + left: -5px; + bottom: -5px; +} +.ui-resizable-nw { + cursor: nw-resize; + width: 9px; + height: 9px; + left: -5px; + top: -5px; +} +.ui-resizable-ne { + cursor: ne-resize; + width: 9px; + height: 9px; + right: -5px; + top: -5px; +} +.ui-selectable { + -ms-touch-action: none; + touch-action: none; +} +.ui-selectable-helper { + position: absolute; + z-index: 100; + border: 1px dotted black; +} +.ui-selectmenu-menu { + padding: 0; + margin: 0; + position: absolute; + top: 0; + left: 0; + display: none; +} +.ui-selectmenu-menu .ui-menu { + overflow: auto; + /* Support: IE7 */ + overflow-x: hidden; + padding-bottom: 1px; +} +.ui-selectmenu-menu .ui-menu .ui-selectmenu-optgroup { + font-size: 1em; + font-weight: bold; + line-height: 1.5; + padding: 2px 0.4em; + margin: 0.5em 0 0 0; + height: auto; + border: 0; +} +.ui-selectmenu-open { + display: block; +} +.ui-selectmenu-button { + display: inline-block; + overflow: hidden; + position: relative; + text-decoration: none; + cursor: pointer; +} +.ui-selectmenu-button span.ui-icon { + right: 0.5em; + left: auto; + margin-top: -8px; + position: absolute; + top: 50%; +} +.ui-selectmenu-button span.ui-selectmenu-text { + text-align: left; + padding: 0.4em 2.1em 0.4em 1em; + display: block; + line-height: 1.4; + overflow: hidden; + text-overflow: ellipsis; + white-space: nowrap; +} +.ui-slider { + position: relative; + text-align: left; +} +.ui-slider .ui-slider-handle { + position: absolute; + z-index: 2; + width: 1.2em; + height: 1.2em; + cursor: default; + -ms-touch-action: none; + touch-action: none; +} +.ui-slider .ui-slider-range { + position: absolute; + z-index: 1; + font-size: 0.7em; + display: block; + border: 0; + background-position: 0 0; +} + +/* For IE8 - See #6727 */ +.ui-slider.ui-state-disabled .ui-slider-handle, +.ui-slider.ui-state-disabled .ui-slider-range { + filter: inherit; +} + +.ui-slider-horizontal { + height: 0.8em; +} +.ui-slider-horizontal .ui-slider-handle { + top: -0.3em; + margin-left: -0.6em; +} +.ui-slider-horizontal .ui-slider-range { + top: 0; + height: 100%; +} +.ui-slider-horizontal .ui-slider-range-min { + left: 0; +} +.ui-slider-horizontal .ui-slider-range-max { + right: 0; +} + +.ui-slider-vertical { + width: 0.8em; + height: 100px; +} +.ui-slider-vertical .ui-slider-handle { + left: -0.3em; + margin-left: 0; + margin-bottom: -0.6em; +} +.ui-slider-vertical .ui-slider-range { + left: 0; + width: 100%; +} +.ui-slider-vertical .ui-slider-range-min { + bottom: 0; +} +.ui-slider-vertical .ui-slider-range-max { + top: 0; +} +.ui-sortable-handle { + -ms-touch-action: none; + touch-action: none; +} +.ui-spinner { + position: relative; + display: inline-block; + overflow: hidden; + padding: 0; + vertical-align: middle; +} +.ui-spinner-input { + border: none; + background: none; + color: inherit; + padding: 0; + margin: 0.2em 0; + vertical-align: middle; + margin-left: 0.4em; + margin-right: 22px; +} +.ui-spinner-button { + width: 16px; + height: 50%; + font-size: 0.5em; + padding: 0; + margin: 0; + text-align: center; + position: absolute; + cursor: default; + display: block; + overflow: hidden; + right: 0; +} +/* more specificity required here to override default borders */ +.ui-spinner a.ui-spinner-button { + border-top: none; + border-bottom: none; + border-right: none; +} +/* vertically center icon */ +.ui-spinner .ui-icon { + position: absolute; + margin-top: -8px; + top: 50%; + left: 0; +} +.ui-spinner-up { + top: 0; +} +.ui-spinner-down { + bottom: 0; +} + +/* TR overrides */ +.ui-spinner .ui-icon-triangle-1-s { + /* need to fix icons sprite */ + background-position: -65px -16px; +} +.ui-tabs { + position: relative; /* position: relative prevents IE scroll bug (element with position: relative inside container with overflow: auto appear as "fixed") */ + padding: 0.2em; +} +.ui-tabs .ui-tabs-nav { + margin: 0; + padding: 0.2em 0.2em 0; +} +.ui-tabs .ui-tabs-nav li { + list-style: none; + float: left; + position: relative; + top: 0; + margin: 1px 0.2em 0 0; + border-bottom-width: 0; + padding: 0; + white-space: nowrap; +} +.ui-tabs .ui-tabs-nav .ui-tabs-anchor { + float: left; + padding: 0.5em 1em; + text-decoration: none; +} +.ui-tabs .ui-tabs-nav li.ui-tabs-active { + margin-bottom: -1px; + padding-bottom: 1px; +} +.ui-tabs .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor, +.ui-tabs .ui-tabs-nav li.ui-state-disabled .ui-tabs-anchor, +.ui-tabs .ui-tabs-nav li.ui-tabs-loading .ui-tabs-anchor { + cursor: text; +} +.ui-tabs-collapsible .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor { + cursor: pointer; +} +.ui-tabs .ui-tabs-panel { + display: block; + border-width: 0; + padding: 1em 1.4em; + background: none; +} +.ui-tooltip { + padding: 8px; + position: absolute; + z-index: 9999; + max-width: 300px; + -webkit-box-shadow: 0 0 5px #aaa; + box-shadow: 0 0 5px #aaa; +} +body .ui-tooltip { + border-width: 2px; +} + +/* Component containers +----------------------------------*/ +.ui-widget { + font-family: Verdana, Arial, sans-serif; + font-size: 1.1em; +} +.ui-widget .ui-widget { + font-size: 1em; +} +.ui-widget input, +.ui-widget select, +.ui-widget textarea, +.ui-widget button { + font-family: Verdana, Arial, sans-serif; + font-size: 1em; +} +.ui-widget-content { + border: 1px solid #aaaaaa; + color: #222222; +} +.ui-widget-content a { + color: #222222; +} +.ui-widget-header { + border: 1px solid #aaaaaa; + color: #222222; + font-weight: bold; +} +.ui-widget-header a { + color: #222222; +} + +/* Interaction states +----------------------------------*/ +.ui-state-default, +.ui-widget-content .ui-state-default, +.ui-widget-header .ui-state-default { + border: 1px solid #d3d3d3; + font-weight: normal; + color: #555555; +} +.ui-state-default a, +.ui-state-default a:link, +.ui-state-default a:visited { + color: #555555; + text-decoration: none; +} +.ui-state-hover, +.ui-widget-content .ui-state-hover, +.ui-widget-header .ui-state-hover, +.ui-state-focus, +.ui-widget-content .ui-state-focus, +.ui-widget-header .ui-state-focus { + border: 1px solid #999999; + font-weight: normal; + color: #212121; +} +.ui-state-hover a, +.ui-state-hover a:hover, +.ui-state-hover a:link, +.ui-state-hover a:visited, +.ui-state-focus a, +.ui-state-focus a:hover, +.ui-state-focus a:link, +.ui-state-focus a:visited { + color: #212121; + text-decoration: none; +} +.ui-state-active, +.ui-widget-content .ui-state-active, +.ui-widget-header .ui-state-active { + border: 1px solid #aaaaaa; + font-weight: normal; + color: #212121; +} +.ui-state-active a, +.ui-state-active a:link, +.ui-state-active a:visited { + color: #212121; + text-decoration: none; +} + +/* Interaction Cues +----------------------------------*/ +.ui-state-highlight, +.ui-widget-content .ui-state-highlight, +.ui-widget-header .ui-state-highlight { + border: 1px solid #fcefa1; + color: #363636; +} +.ui-state-highlight a, +.ui-widget-content .ui-state-highlight a, +.ui-widget-header .ui-state-highlight a { + color: #363636; +} +.ui-state-error, +.ui-widget-content .ui-state-error, +.ui-widget-header .ui-state-error { + border: 1px solid #cd0a0a; + color: #cd0a0a; +} +.ui-state-error a, +.ui-widget-content .ui-state-error a, +.ui-widget-header .ui-state-error a { + color: #cd0a0a; +} +.ui-state-error-text, +.ui-widget-content .ui-state-error-text, +.ui-widget-header .ui-state-error-text { + color: #cd0a0a; +} +.ui-priority-primary, +.ui-widget-content .ui-priority-primary, +.ui-widget-header .ui-priority-primary { + font-weight: bold; +} +.ui-priority-secondary, +.ui-widget-content .ui-priority-secondary, +.ui-widget-header .ui-priority-secondary { + opacity: 0.7; + filter: Alpha(Opacity=70); + font-weight: normal; +} +.ui-state-disabled, +.ui-widget-content .ui-state-disabled, +.ui-widget-header .ui-state-disabled { + opacity: 0.35; + filter: Alpha(Opacity=35); + background-image: none; +} +.ui-state-disabled .ui-icon { + filter: Alpha(Opacity=35); /* For IE8 - See #6059 */ +} + +/* Icons +----------------------------------*/ + +/* states and images */ +.ui-icon { + width: 16px; + height: 16px; +} + +/* positioning */ +.ui-icon-blank { + background-position: 16px 16px; +} +.ui-icon-carat-1-n { + background-position: 0 0; +} +.ui-icon-carat-1-ne { + background-position: -16px 0; +} +.ui-icon-carat-1-e { + background-position: -32px 0; +} +.ui-icon-carat-1-se { + background-position: -48px 0; +} +.ui-icon-carat-1-s { + background-position: -64px 0; +} +.ui-icon-carat-1-sw { + background-position: -80px 0; +} +.ui-icon-carat-1-w { + background-position: -96px 0; +} +.ui-icon-carat-1-nw { + background-position: -112px 0; +} +.ui-icon-carat-2-n-s { + background-position: -128px 0; +} +.ui-icon-carat-2-e-w { + background-position: -144px 0; +} +.ui-icon-triangle-1-n { + background-position: 0 -16px; +} +.ui-icon-triangle-1-ne { + background-position: -16px -16px; +} +.ui-icon-triangle-1-e { + background-position: -32px -16px; +} +.ui-icon-triangle-1-se { + background-position: -48px -16px; +} +.ui-icon-triangle-1-s { + background-position: -64px -16px; +} +.ui-icon-triangle-1-sw { + background-position: -80px -16px; +} +.ui-icon-triangle-1-w { + background-position: -96px -16px; +} +.ui-icon-triangle-1-nw { + background-position: -112px -16px; +} +.ui-icon-triangle-2-n-s { + background-position: -128px -16px; +} +.ui-icon-triangle-2-e-w { + background-position: -144px -16px; +} +.ui-icon-arrow-1-n { + background-position: 0 -32px; +} +.ui-icon-arrow-1-ne { + background-position: -16px -32px; +} +.ui-icon-arrow-1-e { + background-position: -32px -32px; +} +.ui-icon-arrow-1-se { + background-position: -48px -32px; +} +.ui-icon-arrow-1-s { + background-position: -64px -32px; +} +.ui-icon-arrow-1-sw { + background-position: -80px -32px; +} +.ui-icon-arrow-1-w { + background-position: -96px -32px; +} +.ui-icon-arrow-1-nw { + background-position: -112px -32px; +} +.ui-icon-arrow-2-n-s { + background-position: -128px -32px; +} +.ui-icon-arrow-2-ne-sw { + background-position: -144px -32px; +} +.ui-icon-arrow-2-e-w { + background-position: -160px -32px; +} +.ui-icon-arrow-2-se-nw { + background-position: -176px -32px; +} +.ui-icon-arrowstop-1-n { + background-position: -192px -32px; +} +.ui-icon-arrowstop-1-e { + background-position: -208px -32px; +} +.ui-icon-arrowstop-1-s { + background-position: -224px -32px; +} +.ui-icon-arrowstop-1-w { + background-position: -240px -32px; +} +.ui-icon-arrowthick-1-n { + background-position: 0 -48px; +} +.ui-icon-arrowthick-1-ne { + background-position: -16px -48px; +} +.ui-icon-arrowthick-1-e { + background-position: -32px -48px; +} +.ui-icon-arrowthick-1-se { + background-position: -48px -48px; +} +.ui-icon-arrowthick-1-s { + background-position: -64px -48px; +} +.ui-icon-arrowthick-1-sw { + background-position: -80px -48px; +} +.ui-icon-arrowthick-1-w { + background-position: -96px -48px; +} +.ui-icon-arrowthick-1-nw { + background-position: -112px -48px; +} +.ui-icon-arrowthick-2-n-s { + background-position: -128px -48px; +} +.ui-icon-arrowthick-2-ne-sw { + background-position: -144px -48px; +} +.ui-icon-arrowthick-2-e-w { + background-position: -160px -48px; +} +.ui-icon-arrowthick-2-se-nw { + background-position: -176px -48px; +} +.ui-icon-arrowthickstop-1-n { + background-position: -192px -48px; +} +.ui-icon-arrowthickstop-1-e { + background-position: -208px -48px; +} +.ui-icon-arrowthickstop-1-s { + background-position: -224px -48px; +} +.ui-icon-arrowthickstop-1-w { + background-position: -240px -48px; +} +.ui-icon-arrowreturnthick-1-w { + background-position: 0 -64px; +} +.ui-icon-arrowreturnthick-1-n { + background-position: -16px -64px; +} +.ui-icon-arrowreturnthick-1-e { + background-position: -32px -64px; +} +.ui-icon-arrowreturnthick-1-s { + background-position: -48px -64px; +} +.ui-icon-arrowreturn-1-w { + background-position: -64px -64px; +} +.ui-icon-arrowreturn-1-n { + background-position: -80px -64px; +} +.ui-icon-arrowreturn-1-e { + background-position: -96px -64px; +} +.ui-icon-arrowreturn-1-s { + background-position: -112px -64px; +} +.ui-icon-arrowrefresh-1-w { + background-position: -128px -64px; +} +.ui-icon-arrowrefresh-1-n { + background-position: -144px -64px; +} +.ui-icon-arrowrefresh-1-e { + background-position: -160px -64px; +} +.ui-icon-arrowrefresh-1-s { + background-position: -176px -64px; +} +.ui-icon-arrow-4 { + background-position: 0 -80px; +} +.ui-icon-arrow-4-diag { + background-position: -16px -80px; +} +.ui-icon-extlink { + background-position: -32px -80px; +} +.ui-icon-newwin { + background-position: -48px -80px; +} +.ui-icon-refresh { + background-position: -64px -80px; +} +.ui-icon-shuffle { + background-position: -80px -80px; +} +.ui-icon-transfer-e-w { + background-position: -96px -80px; +} +.ui-icon-transferthick-e-w { + background-position: -112px -80px; +} +.ui-icon-folder-collapsed { + background-position: 0 -96px; +} +.ui-icon-folder-open { + background-position: -16px -96px; +} +.ui-icon-document { + background-position: -32px -96px; +} +.ui-icon-document-b { + background-position: -48px -96px; +} +.ui-icon-note { + background-position: -64px -96px; +} +.ui-icon-mail-closed { + background-position: -80px -96px; +} +.ui-icon-mail-open { + background-position: -96px -96px; +} +.ui-icon-suitcase { + background-position: -112px -96px; +} +.ui-icon-comment { + background-position: -128px -96px; +} +.ui-icon-person { + background-position: -144px -96px; +} +.ui-icon-print { + background-position: -160px -96px; +} +.ui-icon-trash { + background-position: -176px -96px; +} +.ui-icon-locked { + background-position: -192px -96px; +} +.ui-icon-unlocked { + background-position: -208px -96px; +} +.ui-icon-bookmark { + background-position: -224px -96px; +} +.ui-icon-tag { + background-position: -240px -96px; +} +.ui-icon-home { + background-position: 0 -112px; +} +.ui-icon-flag { + background-position: -16px -112px; +} +.ui-icon-calendar { + background-position: -32px -112px; +} +.ui-icon-cart { + background-position: -48px -112px; +} +.ui-icon-pencil { + background-position: -64px -112px; +} +.ui-icon-clock { + background-position: -80px -112px; +} +.ui-icon-disk { + background-position: -96px -112px; +} +.ui-icon-calculator { + background-position: -112px -112px; +} +.ui-icon-zoomin { + background-position: -128px -112px; +} +.ui-icon-zoomout { + background-position: -144px -112px; +} +.ui-icon-search { + background-position: -160px -112px; +} +.ui-icon-wrench { + background-position: -176px -112px; +} +.ui-icon-gear { + background-position: -192px -112px; +} +.ui-icon-heart { + background-position: -208px -112px; +} +.ui-icon-star { + background-position: -224px -112px; +} +.ui-icon-link { + background-position: -240px -112px; +} +.ui-icon-cancel { + background-position: 0 -128px; +} +.ui-icon-plus { + background-position: -16px -128px; +} +.ui-icon-plusthick { + background-position: -32px -128px; +} +.ui-icon-minus { + background-position: -48px -128px; +} +.ui-icon-minusthick { + background-position: -64px -128px; +} +.ui-icon-close { + background-position: -80px -128px; +} +.ui-icon-closethick { + background-position: -96px -128px; +} +.ui-icon-key { + background-position: -112px -128px; +} +.ui-icon-lightbulb { + background-position: -128px -128px; +} +.ui-icon-scissors { + background-position: -144px -128px; +} +.ui-icon-clipboard { + background-position: -160px -128px; +} +.ui-icon-copy { + background-position: -176px -128px; +} +.ui-icon-contact { + background-position: -192px -128px; +} +.ui-icon-image { + background-position: -208px -128px; +} +.ui-icon-video { + background-position: -224px -128px; +} +.ui-icon-script { + background-position: -240px -128px; +} +.ui-icon-alert { + background-position: 0 -144px; +} +.ui-icon-info { + background-position: -16px -144px; +} +.ui-icon-notice { + background-position: -32px -144px; +} +.ui-icon-help { + background-position: -48px -144px; +} +.ui-icon-check { + background-position: -64px -144px; +} +.ui-icon-bullet { + background-position: -80px -144px; +} +.ui-icon-radio-on { + background-position: -96px -144px; +} +.ui-icon-radio-off { + background-position: -112px -144px; +} +.ui-icon-pin-w { + background-position: -128px -144px; +} +.ui-icon-pin-s { + background-position: -144px -144px; +} +.ui-icon-play { + background-position: 0 -160px; +} +.ui-icon-pause { + background-position: -16px -160px; +} +.ui-icon-seek-next { + background-position: -32px -160px; +} +.ui-icon-seek-prev { + background-position: -48px -160px; +} +.ui-icon-seek-end { + background-position: -64px -160px; +} +.ui-icon-seek-start { + background-position: -80px -160px; +} +/* ui-icon-seek-first is deprecated, use ui-icon-seek-start instead */ +.ui-icon-seek-first { + background-position: -80px -160px; +} +.ui-icon-stop { + background-position: -96px -160px; +} +.ui-icon-eject { + background-position: -112px -160px; +} +.ui-icon-volume-off { + background-position: -128px -160px; +} +.ui-icon-volume-on { + background-position: -144px -160px; +} +.ui-icon-power { + background-position: 0 -176px; +} +.ui-icon-signal-diag { + background-position: -16px -176px; +} +.ui-icon-signal { + background-position: -32px -176px; +} +.ui-icon-battery-0 { + background-position: -48px -176px; +} +.ui-icon-battery-1 { + background-position: -64px -176px; +} +.ui-icon-battery-2 { + background-position: -80px -176px; +} +.ui-icon-battery-3 { + background-position: -96px -176px; +} +.ui-icon-circle-plus { + background-position: 0 -192px; +} +.ui-icon-circle-minus { + background-position: -16px -192px; +} +.ui-icon-circle-close { + background-position: -32px -192px; +} +.ui-icon-circle-triangle-e { + background-position: -48px -192px; +} +.ui-icon-circle-triangle-s { + background-position: -64px -192px; +} +.ui-icon-circle-triangle-w { + background-position: -80px -192px; +} +.ui-icon-circle-triangle-n { + background-position: -96px -192px; +} +.ui-icon-circle-arrow-e { + background-position: -112px -192px; +} +.ui-icon-circle-arrow-s { + background-position: -128px -192px; +} +.ui-icon-circle-arrow-w { + background-position: -144px -192px; +} +.ui-icon-circle-arrow-n { + background-position: -160px -192px; +} +.ui-icon-circle-zoomin { + background-position: -176px -192px; +} +.ui-icon-circle-zoomout { + background-position: -192px -192px; +} +.ui-icon-circle-check { + background-position: -208px -192px; +} +.ui-icon-circlesmall-plus { + background-position: 0 -208px; +} +.ui-icon-circlesmall-minus { + background-position: -16px -208px; +} +.ui-icon-circlesmall-close { + background-position: -32px -208px; +} +.ui-icon-squaresmall-plus { + background-position: -48px -208px; +} +.ui-icon-squaresmall-minus { + background-position: -64px -208px; +} +.ui-icon-squaresmall-close { + background-position: -80px -208px; +} +.ui-icon-grip-dotted-vertical { + background-position: 0 -224px; +} +.ui-icon-grip-dotted-horizontal { + background-position: -16px -224px; +} +.ui-icon-grip-solid-vertical { + background-position: -32px -224px; +} +.ui-icon-grip-solid-horizontal { + background-position: -48px -224px; +} +.ui-icon-gripsmall-diagonal-se { + background-position: -64px -224px; +} +.ui-icon-grip-diagonal-se { + background-position: -80px -224px; +} + +/* Misc visuals +----------------------------------*/ + +/* Corner radius */ +.ui-corner-all, +.ui-corner-top, +.ui-corner-left, +.ui-corner-tl { + border-top-left-radius: 4px; +} +.ui-corner-all, +.ui-corner-top, +.ui-corner-right, +.ui-corner-tr { + border-top-right-radius: 4px; +} +.ui-corner-all, +.ui-corner-bottom, +.ui-corner-left, +.ui-corner-bl { + border-bottom-left-radius: 4px; +} +.ui-corner-all, +.ui-corner-bottom, +.ui-corner-right, +.ui-corner-br { + border-bottom-right-radius: 4px; +} + +/* Overlays */ +.ui-widget-overlay { + opacity: 0.3; + filter: Alpha(Opacity=30); +} +.ui-widget-shadow { + margin: -8px 0 0 -8px; + padding: 8px; + opacity: 0.3; + filter: Alpha(Opacity=30); + border-radius: 8px; +} \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/css/styles/kbn.css b/SplunkAppForWazuh/appserver/static/css/styles/kbn.css new file mode 100644 index 000000000..586fc1c22 --- /dev/null +++ b/SplunkAppForWazuh/appserver/static/css/styles/kbn.css @@ -0,0 +1,104 @@ +.euiSwitch { + position: relative; + display: inline-block; + min-height: 20px; + } + + .euiSwitch .euiSwitch__input, .euiSwitch .euiSwitch__input[disabled] { + position: absolute; + opacity: 0; + width: 100%; + height: 100%; + cursor: pointer; +} + +.euiSwitch .euiSwitch__body { + pointer-events: none; + width: 44px; + height: 20px; + background-color: #006BB4; + display: inline-block; + position: relative; + border-radius: 20px; + vertical-align: middle; +} + +.euiSwitch .euiSwitch__thumb { + -webkit-box-shadow: 0 2px 2px -1px rgba(152, 162, 179, 0.3); + box-shadow: 0 2px 2px -1px rgba(152, 162, 179, 0.3); + padding: 9px; + border: 1px solid #c9cbcd; + background: #FFF no-repeat center; + border-radius: 18px; + -webkit-transition: background-color 150ms ease-in, border-color 150ms ease-in; + transition: background-color 150ms ease-in, border-color 150ms ease-in; + position: absolute; + display: inline-block; + left: 24px; + -webkit-transition: border-color 250ms cubic-bezier(0.34, 1.61, 0.7, 1), background-color 250ms cubic-bezier(0.34, 1.61, 0.7, 1), left 250ms cubic-bezier(0.34, 1.61, 0.7, 1), -webkit-transform 250ms cubic-bezier(0.34, 1.61, 0.7, 1); + transition: border-color 250ms cubic-bezier(0.34, 1.61, 0.7, 1), background-color 250ms cubic-bezier(0.34, 1.61, 0.7, 1), left 250ms cubic-bezier(0.34, 1.61, 0.7, 1), -webkit-transform 250ms cubic-bezier(0.34, 1.61, 0.7, 1); + transition: border-color 250ms cubic-bezier(0.34, 1.61, 0.7, 1), background-color 250ms cubic-bezier(0.34, 1.61, 0.7, 1), left 250ms cubic-bezier(0.34, 1.61, 0.7, 1), transform 250ms cubic-bezier(0.34, 1.61, 0.7, 1); + transition: border-color 250ms cubic-bezier(0.34, 1.61, 0.7, 1), background-color 250ms cubic-bezier(0.34, 1.61, 0.7, 1), left 250ms cubic-bezier(0.34, 1.61, 0.7, 1), transform 250ms cubic-bezier(0.34, 1.61, 0.7, 1), -webkit-transform 250ms cubic-bezier(0.34, 1.61, 0.7, 1); +} + +.euiSwitch .euiSwitch__track { + position: absolute; + left: 0; + top: 0; + right: 0; + bottom: 0; + overflow: hidden; + border-radius: 20px; +} + +.euiSwitch .euiSwitch__icon { + position: absolute; + right: -34px; + top: 2px; + bottom: 0; + width: 42px; + height: 16px; + -webkit-transition: left 250ms cubic-bezier(0.34, 1.61, 0.7, 1), right 250ms cubic-bezier(0.34, 1.61, 0.7, 1); + transition: left 250ms cubic-bezier(0.34, 1.61, 0.7, 1), right 250ms cubic-bezier(0.34, 1.61, 0.7, 1); + fill: #2D2D2D; +} + +.euiIcon--medium { + width: 16px; + height: 16px; +} +.euiIcon { + display: inline-block; + vertical-align: middle; + fill: currentColor; +} + +.euiSwitch .euiSwitch__icon--checked { + right: auto; + left: -8px; + fill: #FFF; +} + +.euiSwitch .euiSwitch__label { + padding-left: 8px; + line-height: 20px; + font-size: 14px; + vertical-align: middle; +} + +.euiSwitch .euiSwitch__input:not(:checked):not(:disabled) ~ .euiSwitch__body { + background-color: rgba(152, 162, 179, 0.2); +} + +.euiSwitch .euiSwitch__input:not(:checked) ~ .euiSwitch__body .euiSwitch__thumb { + left: 0; +} + +.euiSwitch .euiSwitch__input:not(:checked) ~ .euiSwitch__body .euiSwitch__icon { + right: -8px; +} + +.euiSwitch .euiSwitch__input:not(:checked) ~ .euiSwitch__body .euiSwitch__icon.euiSwitch__icon--checked { + right: auto; + left: -34px; +} \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/css/styles/layout.css b/SplunkAppForWazuh/appserver/static/css/styles/layout.css index b147eccb6..8094bfef6 100644 --- a/SplunkAppForWazuh/appserver/static/css/styles/layout.css +++ b/SplunkAppForWazuh/appserver/static/css/styles/layout.css @@ -66,7 +66,7 @@ } .wz-margin-left-10 { - margin-left: 10px; + margin-left: 10px !important; } .no-margin-left { @@ -131,6 +131,9 @@ .wz-padding-right-17 { padding-right: 17px; } +.wz-padding-right-25 { + padding-right: 25px; +} .wz-padding-metric { line-height: 16px; diff --git a/SplunkAppForWazuh/appserver/static/css/styles/loader.css b/SplunkAppForWazuh/appserver/static/css/styles/loader.css index b41e32b64..3785b2346 100644 --- a/SplunkAppForWazuh/appserver/static/css/styles/loader.css +++ b/SplunkAppForWazuh/appserver/static/css/styles/loader.css @@ -8,6 +8,8 @@ @import "table_decorations.css"; @import "layout.css"; @import "common.css"; +@import "jquery-ui.css"; +@import "kbn.css"; @import "component.css"; @import "typography.css"; @import "height.css"; diff --git a/SplunkAppForWazuh/appserver/static/css/styles/typography.css b/SplunkAppForWazuh/appserver/static/css/styles/typography.css index fa3a8372f..cb34f6e3c 100644 --- a/SplunkAppForWazuh/appserver/static/css/styles/typography.css +++ b/SplunkAppForWazuh/appserver/static/css/styles/typography.css @@ -91,6 +91,10 @@ font-size: 15px; } +.font-size-16 { + font-size: 16px; +} + .font-size-16-pt { font-size: 16pt; } diff --git a/SplunkAppForWazuh/appserver/static/css/styles/wazuh_decorations.css b/SplunkAppForWazuh/appserver/static/css/styles/wazuh_decorations.css index 11bdac0d5..4bb6d23e4 100644 --- a/SplunkAppForWazuh/appserver/static/css/styles/wazuh_decorations.css +++ b/SplunkAppForWazuh/appserver/static/css/styles/wazuh_decorations.css @@ -126,7 +126,7 @@ } .wz-margin-left-10 { - margin-left: 10px; + margin-left: 10px !important; } .wz-margin-left-16 { @@ -170,7 +170,11 @@ } .wz-margin-bottom-10 { - margin-bottom: 10px; + margin-bottom: 10px !important; +} + +.wz-margin-top--20 { + margin-top: -20px !important; } /* Classes for custom shadows for dashboard cells */ diff --git a/SplunkAppForWazuh/appserver/static/js/config/routes/overview-states.js b/SplunkAppForWazuh/appserver/static/js/config/routes/overview-states.js index 3db1c63e8..fc00a973a 100644 --- a/SplunkAppForWazuh/appserver/static/js/config/routes/overview-states.js +++ b/SplunkAppForWazuh/appserver/static/js/config/routes/overview-states.js @@ -126,6 +126,33 @@ define(['../module'], function(module) { } ] } + })// Overview - SCA Security Configuration Assessment + .state('ow-sca', { + templateUrl: + BASE_URL + + 'static/app/SplunkAppForWazuh/js/controllers/overview/sca/overview-sca.html', + onEnter: $navigationService => { + $navigationService.storeRoute('ow-sca') + }, + controller: 'overviewSCACtrl', + resolve: { + reportingEnabled: [ + '$currentDataService', + async $currentDataService => { + return await $currentDataService.getReportingStatus() + } + ], + extensions: [ + '$currentDataService', + async $currentDataService => { + try { + return await $currentDataService.getCurrentExtensions() + } catch (err) { + return false + } + } + ] + } }) // Overview - FIM .state('ow-fim', { diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/agents/agents.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/agents/agents.html index 48b2b3fa7..fa86d3515 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/agents/agents.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/agents/agents.html @@ -1,123 +1,109 @@ -
+
+
- - - Status + +
+
+ + Status + + + +
+ There are no agents yet. +
+
+ +
+
+
+ + Details + -
-
-
-

Active

-

{{ agentsCountActive }}

+
+
+ +
+
+

Active

+
+

{{agentsCountActive}}

-
-

Disconnected

-

- {{ agentsCountDisconnected }} -

+
+
+ +
+
+

Disconnected

+
+

{{agentsCountDisconnected}}

-
-
-

Never connected

-

- {{ agentsCountNeverConnected }} -

+
+ +
+
+

Never connected

+
+

{{agentsCountNeverConnected}}

-
-

Agents coverage

-

- {{ agentsCoverity | number: 2 }}% -

-

0

+
+
+ +
+
+

Agents coverage

+
+

{{(agentsCoverity | number:2)}}%

- - - - - Top - -
-

Last registered agent

- - -
-
-

Higher activity

- - +
+
+ +
+
+

Last registered agent

+
+ +

+ -

+
+
+
+ +
+
+

Most active agent

+
+ +

+ -

+
+
- - +
+ +
+
- -
@@ -125,33 +111,22 @@
- + allow-click="true" rows-per-page="17">
-
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/agents/agentsCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/agents/agentsCtrl.js index d2fdf50b6..78ed95de6 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/agents/agentsCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/agents/agentsCtrl.js @@ -14,7 +14,7 @@ define([ '../../module', '../../../services/visualizations/search/search-handler', 'FileSaver' -], function(app, SearchHandler) { +], function (app, SearchHandler) { 'use strict' class Agents { @@ -107,7 +107,7 @@ define([ if (this.clusterInfo && this.clusterInfo.status === 'enabled') { this.scope.searchBarModel.node_name = nodes || [] } - } catch (error) {} //eslint-disable-line + } catch (error) { } //eslint-disable-line this.topAgent = new SearchHandler( 'searchTopAgent', @@ -141,6 +141,35 @@ define([ this.topAgent.destroy() }) this.scope.reloadList = () => this.reloadList() + + this.scope.loadCharts = (id) => { + setTimeout(() => { + const chart = new Chart(document.getElementById(id), + { + type: "doughnut", + data: { + labels: ["Active", "Disconected", "Never connected"], + datasets: [ + { + backgroundColor: ['#46BFBD', '#F7464A', '#949FB1'], + data: [this.scope.agentsCountActive, this.scope.agentsCountDisconnected, this.scope.agentsCountNeverConnected], + } + ] + }, + options: { + cutoutPercentage: 85, + legend: { + display: true, + position: "right", + }, + tooltips: { + displayColors: false + } + } + }); + chart.update(); + }, 250); + } } /** diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/audit/agents-audit.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/audit/agents-audit.html index 960959860..ba7a91363 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/audit/agents-audit.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/audit/agents-audit.html @@ -1,185 +1,142 @@ -
- -
+
+
Agents / - {{agent.name}} ({{agent.id}}) + {{agent.name}} ({{agent.id}}) Unknown agent / Audit -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
- - -
-
+ + +
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - - Policy monitoring + + Policy monitoring + SCA System auditing - OpenSCAP - CIS-CAT - - + OpenSCAP + CIS-CAT + + - -
- - -
New files: - -
-
Read files: - -
-
Modified files: - -
-
Removed files: - -
-
-
-
- -
- - - Groups - - - -
-
-
- - - Agents - - - -
-
-
- - - Directories - - - -
-
-
- - - Files - - - -
-
-
-
- -
- - - Alerts over time - - - -
-
-
+
+
+ Fetching data...
+
+
+ +
+ + +
New files: + +
+
Read files: + +
+
Modified files: + +
+
Removed files: + +
+
+
+
-
-
- +
+ - File read access - + Groups + + + -
+
+
+
+ + + Commands + + + + + +
+
+
+ + + Files + + + + + +
-
- +
+ - File write access - + Alerts over time + + + -
+
- -
- + +
+ - Commands - + Alerts summary + + + -
+
-
- - - Created files - - - -
-
-
- - - Removed files - - - -
-
-
-
-
- - - Alerts summary - - - -
-
-
-
- \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/audit/agentsAuditCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/audit/agentsAuditCtrl.js index e3a6156dc..4840e6eb7 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/audit/agentsAuditCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/audit/agentsAuditCtrl.js @@ -154,18 +154,12 @@ define([ 'groupsVizz', this.scope ), - new ColumnChart( - 'agentsVizz', - `${this.filters} sourcetype=wazuh agent.name=* | top agent.name`, - 'agentsVizz', - this.scope - ), new PieChart( - 'directoriesVizz', + 'commandsVizz', `${ this.filters - } sourcetype=wazuh audit.directory.name=* | top audit.directory.name`, - 'directoriesVizz', + } sourcetype=wazuh | top limit=5 data.audit.command`, + 'commandsVizz', this.scope ), new PieChart( @@ -184,44 +178,6 @@ define([ 'alertsOverTimeVizz', this.scope ), - new PieChart( - 'fileReadAccessVizz', - `${ - this.filters - } sourcetype=wazuh rule.id=80784 | top audit.file.name`, - 'fileReadAccessVizz', - this.scope - ), - new PieChart( - 'fileWriteAccessVizz', - `${ - this.filters - } sourcetype=wazuh rule.id=80781 | top audit.file.name`, - 'fileWriteAccessVizz', - this.scope - ), - new BarChart( - 'comandsVizz', - `${this.filters} sourcetype=wazuh | top audit.command`, - 'comandsVizz', - this.scope - ), - new BarChart( - 'createdVizz', - `${ - this.filters - } sourcetype=wazuh rule.id=80790 | top audit.file.name`, - 'createdVizz', - this.scope - ), - new PieChart( - 'removedFilesVizz', - `${ - this.filters - } sourcetype=wazuh rule.id=80791 | top audit.file.name`, - 'removedFilesVizz', - this.scope - ), new Table( 'alertsSummaryVizz', `${ @@ -269,15 +225,9 @@ define([ this.filters, [ 'groupsVizz', - 'agentsVizz', - 'directoriesVizz', + 'commandsVizz', 'filesVizz', 'alertsOverTimeVizz', - 'fileReadAccessVizz', - 'fileWriteAccessVizz', - 'comandsVizz', - 'createdVizz', - 'removedFilesVizz', 'alertsSummaryVizz' ], this.reportMetrics, @@ -320,6 +270,7 @@ define([ * On controller loads */ $onInit() { + this.scope.loadingVizz = true this.scope.agent = this.agent && this.agent.data && this.agent.data.data ? this.agent.data.data diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/ciscat/agents-ciscat.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/ciscat/agents-ciscat.html index e3b3f925e..d35ddd828 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/ciscat/agents-ciscat.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/ciscat/agents-ciscat.html @@ -1,127 +1,144 @@ -
- -
+
+
Agents / - {{agent.name}} ({{agent.id}}) + {{agent.name}} ({{agent.id}}) Unknown agent / CIS-CAT -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
- - -
-
+ + +
- - -
Generating report
- - - - Policy monitoring - SCA - System auditing - OpenSCAP - CIS-CAT - - +
+
+ + +
{{reportStatus}}
+ + + + Policy monitoring + + SCA + System auditing + OpenSCAP + CIS-CAT + + - - - -
- - -
Last not checked: - -
-
Last pass: - -
-
Last scan score: - -
-
Last scan date: - -
-
-
-
-
- - -
Last errors: - -
-
Last fails: - -
-
Last unknown: - -
-
Last scan benchmark: - -
-
-
+ +
+
+ Fetching data...
+
- -
-
- - - Top 5 CIS-CAT groups - - - -
- +
+ + +
+ + +
Last not checked: + +
+
Last pass: + +
+
Last scan score: + +
+
Last scan date: + +
- -
- - - Scan result evolution - - - -
+
+ + +
Last errors: + +
+
Last fails: + +
+
Last unknown: + +
+
Last scan benchmark: + +
- -
- -
-
- - - Alerts summary - - - -
-
-
+ +
+
+ + + Top 5 CIS-CAT groups + + + + + +
+
+
+
+ +
+ + + Scan result evolution + + + + + +
+
+
+
+
+ +
+
+ + + Alerts summary + + + + + +
+
+
+
- \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/ciscat/agentsCiscatCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/ciscat/agentsCiscatCtrl.js index d723dc825..bc4a2f685 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/ciscat/agentsCiscatCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/ciscat/agentsCiscatCtrl.js @@ -260,6 +260,7 @@ define([ * On controller loads */ $onInit() { + this.scope.loadingVizz = true this.scope.agent = this.agent && this.agent.data && this.agent.data.data ? this.agent.data.data diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/configuration-assessment/agents-ca.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/configuration-assessment/agents-ca.html index 2e895e609..7efb6896f 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/configuration-assessment/agents-ca.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/configuration-assessment/agents-ca.html @@ -1,8 +1,8 @@ -
+
-
+
Agents / Unknown agent / Configuration assessment -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
- + Waiting for reporting information + breadcrumbs="{section: 'Agents', subSection: 'Policity monitoring', agentName: agent.name, agentId: agent.id, ref: 'agents', agentRef: 'agent-overview'}">
+
-
Generating report
{{reportStatus}}
- + Policy monitoring SCA @@ -50,72 +46,86 @@ -
-
-
-
- - This agent is never connected. +
+
+
+
+ {{policy.name}} + +
+
-
- - - Configuration assessment - - - - - - - - - - - - - - - - - - - - - - -
PolicyDescriptionLast scanFailPassScore
{{policy.description}}{{policy.end_scan}}{{policy.fail}}{{policy.pass}}{{policy.score}}%
-
-
+
+
+
+ + This agent is never connected. +
- + +
+ + + Configuration assessment + + + + + + + + + + + + + + + + + + + + + + +
PolicyDescriptionLast scanPassFailNot applicableScore
{{policy.description}}{{policy.end_scan}}{{policy.pass}}{{policy.fail}}{{policy.invalid}}{{policy.score}}%
+
+
+
+ +
+ + + + + No scans available. + + + + + +
+ +
@@ -151,8 +161,7 @@

There are n {{showPolicyChecks}} - + diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/configuration-assessment/agentsConfigurationAssessmentsCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/configuration-assessment/agentsConfigurationAssessmentsCtrl.js index 96748b84a..020bc23f8 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/configuration-assessment/agentsConfigurationAssessmentsCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/configuration-assessment/agentsConfigurationAssessmentsCtrl.js @@ -12,11 +12,9 @@ define([ '../../module', - '../../../services/visualizations/inputs/time-picker', -], function( - app, - TimePicker, -) { + '../../../services/visualizations/chart/pie-chart', + '../../../services/visualizations/inputs/time-picker' +], function (app, PieChart, TimePicker) { 'use strict' class AgentsCA { @@ -41,7 +39,6 @@ define([ $currentDataService, agent, configAssess, - $reportingService, $requestService, $notificationService, $csvRequestService, @@ -56,9 +53,7 @@ define([ this.scope.reportingEnabled = reportingEnabled this.scope.extensions = extensions this.apiReq = $requestService.apiReq - this.scope.showPolicies = false this.state = $state - this.reportingService = $reportingService this.tableResults = {} this.currentDataService = $currentDataService this.agent = agent @@ -70,7 +65,7 @@ define([ this.baseUrl = BASE_URL this.scope.noScansPng = `${ this.baseUrl - }/static/app/SplunkAppForWazuh/css/images/sca_no_scans.png` + }/static/app/SplunkAppForWazuh/css/images/sca_no_scans.png` this.currentDataService.addFilter( `{"rule.groups{}":"sca", "implicit":true}` ) @@ -99,10 +94,10 @@ define([ } this.filters = this.currentDataService.getSerializedFilters() - /*this.timePicker = new TimePicker( + this.timePicker = new TimePicker( '#timePicker', this.urlTokenModel.handleValueChange - )*/ + ) this.scope.$on('deletedFilter', event => { event.stopPropagation() @@ -114,22 +109,21 @@ define([ this.launchSearches() }) - // Set agent info - try { - this.agentReportData = { - ID: this.agent.data.data.id, - Name: this.agent.data.data.name, - IP: this.agent.data.data.ip, - Version: this.agent.data.data.version, - Manager: this.agent.data.data.manager, - OS: this.agent.data.data.os.name, - dateAdd: this.agent.data.data.dateAdd, - lastKeepAlive: this.agent.data.data.lastKeepAlive, - group: this.agent.data.data.group.toString() - } - } catch (error) { - this.agentReportData = false - } + + this.vizz = [ + /** + * Visualizations + */ + new PieChart( + 'resultDistribution', + `${ + this.filters + } rule.groups{}="sca" | stats count by data.sca.policy,data.sca.check.result `, + 'resultDistribution', + this.scope, + { 'trellisEnabled': true } + ) + ] /** * Generates report @@ -140,52 +134,23 @@ define([ 'Configuration assessment', this.filters, [ - 'alertsOverTime', - 'top5CISPassed', - 'top5CISCSCPassed', - 'top5PCIDSSPassed', - 'top5CISFailed', - 'top5CISCSCFailed', - 'top5PCIDSSFailed', - 'alertsSummary' + 'resultDistribution' ], {}, //Metrics, this.tableResults, this.agentReportData ) - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) - - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - } else { - this.vizz.map(v => { - if (v.constructor.name === 'RawTableData') { - this.tableResults[v.name] = v.results - } - }) - this.scope.loadingVizz = true - } - if (!this.scope.$$phase) this.scope.$digest() - }) - /** * When controller is destroyed */ this.scope.$on('$destroy', () => { - //this.timePicker.destroy() - //this.vizz.map(vizz => vizz.destroy()) + this.timePicker.destroy() + this.vizz.map(vizz => vizz.destroy()) }) } $onInit() { - this.scope.showPolicies = true this.scope.searchRootcheck = (term, specificFilter) => this.scope.$broadcast('wazuhSearch', { term, specificFilter }) this.scope.downloadCsv = () => this.downloadCsv() @@ -203,6 +168,38 @@ define([ this.getAgentStatusClass(agentStatus) this.scope.formatAgentStatus = agentStatus => this.formatAgentStatus(agentStatus) + + this.scope.refreshScans = () => this.refreshScans() + + + this.scope.loadCharts = (policy) => { + setTimeout(function () { + const chart = new Chart(document.getElementById(policy.policy_id), + { + type: "doughnut", + data: { + labels: ["pass", "fail", "not applicable"], + datasets: [ + { + backgroundColor: ['#46BFBD', '#F7464A', '#949FB1'], + data: [policy.pass, policy.fail, policy.invalid], + } + ] + }, + options: { + cutoutPercentage: 85, + legend: { + display: true, + position: "right", + }, + tooltips: { + displayColors: false + } + } + }); + chart.update(); + }, 250); + } } /** @@ -254,15 +251,6 @@ define([ this.state.reload() } - /** - * Switches between alerts visualizations and policies - */ - switchVisualizations() { - this.scope.showPolicies = !this.scope.showPolicies - this.scope.showPolicyChecks = name - this.scope.$applyAsync() - } - /** * Loads policies checks */ @@ -273,6 +261,14 @@ define([ this.scope.wzTablePath = `/sca/${agentId}/checks/${id}` } + /** + * + * Backs to config assessment + */ + backToConfAssess() { + this.scope.showPolicyChecks = false + } + expand(i, id) { this.scope.expandArray[i] = !this.scope.expandArray[i] let vis = $( @@ -280,7 +276,7 @@ define([ ) this.scope.expandArray[i] ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') + : vis.css('height', '280px') let vis_header = $('.wz-headline-title') vis_header.dblclick(e => { @@ -288,7 +284,7 @@ define([ this.scope.expandArray[i] = !this.scope.expandArray[i] this.scope.expandArray[i] ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') + : vis.css('height', '280px') this.scope.$applyAsync() } else { e.preventDefault() @@ -297,11 +293,10 @@ define([ } /** - * Back to configuration assessment from a policy checks + * Refresh SCA scans */ - backToConfAssess() { - this.scope.showPolicyChecks = false - this.scope.showPolicies = true + refreshScans() { + this.state.reload() } } app.controller('agentsConfigurationAssessmentsCtrl', AgentsCA) diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/docker/agents-docker.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/docker/agents-docker.html index 3cbb4f837..0a17764e3 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/docker/agents-docker.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/docker/agents-docker.html @@ -1,111 +1,130 @@
- -
- Agents - / - {{agent.name}} ({{agent.id}}) - Unknown agent - / - Docker listener -
-
- {{formatAgentStatus(agent.status)}} -
-
+ +
+ Agents + / + {{agent.name}} ({{agent.id}}) + Unknown agent + / + Docker listener +
+
+ {{formatAgentStatus(agent.status)}} +
+
- - -
-
+ + +
- - -
Generating report
- +
+

+ + +
{{reportStatus}}
+ - Vulnerabilities - Osquery - VirusTotal - Docker listener - + + Vulnerabilities + Osquery + VirusTotal + Docker listener + - -
- - - - Top 5 images - - - -
-
-
- - - - Top 5 events - - - -
-
-
- - - - Resource usage over time - - - -
-
-
+
+
+ Fetching data...
+
+
+ +
+ + + + Top 5 images + + + + + +
+
+
+ + + + Top 5 events + + + + + +
+
+
+ + + + Resource usage over time + + + + + +
+
+
+
- -
- - - - Events ocurred evolution - - - -
-
-
-
+ +
+ + + + Events ocurred evolution + + + + + +
+
+
+
- -
- - - - Alerts summary - - - -
-
-
+ +
+ + + + Alerts summary + + + + + +
+
+
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/docker/agentsDockerCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/docker/agentsDockerCtrl.js index 02d538614..9e027f5b7 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/docker/agentsDockerCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/docker/agentsDockerCtrl.js @@ -119,7 +119,7 @@ define([ 'alertsSummary', `${ this.filters - } sourcetype=wazuh | stats count sparkline by data.docker.Actor.Attributes.image, data.docker.Actor.Attributes.name, data.docker.Action, timestamp | sort count DESC | rename data.docker.Actor.Attributes.image as Image, data.docker.Actor.Attributes.name as Name, data.docker.Action as Action, timestamp as Date, count as Count, sparkline as Sparkline`, + } sourcetype=wazuh | stats count sparkline by data.docker.Actor.Attributes.image, data.docker.Actor.Attributes.name, data.docker.Action, timestamp | sort count DESC | rename data.docker.Actor.Attributes.image as Image, data.docker.Actor.Attributes.name as Container, data.docker.Action as Action, timestamp as Date, count as Count, sparkline as Sparkline`, 'alertsSummary', this.scope ), @@ -135,7 +135,7 @@ define([ 'alertsSummaryRawTable', `${ this.filters - } sourcetype=wazuh | stats count sparkline by data.docker.Actor.Attributes.image, data.docker.Actor.Attributes.name, data.docker.Action, timestamp | sort count DESC | rename data.docker.Actor.Attributes.image as Image, data.docker.Actor.Attributes.name as Name, data.docker.Action as Action, timestamp as Date, count as Count`, + } sourcetype=wazuh | stats count sparkline by data.docker.Actor.Attributes.image, data.docker.Actor.Attributes.name, data.docker.Action, timestamp | sort count DESC | rename data.docker.Actor.Attributes.image as Image, data.docker.Actor.Attributes.name as Container, data.docker.Action as Action, timestamp as Date, count as Count`, 'alertsSummaryRawTableToken', '$result$', this.scope, @@ -225,6 +225,7 @@ define([ * On controller loads */ $onInit() { + this.scope.loadingVizz = true this.scope.agent = this.agent && this.agent.data && this.agent.data.data ? this.agent.data.data diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/fim/agents-fim.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/fim/agents-fim.html index c2a3b8e57..8ab2c593f 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/fim/agents-fim.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/fim/agents-fim.html @@ -2,251 +2,296 @@ -
- -
+
+
Agents / - {{agent.name}} + {{agent.name}} ({{agent.id}}) Unknown agent / File integrity monitoring -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
- - + +
-
Generating report
{{reportStatus}}
- - Security events + + Security + events Integrity monitoring - Inventory data - + Inventory + data + -
- Show files - -
-
- - - - Top new files - - - -
-
-
+ +
+
+ Fetching data...
+
+
+
+ +
+
+   + Show files
-
- - - - Top modified files - - - -
-
-
+ +
+ +
+ + + + Most active users + + + + + +
+
+
+
+
+ + + + Actions + + + + + +
+
+
+
+
+ + + + Events + + + + + +
+
+
+
+
+
+
+ + + + Files added + + + + + +
+
+
+
+
+ + + + Files modified + + + + + +
+
+
+
+
+ + + + Files deleted + + + + + +
+
+
+
-
- - + + +
+ - Top deleted files - + Alerts summary + + + -
+
+
- -
-
- - - - Events over time - - + +
+
+   + Show alerts +
+
+ + + Windows registry -
+
+ + +
+
+ + +
+
+ + +
+
-
- - - - Top user owners - - + +
+ + + Files -
+
+ + +
+
+ + +
+
-
- - - - Top group owners - - + +
+ + + Files -
+
+ + +
+
+ + +
+
- - -
- - - - Top file changes - - - -
-
-
- - - - Root user file changes - - - -
-
-
-
- - -
- - - Events summary - - - -
-
-
- -
-
- -
- Show alerts - -
- - - Windows registry - -
- - -
-
- - -
-
- - -
- -
-
-
- -
- - - Files - -
- - -
-
- - -
- -
-
-
- -
- - - Files - -
- - -
-
- - -
- -
-
-
- + \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/fim/agentsFimCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/fim/agentsFimCtrl.js index 85744f056..f9ec847fa 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/fim/agentsFimCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/fim/agentsFimCtrl.js @@ -126,6 +126,14 @@ define([ 'topUserOwnersElement', this.scope ), + new PieChart( + 'topActions', + `${ + this.filters + } sourcetype="wazuh" | stats count by "syscheck.event"`, + 'topActions', + this.scope + ), new PieChart( 'topFileChangesElement', `${ @@ -225,6 +233,7 @@ define([ 'topDeletedFiles', 'eventsOverTimeElement', 'topGroupOwnersElement', + 'topActions', 'topUserOwnersElement', 'topFileChangesElement', 'rootUserFileChangesElement', @@ -269,6 +278,7 @@ define([ * On controller loads */ $onInit() { + this.scope.loadingVizz = true this.show() this.scope.show = () => this.show() this.scope.agent = diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/gdpr/agents-gdpr.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/gdpr/agents-gdpr.html index 448c6d30b..0c86449b9 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/gdpr/agents-gdpr.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/gdpr/agents-gdpr.html @@ -1,113 +1,143 @@ -
- -
+
+
Agents / - {{agent.name}} ({{agent.id}}) + {{agent.name}} ({{agent.id}}) Unknown agent / GDPR -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
- - -
-
- + + +
- - -
Generating report
- +
+ +
+ + +
{{reportStatus}}
+ - - PCI DSS - GDPR - + + PCI DSS + GDPR + -
- - - -
- GDPR Requirement: {{tab.title}} - -
-
{{tab.content}}
-
-
-
-
-
-
-
- - - GDPR Requirements - - - -
-
-
- - - Groups - - - -
-
-
+
+
+ Fetching data...
+
+
+
+ + + +
+ GDPR Requirement: {{tab.title}} + +
+
{{tab.content}}
+
+
+
+
+
+
-
- - - Agents - - - -
-
-
- - - Requirements by agent - - - -
-
-
-
+ +
+ + + Top 5 rule groups + + + + + +
+
+
-
- - - Alerts summary - - - -
-
-
-
+ + + Top 5 rules + + + + + +
+
+
+ + + + Top 5 GDPR requirements + + + + + +
+
+
+ + +
+ + + +
+ + + GDPR Requirements + + + + + +
+
+
+
+ +
+ + + Alerts summary + + + + + +
+
+
+
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/gdpr/agentsGdprCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/gdpr/agentsGdprCtrl.js index 3d4ba5a12..ebc3931cc 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/gdpr/agentsGdprCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/gdpr/agentsGdprCtrl.js @@ -47,7 +47,16 @@ define([ this.reportingService = $reportingService this.tableResults = {} this.agent = agent - this.scope.expandArray = [false, false, false, false, false] + this.scope.expandArray = [ + false, + false, + false, + false, + false, + false, + false, + false + ] this.scope.expand = (i, id) => this.expand(i, id) if ( @@ -116,6 +125,22 @@ define([ 'groupsVizz', this.scope ), + new PieChart( + 'top5GDPR', + `${ + this.filters + } sourcetype=wazuh rule.gdpr{}="$gdpr$" | stats count by rule.gdpr{} | sort count DESC`, + 'top5GDPR', + this.scope + ), + new PieChart( + 'rulesVizz', + `${ + this.filters + } sourcetype=wazuh | stats count by rule.description | sort count DESC`, + 'rulesVizz', + this.scope + ), new PieChart( 'agentsVizz', `${ @@ -180,6 +205,8 @@ define([ [ 'gdprRequirementsVizz', 'groupsVizz', + 'top5GDPR', + 'rulesVizz', 'agentsVizz', 'requirementsByAgentVizz', 'alertsSummaryVizz' @@ -224,6 +251,7 @@ define([ * On controller loads */ $onInit() { + this.scope.loadingVizz = true this.scope.agent = this.agent && this.agent.data && this.agent.data.data ? this.agent.data.data diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/general/agents-general.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/general/agents-general.html index 6869a9e53..654650719 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/general/agents-general.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/general/agents-general.html @@ -1,202 +1,157 @@ -
- -
+
+
Agents / - {{agentInfo.name}} - ({{agentInfo.id}}) - Unknown agent + {{agentInfo.name}} + ({{agentInfo.id}}) + Unknown agent / General -
-
- {{formatAgentStatus(agentInfo.status)}} + + {{formatAgentStatus(agentInfo.status)}} +
- - -
-
+ + +
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - + Security events - Integrity monitoring - Inventory data - + Integrity monitoring + + Inventory + data + - - -
- - -
- Name: - {{ agentInfo.name }} - - Full name: {{ agentInfo.name || 'Unknown'}} - -
-
- IP: - {{ agentInfo.ip || 'Unknown'}} -
- -
- Version: - {{ agentInfo.version || 'Unknown'}} -
-
- OS: - {{ agentInfo.agentOS || 'Unknown'}} - - Full OS name: {{ agentInfo.agentOS || 'Unknown'}} - -
-
-
-
-
- - -
- Groups: {{ group }}  -
-
-
+ +
+
+ Fetching data...
+
-
- - -
Last keep alive: - {{agentInfo.lastKeepAlive || 'Unknown' }} -
-
Registration date: - {{agentInfo.dateAdd || 'Unknown'}} -
-
Last syscheck scan: - Scan in progress -
-
Last syscheck scan: - {{agentInfo.syscheck.end || 'Unknown'}} - - Start time: {{ agentInfo.syscheck.start || 'Unknown'}} -
End time: {{ agentInfo.syscheck.end || 'Unknown'}} -
Duration time: {{ agentInfo.syscheck.duration +' minutes' || 'Unknown'}} -
-
-
Last rootcheck scan: - Scan in progress -
-
Last rootcheck scan: - {{agentInfo.rootcheck.end || 'Unknown'}} - - Start time: {{ agentInfo.rootcheck.start || 'Unknown'}} -
End time: {{ agentInfo.rootcheck.end || 'Unknown'}} -
Duration time: {{ agentInfo.rootcheck.duration +' minutes' || 'Unknown'}} -
+
+ +
+ + + + Alert level evolution + + + + + +
+
+
+ + + + Alerts + + + + + +
+
+
- - -
- - + +
+ + + + Top 5 alerts + + + + + +
+
+
+ + + + Top 5 rule groups + + + + + +
+
+
+ + + + Top 5 PCI DSS Requirements + + + + + +
+
+
+
- -
- - - - Top 5 alerts - - - -
-
-
- - - - Top 5 groups - - - -
-
-
- - - - Top 5 PCI DSS Requirements - - - -
-
-
-
-
- - - - Alert level evolution - - - -
-
-
- - - - Alerts - - - -
-
-
-
+ +
+ + + Agents summary + + + + + +
+
+
- -
- - - - Agents summary - - - -
-
-
- -
+ + + Agents summary + + + + + +
+
+
- +
+
+ \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/general/agentsGeneralCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/general/agentsGeneralCtrl.js index 471bc7f14..aca496b87 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/general/agentsGeneralCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/general/agentsGeneralCtrl.js @@ -67,7 +67,7 @@ define([ this.agent = agent this.currentDataService = $currentDataService this.reportingService = $reportingService - this.scope.expandArray = [false, false, false, false, false, false] + this.scope.expandArray = [false, false, false, false, false, false, false] this.scope.expand = (i, id) => this.expand(i, id) if ( this.agent && @@ -136,19 +136,37 @@ define([ 'agentsSummaryVizz', `${ this.filters - } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort rule.level DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, + } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort count DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, 'agentsSummaryVizz', this.scope ), + new Table( + 'groupsSummaryVizz', + `${ + this.filters + } sourcetype=wazuh | stats count by rule.groups{} | sort count DESC | rename rule.groups{} as "Group", count as Count`, + 'groupsSummaryVizz', + this.scope + ), new RawTableDataService( 'alertsSummaryTable', `${ this.filters - } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort rule.level DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, + } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort count DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, 'alertsSummaryTableToken', '$result$', this.scope, 'Alerts Summary' + ), + new RawTableDataService( + 'groupsSummaryTable', + `${ + this.filters + } sourcetype=wazuh | stats count by rule.groups{} | sort count DESC | rename rule.groups{} as "Group", count as Count`, + 'groupsSummaryTableToken', + '$result$', + this.scope, + 'Groups Summary' ) ] @@ -187,6 +205,7 @@ define([ */ $onInit() { try { + this.scope.loadingVizz = true this.agentInfo = { name: this.agent[0].data.data.name, id: this.agent[0].data.data.id, @@ -265,7 +284,8 @@ define([ 'top5PCIreqVizz', 'alertLevelEvoVizz', 'alertsVizz', - 'agentsSummaryVizz' + 'agentsSummaryVizz', + 'groupsSummaryVizz' ], this.reportMetrics, this.tableResults, diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/inventory/inventory.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/inventory/inventory.html index a3ebeaa5e..117f711e8 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/inventory/inventory.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/inventory/inventory.html @@ -1,7 +1,7 @@ -
-
+
+
Agents / {{agent.name}} @@ -9,9 +9,9 @@ Unknown agent / Inventory data -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
@@ -24,12 +24,12 @@
-
Generating report
{{reportStatus}}
- + Security events Integrity monitoring Inventory data @@ -82,8 +82,10 @@ Last scan: {{syscollector.packagesDate}}
- + @@ -101,7 +103,7 @@ @@ -114,8 +116,10 @@ Last scan: {{syscollector.processesDate}}
- + @@ -133,7 +137,7 @@ -  Formatted +  Formatted
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/osquery/osquery.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/osquery/osquery.html index febfac9ec..857259084 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/osquery/osquery.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/osquery/osquery.html @@ -1,105 +1,126 @@ -
- -
- Agents - / - {{agent.name}} ({{agent.id}}) - Unknown agent - / - Osquery -
-
- {{formatAgentStatus(agent.status)}} -
-
+
+
+ Agents + / + {{agent.name}} ({{agent.id}}) + Unknown agent + / + Osquery + + {{formatAgentStatus(agent.status)}} + +
+
- - -
-
+ + +
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - - Vulnerabilities - Osquery - VirusTotal - Docker listener - + + + Vulnerabilities + Osquery + VirusTotal + Docker listener + - - - - -
- - - - Most common packs - - - -
-
-
- - - - Evolution of Osquery events per pack over time - - - -
-
-
-
- -
- - - Most common Osquery actions - - - -
-
-
- - - - Most common rules - - - -
-
-
- + + +
+
+ Fetching data...
+
-
- - +
+ +
+ + + Most common Osquery actions + + + + + +
+
+
+ - Evolution of Osquery events over time - + Evolution of Osquery events per pack over time + + + -
+
- - +
+ +
+ + + Most common Osquery packs being used + + + + + +
+
+
+ + + + Most common rules + + + + + +
+
+
+ +
+
+ + + + Alerts summary + + + + + +
+
+
+ + +
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/osquery/osqueryCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/osquery/osqueryCtrl.js index 716f847ca..a9c78eb9d 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/osquery/osqueryCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/osquery/osqueryCtrl.js @@ -109,7 +109,7 @@ define([ 'mostCommonActions', `${ this.filters - } sourcetype=wazuh | top "data.osquery.action" limit=5`, + } sourcetype=wazuh | top data.osquery.action limit=5`, 'mostCommonActions', this.scope ), @@ -136,6 +136,24 @@ define([ '$result$', this.scope, 'Top Rules' + ), + new Table( + 'alertsSummary', + `${ + this.filters + } sourcetype=wazuh | stats count by data.osquery.name, data.osquery.action,agent.name,data.osquery.pack | rename data.osquery.name as Name, data.osquery.action as Action, agent.name as Agent, data.osquery.pack as Pack, count as Count`, + 'alertsSummary', + this.scope + ), + new RawTableDataService( + 'alertsSummaryTable', + `${ + this.filters + } sourcetype=wazuh | stats count by data.osquery.name, data.osquery.action,agent.name,data.osquery.pack | rename data.osquery.name as Name, data.osquery.action as Action, agent.name as Agent, data.osquery.pack as Pack, count as Count`, + 'alertsSummaryTableToken', + '$result$', + this.scope, + 'Alerts summary' ) ] @@ -169,7 +187,8 @@ define([ 'alertsPacksOverTime', 'mostCommonActions', 'topRules', - 'alertsOverTime' + 'alertsOverTime', + 'alertsSummary' ], {}, //Metrics, this.tableResults, @@ -210,6 +229,7 @@ define([ * On controller loads */ $onInit() { + this.scope.loadingVizz = true this.scope.agent = this.agent && this.agent.data && this.agent.data.data ? this.agent.data.data diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/overview/agentsOverviewCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/overview/agentsOverviewCtrl.js index baec26fe8..0ff64dbdb 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/overview/agentsOverviewCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/overview/agentsOverviewCtrl.js @@ -177,12 +177,12 @@ define(['../../module'], function(app) { if (!this.scope.$$phase) this.scope.$digest() }) .catch(error => { - if (!this.$scope.agent) { + if (!this.scope.agent) { if ((error || {}).status === -1) { this.scope.emptyAgent = 'Wazuh API timeout.' } } - this.$scope.editGroup = false + this.scope.editGroup = false this.scope.addingGroupToAgent = false this.notification.showErrorToast(error.message || error) }) @@ -247,7 +247,7 @@ define(['../../module'], function(app) { this.scope.load = false this.scope.adminMode = false this.notification.showErrorToast('Error loading agent data.') - if (!this.$scope.$$phase) this.$scope.$digest() + this.scope.$applyAsync() } } diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/overview/overview.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/overview/overview.html index 18817e9b6..b2bc1ec8d 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/overview/overview.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/overview/overview.html @@ -1,17 +1,16 @@
-
- -
+
+
Agents / {{agent.name}} ({{agent.id}}) Unknown agent -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
@@ -24,28 +23,30 @@ + tooltip="Discover"> + + Discover +
+ The {{ agent.name}}({{agent.id}}) will be restarted. + + +
-
- The {{ agent.name}}({{agent.id}}) will be restarted. - - -
@@ -147,9 +148,11 @@
- Groups + Groups + + +
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/pcidss/agents-pci.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/pcidss/agents-pci.html index c4cdddaee..93c3b7d80 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/pcidss/agents-pci.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/pcidss/agents-pci.html @@ -1,115 +1,136 @@ -
- -
+
+
Agents / - {{agent.name}} ({{agent.id}}) + {{agent.name}} ({{agent.id}}) Unknown agent / PCI-DSS -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
- - -
-
- + + +
- - -
Generating report
- +
+ +
+ + +
{{reportStatus}}
+ - - PCI DSS - GDPR - + + PCI DSS + GDPR + - -
- - - -
- PCI-DSS Requirement: {{tab.title}} - -
-

{{tab.content}}

-
-
-
-
-
-
-
- - - PCI Requirements - - - -
-
-
- - - Groups - - - -
-
-
+
+
+ Fetching data...
+
+
+ +
+ + + +
+ PCI-DSS Requirement: {{tab.title}} + +
+

{{tab.content}}

+
+
+
+
+
+
+
+ + + PCI Requirements + + + + + +
+
+
+ + + Groups + + + + + +
+
+
+
-
- - - Agents - - - -
-
-
- - - Requirements by agent - - - -
-
-
-
+
+ + + Agents + + + + + +
+
+
+ + + Requirements by agent + + + + + +
+
+
+
-
- - - Alerts summary - - - -
-
-
+
+ + + Alerts summary + + + + + +
+
+
+
- \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/pcidss/agentsPciCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/pcidss/agentsPciCtrl.js index 468da1805..78f3ce9af 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/pcidss/agentsPciCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/pcidss/agentsPciCtrl.js @@ -217,6 +217,7 @@ define([ * On controller loads */ $onInit() { + this.scope.loadingVizz = true this.scope.agent = this.agent && this.agent.data && this.agent.data.data ? this.agent.data.data diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/policy-monitoring/agents-pm.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/policy-monitoring/agents-pm.html index 73b7e34b0..2147af5e7 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/policy-monitoring/agents-pm.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/policy-monitoring/agents-pm.html @@ -1,109 +1,133 @@ -
- -
+
+
Agents / - {{agent.name}} + {{agent.name}} ({{agent.id}}) Unknown agent / Policy monitoring -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
- - -
+ + + +
-
Generating report
+
{{reportStatus}}
- + Policy monitoring SCA - System auditing - OpenSCAP - CIS-CAT - + System auditing + OpenSCAP + CIS-CAT + - -
- - +
+
+ Fetching data...
+
- -
- - - Events over time - - - -
-
-
+
+ +
+ + +
+ +
+ + + Alerts over time + + + + + +
+
+
- - - Top 5 CIS Requirements - - - -
-
-
+ + + Top 5 CIS Requirements + + + + + +
+
+
- - - Top 5 PCI DSS Requirements - - - -
-
-
-
+ + + Top 5 PCI DSS Requirements + + + + + +
+
+
+
-
- - - Events per agent evolution - - - -
-
-
-
+
+ + + Events per agent evolution + + + + + +
+
+
+
-
- - - Alerts summary - - - -
-
-
+
+ + + Alerts summary + + + + + +
+
+
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/policy-monitoring/agentsPolicyMonitoringCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/policy-monitoring/agentsPolicyMonitoringCtrl.js index 3b837c55f..e33c3dc72 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/policy-monitoring/agentsPolicyMonitoringCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/policy-monitoring/agentsPolicyMonitoringCtrl.js @@ -218,6 +218,7 @@ define([ } $onInit() { + this.scope.loadingVizz = true this.scope.searchRootcheck = (term, specificFilter) => this.scope.$broadcast('wazuhSearch', { term, specificFilter }) this.scope.downloadCsv = () => this.downloadCsv() diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/scap/agents-openscap.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/scap/agents-openscap.html index 782964af7..f872f657a 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/scap/agents-openscap.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/scap/agents-openscap.html @@ -1,147 +1,177 @@ -
- -
+
+
Agents / - {{agent.name}} ({{agent.id}}) + {{agent.name}} + ({{agent.id}}) / OpenSCAP -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
- - -
-
- + + +
- - -
Generating report
+
+ +
+ + +
{{reportStatus}}
- - Policy monitoring + + Policy monitoring + SCA - System auditing + System auditing OpenSCAP - CIS-CAT - + CIS-CAT + - -
- - -
Last score: - {{ scapLastScore | number:2}} -
-
Highest score: - {{scapHighestScore | number:2}} -
-
Lowest score: - {{scapLowestScore | number:2}} -
-
-
-
-
- - - Agents - - - -
-
-
- - - Profiles - - - -
-
-
- - - Content - - - -
-
-
- - - Severity - - - -
-
-
+
+
+ Fetching data...
+
+
+ +
+ + +
Last score: + {{ scapLastScore | number:2}} +
+
Highest score: + {{scapHighestScore | number:2}} +
+
Lowest score: + {{scapLowestScore | number:2}} +
+
+
+
-
- - - Top 5 Agents - Severity high - - - -
-
-
-
+
+ + + Top 5 scans + + + + + +
+
+
+ + + Top 5 profiles + + + + + +
+
+
+ + + Top 5 content + + + + + +
+
+
+ + + Top 5 severity + + + + + +
+
+
+
-
- - - Top 10 - Alerts - - - -
-
-
+
+ + + Top 5 Agents - Severity high + + + + + +
+
+
+
- - - Top 10 - High risk alerts - - - -
-
-
-
+
+ + + Top 5 - Alerts + + + + + +
+
+
-
- - - Alerts summary - - - -
-
-
-
+ + + Top 5 - High risk alerts + + + + + +
+
+
+
+
+ + + Alerts summary + + + + + +
+
+
+
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/scap/agentsOpenScapCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/scap/agentsOpenScapCtrl.js index e9fa8cd40..9778d9ff6 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/scap/agentsOpenScapCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/scap/agentsOpenScapCtrl.js @@ -75,6 +75,7 @@ define([ false, false, false, + false, false ] this.scope.expand = (i, id) => this.expand(i, id) @@ -96,8 +97,8 @@ define([ 'dropDownInput', `${ this.filters - } sourcetype=wazuh rule.groups{}!="syslog" oscap.scan.profile.title=* | stats count by oscap.scan.profile.title | sort oscap.scan.profile.title ASC|fields - count`, - 'oscap.scan.profile.title', + } sourcetype=wazuh rule.groups{}!="syslog" data.oscap.scan.profile.title=* | stats count by data.oscap.scan.profile.title | sort data.oscap.scan.profile.title ASC|fields - count`, + 'data.oscap.scan.profile.title', '$form.profile$', 'dropDownInput', this.scope @@ -118,9 +119,9 @@ define([ `lastScapScore`, `${ this.filters - } sourcetype=wazuh oscap.scan.score=* | stats latest(oscap.scan.score)`, + } sourcetype=wazuh data.oscap.scan.score=* | stats latest(data.oscap.scan.score)`, `latestScapScore`, - '$result.latest(oscap.scan.score)$', + '$result.latest(data.oscap.scan.score)$', 'scapLastScore', this.submittedTokenModel, this.scope @@ -129,9 +130,9 @@ define([ `maxScapScore`, `${ this.filters - } sourcetype=wazuh oscap.scan.score=* | stats max(oscap.scan.score)`, + } sourcetype=wazuh data.oscap.scan.score=* | stats max(data.oscap.scan.score)`, `maxScapScore`, - '$result.max(oscap.scan.score)$', + '$result.max(data.oscap.scan.score)$', 'scapHighestScore', this.submittedTokenModel, this.scope @@ -140,9 +141,9 @@ define([ `scapLowest`, `${ this.filters - } sourcetype=wazuh oscap.scan.score=* | stats min(oscap.scan.score)`, + } sourcetype=wazuh data.oscap.scan.score=* | stats min(data.oscap.scan.score)`, `minScapScore`, - '$result.min(oscap.scan.score)$', + '$result.min(data.oscap.scan.score)$', 'scapLowestScore', this.submittedTokenModel, this.scope @@ -152,18 +153,18 @@ define([ * Visualizations */ new PieChart( - 'agentsVizz', + 'top5Scans', `${ this.filters - } sourcetype=wazuh oscap.check.result="fail" rule.groups{}!="syslog" oscap.scan.profile.title="$profile$" | top agent.name`, - 'agentsVizz', + } sourcetype=wazuh data.oscap.check.result="fail" rule.groups{}!="syslog" data.oscap.scan.profile.title="$profile$" | top limit=5 data.oscap.scan.id`, + 'top5Scans', this.scope ), new PieChart( 'profilesVizz', `${ this.filters - } sourcetype=wazuh oscap.check.result="fail" rule.groups{}!="syslog" oscap.scan.profile.title="$profile$" | top oscap.scan.profile.title`, + } sourcetype=wazuh data.oscap.check.result="fail" rule.groups{}!="syslog" data.oscap.scan.profile.title="$profile$" | top limit=5 data.oscap.scan.profile.title`, 'profilesVizz', this.scope ), @@ -171,7 +172,7 @@ define([ 'contentVizz', `${ this.filters - } sourcetype=wazuh oscap.check.result="fail" rule.groups{}!="syslog" oscap.scan.profile.title="$profile$" | top oscap.scan.content`, + } sourcetype=wazuh data.oscap.check.result="fail" rule.groups{}!="syslog" data.oscap.scan.profile.title="$profile$" | top limit=5 data.oscap.scan.content`, 'contentVizz', this.scope ), @@ -179,7 +180,7 @@ define([ 'severityVizz', `${ this.filters - } sourcetype=wazuh oscap.check.result="fail" rule.groups{}!="syslog" oscap.scan.profile.title="$profile$" | top oscap.check.severity`, + } sourcetype=wazuh data.oscap.check.result="fail" rule.groups{}!="syslog" data.oscap.scan.profile.title="$profile$" | top limit=5 data.oscap.check.severity`, 'severityVizz', this.scope ), @@ -187,31 +188,31 @@ define([ 'top5AgentsSHVizz', `${ this.filters - } sourcetype=wazuh oscap.scan.profile.title="$profile$" oscap.check.severity="high" | chart count by agent.name`, + } sourcetype=wazuh data.oscap.scan.profile.title="$profile$" data.oscap.check.severity="high" | chart count by agent.name`, 'top5AgentsSHVizz', this.scope ), new PieChart( - 'top10AleertsVizz', + 'top5AlertsVizz', `${ this.filters - } sourcetype=wazuh oscap.check.result="fail" rule.groups{}="oscap-result" oscap.scan.profile.title="$profile$" | top oscap.check.title`, - 'top10AleertsVizz', + } sourcetype=wazuh data.oscap.check.result="fail" rule.groups{}="oscap-result" data.oscap.scan.profile.title="$profile$" | top limit=5 data.oscap.check.title`, + 'top5AlertsVizz', this.scope ), new PieChart( - 'top10HRAlertsVizz', + 'top5HRAlertsVizz', `${ this.filters - } sourcetype=wazuh oscap.check.result="fail" rule.groups{}="oscap-result" oscap.check.severity="high" oscap.scan.profile.title="$profile$" | top oscap.check.title`, - 'top10HRAlertsVizz', + } sourcetype=wazuh data.oscap.check.result="fail" rule.groups{}="oscap-result" data.oscap.check.severity="high" data.oscap.scan.profile.title="$profile$" | top limit=5 data.oscap.check.title`, + 'top5HRAlertsVizz', this.scope ), new Table( 'alertsSummaryVizz', `${ this.filters - } sourcetype=wazuh oscap.check.result="fail" oscap.scan.profile.title="$profile$" | stats count by agent.name, oscap.check.title, oscap.scan.profile.title, oscap.scan.id, oscap.scan.content | sort count DESC | rename agent.name as "Agent name", oscap.check.title as Title, oscap.scan.profile.title as Profile, oscap.scan.id as "Scan ID", oscap.scan.content as Content`, + } sourcetype=wazuh data.oscap.check.result="fail" data.oscap.scan.profile.title="$profile$" | stats count by agent.name, data.oscap.check.title, data.oscap.scan.profile.title, data.oscap.scan.id, data.oscap.scan.content | sort count DESC | rename agent.name as "Agent name", data.oscap.check.title as Title, data.oscap.scan.profile.title as Profile, data.oscap.scan.id as "Scan ID", data.oscap.scan.content as Content`, 'alertsSummaryVizz', this.scope ), @@ -219,7 +220,7 @@ define([ 'alertsSummaryTable', `${ this.filters - } sourcetype=wazuh oscap.check.result="fail" oscap.scan.profile.title="$profile$" | stats count by agent.name, oscap.check.title, oscap.scan.profile.title, oscap.scan.id, oscap.scan.content | sort count DESC | rename agent.name as "Agent name", oscap.check.title as Title, oscap.scan.profile.title as Profile, oscap.scan.id as "Scan ID", oscap.scan.content as Content`, + } sourcetype=wazuh data.oscap.check.result="fail" data.oscap.scan.profile.title="$profile$" | stats count by agent.name, data.oscap.check.title, data.oscap.scan.profile.title, data.oscap.scan.id, data.oscap.scan.content | sort count DESC | rename agent.name as "Agent name", data.oscap.check.title as Title, data.oscap.scan.profile.title as Profile, oscap.scan.id as "Scan ID", data.oscap.scan.content as Content`, 'alertsSummaryTableToken', '$result$', this.scope, @@ -253,13 +254,13 @@ define([ 'Open SCAP', this.filters, [ - 'agentsVizz', + 'top5Scans', 'profilesVizz', 'contentVizz', 'severityVizz', 'top5AgentsSHVizz', - 'top10AleertsVizz', - 'top10HRAlertsVizz', + 'top5AlertsVizz', + 'top5HRAlertsVizz', 'alertsSummaryVizz' ], this.reportMetrics, @@ -303,6 +304,7 @@ define([ * On controller loads */ $onInit() { + this.scope.loadingVizz = true this.scope.agent = this.agent && this.agent.data && this.agent.data.data ? this.agent.data.data diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/virustotal/agents-virustotal.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/virustotal/agents-virustotal.html index c1e372e01..1231eb130 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/virustotal/agents-virustotal.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/virustotal/agents-virustotal.html @@ -1,123 +1,147 @@ -
- -
+
+
Agents / - {{agent.name}} ({{agent.id}}) + {{agent.name}} ({{agent.id}}) Unknown agent / VirusTotal -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
- - -
-
+ + +
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - Vulnerabilities - Osquery - VirusTotal - Docker listener - + + Vulnerabilities + Osquery + VirusTotal + Docker listener + - -
- - - -
Files added: - {{filesAdded}} -
-
Files modified: - {{filesModified}} -
-
Files deleted: - {{filesDeleted}} -
-
-
-
- - -
- - - - VirusTotal alerts volume - - - -
-
-
- - - Events summary - - - -
-
-
-
- - -
- - - - Events over time - - - -
-
-
- - - Top 5 Rules - - - -
-
-
+ +
+
+ Fetching data...
+
- - -
- - - Files Affected - - - -
-
-
+
+ +
+ + + +
Files added: + {{filesAdded}} +
+
Files modified: + {{filesModified}} +
+
Files deleted: + {{filesDeleted}} +
+
+
+
+ + +
+ + + + VirusTotal alerts volume + + + + + +
+
+
+ + + Events summary + + + + + +
+
+
+
+ + +
+ + + + Events over time + + + + + +
+
+
+ + + Top 5 Rules + + + + + +
+
+
+
+ + +
+ + + Files Affected + + + + + +
+
+
+
+
- - \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/virustotal/agentsVirusTotalCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/virustotal/agentsVirusTotalCtrl.js index 052853919..2f08407e9 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/virustotal/agentsVirusTotalCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/virustotal/agentsVirusTotalCtrl.js @@ -219,6 +219,7 @@ define([ * On controller loads */ $onInit() { + this.scope.loadingVizz = true this.scope.agent = this.agent && this.agent.data && this.agent.data.data ? this.agent.data.data diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/vulnerabilities/agents-vulnerabilities.html b/SplunkAppForWazuh/appserver/static/js/controllers/agents/vulnerabilities/agents-vulnerabilities.html index 10d155983..c3e0b962d 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/vulnerabilities/agents-vulnerabilities.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/vulnerabilities/agents-vulnerabilities.html @@ -1,127 +1,154 @@ -
- -
+
+
Agents / - {{agent.name}} ({{agent.id}}) + {{agent.name}} ({{agent.id}}) Unknown agent / Vulnerabilities -
-
- {{formatAgentStatus(agent.status)}} + + {{formatAgentStatus(agent.status)}} +
- - -
-
+ + +
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - - Vulnerabilities - Osquery - VirusTotal - Docker listener - - + + Vulnerabilities + + Osquery + VirusTotal + Docker listener + + - -
- - -
Critical severity alerts: - -
-
High severity alerts: - -
-
Medium severity alerts: - -
-
Low severity alerts: - -
-
-
-
- - - -
- - - Alerts severity over time - - - -
-
-
- - - Most common rules - - - -
-
-
-
-
- - - Most common CVEs - - - -
-
-
- - - Severity distribution - - - -
-
-
- - - Commonly affected packages - - - -
-
-
+ +
+
+ Fetching data...
+
-
- - - Alerts summary - - - -
-
-
+
+ +
+ + +
Critical severity alerts: + +
+
High severity alerts: + +
+
Medium severity alerts: + +
+
Low severity alerts: + +
+
+
+
+ + + +
+ + + Alerts severity over time + + + + + +
+
+
+ + + Most common rules + + + + + +
+
+
+
+
+ + + Most common CVEs + + + + + +
+
+
+ + + Severity distribution + + + + + +
+
+
+ + + Commonly affected packages + + + + + +
+
+
+
+
+ + + Alerts summary + + + + + +
+
+
+
- \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/agents/vulnerabilities/agentsVulnerabilitiesCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/agents/vulnerabilities/agentsVulnerabilitiesCtrl.js index 7c83e1774..48c015b74 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/agents/vulnerabilities/agentsVulnerabilitiesCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/agents/vulnerabilities/agentsVulnerabilitiesCtrl.js @@ -179,7 +179,7 @@ define([ 'alertsSummaryVizz', `${ this.filters - } | stats count sparkline by data.vulnerability.title, data.vulnerability.severity | rename data.vulnerability.title as Title, data.vulnerability.severity as Severity, count as Count, sparkline as Sparkline `, + } | stats count sparkline by data.vulnerability.title, data.vulnerability.severity | sort count DESC | rename data.vulnerability.title as Title, data.vulnerability.severity as Severity, count as Count, sparkline as Sparkline `, 'alertsSummaryVizz', this.scope ), @@ -278,6 +278,7 @@ define([ * On controller loads */ $onInit() { + this.scope.loadingVizz = true this.scope.agent = this.agent && this.agent.data && this.agent.data.data ? this.agent.data.data diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/dev-tools/devToolsCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/dev-tools/devToolsCtrl.js index e13f53266..557f3a96f 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/dev-tools/devToolsCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/dev-tools/devToolsCtrl.js @@ -609,13 +609,12 @@ define([ //if (typeof JSONraw === 'object') JSONraw.devTools = true if (!firstTime) { const output = await this.request.apiReq(path, JSONraw, method) - const result = - output.data - ? JSON.stringify((output || {}).data || {}, null, 2).replace( - /\\\\/g, - '\\' - ) - : output.data.message || 'Unkown error' + const result = output.data + ? JSON.stringify((output || {}).data || {}, null, 2).replace( + /\\\\/g, + '\\' + ) + : output.data.message || 'Unkown error' this.apiOutputBox.setValue(result) } } diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/cdb/manager-cdb-id.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/cdb/manager-cdb-id.html index 49c44e729..38d669625 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/cdb/manager-cdb-id.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/cdb/manager-cdb-id.html @@ -1,6 +1,6 @@
-
+
Management / Ruleset / CDB Lists @@ -59,9 +59,11 @@
+ @@ -82,7 +84,7 @@ - - - - + diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/decoders/manager-decoders-id.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/decoders/manager-decoders-id.html index 847d9af90..8bd5ff9ac 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/decoders/manager-decoders-id.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/decoders/manager-decoders-id.html @@ -1,6 +1,6 @@
-
+
Management / Ruleset / Decoders @@ -11,7 +11,8 @@
- + Rules Decoders @@ -66,7 +67,8 @@

{{currentDecoder.name}}

@@ -147,11 +149,13 @@

{{currentDecoder.name}}

+

+ Related decoders +

-

- Related decoders

+
@@ -189,7 +193,7 @@

-
+
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/decoders/manager-decoders.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/decoders/manager-decoders.html index 4a6b92908..58e52bb01 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/decoders/manager-decoders.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/decoders/manager-decoders.html @@ -1,6 +1,6 @@
-
+
Management / Ruleset / Decoders @@ -17,21 +17,31 @@ Lists -
+
- - - +
+ +
+
+ +
+
+ +
-
\ No newline at end of file +
+ + +
+ + +
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/edition/edition.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/edition/edition.html index 91c9e0df8..d12fd6734 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/edition/edition.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/edition/edition.html @@ -1,8 +1,8 @@ -
+
-
+
Management @@ -87,7 +87,7 @@
-
+
- +
@@ -132,7 +134,7 @@ @@ -149,7 +151,7 @@ @@ -164,8 +166,8 @@ diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/logs/manager-logs.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/logs/manager-logs.html index 1d7fb6821..2664a2548 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/logs/manager-logs.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/logs/manager-logs.html @@ -1,6 +1,6 @@
-
+
Management / Logs
@@ -23,7 +23,7 @@
+ class="wz-margin-left-10 wz-margin-right-600 less-25-side" style="margin-left: 25px !important;"> + + - +
+ +
- +
+ +
@@ -109,9 +113,9 @@
-
+ \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/logs/managerLogsCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/management/logs/managerLogsCtrl.js index 65be78843..eb18fd3e9 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/logs/managerLogsCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/logs/managerLogsCtrl.js @@ -65,7 +65,7 @@ define(['../../module', 'FileSaver'], function(app) { this.scope.$broadcast('XMLContentReady', { data: this.scope.XMLContent }) - } + } this.scope.$applyAsync() }) } catch (err) { diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/monitoring/monitoring.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/monitoring/monitoring.html index cbedc2646..87cba3d2c 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/monitoring/monitoring.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/monitoring/monitoring.html @@ -1,9 +1,9 @@
-
+
-
+
Management / Cluster @@ -11,7 +11,7 @@ {{ currentApi }}
-
+
Management / Cluster @@ -20,7 +20,7 @@ / Overview
-
+
Management / Cluster @@ -30,7 +30,7 @@ Nodes
-
+
Management / Cluster @@ -42,328 +42,349 @@ {{ currentNode.name }}
-
+
- - - - Status + + + + Status + Logs - Cluster - Reporting + Cluster + + Reporting + -
-
- - - - Overview - -
- IP - {{configuration.nodes[0] || 'Unknown'}} -
-
- Running - {{ status || 'no' }} -
-
- Version - {{version}} -
-
-
- - - - - - Information - - -
- Nodes - - Click to open the list of nodes - - - {{nodesCount}} - - Click to open the list of nodes - - -
- -
- Agents - - Click to open the list of agents - - - {{agentsCount}} - - Click to open the list of agents - - -
-
-
-
-
- - - Cluster alerts summary - -
-
-
- - - Alerts by node summary - -
-
-
-
+
+
+ + + + Overview + +
+ IP + {{configuration.nodes[0] || 'Unknown'}} +
+
+ Running + {{ status || 'no' }} +
+
+ Version + {{version}} +
+
+
+ + + + + + Information + + +
+ Nodes + + Click to open the list of nodes + + + {{nodesCount}} + + Click to open the list of nodes + + +
+ +
+ Agents + + Click to open the list of agents + + + {{agentsCount}} + + Click to open the list of agents + + +
+
+
- - -
- - - +
+ + + Cluster alerts summary + +
+
+
+ - Top 5 nodes + Alerts by node summary -
+
- - +
+
+ + +
+ + + + + Top 5 nodes + +
+
+
+ + + + + Cluster configuration + + +
+ Disabled + {{configuration.disabled}} +
+
+ Hidden + {{configuration.hidden}} +
+
+ Name + {{configuration.name}} +
+
+ Node name + {{configuration.node_name}} +
+
+ Node type + {{configuration.node_type}} +
+
+ Bind address + {{configuration.bind_addr}} +
+
+ IP + {{configuration.nodes[0] || 'Unknown'}} +
+
+ Port + {{configuration.port}} +
+
+
+
+ +
+ + +
+ + {{ currentNode.name }} alerts summary + +
+
+
+
+ + + +
+ + + + + Node information + +
+ IP + {{currentNode.healthCheck.info.ip}} +
+
+ Version + {{currentNode.healthCheck.info.version}} +
+
+ Type + {{currentNode.healthCheck.info.type}} +
+
+ Name + {{currentNode.healthCheck.info.name}} +
+
+ Active agents + {{ currentNode.healthCheck.info.n_active_agents }} +
+
+
+ + + - Cluster configuration + Last files integrity + synchronization -
- Disabled - {{configuration.disabled}} + Last sync + {{currentNode.healthCheck.status.last_sync_integrity.date_end_master}} +
+
+ Duration + {{currentNode.healthCheck.status.last_sync_integrity.duration}}
- Hidden - {{configuration.hidden}} + Total shared files + {{currentNode.healthCheck.status.last_sync_integrity.total_files.shared}}
- Name - {{configuration.name}} + Total missing files + {{currentNode.healthCheck.status.last_sync_integrity.total_files.missing}}
- Node name - {{configuration.node_name}} + Total extra but valid files + {{currentNode.healthCheck.status.last_sync_integrity.total_files.extra_valid}}
- Node type - {{configuration.node_type}} + Total extra files + {{currentNode.healthCheck.status.last_sync_integrity.total_files.extra}}
+
+
+
+ + + + +
+ + + + + Last agents information + synchronization +
- Bind address - {{configuration.bind_addr}} + Last sync + {{currentNode.healthCheck.status.last_sync_agentinfo.date_end_master}}
- IP - {{configuration.nodes[0] || 'Unknown'}} + Duration + {{currentNode.healthCheck.status.last_sync_agentinfo.duration}} +
+
+ Total agent info + {{currentNode.healthCheck.status.last_sync_agentinfo.total_agentinfo}}
+
+
+ + + + + Last agents groups + synchronization +
- Port - {{configuration.port}} + Last sync + {{currentNode.healthCheck.status.last_sync_agentgroups.date_end_master}} +
+
+ Duration + {{currentNode.healthCheck.status.last_sync_agentgroups.duration}} +
+
+ Total agent info + {{currentNode.healthCheck.status.last_sync_agentgroups.total_agentgroups}}
- -
- - -
- - - {{ currentNode.name }} alerts summary - -
-
-
-
- - - -
- - - - - Node information - -
- IP - {{currentNode.healthCheck.info.ip}} -
-
- Version - {{currentNode.healthCheck.info.version}} -
-
- Type - {{currentNode.healthCheck.info.type}} -
-
- Name - {{currentNode.healthCheck.info.name}} -
-
- Active agents - {{ currentNode.healthCheck.info.n_active_agents }} -
-
-
- - - - - Last files integrity synchronization - -
- Last sync - {{currentNode.healthCheck.status.last_sync_integrity.date_end_master}} -
-
- Duration - {{currentNode.healthCheck.status.last_sync_integrity.duration}} -
-
- Total shared files - {{currentNode.healthCheck.status.last_sync_integrity.total_files.shared}} -
-
- Total missing files - {{currentNode.healthCheck.status.last_sync_integrity.total_files.missing}} -
-
- Total extra but valid files - {{currentNode.healthCheck.status.last_sync_integrity.total_files.extra_valid}} -
-
- Total extra files - {{currentNode.healthCheck.status.last_sync_integrity.total_files.extra}} -
-
-
-
- - - - -
- - - - - Last agents information synchronization - -
- Last sync - {{currentNode.healthCheck.status.last_sync_agentinfo.date_end_master}} -
-
- Duration - {{currentNode.healthCheck.status.last_sync_agentinfo.duration}} -
-
- Total agent info - {{currentNode.healthCheck.status.last_sync_agentinfo.total_agentinfo}} -
-
-
- - - - - Last agents groups synchronization - -
- Last sync - {{currentNode.healthCheck.status.last_sync_agentgroups.date_end_master}} -
-
- Duration - {{currentNode.healthCheck.status.last_sync_agentgroups.duration}} -
-
- Total agent info - {{currentNode.healthCheck.status.last_sync_agentgroups.total_agentgroups}} -
-
-
-
- + +
+ +
+
+ + +
- -
-
- - -
-
- -
+
+
+
- +
- Management + Management / - Cluster + Manager
- - - Status - Logs - Cluster - Reporting - + + + Status + + Logs + Cluster + + Reporting + + + -
- Cluster disabled + Cluster + disabled
-

The cluster is disabled. Visit the documentation on this link to learn about how to enable it. +

The cluster is disabled. Visit the documentation on this link to + learn about how to enable it.

- +
- Cluster not running + Cluster not + running

@@ -374,5 +395,5 @@

- -
+ +
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/reporting/reporting.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/reporting/reporting.html index acfd25947..c47e74902 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/reporting/reporting.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/reporting/reporting.html @@ -1,6 +1,6 @@
-
+
Management / Reporting
@@ -41,7 +41,15 @@ - Refresh + + + + + + Refresh + + Refresh +
@@ -62,10 +70,25 @@
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/manager-ruleset-id.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/manager-ruleset-id.html index e691702da..35d538d63 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/manager-ruleset-id.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/manager-ruleset-id.html @@ -1,15 +1,11 @@
- Management + Management - / Ruleset + / Ruleset - / Rules + / Rules / {{ ruleInfo.id }}
@@ -18,51 +14,27 @@
- - Rules + + Rules - Decoders + Decoders - Lists + Lists
- + Back -

+

@@ -74,16 +46,10 @@ ID: {{ ruleInfo.id }}
-
+
Level: - {{ ruleInfo.level }} + {{ ruleInfo.level }} Filter by this level @@ -91,10 +57,8 @@
File: - {{ ruleInfo.file }} + {{ ruleInfo.file }} Filter by this file @@ -102,10 +66,8 @@
Path: - {{ ruleInfo.path }} + {{ ruleInfo.path }} Filter by this path @@ -118,12 +80,9 @@
-
@@ -132,85 +91,52 @@
- + - Details + + Details
-
+
{{ key }}
- {{ value }} + {{ value }} - {{ key }}: {{ value }} | + {{ key }}: {{ value }} |
- + {{ v }}{{ $last ? "" : ", " }}
-
+
{{ key }} - {{ v }}{{ $last ? "" : ", " }} + {{ v }}{{ $last ? "" : ", " }}
- + - Groups + Groups
- + {{ item }} Filter by this group @@ -224,52 +150,32 @@ - + Compliance -
+
PCI DSS
- + {{ item }}
-
+
GDPR
- + {{ item }}
@@ -281,22 +187,14 @@
-
+
- + - Regex + Regex
@@ -308,15 +206,10 @@ - + - Match + Match
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/manager-ruleset.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/manager-ruleset.html index af3085621..c3315c087 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/manager-ruleset.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/manager-ruleset.html @@ -1,6 +1,6 @@
-
+
Management / Ruleset / Rules @@ -17,21 +17,31 @@ Lists -
+
- - - +
+ +
+
+ +
+
+ +
- -
Editable files
-
- -
Only custom rules
-
+ + @@ -112,7 +118,7 @@ @@ -164,4 +170,10 @@ valid-fn='xmlIsValid(valid)' close-fn='closeEditingFile()'>
+
+ + +
+ +
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/managerRulesetIdCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/managerRulesetIdCtrl.js index 1fb00dd21..3d6c07e8c 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/managerRulesetIdCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/managerRulesetIdCtrl.js @@ -49,14 +49,13 @@ define(['../../module', './ruleset'], function(controllers, Ruleset) { this.filters = [] } - //Check if the rule is overwrited - if (ruleInfo.data.data.totalItems > 1) { - ruleInfo = ruleInfo.data.data.items.filter( - rule => rule.details.overwrite - ) - this.scope.ruleInfo = ruleInfo[0] + //Check if the rule is overwritted + const response = (((ruleInfo || {}).data || {}).data || {}).items || [] + if (response.length) { + const result = response.filter(rule => rule.details.overwrite) + this.scope.ruleInfo = result.length ? result[0] : response[0] } else { - this.scope.ruleInfo = ruleInfo.data.data.items[0] + this.scope.ruleInfo = false } if ( !(Object.keys((this.scope.ruleInfo || {}).details || {}) || []).length @@ -102,18 +101,20 @@ define(['../../module', './ruleset'], function(controllers, Ruleset) { async closeEditingFile() { try { //Refresh rule info - const result = await this.requestService.apiReq( + const ruleReloaded = await this.requestService.apiReq( `/rules/${this.scope.ruleInfo.id}` ) - if (result.data.data.totalItems === 0) { + if (ruleReloaded.data.data.totalItems === 0) { this.state.go('mg-rules') } - //Check if the rule is overwrited - if (result.data.data.totalItems > 1) { - result = result.data.data.items.filter(rule => rule.details.overwrite) - this.scope.ruleInfo = result[0] + //Check if the rule is overwritted + const response = + (((ruleReloaded || {}).data || {}).data || {}).items || [] + if (response.length) { + const result = response.filter(rule => rule.details.overwrite) + this.scope.ruleInfo = result.length ? result[0] : response[0] } else { - this.scope.ruleInfo = result.data.data.items[0] + this.scope.ruleInfo = false } } catch (error) { this.state.go('mg-rules') diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/ruleset.js b/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/ruleset.js index 1c4d011f4..022c958da 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/ruleset.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/rules/ruleset.js @@ -128,7 +128,7 @@ define(['../../module', 'FileSaver'], function(app) { this.scope.$on('editFile', (ev, params) => { ev.stopPropagation() - this.editFile(params.file, params.path) + this.editFile(params.file, params.path, params.readOnly) }) this.scope.$on('performRestart', event => { @@ -459,6 +459,7 @@ define(['../../module', 'FileSaver'], function(app) { this.scope.addingNewFile = false this.scope.overwrite = false this.scope.fetchedXML = '' + this.scope.XMLContent = false } /** @@ -474,14 +475,25 @@ define(['../../module', 'FileSaver'], function(app) { * Open xml editior box * @param {String} file */ - async editFile(file, path) { + async editFile(file, path, readOnly = false) { try { - this.scope.editingRulesetFile = { - file, - path: `${path}/${file}` + if (readOnly) { + this.scope.XMLContent = await this.fetchFileContent( + `${path}/${file}`, + readOnly + ) + this.scope.$broadcast('XMLContentReady', { + data: this.scope.XMLContent + }) + this.scope.fileName = file + } else { + this.scope.editingRulesetFile = { + file, + path: `${path}/${file}` + } + this.scope.fetchedXML = await this.fetchFileContent(`${path}/${file}`) + this.scope.$broadcast('fetchedFile', { data: this.scope.fetchedXML }) } - this.scope.fetchedXML = await this.fetchFileContent(`${path}/${file}`) - this.scope.$broadcast('fetchedFile', { data: this.scope.fetchedXML }) } catch (error) { this.scope.fetchedXML = null this.notification.showErrorToast(error.message || error) @@ -506,7 +518,25 @@ define(['../../module', 'FileSaver'], function(app) { * Fetchs file content * @param {String} file */ - async fetchFileContent(file) { + async fetchFileContent(file, readOnly = false) { + try { + const result = await this.fileEditor.getConfiguration( + file, + null, + null, + readOnly + ) + return result + } catch (error) { + return Promise.reject(error) + } + } + + /** + * Fetchs readable file content + * @param {String} file + */ + async fetchReadableFileContent(file) { try { const result = await this.fileEditor.getConfiguration(file) return result diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/status/status.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/status/status.html index 4330c1e07..2fd1af00b 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/status/status.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/status/status.html @@ -1,6 +1,6 @@
-
+
Management / Status
@@ -25,12 +25,13 @@ - +
The {{clusterEnabled ? "cluster" : "manager"}} will be restarted. - -
-
+ +
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - - Policy monitoring + + Policy monitoring + + SCA System auditing - OpenSCAP - CIS-CAT + OpenSCAP + CIS-CAT - -
- - -
New files: - -
-
Read files: - -
-
Modified files: - -
-
Removed files: - -
-
-
-
- -
- - - Groups - - - -
-
-
- - - Agents - - - -
-
-
- - - Directories - - - -
-
-
- - - Files - - - -
-
-
-
- -
- - - Alerts over time - - - -
-
-
+ +
+
+ Fetching data...
+
- -
-
- +
+
+ + +
New files: + +
+
Read files: + +
+
Modified files: + +
+
Removed files: + +
+
+
+
+ +
+ + + Groups + + + + + +
+
+
+ - File read access - + Agents + + + -
+
+
+
+ + + Commands + + + + + +
+
+
+ + + Files + + + + + +
- -
- + +
+ - File write access - + Alerts over time + + + -
+
- -
- +
+ - Commands - + Alerts summary + + + -
+
-
- - - Created files - - - -
-
-
- - - Removed files - - - -
-
-
-
-
- - - Alerts summary - - - -
-
-
-
- \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/audit/overviewAuditCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/audit/overviewAuditCtrl.js index 355870f2e..af30a2290 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/audit/overviewAuditCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/audit/overviewAuditCtrl.js @@ -134,7 +134,7 @@ define([ 'groupsElement', `${ this.filters - } sourcetype=wazuh rule.groups{}="audit" | top rule.groups{}`, + } sourcetype=wazuh rule.groups{}="audit" | top limit=5 rule.groups{}`, 'groupsElement', this.scope ), @@ -142,23 +142,23 @@ define([ 'agentsElement', `${ this.filters - } sourcetype=wazuh rule.groups{}="audit" agent.name=* | top agent.name`, + } sourcetype=wazuh rule.groups{}="audit" agent.name=* | top limit=5 agent.name`, 'agentsElement', this.scope ), new PieChart( - 'directoriesElement', + 'commandsVizz', `${ this.filters - } sourcetype=wazuh rule.groups{}="audit" data.audit.directory.name=* | top data.audit.directory.name`, - 'directoriesElement', + } sourcetype=wazuh rule.groups{}="audit" | top limit=5 data.audit.command`, + 'commandsVizz', this.scope ), new PieChart( 'filesElement', `${ this.filters - } sourcetype=wazuh rule.groups{}="audit" data.audit.file.name=* | top data.audit.file.name`, + } sourcetype=wazuh rule.groups{}="audit" data.audit.file.name=* | top limit=5 data.audit.file.name`, 'filesElement', this.scope ), @@ -170,46 +170,6 @@ define([ 'alertsOverTimeElement', this.scope ), - new PieChart( - 'fileReadAccess', - `${ - this.filters - } sourcetype=wazuh rule.groups{}="audit" rule.id=80784 | top data.audit.file.name`, - 'fileReadAccessElement', - this.scope - ), - new PieChart( - 'fileWriteAccess', - `${ - this.filters - } sourcetype=wazuh rule.groups{}="audit" rule.id=80781 | top data.audit.file.name`, - 'fileWriteAccessElement', - this.scope - ), - new ColumnChart( - 'commands', - `${ - this.filters - } sourcetype=wazuh rule.groups{}="audit" | top data.audit.command`, - 'commandsElement', - this.scope - ), - new ColumnChart( - 'createdFiles', - `${ - this.filters - } sourcetype=wazuh rule.groups{}="audit" rule.id=80790 | top data.audit.file.name`, - 'createdFilesElement', - this.scope - ), - new PieChart( - 'removedFiles', - `${ - this.filters - } sourcetype=wazuh rule.groups{}="audit" rule.id=80791 | top data.audit.file.name`, - 'removedFilesElement', - this.scope - ), new Table( 'alertsSummary', `${ @@ -229,59 +189,59 @@ define([ 'Alerts Summary' ) ] + } - this.reportMetrics = { - 'New files': this.scope.newFiles, - 'Read files': this.scope.readFiles, - 'Modified files': this.scope.filesModifiedToken, - 'Deleted files': this.scope.filesDeleted - } - - /** - * Generates report - */ - this.scope.startVis2Png = () => - this.reportingService.startVis2Png( - 'overview-audit', - 'Audit', - this.filters, - [ - 'groupsElement', - 'agentsElement', - 'directoriesElement', - 'filesElement', - 'alertsOverTimeElement', - 'fileReadAccessElement', - 'fileWriteAccessElement', - 'commandsElement', - 'createdFilesElement', - 'removedFilesElement', - 'alertsSummaryElement' - ], - this.reportMetrics, - this.tableResults - ) - - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) - - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - } else { - this.vizz.map(v => { - if (v.constructor.name === 'RawTableData') { - this.tableResults[v.name] = v.results - } - }) - this.scope.loadingVizz = true + $onInit() { + try { + this.scope.loadingVizz = true + this.reportMetrics = { + 'New files': this.scope.newFiles, + 'Read files': this.scope.readFiles, + 'Modified files': this.scope.filesModifiedToken, + 'Deleted files': this.scope.filesDeleted } - if (!this.scope.$$phase) this.scope.$digest() - }) + + /** + * Generates report + */ + this.scope.startVis2Png = () => + this.reportingService.startVis2Png( + 'overview-audit', + 'Audit', + this.filters, + [ + 'groupsElement', + 'agentsElement', + 'commandsVizz', + 'filesElement', + 'alertsOverTimeElement', + 'alertsSummaryElement' + ], + this.reportMetrics, + this.tableResults + ) + + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) + + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + } else { + this.vizz.map(v => { + if (v.constructor.name === 'RawTableData') { + this.tableResults[v.name] = v.results + } + }) + this.scope.loadingVizz = true + } + if (!this.scope.$$phase) this.scope.$digest() + }) + } catch (error) {} } /** diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/aws/aws.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/aws/aws.html index 78b5b7d41..4e7824422 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/aws/aws.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/aws/aws.html @@ -1,126 +1,170 @@ -
-
+
+
Overview / Amazon Web Services
- - -
-
+ +
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - - Security events - Integrity monitoring + + Security + events + Integrity monitoring + Amazon AWS - -
- - - - Sources - - - -
-
-
- - - - Accounts - - - -
-
-
- - - - S3 buckets - - - -
-
-
- - - - Regions - - - -
-
-
+
+
+ Fetching data...
+
+
+ +
+ + + + Sources + + + + + +
+
+
+ + + + Accounts + + + + + +
+
+
+ + + + S3 buckets + + + + + +
+
+
+ + + + Regions + + + + + +
+
+
+
- -
- - - - Events by source over time - - - -
-
-
- - - - Events by S3 over time - - - -
-
-
-
+ +
+ + + + Events by source over time + + + + + +
+
+
+ + + + Events by S3 over time + + + + + +
+
+
+
+ + +
+ + + + Geolocation map + + + + + +
+
+
+ +
- -
- - - - Top 5 buckets - - - -
-
-
- - - - Top 5 rules - - - -
-
-
+ + +
+ + + + Top 5 buckets + + + + + +
+
+
+ + + + Top 5 rules + + + + + +
+
+
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/aws/awsCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/aws/awsCtrl.js index 479514a70..da1018b6b 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/aws/awsCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/aws/awsCtrl.js @@ -4,244 +4,263 @@ define([ '../../../services/visualizations/chart/area-chart', '../../../services/visualizations/chart/column-chart', '../../../services/visualizations/table/table', + '../../../services/visualizations/map/map', '../../../services/visualizations/inputs/time-picker', '../../../services/rawTableData/rawTableDataService' -], function( +], function ( app, PieChart, AreaChart, ColumnChart, Table, + Map, TimePicker, RawTableDataService ) { - 'use strict' + 'use strict' - class AWS { - /** - * Class constructor - * @param {*} $rootScope - * @param {*} $scope - * @param {*} $currentDataService - * @param {*} $state - * @param {*} $notificationService - * @param {*} $reportingService - */ - constructor( - $urlTokenModel, - $scope, - $currentDataService, - $state, - $notificationService, - $reportingService, - reportingEnabled - ) { - this.scope = $scope - this.scope.reportingEnabled = reportingEnabled - this.urlTokenModel = $urlTokenModel - this.state = $state - this.notification = $notificationService - this.reportingService = $reportingService - this.currentDataService = $currentDataService - this.tableResults = {} - this.currentDataService.addFilter( - `{"rule.groups{}":"amazon", "implicit":true}` - ) - this.getFilters = this.currentDataService.getSerializedFilters - this.filters = this.getFilters() - this.submittedTokenModel = this.urlTokenModel.getSubmittedTokenModel() - this.timePicker = new TimePicker( - '#timePicker', - this.urlTokenModel.handleValueChange - ) - this.scope.expandArray = [ - false, - false, - false, - false, - false, - false, - false, - false - ] - this.scope.expand = (i, id) => this.expand(i, id) + class AWS { + /** + * Class constructor + * @param {*} $rootScope + * @param {*} $scope + * @param {*} $currentDataService + * @param {*} $state + * @param {*} $notificationService + * @param {*} $reportingService + */ + constructor( + $urlTokenModel, + $scope, + $currentDataService, + $state, + $notificationService, + $reportingService, + reportingEnabled + ) { + this.scope = $scope + this.scope.reportingEnabled = reportingEnabled + this.urlTokenModel = $urlTokenModel + this.state = $state + this.notification = $notificationService + this.reportingService = $reportingService + this.currentDataService = $currentDataService + this.tableResults = {} + this.currentDataService.addFilter( + `{"rule.groups{}":"amazon", "implicit":true}` + ) + this.getFilters = this.currentDataService.getSerializedFilters + this.filters = this.getFilters() + this.submittedTokenModel = this.urlTokenModel.getSubmittedTokenModel() + this.timePicker = new TimePicker( + '#timePicker', + this.urlTokenModel.handleValueChange + ) + this.scope.expandArray = [ + false, + false, + false, + false, + false, + false, + false, + false + ] + this.scope.expand = (i, id) => this.expand(i, id) - this.vizz = [ - /** - * Visualizations - */ - new AreaChart( - 'eventsBySourceVizz', - `${ + this.vizz = [ + /** + * Visualizations + */ + new AreaChart( + 'eventsBySourceVizz', + `${ this.filters - } sourcetype=wazuh | timechart count by data.aws.source usenull=f`, - 'eventsBySourceVizz', - this.scope - ), - new ColumnChart( - 'eventsByS3BucketsVizz', - `${ + } sourcetype=wazuh | timechart count by data.aws.source usenull=f`, + 'eventsBySourceVizz', + this.scope + ), + new ColumnChart( + 'eventsByS3BucketsVizz', + `${ + this.filters + } sourcetype=wazuh | timechart count by data.aws.log_info.s3bucket usenull=f`, + 'eventsByS3BucketsVizz', + this.scope + ), + new PieChart( + 'sourcesVizz', + `${this.filters} sourcetype=wazuh | stats count BY data.aws.source`, + 'sourcesVizz', + this.scope + ), + new PieChart( + 'accountsVizz', + `${ this.filters - } sourcetype=wazuh | timechart count by data.aws.log_info.s3bucket usenull=f`, - 'eventsByS3BucketsVizz', - this.scope - ), - new PieChart( - 'sourcesVizz', - `${this.filters} sourcetype=wazuh | stats count BY data.aws.source`, - 'sourcesVizz', - this.scope - ), - new PieChart( - 'accountsVizz', - `${ + } sourcetype=wazuh | top data.aws.responseElements.instancesSet.items.instanceId`, + 'accountsVizz', + this.scope + ), + new PieChart( + 's3BucketsVizz', + `${ this.filters - } sourcetype=wazuh | top data.aws.responseElements.instancesSet.items.instanceId`, - 'accountsVizz', - this.scope - ), - new PieChart( - 's3BucketsVizz', - `${ + } sourcetype=wazuh | stats count by data.aws.log_info.s3bucket`, + 's3BucketsVizz', + this.scope + ), + new PieChart( + 'regionsVizz', + `${this.filters} sourcetype=wazuh | top data.aws.awsRegion`, + 'regionsVizz', + this.scope + ), + new Table( + 'top5Buckets', + `${ this.filters - } sourcetype=wazuh | stats count by data.aws.log_info.s3bucket`, - 's3BucketsVizz', - this.scope - ), - new PieChart( - 'regionsVizz', - `${this.filters} sourcetype=wazuh | top data.aws.awsRegion`, - 'regionsVizz', - this.scope - ), - new Table( - 'top5Buckets', - `${ + } sourcetype=wazuh | top data.aws.source limit=5 | rename data.aws.source as Source, count as Count, percent as Percent`, + 'top5Buckets', + this.scope + ), + new Table( + 'top5Rules', + `${ this.filters - } sourcetype=wazuh | top data.aws.source limit=5 | rename data.aws.source as Source, count as Count, percent as Percent`, - 'top5Buckets', - this.scope - ), - new Table( - 'top5Rules', - `${ + } sourcetype=wazuh | top rule.id, rule.description limit=5 | rename rule.id as "Rule ID", rule.description as "Rule description", count as Count, percent as Percent`, + 'top5Rules', + this.scope + ), + new RawTableDataService( + 'top5BucketsTable', + `${ this.filters - } sourcetype=wazuh | top rule.id, rule.description limit=5 | rename rule.id as "Rule ID", rule.description as "Rule description", count as Count, percent as Percent`, - 'top5Rules', - this.scope - ), - new RawTableDataService( - 'top5BucketsTable', - `${ + } sourcetype=wazuh | top data.aws.source limit=5 | rename data.aws.source as Source, count as Count, percent as Percent`, + 'top5BucketsTableToken', + '$result$', + this.scope, + 'Top 5 buckets' + ), + new RawTableDataService( + 'top5RulesTable', + `${ this.filters - } sourcetype=wazuh | top data.aws.source limit=5 | rename data.aws.source as Source, count as Count, percent as Percent`, - 'top5BucketsTableToken', - '$result$', - this.scope, - 'Top 5 buckets' - ), - new RawTableDataService( - 'top5RulesTable', - `${ + } sourcetype=wazuh | top rule.id, rule.description limit=5 | rename rule.id as "Rule ID", rule.description as "Rule description", count as Count, percent as Percent`, + 'top5RulesTableToken', + '$result$', + this.scope, + 'Top 5 Rules' + ), + new Map( + 'map', + `${ this.filters - } sourcetype=wazuh | top rule.id, rule.description limit=5 | rename rule.id as "Rule ID", rule.description as "Rule description", count as Count, percent as Percent`, - 'top5RulesTableToken', - '$result$', - this.scope, - 'Top 5 Rules' - ) - ] + } sourcetype=wazuh | stats count by data.aws.service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lat, data.aws.service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lon | rename data.aws.service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lon as "lon" | rename data.aws.service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lat as "lat" | geostats count`, + 'map', + this.scope + ) + ] + } - this.scope.$on('deletedFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + $onInit() { + try { - this.scope.$on('barFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + this.scope.loadingVizz = true + this.scope.$on('deletedFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.scope.startVis2Png = () => - this.reportingService.startVis2Png( - 'overview-aws', - 'AWS', - this.filters, - [ - 'sourcesVizz', - 'accountsVizz', - 's3BucketsVizz', - 'regionsVizz', - 'eventsBySourceVizz', - 'eventsByS3BucketsVizz', - 'top5Buckets', - 'top5Rules' - ], - {}, //Metrics - this.tableResults - ) + this.scope.$on('barFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - /** - * On controller destroy - */ - this.scope.$on('$destroy', () => { - this.timePicker.destroy() - this.vizz.map(vizz => vizz.destroy()) - }) + this.scope.startVis2Png = () => + this.reportingService.startVis2Png( + 'overview-aws', + 'AWS', + this.filters, + [ + 'sourcesVizz', + 'accountsVizz', + 's3BucketsVizz', + 'regionsVizz', + 'eventsBySourceVizz', + 'eventsByS3BucketsVizz', + 'map', + 'top5Buckets', + 'top5Rules' + ], + {}, //Metrics + this.tableResults + ) - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) + /** + * On controller destroy + */ + this.scope.$on('$destroy', () => { + this.timePicker.destroy() + this.vizz.map(vizz => vizz.destroy()) + }) + + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - } else { - this.vizz.map(v => { - if (v.constructor.name === 'RawTableData') { - this.tableResults[v.name] = v.results + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + } else { + this.vizz.map(v => { + if (v.constructor.name === 'RawTableData') { + this.tableResults[v.name] = v.results + } + }) + this.scope.loadingVizz = true } + if (!this.scope.$$phase) this.scope.$digest() }) - this.scope.loadingVizz = true + } catch (error) { + console.error('error on init ', error) } - if (!this.scope.$$phase) this.scope.$digest() - }) - } + } - /** - * Gets filters and launches search - */ - launchSearches() { - this.filters = this.getFilters() - this.state.reload() - } + /** + * Gets filters and launches search + */ + launchSearches() { + this.filters = this.getFilters() + this.state.reload() + } - expand(i, id) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - let vis = $( - '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' - ) - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') + expand(i, id) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + let vis = $( + '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' + ) + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') - let vis_header = $('.wz-headline-title') - vis_header.dblclick(e => { - if (this.scope.expandArray[i]) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') - this.scope.$applyAsync() - } else { - e.preventDefault() - } - }) + let vis_header = $('.wz-headline-title') + vis_header.dblclick(e => { + if (this.scope.expandArray[i]) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') + this.scope.$applyAsync() + } else { + e.preventDefault() + } + }) + } } - } - app.controller('awsCtrl', AWS) -}) + app.controller('awsCtrl', AWS) + }) diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/ciscat/ciscatCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/ciscat/ciscatCtrl.js index 27cd8e932..2a573fa1b 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/ciscat/ciscatCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/ciscat/ciscatCtrl.js @@ -234,6 +234,7 @@ define([ */ $onInit() { this.addFilter(`{"rule.groups{}":"ciscat", "implicit":true}`) + this.scope.loadingVizz = true /** * On controller destroy diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/ciscat/overview-ciscat.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/ciscat/overview-ciscat.html index 474e52d50..7298b3d6b 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/ciscat/overview-ciscat.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/ciscat/overview-ciscat.html @@ -1,116 +1,132 @@ -
-
+
+
Overview / CIS-CAT
- - -
+ + +
-
Generating report
+
{{reportStatus}}
- - Policy monitoring - System auditing - OpenSCAP + + Policy monitoring + + SCA + System auditing + OpenSCAP CIS-CAT - - - -
- - -
Last not checked: - -
-
Last pass: - -
-
Last scan score: - -
-
Last scan date: - -
-
-
-
-
- - -
Last errors: - -
-
Last fails: - -
-
Last unknown: - -
-
Last scan benchmark: - -
-
-
+
+
+ Fetching data...
+
+
+ -
-
- - - Top 5 CIS-CAT groups - - - -
+
+ + +
Last not checked: + +
+
Last pass: + +
+
Last scan score: + +
+
Last scan date: + +
- -
- - - Scan result evolution - - - -
+
+ + +
Last errors: + +
+
Last fails: + +
+
Last unknown: + +
+
Last scan benchmark: + +
-
+
+
+ + + Top 5 CIS-CAT groups + + + + + +
+
+
+
+ +
+ + + Scan result evolution + + + + + +
+
+
+
-
-
- - - Alerts summary - - - -
-
-
-
+
+
+ + + Alerts summary + + + + + +
+
+
+
+
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/docker/dockerCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/docker/dockerCtrl.js index 7f74b6510..837014bd6 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/docker/dockerCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/docker/dockerCtrl.js @@ -94,7 +94,7 @@ define([ 'alertsSummary', `${ this.filters - } sourcetype=wazuh | stats count sparkline by data.docker.Actor.Attributes.image, data.docker.Actor.Attributes.name, data.docker.Action, timestamp | sort count DESC | rename data.docker.Actor.Attributes.image as Image, data.docker.Actor.Attributes.name as Name, data.docker.Action as Action, timestamp as Date, count as Count, sparkline as Sparkline`, + } sourcetype=wazuh | stats count sparkline by data.docker.Actor.Attributes.image, data.docker.Actor.Attributes.name, data.docker.Action, timestamp | sort count DESC | rename data.docker.Actor.Attributes.image as Image, data.docker.Actor.Attributes.name as Container, data.docker.Action as Action, timestamp as Date, count as Count, sparkline as Sparkline`, 'alertsSummary', this.scope ), @@ -110,7 +110,7 @@ define([ 'alertsSummaryRawTable', `${ this.filters - } sourcetype=wazuh | stats count sparkline by data.docker.Actor.Attributes.image, data.docker.Actor.Attributes.name, data.docker.Action, timestamp | sort count DESC | rename data.docker.Actor.Attributes.image as Image, data.docker.Actor.Attributes.name as Name, data.docker.Action as Action, timestamp as Date, count as Count`, + } sourcetype=wazuh | stats count sparkline by data.docker.Actor.Attributes.image, data.docker.Actor.Attributes.name, data.docker.Action, timestamp | sort count DESC | rename data.docker.Actor.Attributes.image as Image, data.docker.Actor.Attributes.name as Container, data.docker.Action as Action, timestamp as Date, count as Count`, 'alertsSummaryRawTableToken', '$result$', this.scope, @@ -164,7 +164,9 @@ define([ /** * On controller loads */ - $onInit() {} + $onInit() { + this.scope.loadingVizz = true + } /** * Get filters and launches search diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/docker/overview-docker.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/docker/overview-docker.html index bca992ffb..54488e89a 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/docker/overview-docker.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/docker/overview-docker.html @@ -1,6 +1,6 @@
-
+
Overview / Docker listener
@@ -20,7 +20,7 @@
-
Generating report
{{reportStatus}}
@@ -36,70 +36,82 @@ - -
- - - - Top 5 images - - - -
-
-
- - - - Top 5 events - - - -
-
-
- - - - Resource usage over time - - - -
-
-
+
+
+ Fetching data...
+
+
+ +
+ + + + Top 5 images + + + + + +
+
+
+ + + + Top 5 events + + + + + +
+
+
+ + + + Resource usage over time + + + + + +
+
+
+
- -
- - - - Events ocurred evolution - - - -
-
-
-
+ +
+ + + + Events ocurred evolution + + + + + +
+
+
+
- -
- - - - Alerts summary - - - -
-
-
+ +
+ + + + Alerts summary + + + + + +
+
+
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/fim/overview-fim.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/fim/overview-fim.html index 63f1df7a2..51b7cf8fd 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/fim/overview-fim.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/fim/overview-fim.html @@ -1,124 +1,133 @@ -
-
+
+
Overview / File integrity monitoring
- - -
-
+ + +
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - - Security events + + Security + events Integrity monitoring - Amazon AWS + Amazon AWS - -
- - - Top new files - - - -
-
-
- - - Top modified files - - - -
-
-
- - - Top deleted files - - - -
-
-
-
- -
- - - FIM Alerts volume - - - -
-
-
- - - Events summary - - - -
-
-
-
-
-
- +
+
+ Fetching data...
+
+
+
+ +
+ - Top 10 agents by alerts number - + Alerts by action over time + + + -
+
-
- + +
+ - Top 5 users - + Top 5 agents + + + -
+
-
- -
- + - Whodata usage - + Events summary + + + -
+
+ + +
+
+ + + Rule distribution + + + + + +
+
+
+
+ +
+ + + Top actions + + + + + +
+
+
+
+ +
+ + + Top 5 users + + + + + +
+
+
+
+ +
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/fim/overviewFimCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/fim/overviewFimCtrl.js index d7737f9df..c6bdaf03f 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/fim/overviewFimCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/fim/overviewFimCtrl.js @@ -6,241 +6,208 @@ define([ '../../../services/visualizations/chart/linear-chart', '../../../services/visualizations/inputs/time-picker', '../../../services/rawTableData/rawTableDataService' -], function( +], function ( app, ColumnChart, PieChart, Table, LinearChart, - TimePicker, - RawTableDataService + TimePicker ) { - 'use strict' + 'use strict' - class OverviewFIM { - /** - * Class File Integrity Monitoring (syscheck) - * @param {*} $urlTokenModel - * @param {*} $scope - * @param {*} $currentDataService - * @param {*} $state - * @param {*} $reportingService - */ - constructor( - $urlTokenModel, - $scope, - $currentDataService, - $state, - $reportingService, - reportingEnabled, - awsExtensionEnabled - ) { - this.scope = $scope - this.scope.reportingEnabled = reportingEnabled - this.scope.awsExtensionEnabled = awsExtensionEnabled - this.state = $state - this.reportingService = $reportingService - $currentDataService.addFilter( - `{"rule.groups{}":"syscheck", "implicit":true, "onlyShow":true}` - ) - this.getFilters = $currentDataService.getSerializedFilters - this.filters = this.getFilters() - this.tableResults = {} - this.submittedTokenModel = $urlTokenModel.getSubmittedTokenModel() - this.timePicker = new TimePicker( - '#timePicker', - $urlTokenModel.handleValueChange - ) + class OverviewFIM { + /** + * Class File Integrity Monitoring (syscheck) + * @param {*} $urlTokenModel + * @param {*} $scope + * @param {*} $currentDataService + * @param {*} $state + * @param {*} $reportingService + */ + constructor( + $urlTokenModel, + $scope, + $currentDataService, + $state, + $reportingService, + reportingEnabled, + awsExtensionEnabled + ) { + this.scope = $scope + this.scope.reportingEnabled = reportingEnabled + this.scope.awsExtensionEnabled = awsExtensionEnabled + this.state = $state + this.reportingService = $reportingService + $currentDataService.addFilter( + `{"rule.groups{}":"syscheck", "implicit":true, "onlyShow":true}` + ) + this.getFilters = $currentDataService.getSerializedFilters + this.filters = this.getFilters() + this.tableResults = {} + this.submittedTokenModel = $urlTokenModel.getSubmittedTokenModel() + this.timePicker = new TimePicker( + '#timePicker', + $urlTokenModel.handleValueChange + ) - this.scope.expandArray = [false, false, false, false, false, false, false] - this.scope.expand = (i, id) => this.expand(i, id) + this.scope.expandArray = [false, false, false, false, false, false, false] + this.scope.expand = (i, id) => this.expand(i, id) - this.vizz = [ - /** - * Visualizations - */ - new PieChart( - 'deletedFiles', - `${ - this.filters - } sourcetype=wazuh syscheck.event=deleted | stats count by syscheck.path | top syscheck.path limit=5`, - 'deletedFiles', - this.scope - ), - new ColumnChart( - 'whodataUsage', - `${this.filters} sourcetype=wazuh rule.groups{}=syscheck - | eval WHODATA=if(isnotnull('syscheck.audit.effective_user.id'), "WHODATA", "NOWHO") - | stats count BY WHODATA - | addcoltotals count labelfield=WHODATA label=Total - | where NOT WHODATA="NOWHO"`, - 'whodataUsage', - this.scope - ), - new PieChart( - 'alertsVolume', - `${ - this.filters - } sourcetype=wazuh rule.groups{}=syscheck | eval SYSCHECK=if(isnotnull('syscheck.event'), "SYSCHECK", "NO") - | stats count BY SYSCHECK - | addcoltotals count labelfield=SYSCHECK label=Total - | where NOT SYSCHECK="NO"`, - 'alertsVolume', - this.scope - ), - new PieChart( - 'newFiles', - `${ - this.filters - } sourcetype=wazuh syscheck.event=added | stats count by syscheck.path | top syscheck.path limit=5`, - 'newFiles', - this.scope - ), - new PieChart( - 'modifiedFiles', - `${ + this.vizz = [ + /** + * Visualizations + */ + + new LinearChart( + 'alertsByActionOverTime', + `${ this.filters - } sourcetype=wazuh syscheck.event=modified | stats count by syscheck.path | top syscheck.path limit=5`, - 'modifiedFiles', - this.scope - ), - new LinearChart( - 'eventsSummary', - `${ + } sourcetype=wazuh rule.groups{}=syscheck | timechart count by syscheck.event`, + 'alertsByActionOverTime', + this.scope + ), + new PieChart( + 'top5Agents', + `${ this.filters - } sourcetype=wazuh rule.groups{}=syscheck | timechart count`, - 'eventsSummary', - this.scope - ), - new PieChart( - 'topAgents', - `${ + } sourcetype=wazuh rule.groups{}=syscheck | top agent.name limit=5`, + 'top5Agents', + this.scope + ), + new LinearChart( + 'eventsSummary', + `${ this.filters - } sourcetype=wazuh rule.groups{}=syscheck | top agent.name limit=10`, - 'topAgents', - this.scope - ), - new Table( - 'topUsers', - `${ + } sourcetype=wazuh rule.groups{}=syscheck | timechart count`, + 'eventsSummary', + this.scope + ), + new PieChart( + 'ruleDistribution', + `${ this.filters - } sourcetype=wazuh syscheck.audit.effective_user.id=* | top syscheck.audit.effective_user.name limit=5 | rename syscheck.audit.effective_user.name as Username, count as Count, percent as Percent`, - 'topUsers', - this.scope - ), - new RawTableDataService( - 'topRulesTable', - `${ + } sourcetype=wazuh rule.groups{}=syscheck | top limit=5 rule.description`, + 'ruleDistribution', + this.scope + ), + new PieChart( + 'topActions', + `${ this.filters - } sourcetype=wazuh rule.groups{}=syscheck |stats count sparkline by rule.id, rule.description | sort count DESC | head 5 | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, - 'topRulesTableToken', - '$result$', - this.scope, - 'Top rules' - ), - new RawTableDataService( - 'topUsersTable', - `${ + } sourcetype=wazuh rule.groups{}=syscheck | top limit=5 syscheck.event`, + 'topActions', + this.scope + ), + new Table( + 'topUsers', + `${ this.filters - } sourcetype=wazuh syscheck.audit.effective_user.id=* | top syscheck.audit.effective_user.name limit=5 | rename syscheck.audit.effective_user.name as Username, count as Count, percent as Percent`, - 'topUsersTableToken', - '$result$', - this.scope, - 'Top users' - ) - ] + } sourcetype=wazuh rule.groups{}=syscheck | top limit=5 agent.id,agent.name,syscheck.uname_after | rename agent.id as "Agent ID", agent.name as "Agent name", syscheck.uname_after as "Top User", count as "Count"`, + 'topUsers', + this.scope + ) + ] - this.scope.$on('deletedFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + } - this.scope.$on('barFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + $onInit() { + try { + this.scope.loadingVizz = true + this.scope.$on('deletedFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - /** - * Generates report - */ - this.scope.startVis2Png = () => - this.reportingService.startVis2Png( - 'overview-fim', - 'File integrity monitoring', - this.filters, - [ - 'deletedFiles', - 'newFiles', - 'modifiedFiles', - 'alertsVolume', - 'eventsSummary', - 'whodataUsage', - 'topUsers' - ], - {}, //Metrics - this.tableResults - ) + this.scope.$on('barFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - } else { - this.vizz.map(v => { - if (v.constructor.name === 'RawTableData') { - this.tableResults[v.name] = v.results + /** + * Generates report + */ + this.scope.startVis2Png = () => + this.reportingService.startVis2Png( + 'overview-fim', + 'File integrity monitoring', + this.filters, + [ + 'alertsByActionOverTime', + 'top5Agents', + 'eventsSummary', + 'ruleDistribution', + 'topActions', + 'topUsers' + ], + {}, //Metrics + this.tableResults + ) + + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + } else { + this.vizz.map(v => { + if (v.constructor.name === 'RawTableData') { + this.tableResults[v.name] = v.results + } + }) + this.scope.loadingVizz = true } + if (!this.scope.$$phase) this.scope.$digest() }) - this.scope.loadingVizz = true + + /** + * On controller destroy + */ + this.scope.$on('$destroy', () => { + this.timePicker.destroy() + this.vizz.map(vizz => vizz.destroy()) + }) + + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) + + } catch (error) { + console.error('error on init ', error) } - if (!this.scope.$$phase) this.scope.$digest() - }) + } /** - * On controller destroy + * Get filters and launches the search */ - this.scope.$on('$destroy', () => { - this.timePicker.destroy() - this.vizz.map(vizz => vizz.destroy()) - }) - - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) - } + launchSearches() { + this.filters = this.getFilters() + this.state.reload() + } - /** - * Get filters and launches the search - */ - launchSearches() { - this.filters = this.getFilters() - this.state.reload() - } - - expand(i, id) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - let vis = $( - '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' - ) - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') + expand(i, id) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + let vis = $( + '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' + ) + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') - let vis_header = $('.wz-headline-title') - vis_header.dblclick(e => { - if (this.scope.expandArray[i]) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') - this.scope.$applyAsync() - } else { - e.preventDefault() - } - }) + let vis_header = $('.wz-headline-title') + vis_header.dblclick(e => { + if (this.scope.expandArray[i]) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') + this.scope.$applyAsync() + } else { + e.preventDefault() + } + }) + } } - } - app.controller('overviewFimCtrl', OverviewFIM) -}) + app.controller('overviewFimCtrl', OverviewFIM) + }) diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/gdpr/overview-gdpr.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/gdpr/overview-gdpr.html index e16d7a7f8..4ab5c3f6d 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/gdpr/overview-gdpr.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/gdpr/overview-gdpr.html @@ -1,109 +1,127 @@ -
-
+
+
Overview / GDPR
- - -
-
- + +
- - -
Generating report
- +
+ +
+ + +
{{reportStatus}}
+ - - PCI DSS - GDPR - + + PCI DSS + GDPR + - -
- - - -
- GDPR Requirement: {{tab.title}} - -
-
{{tab.content}}
-
-
-
-
-
+
+
+ Fetching data...
+
+
+ +
+ + + +
+ GDPR Requirement: {{tab.title}} + +
+
{{tab.content}}
+
+
+
+
+
+
-
- - - Top 10 agents by alerts number - - - -
+
+ + + Top 10 agents by alerts number + + + + + +
-
- - - GDPR Requirements - - - -
-
-
-
+
+ + + GDPR Requirements + + + + + +
+
+
+
-
- +
+ Top requirements over time - + + +
-
- -
- - - Requirements by agent - - - -
-
-
-
+
-
- - - Alerts summary - - - -
-
-
+
+ + + Requirements by agent + + + + + +
+
+
+
+ +
+ + + Alerts summary + + + + + +
+
+
+
- \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/gdpr/overviewGdprCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/gdpr/overviewGdprCtrl.js index f0ef74f88..8676c1845 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/gdpr/overviewGdprCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/gdpr/overviewGdprCtrl.js @@ -6,192 +6,205 @@ define([ '../../../services/visualizations/table/table', '../../../services/visualizations/inputs/time-picker', '../../../services/visualizations/inputs/dropdown-input' -], function(app, LinearChart, ColumnChart, PieChart, Table, TimePicker, Dropdown) { - 'use strict' - class OverviewGDPR { - /** - * Class GDPR - * @param {*} $urlTokenModel - * @param {*} $scope - * @param {*} $currentDataService - * @param {*} $state - * @param {*} $reportingService - */ - constructor( - $urlTokenModel, - $scope, - $currentDataService, - $state, - $reportingService, - gdprTabs, - reportingEnabled, - pciExtensionEnabled - ) { - this.scope = $scope - ;(this.scope.reportingEnabled = reportingEnabled), - (this.scope.pciExtensionEnabled = pciExtensionEnabled) - this.state = $state - this.getFilters = $currentDataService.getSerializedFilters - this.reportingService = $reportingService - this.tableResults = {} - this.filters = this.getFilters() - this.scope.gdprTabs = gdprTabs ? gdprTabs : false - this.scope.$on('deletedFilter', event => { - event.stopPropagation() - this.launchSearches() - }) +], function ( + app, + LinearChart, + ColumnChart, + PieChart, + Table, + TimePicker, + Dropdown +) { + 'use strict' + class OverviewGDPR { + /** + * Class GDPR + * @param {*} $urlTokenModel + * @param {*} $scope + * @param {*} $currentDataService + * @param {*} $state + * @param {*} $reportingService + */ + constructor( + $urlTokenModel, + $scope, + $currentDataService, + $state, + $reportingService, + gdprTabs, + reportingEnabled, + pciExtensionEnabled + ) { + this.scope = $scope + ; (this.scope.reportingEnabled = reportingEnabled), + (this.scope.pciExtensionEnabled = pciExtensionEnabled) + this.state = $state + this.getFilters = $currentDataService.getSerializedFilters + this.reportingService = $reportingService + this.tableResults = {} + this.filters = this.getFilters() + this.scope.gdprTabs = gdprTabs ? gdprTabs : false + this.scope.$on('deletedFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.scope.$on('barFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + this.scope.$on('barFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.timePicker = new TimePicker( - '#timePicker', - $urlTokenModel.handleValueChange - ) - this.dropdown = new Dropdown( - 'dropDownInputAgent', - `${ + this.timePicker = new TimePicker( + '#timePicker', + $urlTokenModel.handleValueChange + ) + this.dropdown = new Dropdown( + 'dropDownInputAgent', + `${ this.filters - } sourcetype=wazuh rule.gdpr{}="*"| stats count by "rule.gdpr{}" | spath "rule.gdpr{}" | fields - count`, - 'rule.gdpr{}', - '$form.gdpr$', - 'dropDownInput', - this.scope - ) + } sourcetype=wazuh rule.gdpr{}="*"| stats count by "rule.gdpr{}" | spath "rule.gdpr{}" | fields - count`, + 'rule.gdpr{}', + '$form.gdpr$', + 'dropDownInput', + this.scope + ) - this.dropdownInstance = this.dropdown.getElement() - this.dropdownInstance.on('change', newValue => { - if (newValue && this.dropdownInstance) { - $urlTokenModel.handleValueChange(this.dropdownInstance) - } - }) + this.dropdownInstance = this.dropdown.getElement() + this.dropdownInstance.on('change', newValue => { + if (newValue && this.dropdownInstance) { + $urlTokenModel.handleValueChange(this.dropdownInstance) + } + }) - this.scope.expandArray = [false, false, false, false, false] - this.scope.expand = (i, id) => this.expand(i, id) + this.scope.expandArray = [false, false, false, false, false] + this.scope.expand = (i, id) => this.expand(i, id) - this.vizz = [ - /** - * Visualizations - */ - new ColumnChart( - 'gdprRequirements', - `${ + this.vizz = [ + /** + * Visualizations + */ + new ColumnChart( + 'gdprRequirements', + `${ this.filters - } sourcetype=wazuh rule.gdpr{}="$gdpr$" | stats count by rule.gdpr{}`, - 'gdprRequirements', - this.scope - ), - new LinearChart( - 'evoViz', - `${ + } sourcetype=wazuh rule.gdpr{}="$gdpr$" | stats count by rule.gdpr{}`, + 'gdprRequirements', + this.scope + ), + new LinearChart( + 'evoViz', + `${ this.filters - } sourcetype=wazuh rule.gdpr{}="*" | timechart count by rule.gdpr{}`, - 'evoViz', - this.scope - ), - new PieChart( - 'agentsViz', - `${ + } sourcetype=wazuh rule.gdpr{}="*" | timechart count by rule.gdpr{}`, + 'evoViz', + this.scope + ), + new PieChart( + 'agentsViz', + `${ this.filters - } sourcetype=wazuh rule.gdpr{}="$gdpr$" | stats count by agent.name`, - 'agentsViz', - this.scope - ), - new ColumnChart( - 'requirementsByAgents', - `${ + } sourcetype=wazuh rule.gdpr{}="$gdpr$" | stats count by agent.name`, + 'agentsViz', + this.scope + ), + new ColumnChart( + 'requirementsByAgents', + `${ this.filters - } sourcetype=wazuh rule.gdpr{}="$gdpr$" agent.name=*| chart count(rule.gdpr{}) by rule.gdpr{},agent.name`, - 'requirementsByAgents', - this.scope - ), - new Table( - 'alertsSummaryViz', - `${ + } sourcetype=wazuh rule.gdpr{}="$gdpr$" agent.name=*| chart count(rule.gdpr{}) by rule.gdpr{},agent.name`, + 'requirementsByAgents', + this.scope + ), + new Table( + 'alertsSummaryViz', + `${ this.filters - } sourcetype=wazuh rule.gdpr{}="$gdpr$" | stats count sparkline by agent.name, rule.gdpr{}, rule.description | sort count DESC | rename agent.name as "Agent Name", rule.gdpr{} as Requirement, rule.description as "Rule description", count as Count`, - 'alertsSummaryViz', - this.scope - ) - ] + } sourcetype=wazuh rule.gdpr{}="$gdpr$" | stats count sparkline by agent.name, rule.gdpr{}, rule.description | sort count DESC | rename agent.name as "Agent Name", rule.gdpr{} as Requirement, rule.description as "Rule description", count as Count`, + 'alertsSummaryViz', + this.scope + ) + ] + } - /** - * Generates report - */ - this.scope.startVis2Png = () => - this.reportingService.startVis2Png( - 'overview-gdpr', - 'GDPR', - this.filters, - [ - 'gdprRequirements', - 'groupsViz', - 'agentsViz', - 'requirementsByAgents', - 'alertsSummaryViz' - ], - {}, //Metrics, - this.tableResults - ) + $onInit() { + try { + this.scope.loadingVizz = true + /** + * Generates report + */ + this.scope.startVis2Png = () => + this.reportingService.startVis2Png( + 'overview-gdpr', + 'GDPR', + this.filters, + [ + 'gdprRequirements', + 'groupsViz', + 'agentsViz', + 'requirementsByAgents', + 'alertsSummaryViz' + ], + {}, //Metrics, + this.tableResults + ) - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - } else { - this.scope.loadingVizz = true - } - if (!this.scope.$$phase) this.scope.$digest() - }) + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + } else { + this.scope.loadingVizz = true + } + if (!this.scope.$$phase) this.scope.$digest() + }) + + /** + * When controller is destroyed + */ + this.scope.$on('$destroy', () => { + this.timePicker.destroy() + this.dropdown.destroy() + this.vizz.map(vizz => vizz.destroy()) + }) + } catch (error) { } + } /** - * When controller is destroyed + * Get filters and launches the search */ - this.scope.$on('$destroy', () => { - this.timePicker.destroy() - this.dropdown.destroy() - this.vizz.map(vizz => vizz.destroy()) - }) - } - - /** - * Get filters and launches the search - */ - launchSearches() { - this.filters = this.getFilters() - this.state.reload() - } + launchSearches() { + this.filters = this.getFilters() + this.state.reload() + } - expand(i, id) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - let vis = $( - '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' - ) - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') + expand(i, id) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + let vis = $( + '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' + ) + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') - let vis_header = $('.wz-headline-title') - vis_header.dblclick(e => { - if (this.scope.expandArray[i]) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') - this.scope.$applyAsync() - } else { - e.preventDefault() - } - }) + let vis_header = $('.wz-headline-title') + vis_header.dblclick(e => { + if (this.scope.expandArray[i]) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') + this.scope.$applyAsync() + } else { + e.preventDefault() + } + }) + } } - } - app.controller('overviewGdprCtrl', OverviewGDPR) -}) + app.controller('overviewGdprCtrl', OverviewGDPR) + }) diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/general/overview-general.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/general/overview-general.html index 755b028cc..b06644495 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/general/overview-general.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/general/overview-general.html @@ -1,14 +1,14 @@ -
-
+
+
Overview / General
-
-
Generating report
+
{{reportStatus}}
- + Security events - Integrity monitoring - Amazon AWS + Integrity monitoring + + Amazon AWS - - -
- - - -
Alerts: - -
-
Level 12 or above alerts: - -
-
Authentication failure: - -
-
Authentication success: - -
-
-
+
+
+ Fetching data...
+
+
+ +
- -
- - - - Alert level evolution - + + +
Alerts: + +
+
Level 12 or above alerts: + +
+
Authentication failure: + +
+
Authentication success: + +
+
+
+
+ + +
+ + + + Alert level evolution + + + + + +
+
+
+ + + + Alerts + + + + - -
-
-
- - - - Alerts - - - -
-
-
-
+
+ + +
- -
- - - - Top 5 agents - - - -
-
-
- - - - Top 5 rule groups - - - -
-
-
- - - - Agents status - - - -
-
- - Agents status - -
-
-
-
-

Total

-

{{agentsCountTotal}}

-
-
-
-

Active

-

{{agentsCountActive}}

-
-
-

Disconnected

-

{{agentsCountDisconnected}}

-
-
-

Never connected

-

{{agentsCountNeverConnected}}

-
-
-

Agents coverage

-

{{(agentsCoverity | number:2)}}%

+ +
+ + + + Top 5 agents + + + + + +
+
+
+ + + + Top 5 rule groups + + + + + +
+
+
+ + + + Agents status + + + + + +
+
+ + Agents status + +
+
+
+
+

Total

+

{{agentsCountTotal}}

+
+
+
+

Active

+

{{agentsCountActive}}

+
+
+

Disconnected

+

{{agentsCountDisconnected}}

+
+
+

Never connected

+

{{agentsCountNeverConnected}}

+
+
+

Agents coverage

+

{{(agentsCoverity | number:2)}}%

+
-
- - -
+ + +
- -
+ +
- - - Agents summary - - - -
-
-
+ + + Agents summary + + + + + +
+
+
+
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/general/overviewGeneralCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/general/overviewGeneralCtrl.js index 09c632fa8..c633339ec 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/general/overviewGeneralCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/general/overviewGeneralCtrl.js @@ -168,7 +168,7 @@ define([ 'agentsSummaryVizz', `${ this.filters - } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort rule.level DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, + } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort count DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, 'agentsSummaryVizz', this.scope ), @@ -176,7 +176,7 @@ define([ 'agentsSummaryTable', `${ this.filters - } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort rule.level DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, + } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort count DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, 'agentsSummaryTableToken', '$result$', this.scope, @@ -190,6 +190,7 @@ define([ */ $onInit() { try { + this.scope.loadingVizz = true if (!this.pollingEnabled) { this.scope.wzMonitoringEnabled = false this.apiReq(`/agents/summary`) diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/index.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/index.js index ccd578ef5..64da1b347 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/index.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/index.js @@ -12,5 +12,6 @@ define([ './pci/overviewPciCtrl', './ciscat/ciscatCtrl', './policy-monitoring/overviewPolicyMonitoringCtrl', - './vulnerabilities/overviewVulnerabilitiesCtrl' + './vulnerabilities/overviewVulnerabilitiesCtrl', + './sca/overviewSCACtrl' ], function() {}) diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/osquery/osquery.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/osquery/osquery.html index 888fafb7c..fc7f2ea29 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/osquery/osquery.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/osquery/osquery.html @@ -1,129 +1,127 @@ -
-
+
+
Overview / Osquery
- - -
-
+ +
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - - Vulnerabilities - Osquery - VirusTotal - Docker listener - + + + Vulnerabilities + Osquery + VirusTotal + Docker listener + - - -
- - - Wodle configuration - -
-
-
-
-

Add labels

-

{{osqueryWodle.add_labels}}

-
-
-
-

Configuration path

-

{{osqueryWodle.config_path}}

-
-
-

Disabled

-

{{osqueryWodle.disabled}}

-
-
-

Log path

-

{{osqueryWodle.log_path}}

-
-
-

Run daemon

-

{{(osqueryWodle.run_daemon)}}

-
-
-
-
-
- - - - Alerts over time - - - -
-
-
- -
- - -
- - - - Most common packs - - - -
-
-
- - - - Alerts evolution - Top 5 agents - - - -
-
-
- + +
+
+ Fetching data...
+
-
- - - - Top 5 packs - - - -
-
-
- - - - Top 5 rules - - - -
-
-
+
+ +
+ + + Top 5 Osquery events added + + + + + +
+
+
+ + + + Top 5 Osquery events removed + + + + + +
+
+
+ + + + Evolution of Osquery events per pack over time + + + + + +
+
+
+ +
+ + +
+ + + Most common packs + + + + + +
+
+
+ + + Top 5 rules + + + + + +
+
+
+
+ + +
+ + + Most common packs + + + + + +
+
+
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/osquery/osqueryCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/osquery/osqueryCtrl.js index 77547435a..139df317f 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/osquery/osqueryCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/osquery/osqueryCtrl.js @@ -5,7 +5,7 @@ define([ '../../../services/visualizations/table/table', '../../../services/visualizations/inputs/time-picker', '../../../services/rawTableData/rawTableDataService' -], function(app, PieChart, AreaChart, Table, TimePicker, RawTableDataService) { +], function (app, PieChart, AreaChart, Table, TimePicker, RawTableDataService) { 'use strict' class Osquery { @@ -67,110 +67,69 @@ define([ * Visualizations */ new AreaChart( - 'alertsOverTime', - `${this.filters} sourcetype=wazuh | timechart span=1h count`, - 'alertsOverTime', + 'alertsPacksOverTime', + `${ + this.filters + } sourcetype=wazuh | timechart span=1h count by data.osquery.pack`, + 'alertsPacksOverTime', this.scope ), - new AreaChart( - 'alertsEvolution', - `${ - this.filters - } sourcetype=wazuh | timechart span=1h limit=5 useother=f count by agent.name`, - 'alertsEvolution', + new PieChart( + 'topOsqueryAdded', + `${this.filters} sourcetype=wazuh data.osquery.action="added" | top data.osquery.name limit=5`, + 'topOsqueryAdded', this.scope ), new PieChart( - 'mostCommonEvents', - `${this.filters} sourcetype=wazuh | top data.osquery.name limit=5`, - 'mostCommonEvents', + 'topOsqueryRemoved', + `${this.filters} sourcetype=wazuh data.osquery.action="removed" | top data.osquery.name limit=5`, + 'topOsqueryRemoved', + this.scope + ), + new PieChart( + 'mostCommonPacks', + `${this.filters} sourcetype=wazuh | top data.osquery.pack limit=5`, + 'mostCommonPacks', this.scope ), new Table( - 'topPacks', + 'alertsSummary', `${ - this.filters - } sourcetype=wazuh | top "data.osquery.pack" limit=5 | rename data.osquery.pack as Pack, count as Count, percent as Percent`, - 'topPacks', + this.filters + } sourcetype=wazuh | stats count by data.osquery.name, data.osquery.action,agent.name,data.osquery.pack | rename data.osquery.name as Name, data.osquery.action as Action, agent.name as Agent, data.osquery.pack as Pack, count as Count`, + 'alertsSummary', this.scope ), + new RawTableDataService( + 'alertsSummaryTable', + `${ + this.filters + } sourcetype=wazuh | stats count by data.osquery.name, data.osquery.action,agent.name,data.osquery.pack | rename data.osquery.name as Name, data.osquery.action as Action, agent.name as Agent, data.osquery.pack as Pack, count as Count`, + 'alertsSummaryTableToken', + '$result$', + this.scope, + 'Alerts summary' + ), new Table( 'topRules', `${ - this.filters + this.filters } sourcetype=wazuh | top rule.id, rule.description limit=5 | rename rule.id as "Rule ID", rule.description as "Rule description", count as Count, percent as Percent`, 'topRules', this.scope ), + new RawTableDataService( 'topRulesTable', `${ - this.filters + this.filters } sourcetype=wazuh | top rule.id, rule.description limit=5 | rename rule.id as "Rule ID", rule.description as "Rule description", count as Count, percent as Percent`, 'topRulesTableToken', '$result$', this.scope, 'Top 5 Rules' - ), - new RawTableDataService( - 'topPacksTable', - `${ - this.filters - } sourcetype=wazuh | top "data.osquery.pack" limit=5 | rename data.osquery.pack as Pack, count as Count, percent as Percent`, - 'topPacksTableToken', - '$result$', - this.scope, - 'Top 5 Packs' ) ] - - /** - * Generates report - */ - this.scope.startVis2Png = () => - this.reportingService.startVis2Png( - 'ow-osquery', - 'Osquery', - this.filters, - [ - 'alertsOverTime', - 'mostCommonEvents', - 'alertsEvolution', - 'topPacks', - 'topRules' - ], - {}, //Metrics - this.tableResults - ) - - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) - - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - } else { - this.vizz.map(v => { - if (v.constructor.name === 'RawTableData') { - this.tableResults[v.name] = v.results - } - }) - this.scope.loadingVizz = true - } - if (!this.scope.$$phase) this.scope.$digest() - }) - - /** - * On controller destroy - */ - this.scope.$on('$destroy', () => { - this.timePicker.destroy() - this.vizz.map(vizz => vizz.destroy()) - }) } /** @@ -178,8 +137,57 @@ define([ */ $onInit() { try { + this.scope.loadingVizz = true const wodles = this.osquery.data.data.wmodules this.scope.osqueryWodle = wodles.filter(item => item.osquery)[0].osquery + /** + * Generates report + */ + this.scope.startVis2Png = () => + this.reportingService.startVis2Png( + 'ow-osquery', + 'Osquery', + this.filters, + [ + 'alertsPacksOverTime', + 'topOsqueryAdded', + 'topOsqueryRemoved', + 'mostCommonPacks', + 'alertsSummary', + 'topRules' + ], + {}, //Metrics + this.tableResults + ) + + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) + + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + } else { + this.vizz.map(v => { + if (v.constructor.name === 'RawTableData') { + this.tableResults[v.name] = v.results + } + }) + this.scope.loadingVizz = true + } + if (!this.scope.$$phase) this.scope.$digest() + }) + + /** + * On controller destroy + */ + this.scope.$on('$destroy', () => { + this.timePicker.destroy() + this.vizz.map(vizz => vizz.destroy()) + }) } catch (err) { this.notification.showErrorToast( 'Cannot load wodle configuration. Osquery is not configured.' diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/pci/overview-pci.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/pci/overview-pci.html index 906be5cb6..0ba4e6e3e 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/pci/overview-pci.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/pci/overview-pci.html @@ -1,106 +1,125 @@ -
-
+
+
Overview / PCI-DSS
- - -
+ +
-
Generating report
+
{{reportStatus}}
- - PCI DSS - GDPR - + + PCI DSS + GDPR + - -
- - - -
- PCI-DSS Requirement: {{tab.title}} - -
-
{{tab.content}}
-
-
-
-
-
+ +
+
+ Fetching data...
+
-
- - - PCI Requirements - - - -
-
-
- +
+ +
+ + + +
+ PCI-DSS Requirement: {{tab.title}} + +
+
{{tab.content}}
+
+
+
+
+
+
+
+ + + PCI Requirements + + + + + +
+
+
+ Top 10 Agents by alerts number - + + +
-
+
-
- - - Top requirements over time - +
+ + + Top requirements over time + + +
-
-
-
+
+
+
-
- - - Requirements by agent - - - -
-
-
-
+
+ + + Requirements by agent + + + + + +
+
+
+
-
- - - Alerts summary - - - -
-
-
+
+ + + Alerts summary + + + + + +
+
+
+
- \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/pci/overviewPciCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/pci/overviewPciCtrl.js index fa7f66d87..5ef918f68 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/pci/overviewPciCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/pci/overviewPciCtrl.js @@ -7,7 +7,7 @@ define([ '../../../services/visualizations/inputs/time-picker', '../../../services/visualizations/inputs/dropdown-input', '../../../services/rawTableData/rawTableDataService' -], function( +], function ( app, LinearChart, ColumnChart, @@ -17,201 +17,208 @@ define([ Dropdown, RawTableDataService ) { - 'use strict' + 'use strict' - class PCI { - /** - * Class PCI-DSS - * @param {*} $urlTokenModel - * @param {*} $scope - * @param {*} $currentDataService - * @param {*} $state - * @param {*} $reportingService - */ - constructor( - $urlTokenModel, - $scope, - $currentDataService, - $state, - $reportingService, - pciTabs, - reportingEnabled, - gdprExtensionEnabled - ) { - this.scope = $scope - this.scope.reportingEnabled = reportingEnabled - this.scope.gdprExtensionEnabled = gdprExtensionEnabled - this.state = $state - this.scope.pciTabs = pciTabs ? pciTabs : false - this.reportingService = $reportingService - this.tableResults = {} - this.getFilters = $currentDataService.getSerializedFilters - this.filters = this.getFilters() - this.submittedTokenModel = $urlTokenModel.getSubmittedTokenModel() + class PCI { + /** + * Class PCI-DSS + * @param {*} $urlTokenModel + * @param {*} $scope + * @param {*} $currentDataService + * @param {*} $state + * @param {*} $reportingService + */ + constructor( + $urlTokenModel, + $scope, + $currentDataService, + $state, + $reportingService, + pciTabs, + reportingEnabled, + gdprExtensionEnabled + ) { + this.scope = $scope + this.scope.reportingEnabled = reportingEnabled + this.scope.gdprExtensionEnabled = gdprExtensionEnabled + this.state = $state + this.scope.pciTabs = pciTabs ? pciTabs : false + this.reportingService = $reportingService + this.tableResults = {} + this.getFilters = $currentDataService.getSerializedFilters + this.filters = this.getFilters() + this.submittedTokenModel = $urlTokenModel.getSubmittedTokenModel() - this.scope.$on('deletedFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + this.scope.$on('deletedFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.scope.$on('barFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + this.scope.$on('barFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.scope.$on('$destroy', () => { - this.dropdown.destroy() - this.timePicker.destroy() - this.vizz.map(vizz => vizz.destroy()) - }) - this.timePicker = new TimePicker( - '#timePicker', - $urlTokenModel.handleValueChange - ) + this.scope.$on('$destroy', () => { + this.dropdown.destroy() + this.timePicker.destroy() + this.vizz.map(vizz => vizz.destroy()) + }) + this.timePicker = new TimePicker( + '#timePicker', + $urlTokenModel.handleValueChange + ) - this.scope.expandArray = [false, false, false, false, false] - this.scope.expand = (i, id) => this.expand(i, id) + this.scope.expandArray = [false, false, false, false, false] + this.scope.expand = (i, id) => this.expand(i, id) - this.dropdown = new Dropdown( - 'dropDownInput', - `${ - this.filters - } sourcetype=wazuh rule.pci_dss{}="*"| stats count by "rule.pci_dss{}" | sort "rule.pci_dss{}" ASC | fields - count`, - 'rule.pci_dss{}', - '$form.pci$', - 'dropDownInput', - this.scope - ) - this.dropdownInstance = this.dropdown.getElement() - this.vizz = [ - new ColumnChart( - 'pciReqVizz', + this.dropdown = new Dropdown( + 'dropDownInput', `${ - this.filters - } sourcetype=wazuh rule.pci_dss{}="$pci$" | stats count by rule.pci_dss{}`, - 'pciReqVizz', + this.filters + } sourcetype=wazuh rule.pci_dss{}="*"| stats count by "rule.pci_dss{}" | sort "rule.pci_dss{}" ASC | fields - count`, + 'rule.pci_dss{}', + '$form.pci$', + 'dropDownInput', this.scope - ), - new LinearChart( - 'evoVizz', - `${ + ) + this.dropdownInstance = this.dropdown.getElement() + + this.dropdownInstance.on('change', newValue => { + if (newValue && this.dropdownInstance) + $urlTokenModel.handleValueChange(this.dropdownInstance) + }) + + this.vizz = [ + new ColumnChart( + 'pciReqVizz', + `${ this.filters - } sourcetype=wazuh rule.pci_dss{}="*" | timechart count by rule.pci_dss{}`, - 'evoVizz', - this.scope - ), - new PieChart( - 'agentsVizz', - `${ + } sourcetype=wazuh rule.pci_dss{}="$pci$" | stats count by rule.pci_dss{}`, + 'pciReqVizz', + this.scope + ), + new LinearChart( + 'evoVizz', + `${ this.filters - } sourcetype=wazuh rule.pci_dss{}="$pci$" | stats count by agent.name`, - 'agentsVizz', - this.scope - ), - new ColumnChart( - 'requirementsByAgentVizz', - `${ + } sourcetype=wazuh rule.pci_dss{}="*" | timechart count by rule.pci_dss{}`, + 'evoVizz', + this.scope + ), + new PieChart( + 'agentsVizz', + `${ this.filters - } sourcetype=wazuh rule.pci_dss{}="$pci$" agent.name=*| chart count(rule.pci_dss{}) by rule.pci_dss{},agent.name`, - 'requirementsByAgentVizz', - this.scope - ), - new Table( - 'alertsSummaryViz', - `${ + } sourcetype=wazuh rule.pci_dss{}="$pci$" | stats count by agent.name`, + 'agentsVizz', + this.scope + ), + new ColumnChart( + 'requirementsByAgentVizz', + `${ this.filters - } sourcetype=wazuh rule.pci_dss{}="$pci$" | stats count sparkline by agent.name, rule.pci_dss{}, rule.description | sort count DESC | rename agent.name as "Agent Name", rule.pci_dss{} as Requirement, rule.description as "Rule description", count as Count`, - 'alertsSummaryViz', - this.scope - ), - new RawTableDataService( - 'alertsSummaryTable', - `${ + } sourcetype=wazuh rule.pci_dss{}="$pci$" agent.name=*| chart count(rule.pci_dss{}) by rule.pci_dss{},agent.name`, + 'requirementsByAgentVizz', + this.scope + ), + new Table( + 'alertsSummaryViz', + `${ this.filters - } sourcetype=wazuh rule.pci_dss{}="$pci$" | stats count sparkline by agent.name, rule.pci_dss{}, rule.description | sort count DESC | rename agent.name as "Agent Name", rule.pci_dss{} as Requirement, rule.description as "Rule description", count as Count`, - 'alertsSummaryTableToken', - '$result$', - this.scope, - 'Alerts Summary' - ) - ] + } sourcetype=wazuh rule.pci_dss{}="$pci$" | stats count sparkline by agent.name, rule.pci_dss{}, rule.description | sort count DESC | rename agent.name as "Agent Name", rule.pci_dss{} as Requirement, rule.description as "Rule description", count as Count`, + 'alertsSummaryViz', + this.scope + ), + new RawTableDataService( + 'alertsSummaryTable', + `${ + this.filters + } sourcetype=wazuh rule.pci_dss{}="$pci$" | stats count sparkline by agent.name, rule.pci_dss{}, rule.description | sort count DESC | rename agent.name as "Agent Name", rule.pci_dss{} as Requirement, rule.description as "Rule description", count as Count`, + 'alertsSummaryTableToken', + '$result$', + this.scope, + 'Alerts Summary' + ) + ] + } - /** - * Generates report - */ - this.scope.startVis2Png = () => - this.reportingService.startVis2Png( - 'overview-pci', - 'PCI DSS', - this.filters, - [ - 'pciReqVizz', - 'groupsVizz', - 'agentsVizz', - 'requirementsByAgentVizz', - 'alertsSummaryViz' - ], - {}, //Metrics - this.tableResults - ) + $onInit() { + try { + this.scope.loadingVizz = true + /** + * Generates report + */ + this.scope.startVis2Png = () => + this.reportingService.startVis2Png( + 'overview-pci', + 'PCI DSS', + this.filters, + [ + 'pciReqVizz', + 'groupsVizz', + 'agentsVizz', + 'requirementsByAgentVizz', + 'alertsSummaryViz' + ], + {}, //Metrics + this.tableResults + ) - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - } else { - this.vizz.map(v => { - if (v.constructor.name === 'RawTableData') { - this.tableResults[v.name] = v.results + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + } else { + this.vizz.map(v => { + if (v.constructor.name === 'RawTableData') { + this.tableResults[v.name] = v.results + } + }) + this.scope.loadingVizz = true } + if (!this.scope.$$phase) this.scope.$digest() }) - this.scope.loadingVizz = true - } - if (!this.scope.$$phase) this.scope.$digest() - }) - this.dropdownInstance.on('change', newValue => { - if (newValue && this.dropdownInstance) - $urlTokenModel.handleValueChange(this.dropdownInstance) - }) - } + } catch (error) {} + } - expand(i, id) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - let vis = $( - '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' - ) - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') + expand(i, id) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + let vis = $( + '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' + ) + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') - let vis_header = $('.wz-headline-title') - vis_header.dblclick(e => { - if (this.scope.expandArray[i]) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') - this.scope.$applyAsync() - } else { - e.preventDefault() - } - }) - } + let vis_header = $('.wz-headline-title') + vis_header.dblclick(e => { + if (this.scope.expandArray[i]) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') + this.scope.$applyAsync() + } else { + e.preventDefault() + } + }) + } - /** - * Get filters and launches the search - */ - launchSearches() { - this.filters = this.getFilters() - this.state.reload() + /** + * Get filters and launches the search + */ + launchSearches() { + this.filters = this.getFilters() + this.state.reload() + } } - } - app.controller('overviewPciCtrl', PCI) -}) + app.controller('overviewPciCtrl', PCI) + }) diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/policy-monitoring/overview-pm.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/policy-monitoring/overview-pm.html index 08b356b77..38f44f993 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/policy-monitoring/overview-pm.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/policy-monitoring/overview-pm.html @@ -1,93 +1,113 @@ -
-
+
+
Overview / Policy monitoring
- - -
-
+
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - + Policy monitoring - System auditing - OpenSCAP - CIS-CAT + SCA + System auditing + OpenSCAP + CIS-CAT +
+
+ Fetching data...
+
+
+
+
+ + + Events over time + + + + + +
+
+
-
- - - Events over time - - - -
-
-
- - - - Top 5 CIS Requirements - - - -
-
-
+ + + Top 5 CIS Requirements + + + + + +
+
+
- - - Top 5 PCI DSS Requirements - - - -
-
-
-
+ + + Top 5 PCI DSS Requirements + + + + + +
+
+
+
-
- - - Events per agent evolution - - - -
-
-
-
+
+ + + Events per agent evolution + + + + + +
+
+
+
-
- - - Alerts summary - - - -
-
-
+
+ + + Alerts summary + + + + + +
+
+
+
- \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/policy-monitoring/overviewPolicyMonitoringCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/policy-monitoring/overviewPolicyMonitoringCtrl.js index 216c51716..da77769ca 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/policy-monitoring/overviewPolicyMonitoringCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/policy-monitoring/overviewPolicyMonitoringCtrl.js @@ -41,7 +41,6 @@ define([ '#timePicker', this.urlTokenModel.handleValueChange ) - console.log('ext ', this.scope.extensions) this.scope.expandArray = [false, false, false, false, false] this.scope.expand = (i, id) => this.expand(i, id) @@ -98,63 +97,68 @@ define([ 'Alerts Summary' ) ] + } - this.scope.$on('deletedFilter', event => { - event.stopPropagation() - this.launchSearches() - }) - - this.scope.$on('barFilter', event => { - event.stopPropagation() - this.launchSearches() - }) - /** - * On controller destroy - */ - this.scope.$on('$destroy', () => { - this.timePicker.destroy() - this.vizz.map(vizz => vizz.destroy()) - }) - - /** - * Generates report - */ - this.scope.startVis2Png = () => - this.reportingService.startVis2Png( - 'overview-pm', - 'Policity monitoring', - this.filters, - [ - 'elementOverTime', - 'cisRequirements', - 'topPciDss', - 'eventsPerAgent', - 'alertsSummary' - ], - {}, //Metrics - this.tableResults - ) - - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) - - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - } else { - this.vizz.map(v => { - if (v.constructor.name === 'RawTableData') { - this.tableResults[v.name] = v.results - } - }) - this.scope.loadingVizz = true - } - if (!this.scope.$$phase) this.scope.$digest() - }) + $onInit() { + try { + this.scope.loadingVizz = true + this.scope.$on('deletedFilter', event => { + event.stopPropagation() + this.launchSearches() + }) + + this.scope.$on('barFilter', event => { + event.stopPropagation() + this.launchSearches() + }) + /** + * On controller destroy + */ + this.scope.$on('$destroy', () => { + this.timePicker.destroy() + this.vizz.map(vizz => vizz.destroy()) + }) + + /** + * Generates report + */ + this.scope.startVis2Png = () => + this.reportingService.startVis2Png( + 'overview-pm', + 'Policity monitoring', + this.filters, + [ + 'elementOverTime', + 'cisRequirements', + 'topPciDss', + 'eventsPerAgent', + 'alertsSummary' + ], + {}, //Metrics + this.tableResults + ) + + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) + + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + } else { + this.vizz.map(v => { + if (v.constructor.name === 'RawTableData') { + this.tableResults[v.name] = v.results + } + }) + this.scope.loadingVizz = true + } + if (!this.scope.$$phase) this.scope.$digest() + }) + } catch (error) {} } /** diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/sca/overview-sca.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/sca/overview-sca.html new file mode 100644 index 000000000..14b5cdbce --- /dev/null +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/sca/overview-sca.html @@ -0,0 +1,146 @@ + + +
+
+ Overview + / Security Configuration Assessment +
+
+ +
+ + + +
+
+
+ + +
{{reportStatus}}
+ + + + + Policy monitoring + + SCA + System auditing + OpenSCAP + CIS-CAT + + + + + +
+
+ Fetching data...
+
+
+
+ +
+ + + +
+ + + Overall Score + + + +
+
+
+ + + + + Score by policy + + + +
+
+
+
+ + +
+ + + Results distribution + + + +
+
+
+ + + Top 5 passed checks + + + +
+
+
+ + + Top 5 failed checks + + + +
+
+
+ +
+ + + + +
+ + + Result distribution by policy + + + +
+
+
+
+ + +
+ + + Alerts summary + + + +
+
+
+
+
+ \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/sca/overviewSCACtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/sca/overviewSCACtrl.js new file mode 100644 index 000000000..f960b0604 --- /dev/null +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/sca/overviewSCACtrl.js @@ -0,0 +1,332 @@ +/* + * Wazuh app - Overview SCA controller + * Copyright (C) 2015-2019 Wazuh, Inc. + * + * This program is free software you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation either version 2 of the License, or + * (at your option) any later version. + * + * Find more information about this on the LICENSE file. + */ + +define([ + '../../module', + '../../../services/visualizations/chart/column-chart', + '../../../services/visualizations/chart/single-value', + '../../../services/visualizations/chart/gauge-chart', + '../../../services/visualizations/chart/pie-chart', + '../../../services/visualizations/chart/area-chart', + '../../../services/visualizations/table/table', + '../../../services/visualizations/inputs/time-picker', +], function( + app, + ColumnChart, + SingleValue, + GaugeChart, + PieChart, + AreaChart, + Table, + TimePicker, +) { + 'use strict' + + class overviewSCA { + /** + * Class Overview SCA + * @param {Object} $urlTokenModel + * @param {Object} $scope + * @param {Object} $state + * @param {Object} $currentDataService + * @param {*} $reportingService + * @param {*} $requestService + * @param {*} $notificationService + * @param {*} $csvRequestService + */ + + constructor( + $urlTokenModel, + $rootScope, + $scope, + $state, + $currentDataService, + $reportingService, + $requestService, + $notificationService, + $csvRequestService, + $tableFilterService, + reportingEnabled, + BASE_URL, + extensions + ) { + this.urlTokenModel = $urlTokenModel + this.rootScope = $rootScope + this.scope = $scope + this.scope.reportingEnabled = reportingEnabled + this.scope.extensions = extensions + this.apiReq = $requestService.apiReq + this.state = $state + this.reportingService = $reportingService + this.tableResults = {} + this.currentDataService = $currentDataService + this.notification = $notificationService + this.api = $currentDataService.getApi() + this.csvReq = $csvRequestService + this.wzTableFilter = $tableFilterService + this.baseUrl = BASE_URL + this.scope.noScansPng = `${ + this.baseUrl + }/static/app/SplunkAppForWazuh/css/images/sca_no_scans.png` + this.currentDataService.addFilter( + `{"rule.groups{}":"sca", "implicit":true}` + ) + this.scope.expandArray = [false, false, false, false, false,false,false] + this.scope.expand = (i, id) => this.expand(i, id) + + + this.filters = this.currentDataService.getSerializedFilters() + this.timePicker = new TimePicker( + '#timePicker', + this.urlTokenModel.handleValueChange + ) + + this.scope.$on('deletedFilter', (event) => { + event.stopPropagation() + this.launchSearches() + }) + + this.scope.$on('barFilter', (event) => { + event.stopPropagation() + this.launchSearches() + }) + + this.vizz = [ + /** + * Visualizations + */ + new SingleValue( + 'overallScore', + `${ + this.filters + } | stats sum(data.sca.failed) as failed, sum(data.sca.passed) as passed | eval total=((passed/(failed+passed))*100) | eval total2=round(total,1) | eval total3=(total2 + "%") | table total3 `, + 'overallScore', + this.scope + ), + new GaugeChart( + 'scoreByPolicy', + `${ + this.filters + } | stats values(data.sca.score) by data.sca.policy_id `, + 'scoreByPolicy', + { trellisEnabled : true, + gaugeType : 'radialGauge'}, + this.scope + ), + new PieChart( + 'resultDistribution', + `${ + this.filters + } | stats count by data.sca.check.result `, + 'resultDistribution', + this.scope + ), + new ColumnChart( + 'resultDistributionByPolicy', + `${ + this.filters + } | stats sum(data.sca.failed) as failed, sum(data.sca.passed) as passed by data.sca.policy`, + 'resultDistributionByPolicy', + this.scope + ), + new PieChart( + 'top5Passed', + `${ + this.filters + } data.sca.check.result="passed" | top limit=5 data.sca.check.title`, + 'top5Passed', + this.scope + ), + new PieChart( + 'top5Failed', + `${ + this.filters + } data.sca.check.result="failed" | top limit=5 data.sca.check.title`, + 'top5Failed', + this.scope + ), + new AreaChart( + 'alertLevelEvolution', + `${ + this.filters + } | timechart span=1h count by rule.level`, + 'alertLevelEvolution', + this.scope + ), + new Table( + 'alertsSummary', + `${ + this.filters + } | stats count by data.sca.policy,data.sca.passed,data.sca.failed | fields - count`, + 'alertsSummary', + this.scope + ) + ] + /** + * Generates report + */ + this.scope.startVis2Png = () => + this.reportingService.startVis2Png( + 'overview-sca', + 'Configuration assessment', + this.filters, + [ + 'overallScore', + 'scoreByPolicy', + 'resultDistribution', + 'alertsOverTime', + 'resultDistributionByPolicy', + 'top5Failed', + 'top5Passed', + 'alertsSummary' + ], + {}, //Metrics, + this.tableResults, + this.agentReportData + ) + + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) + + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + } else { + this.vizz.map(v => { + if (v.constructor.name === 'RawTableData') { + this.tableResults[v.name] = v.results + } + }) + this.scope.loadingVizz = true + } + if (!this.scope.$$phase) this.scope.$digest() + }) + + /** + * When controller is destroyed + */ + this.scope.$on('$destroy', () => { + this.timePicker.destroy() + this.vizz.map(vizz => vizz.destroy()) + }) + } + + $onInit() { + this.scope.loadingVizz = true + this.scope.searchRootcheck = (term, specificFilter) => + this.scope.$broadcast('wazuhSearch', { term, specificFilter }) + this.scope.downloadCsv = () => this.downloadCsv() + + this.scope.switchVisualizations = () => this.switchVisualizations() + this.scope.loadPolicyChecks = (id, name) => + this.loadPolicyChecks(id, name) + this.scope.backToConfAssess = () => this.backToConfAssess() + + this.scope.agent = + this.agent && this.agent.data && this.agent.data.data + ? this.agent.data.data + : { error: true } + this.scope.getAgentStatusClass = agentStatus => + this.getAgentStatusClass(agentStatus) + this.scope.formatAgentStatus = agentStatus => + this.formatAgentStatus(agentStatus) + } + + /** + * Returns a class depending of the agent state + * @param {String} agentStatus + */ + getAgentStatusClass(agentStatus) { + return agentStatus === 'Active' ? 'teal' : 'red' + } + + /** + * Checks and returns agent status + * @param {Array} agentStatus + */ + formatAgentStatus(agentStatus) { + return ['Active', 'Disconnected'].includes(agentStatus) + ? agentStatus + : 'Never connected' + } + + /** + * Exports the table in CSV format + */ + async downloadCsv() { + try { + this.notification.showSimpleToast( + 'Your download should begin automatically...' + ) + const currentApi = this.api.id + const output = await this.csvReq.fetch( + '/agents', + currentApi, + this.wzTableFilter.get() + ) + const blob = new Blob([output], { type: 'text/csv' }) // eslint-disable-line + saveAs(blob, 'agents.csv') // eslint-disable-line + return + } catch (error) { + this.notification.showErrorToast('Error downloading CSV') + } + return + } + + /** + * Gets filters and launches search + */ + launchSearches() { + this.filters = this.currentDataService.getSerializedFilters() + this.state.reload() + } + + /** + * Loads policies checks + */ + async loadPolicyChecks(id, name) { + this.scope.showPolicyChecks = name + this.scope.policyId = id + const agentId = this.agent.data.data.id + this.scope.wzTablePath = `/sca/${agentId}/checks/${id}` + } + + expand(i, id) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + let vis = $( + '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' + ) + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') + + let vis_header = $('.wz-headline-title') + vis_header.dblclick(e => { + if (this.scope.expandArray[i]) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') + this.scope.$applyAsync() + } else { + e.preventDefault() + } + }) + } + + } + app.controller('overviewSCACtrl', overviewSCA) +}) diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/scap/overview-openscap.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/scap/overview-openscap.html index 05db296b1..a251dd608 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/scap/overview-openscap.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/scap/overview-openscap.html @@ -1,137 +1,165 @@ -
-
+
+
Overview / OpenSCAP
- - -
+ +
-
Generating report
+
{{reportStatus}}
- - Policy monitoring - System auditing + + Policy monitoring + + SCA + System auditing OpenSCAP - CIS-CAT + CIS-CAT -
- - -
Last score: - -
-
Highest score: - -
-
Lowest score: - -
-
-
-
-
- - - Agents - - - -
-
-
- - - Profiles - - - -
-
-
- - - Content - - - -
-
-
- - - Severity - - - -
-
-
+
+
+ Fetching data...
+
+
+
+ + +
Last score: + +
+
Highest score: + +
+
Lowest score: + +
+
+
+
-
- - - Top 5 Agents - Severity high - - - -
-
-
-
+
+ + + Agents + + + + + +
+
+
+ + + Profiles + + + + + +
+
+
+ + + Content + + + + + +
+
+
+ + + Severity + + + + + +
+
+
+
-
- - - Top 10 - Alerts - - - -
-
-
+
+ + + Top 5 Agents - Severity high + + + + + +
+
+
+
- - - Top 10 - High risk alerts - - - -
-
-
-
+
+ + + Top 10 - Alerts + + + + + +
+
+
-
- - - Alerts summary - - - -
-
-
-
+ + + Top 10 - High risk alerts + + + + + +
+
+
+
+
+ + + Alerts summary + + + + + +
+
+
+
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/scap/overviewOpenScapCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/scap/overviewOpenScapCtrl.js index f0f9864e5..c743a632d 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/scap/overviewOpenScapCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/scap/overviewOpenScapCtrl.js @@ -9,7 +9,7 @@ define([ '../../../services/visualizations/inputs/dropdown-input', '../../../services/visualizations/search/search-handler', '../../../services/rawTableData/rawTableDataService' -], function( +], function ( app, LinearChart, ColumnChart, @@ -21,284 +21,291 @@ define([ SearchHandler, RawTableDataService ) { - 'use strict' + 'use strict' - class OpenSCAP { - /** - * OpenSCAP class - * @param {*} $urlTokenModel - * @param {*} $scope - * @param {*} $currentDataService - * @param {*} $state - */ - constructor( - $urlTokenModel, - $scope, - $currentDataService, - $state, - $reportingService, - reportingEnabled, - extensions - ) { - this.scope = $scope - this.scope.reportingEnabled = reportingEnabled - this.state = $state - this.reportingService = $reportingService - this.scope.extensions = extensions - this.tableResults = {} - this.currentDataService = $currentDataService - this.currentDataService.addFilter( - `{"rule.groups{}":"oscap", "implicit":true}` - ) - this.getFilters = this.currentDataService.getSerializedFilters - this.filters = this.getFilters() - this.submittedTokenModel = $urlTokenModel.getSubmittedTokenModel() - this.scope.$on('deletedFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + class OpenSCAP { + /** + * OpenSCAP class + * @param {*} $urlTokenModel + * @param {*} $scope + * @param {*} $currentDataService + * @param {*} $state + */ + constructor( + $urlTokenModel, + $scope, + $currentDataService, + $state, + $reportingService, + reportingEnabled, + extensions + ) { + this.scope = $scope + this.scope.reportingEnabled = reportingEnabled + this.state = $state + this.reportingService = $reportingService + this.scope.extensions = extensions + this.tableResults = {} + this.currentDataService = $currentDataService + this.currentDataService.addFilter( + `{"rule.groups{}":"oscap", "implicit":true}` + ) + this.getFilters = this.currentDataService.getSerializedFilters + this.filters = this.getFilters() + this.submittedTokenModel = $urlTokenModel.getSubmittedTokenModel() + this.scope.$on('deletedFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.scope.$on('barFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + this.scope.$on('barFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.scope.expandArray = [ - false, - false, - false, - false, - false, - false, - false, - false - ] - this.scope.expand = (i, id) => this.expand(i, id) + this.scope.expandArray = [ + false, + false, + false, + false, + false, + false, + false, + false + ] + this.scope.expand = (i, id) => this.expand(i, id) - this.scope.$on('$destroy', () => { - this.timePicker.destroy() - this.dropdown.destroy() - this.vizz.map(vizz => vizz.destroy()) - }) - this.timePicker = new TimePicker( - '#timePicker', - $urlTokenModel.handleValueChange - ) - this.dropdown = new Dropdown( - 'dropDownInput', - `${ - this.filters - } sourcetype=wazuh rule.groups{}="oscap" rule.groups{}!="syslog" oscap.scan.profile.title=* | stats count by oscap.scan.profile.title | sort oscap.scan.profile.title ASC|fields - count`, - 'oscap.scan.profile.title', - '$form.profile$', - 'dropDownInput', - this.scope - ) - this.vizz = [ - /** - * Metrics - */ - new SearchHandler( - `lastScapScore`, - `${ - this.filters - } sourcetype=wazuh oscap.scan.score=* | stats latest(oscap.scan.score)`, - `latestScapScore`, - '$result.latest(oscap.scan.score)$', - 'scapLastScore', - this.submittedTokenModel, - this.scope - ), - new SearchHandler( - `maxScapScore`, - `${ - this.filters - } sourcetype=wazuh oscap.scan.score=* | stats max(oscap.scan.score)`, - `maxScapScore`, - '$result.max(oscap.scan.score)$', - 'scapHighestScore', - this.submittedTokenModel, - this.scope - ), - new SearchHandler( - `scapLowest`, + this.scope.$on('$destroy', () => { + this.timePicker.destroy() + this.dropdown.destroy() + this.vizz.map(vizz => vizz.destroy()) + }) + this.timePicker = new TimePicker( + '#timePicker', + $urlTokenModel.handleValueChange + ) + this.dropdown = new Dropdown( + 'dropDownInput', `${ - this.filters - } sourcetype=wazuh oscap.scan.score=* | stats min(oscap.scan.score)`, - `minScapScore`, - '$result.min(oscap.scan.score)$', - 'scapLowestScore', - this.submittedTokenModel, + this.filters + } sourcetype=wazuh rule.groups{}="oscap" rule.groups{}!="syslog" oscap.scan.profile.title=* | stats count by oscap.scan.profile.title | sort oscap.scan.profile.title ASC|fields - count`, + 'oscap.scan.profile.title', + '$form.profile$', + 'dropDownInput', this.scope - ), + ) - /** - * Visualizations - */ - new PieChart( - 'agentsVizz', - `${ + this.dropdownInstance = this.dropdown.getElement() + this.dropdownInstance.on('change', newValue => { + if (newValue && this.dropdownInstance) + $urlTokenModel.handleValueChange(this.dropdownInstance) + }) + + this.vizz = [ + /** + * Metrics + */ + new SearchHandler( + `lastScapScore`, + `${ this.filters - } sourcetype=wazuh oscap.check.result="fail" rule.groups{}="oscap" rule.groups{}!="syslog" oscap.scan.profile.title="$profile$" | top agent.name`, - 'agentsVizz', - this.scope - ), - new LinearChart( - 'profilesVizz', - `${ + } sourcetype=wazuh oscap.scan.score=* | stats latest(oscap.scan.score)`, + `latestScapScore`, + '$result.latest(oscap.scan.score)$', + 'scapLastScore', + this.submittedTokenModel, + this.scope + ), + new SearchHandler( + `maxScapScore`, + `${ this.filters - } sourcetype=wazuh rule.level=*| timechart count by rule.level`, - 'profilesVizz', - this.scope - ), - new ColumnChart( - 'contentVizz', - `${this.filters} sourcetype=wazuh | timechart span=2h count`, - 'contentVizz', - this.scope - ), - new PieChart( - 'severityVizz', - `${this.filters} sourcetype=wazuh | top agent.name`, - 'severityVizz', - this.scope - ), - new AreaChart( - 'top5AgentsVizz', - `${ - this.filters - } sourcetype=wazuh | timechart span=1h limit=5 useother=f count by agent.name`, - 'top5AgentsVizz', - this.scope - ), - new PieChart( - 'top10AlertsVizz', - `${ - this.filters - } sourcetype=wazuh oscap.check.result="fail" rule.groups{}="oscap" rule.groups{}="oscap-result" oscap.scan.profile.title="$profile$" | top oscap.check.title`, - 'top10AlertsVizz', - this.scope - ), - new PieChart( - 'top10HRisk', - `${ + } sourcetype=wazuh oscap.scan.score=* | stats max(oscap.scan.score)`, + `maxScapScore`, + '$result.max(oscap.scan.score)$', + 'scapHighestScore', + this.submittedTokenModel, + this.scope + ), + new SearchHandler( + `scapLowest`, + `${ this.filters - } sourcetype=wazuh oscap.check.result="fail" rule.groups{}="oscap" rule.groups{}="oscap-result" oscap.check.severity="high" oscap.scan.profile.title="$profile$" | top oscap.check.title`, - 'top10HRisk', - this.scope - ), - new Table( - 'alertsSummaryVizz', - `${ - this.filters - } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort rule.level DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, - 'alertsSummaryVizz', - this.scope - ), - new RawTableDataService( - 'alertsSummaryTable', - `${ - this.filters - } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort rule.level DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, - 'alertsSummaryTableToken', - '$result$', - this.scope, - 'Alerts Summary' - ) - ] + } sourcetype=wazuh oscap.scan.score=* | stats min(oscap.scan.score)`, + `minScapScore`, + '$result.min(oscap.scan.score)$', + 'scapLowestScore', + this.submittedTokenModel, + this.scope + ), - /** - * Generates report - */ - this.scope.startVis2Png = () => - this.reportingService.startVis2Png( - 'overview-oscap', - 'Open SCAP', - this.filters, - [ + /** + * Visualizations + */ + new PieChart( + 'agentsVizz', + `${ + this.filters + } sourcetype=wazuh oscap.check.result="fail" rule.groups{}="oscap" rule.groups{}!="syslog" oscap.scan.profile.title="$profile$" | top agent.name`, 'agentsVizz', + this.scope + ), + new LinearChart( + 'profilesVizz', + `${ + this.filters + } sourcetype=wazuh rule.level=*| timechart count by rule.level`, 'profilesVizz', + this.scope + ), + new ColumnChart( 'contentVizz', + `${this.filters} sourcetype=wazuh | timechart span=2h count`, + 'contentVizz', + this.scope + ), + new PieChart( + 'severityVizz', + `${this.filters} sourcetype=wazuh | top agent.name`, 'severityVizz', + this.scope + ), + new AreaChart( + 'top5AgentsVizz', + `${ + this.filters + } sourcetype=wazuh | timechart span=1h limit=5 useother=f count by agent.name`, 'top5AgentsVizz', + this.scope + ), + new PieChart( 'top10AlertsVizz', + `${ + this.filters + } sourcetype=wazuh oscap.check.result="fail" rule.groups{}="oscap" rule.groups{}="oscap-result" oscap.scan.profile.title="$profile$" | top oscap.check.title`, + 'top10AlertsVizz', + this.scope + ), + new PieChart( 'top10HRisk', - 'alertsSummaryVizz' - ], - this.reportMetrics, - this.tableResults - ) + `${ + this.filters + } sourcetype=wazuh oscap.check.result="fail" rule.groups{}="oscap" rule.groups{}="oscap-result" oscap.check.severity="high" oscap.scan.profile.title="$profile$" | top oscap.check.title`, + 'top10HRisk', + this.scope + ), + new Table( + 'alertsSummaryVizz', + `${ + this.filters + } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort count DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, + 'alertsSummaryVizz', + this.scope + ), + new RawTableDataService( + 'alertsSummaryTable', + `${ + this.filters + } sourcetype=wazuh |stats count sparkline by rule.id, rule.description, rule.level | sort count DESC | rename rule.id as "Rule ID", rule.description as "Description", rule.level as Level, count as Count`, + 'alertsSummaryTableToken', + '$result$', + this.scope, + 'Alerts Summary' + ) + ] + } + + $onInit() { + try { + this.scope.loadingVizz = true + /** + * Generates report + */ + this.scope.startVis2Png = () => + this.reportingService.startVis2Png( + 'overview-oscap', + 'Open SCAP', + this.filters, + [ + 'agentsVizz', + 'profilesVizz', + 'contentVizz', + 'severityVizz', + 'top5AgentsVizz', + 'top10AlertsVizz', + 'top10HRisk', + 'alertsSummaryVizz' + ], + this.reportMetrics, + this.tableResults + ) - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - this.setReportMetrics() - } else { - this.vizz.map(v => { - if (v.constructor.name === 'RawTableData') { - this.tableResults[v.name] = v.results + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + this.setReportMetrics() + } else { + this.vizz.map(v => { + if (v.constructor.name === 'RawTableData') { + this.tableResults[v.name] = v.results + } + }) + this.scope.loadingVizz = true } + if (!this.scope.$$phase) this.scope.$digest() }) - this.scope.loadingVizz = true - } - if (!this.scope.$$phase) this.scope.$digest() - }) - this.dropdownInstance = this.dropdown.getElement() - this.dropdownInstance.on('change', newValue => { - if (newValue && this.dropdownInstance) - $urlTokenModel.handleValueChange(this.dropdownInstance) - }) - } + } catch (error) { } + } - /** - * Set report metrics - */ - setReportMetrics() { - this.reportMetrics = { - 'Last score': this.scope.scapLastScore, - 'Highest score': this.scope.scapHighestScore, - 'Lowest score': this.scope.scapLowestScore + /** + * Set report metrics + */ + setReportMetrics() { + this.reportMetrics = { + 'Last score': this.scope.scapLastScore, + 'Highest score': this.scope.scapHighestScore, + 'Lowest score': this.scope.scapLowestScore + } } - } - /** - * Get filters and launches the search - */ - launchSearches() { - this.filters = this.getFilters() - this.state.reload() - } + /** + * Get filters and launches the search + */ + launchSearches() { + this.filters = this.getFilters() + this.state.reload() + } - expand(i, id) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - let vis = $( - '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' - ) - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') + expand(i, id) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + let vis = $( + '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' + ) + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') - let vis_header = $('.wz-headline-title') - vis_header.dblclick(e => { - if (this.scope.expandArray[i]) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') - this.scope.$applyAsync() - } else { - e.preventDefault() - } - }) + let vis_header = $('.wz-headline-title') + vis_header.dblclick(e => { + if (this.scope.expandArray[i]) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') + this.scope.$applyAsync() + } else { + e.preventDefault() + } + }) + } } - } - app.controller('overviewOpenScapCtrl', OpenSCAP) -}) + app.controller('overviewOpenScapCtrl', OpenSCAP) + }) diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/virustotal/overview-virustotal.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/virustotal/overview-virustotal.html index a9165ca69..a8da484f6 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/virustotal/overview-virustotal.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/virustotal/overview-virustotal.html @@ -1,89 +1,110 @@ -
-
+
+
Overview / VirusTotal
- - -
-
+
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - - Vulnerabilities - Osquery - VirusTotal - Docker listener - - + + + Vulnerabilities + Osquery + VirusTotal + Docker listener + + - -
- - - Top 5 agents with engines detected - - - -
-
-
- - - Events summary - - - -
-
-
-
- -
- - - Top 5 agents with no positives found - - - -
-
-
- - - Alerts per agent - - - -
-
-
+
+
+ Fetching data...
+
- -
- - - Top 5 rules - - - -
-
-
+
+ +
+ + + Top 5 agents with engines detected + + + + + +
+
+
+ + + Events summary + + + + + +
+
+
+
+ +
+ + + Top 5 agents with no positives found + + + + + +
+
+
+ + + Alerts per agent + + + + + +
+
+
+
+ +
+ + + Top 5 rules + + + + + +
+
+
+
\ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/virustotal/overviewVirusTotalCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/virustotal/overviewVirusTotalCtrl.js index 9a6e74353..9ee93ac2c 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/virustotal/overviewVirusTotalCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/virustotal/overviewVirusTotalCtrl.js @@ -104,64 +104,69 @@ define([ 'Top 5 Rules' ) ] + } + $onInit() { + try { + this.scope.loadingVizz = true /** * Generates report */ this.scope.startVis2Png = () => - this.reportingService.startVis2Png( - 'overview-virustotal', - 'VirusTotal', - this.filters, - [ - 'top5AgentsPositive', - 'eventsSummary', - 'top5AgentsNoPositive', - 'alertsPerAgent', - 'top5Rules' - ], - {}, //Metrics - this.tableResults - ) + this.reportingService.startVis2Png( + 'overview-virustotal', + 'VirusTotal', + this.filters, + [ + 'top5AgentsPositive', + 'eventsSummary', + 'top5AgentsNoPositive', + 'alertsPerAgent', + 'top5Rules' + ], + {}, //Metrics + this.tableResults + ) - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - } else { - this.vizz.map(v => { - if (v.constructor.name === 'RawTableData') { - this.tableResults[v.name] = v.results - } - }) - this.scope.loadingVizz = true - } - if (!this.scope.$$phase) this.scope.$digest() - }) + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + } else { + this.vizz.map(v => { + if (v.constructor.name === 'RawTableData') { + this.tableResults[v.name] = v.results + } + }) + this.scope.loadingVizz = true + } + if (!this.scope.$$phase) this.scope.$digest() + }) - this.scope.$on('deletedFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + this.scope.$on('deletedFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.scope.$on('barFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + this.scope.$on('barFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - /** - * On controller destroy - */ - this.scope.$on('$destroy', () => { - this.timePicker.destroy() - this.vizz.map(vizz => vizz.destroy()) - }) + /** + * On controller destroy + */ + this.scope.$on('$destroy', () => { + this.timePicker.destroy() + this.vizz.map(vizz => vizz.destroy()) + }) + } catch (error) {} } /** diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/vulnerabilities/overview-vulnerabilities.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/vulnerabilities/overview-vulnerabilities.html index f3bbf8192..221cb0eb6 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/vulnerabilities/overview-vulnerabilities.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/vulnerabilities/overview-vulnerabilities.html @@ -1,118 +1,141 @@ -
-
+
+
Overview / Vulnerabilities
- - -
-
+ +
- - -
Generating report
- +
+
+ + +
{{reportStatus}}
+ - - Vulnerabilities - Osquery - VirusTotal - Docker listener - + + Vulnerabilities + + Osquery + VirusTotal + Docker listener + -
- - -
Critical severity alerts: - -
-
High severity alerts: - -
-
Medium severity alerts: - -
-
Low severity alerts: - -
-
-
+
+
+ Fetching data...
+
+
+
+ + +
Critical severity alerts: + +
+
High severity alerts: + +
+
Medium severity alerts: + +
+
Low severity alerts: + +
+
+
+
-
- - - Most affected agents - - - -
-
-
- - - Alerts evolution over time - - - -
-
-
-
+
+ + + Most affected agents + + + + + +
+
+
+ + + Alerts evolution over time + + + + + +
+
+
+
-
- - - Severity distribution - - - -
-
-
- - - Commonly affectected packages - - - -
-
-
- - - Most common CVEs - - - -
-
-
-
+
+ + + Severity distribution + + + + + +
+
+
+ + + Commonly affectected packages + + + + + +
+
+
+ + + Most common CVEs + + + + + +
+
+
+
-
- - - Alerts summary - - - -
-
-
+
+ + + Alerts summary + + + + + +
+
+
+
- \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/vulnerabilities/overviewVulnerabilitiesCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/overview/vulnerabilities/overviewVulnerabilitiesCtrl.js index 72398b0c5..bc22e7094 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/vulnerabilities/overviewVulnerabilitiesCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/vulnerabilities/overviewVulnerabilitiesCtrl.js @@ -8,7 +8,7 @@ define([ '../../../services/visualizations/inputs/time-picker', '../../../services/visualizations/search/search-handler', '../../../services/rawTableData/rawTableDataService' -], function( +], function ( app, BarChart, ColumnChart, @@ -19,236 +19,241 @@ define([ SearchHandler, RawTableDataService ) { - 'use strict' - class OverviewVulnerabilities { - /** - * - * @param {*} $urlTokenModel - * @param {*} $scope - * @param {*} $currentDataService - * @param {*} $state - * @param {*} $reportingService - */ - constructor( - $urlTokenModel, - $scope, - $currentDataService, - $state, - $reportingService, - reportingEnabled, - extensions - ) { - this.scope = $scope - this.scope.reportingEnabled = reportingEnabled - this.scope.extensions = extensions - this.state = $state - this.reportingService = $reportingService - this.tableResults = {} - this.timePicker = new TimePicker( - '#timePicker', - $urlTokenModel.handleValueChange - ) - this.submittedTokenModel = $urlTokenModel.getSubmittedTokenModel() - $currentDataService.addFilter( - `{"rule.groups{}":"vulnerability-detector", "implicit":true, "onlyShow":true}` - ) - this.getFilters = $currentDataService.getSerializedFilters - this.filters = this.getFilters() + 'use strict' + class OverviewVulnerabilities { + /** + * + * @param {*} $urlTokenModel + * @param {*} $scope + * @param {*} $currentDataService + * @param {*} $state + * @param {*} $reportingService + */ + constructor( + $urlTokenModel, + $scope, + $currentDataService, + $state, + $reportingService, + reportingEnabled, + extensions + ) { + this.scope = $scope + this.scope.reportingEnabled = reportingEnabled + this.scope.extensions = extensions + this.state = $state + this.reportingService = $reportingService + this.tableResults = {} + this.timePicker = new TimePicker( + '#timePicker', + $urlTokenModel.handleValueChange + ) + this.submittedTokenModel = $urlTokenModel.getSubmittedTokenModel() + $currentDataService.addFilter( + `{"rule.groups{}":"vulnerability-detector", "implicit":true, "onlyShow":true}` + ) + this.getFilters = $currentDataService.getSerializedFilters + this.filters = this.getFilters() - this.scope.$on('deletedFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + this.scope.$on('deletedFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.scope.$on('barFilter', event => { - event.stopPropagation() - this.launchSearches() - }) + this.scope.$on('barFilter', event => { + event.stopPropagation() + this.launchSearches() + }) - this.scope.expandArray = [false, false, false, false, false, false] - this.scope.expand = (i, id) => this.expand(i, id) + this.scope.expandArray = [false, false, false, false, false, false] + this.scope.expand = (i, id) => this.expand(i, id) - this.vizz = [ - /** - * Metrics - */ - new SearchHandler( - `criticalSeveritySearch`, - `${this.filters} data.vulnerability.severity=critical | stats count`, - `criticalSeverityToken`, - `$result.count$`, - `criticalSeverity`, - this.submittedTokenModel, - this.scope - ), - new SearchHandler( - `highSeveritySeach`, - `${this.filters} data.vulnerability.severity=high | stats count`, - `highSeverityToken`, - `$result.count$`, - `highSeverity`, - this.submittedTokenModel, - this.scope - ), - new SearchHandler( - `mediumSeveritySeach`, - `${this.filters} data.vulnerability.severity=medium | stats count`, - `mediumSeverityToken`, - `$result.count$`, - `mediumSeverity`, - this.submittedTokenModel, - this.scope - ), - new SearchHandler( - `lowSeveritySeach`, - `${this.filters} data.vulnerability.severity=low | stats count`, - `lowSeverityToken`, - `$result.count$`, - `lowSeverity`, - this.submittedTokenModel, - this.scope - ), - /** - * Visualizations - */ - new PieChart( - 'affectedAgents', - `${ + this.vizz = [ + /** + * Metrics + */ + new SearchHandler( + `criticalSeveritySearch`, + `${this.filters} data.vulnerability.severity=critical | stats count`, + `criticalSeverityToken`, + `$result.count$`, + `criticalSeverity`, + this.submittedTokenModel, + this.scope + ), + new SearchHandler( + `highSeveritySeach`, + `${this.filters} data.vulnerability.severity=high | stats count`, + `highSeverityToken`, + `$result.count$`, + `highSeverity`, + this.submittedTokenModel, + this.scope + ), + new SearchHandler( + `mediumSeveritySeach`, + `${this.filters} data.vulnerability.severity=medium | stats count`, + `mediumSeverityToken`, + `$result.count$`, + `mediumSeverity`, + this.submittedTokenModel, + this.scope + ), + new SearchHandler( + `lowSeveritySeach`, + `${this.filters} data.vulnerability.severity=low | stats count`, + `lowSeverityToken`, + `$result.count$`, + `lowSeverity`, + this.submittedTokenModel, + this.scope + ), + /** + * Visualizations + */ + new PieChart( + 'affectedAgents', + `${ this.filters - } rule.groups{}=vulnerability-detector | top agent.name limit=5`, - 'affectedAgents', - this.scope - ), - new AreaChart( - 'alertsEvolution', - `${ + } rule.groups{}=vulnerability-detector | top agent.name limit=5`, + 'affectedAgents', + this.scope + ), + new AreaChart( + 'alertsEvolution', + `${ this.filters - } rule.groups{}=vulnerability-detector data.vulnerability.severity=* | timechart count by data.vulnerability.severity`, - 'alertsEvolution', - this.scope - ), - new ColumnChart( - 'severityDist', - `${ + } rule.groups{}=vulnerability-detector data.vulnerability.severity=* | timechart count by data.vulnerability.severity`, + 'alertsEvolution', + this.scope + ), + new ColumnChart( + 'severityDist', + `${ this.filters - } data.vulnerability.severity=* | spath "agent.name" | search "agent.name"=* | rename agent.id AS RootObject.agent.id agent.ip AS RootObject.agent.ip agent.name AS RootObject.agent.name data.vulnerability.cve AS RootObject.data.vulnerability.cve data.vulnerability.package.condition AS RootObject.data.vulnerability.package.condition data.vulnerability.package.name AS RootObject.data.vulnerability.package.name data.vulnerability.package.version AS RootObject.data.vulnerability.package.version data.vulnerability.published AS RootObject.data.vulnerability.published data.vulnerability.reference AS RootObject.data.vulnerability.reference data.vulnerability.severity AS RootObject.data.vulnerability.severity data.vulnerability.state AS RootObject.data.vulnerability.state data.vulnerability.title AS RootObject.data.vulnerability.title data.vulnerability.updated AS RootObject.data.vulnerability.updated date_hour AS RootObject.date_hour date_mday AS RootObject.date_mday date_minute AS RootObject.date_minute date_month AS RootObject.date_month date_second AS RootObject.date_second date_wday AS RootObject.date_wday date_year AS RootObject.date_year date_zone AS RootObject.date_zone decoder.name AS RootObject.decoder.name id AS RootObject.id index AS RootObject.index linecount AS RootObject.linecount location AS RootObject.location manager.name AS RootObject.manager.name rule.description AS RootObject.rule.description rule.firedtimes AS RootObject.rule.firedtimes "rule.gdpr{}" AS "RootObject.rule.gdpr{}" rule.groups{} AS RootObject.rule.groups{} "rule.groups{}{}" AS "RootObject.rule.groups{}{}" rule.id AS RootObject.rule.id rule.level AS RootObject.rule.level rule.mail AS RootObject.rule.mail splunk_server AS RootObject.splunk_server timeendpos AS RootObject.timeendpos timestamp AS RootObject.timestamp timestartpos AS RootObject.timestartpos | fields "_time" "host" "source" "sourcetype" "RootObject.agent.id" "RootObject.agent.ip" "RootObject.agent.name" "RootObject.data.vulnerability.cve" "RootObject.data.vulnerability.package.condition" "RootObject.data.vulnerability.package.name" "RootObject.data.vulnerability.package.version" "RootObject.data.vulnerability.published" "RootObject.data.vulnerability.reference" "RootObject.data.vulnerability.severity" "RootObject.data.vulnerability.state" "RootObject.data.vulnerability.title" "RootObject.data.vulnerability.updated" "RootObject.date_hour" "RootObject.date_mday" "RootObject.date_minute" "RootObject.date_month" "RootObject.date_second" "RootObject.date_wday" "RootObject.date_year" "RootObject.date_zone" "RootObject.decoder.name" "RootObject.id" "RootObject.index" "RootObject.linecount" "RootObject.location" "RootObject.manager.name" "RootObject.rule.description" "RootObject.rule.firedtimes" ""RootObject.rule.gdpr{}"" "RootObject.rule.groups{}" ""RootObject.rule.groups{}{}"" "RootObject.rule.id" "RootObject.rule.level" "RootObject.rule.mail" "RootObject.splunk_server" "RootObject.timeendpos" "RootObject.timestamp" "RootObject.timestartpos" | eval "RootObject.data.vulnerability.severity"='RootObject.data.vulnerability.severity', "agent.name"='RootObject.agent.name' | chart dedup_splitvals=t limit=100 useother=t count AS "Count of 1532686833.50" by agent.name RootObject.data.vulnerability.severity format=$$VAL$$:::$$AGG$$ | sort limit=100 RootObject.agent.name | fields - _span | fields agent.name *`, - 'severityDist', - this.scope - ), - new PieChart( - 'commonAffectedPackages', - `${this.filters} | top 5 data.vulnerability.package.name`, - 'commonAffectedPackages', - this.scope - ), - new BarChart( - 'commonCves', - `${ + } data.vulnerability.severity=* | spath "agent.name" | search "agent.name"=* | rename agent.id AS RootObject.agent.id agent.ip AS RootObject.agent.ip agent.name AS RootObject.agent.name data.vulnerability.cve AS RootObject.data.vulnerability.cve data.vulnerability.package.condition AS RootObject.data.vulnerability.package.condition data.vulnerability.package.name AS RootObject.data.vulnerability.package.name data.vulnerability.package.version AS RootObject.data.vulnerability.package.version data.vulnerability.published AS RootObject.data.vulnerability.published data.vulnerability.reference AS RootObject.data.vulnerability.reference data.vulnerability.severity AS RootObject.data.vulnerability.severity data.vulnerability.state AS RootObject.data.vulnerability.state data.vulnerability.title AS RootObject.data.vulnerability.title data.vulnerability.updated AS RootObject.data.vulnerability.updated date_hour AS RootObject.date_hour date_mday AS RootObject.date_mday date_minute AS RootObject.date_minute date_month AS RootObject.date_month date_second AS RootObject.date_second date_wday AS RootObject.date_wday date_year AS RootObject.date_year date_zone AS RootObject.date_zone decoder.name AS RootObject.decoder.name id AS RootObject.id index AS RootObject.index linecount AS RootObject.linecount location AS RootObject.location manager.name AS RootObject.manager.name rule.description AS RootObject.rule.description rule.firedtimes AS RootObject.rule.firedtimes "rule.gdpr{}" AS "RootObject.rule.gdpr{}" rule.groups{} AS RootObject.rule.groups{} "rule.groups{}{}" AS "RootObject.rule.groups{}{}" rule.id AS RootObject.rule.id rule.level AS RootObject.rule.level rule.mail AS RootObject.rule.mail splunk_server AS RootObject.splunk_server timeendpos AS RootObject.timeendpos timestamp AS RootObject.timestamp timestartpos AS RootObject.timestartpos | fields "_time" "host" "source" "sourcetype" "RootObject.agent.id" "RootObject.agent.ip" "RootObject.agent.name" "RootObject.data.vulnerability.cve" "RootObject.data.vulnerability.package.condition" "RootObject.data.vulnerability.package.name" "RootObject.data.vulnerability.package.version" "RootObject.data.vulnerability.published" "RootObject.data.vulnerability.reference" "RootObject.data.vulnerability.severity" "RootObject.data.vulnerability.state" "RootObject.data.vulnerability.title" "RootObject.data.vulnerability.updated" "RootObject.date_hour" "RootObject.date_mday" "RootObject.date_minute" "RootObject.date_month" "RootObject.date_second" "RootObject.date_wday" "RootObject.date_year" "RootObject.date_zone" "RootObject.decoder.name" "RootObject.id" "RootObject.index" "RootObject.linecount" "RootObject.location" "RootObject.manager.name" "RootObject.rule.description" "RootObject.rule.firedtimes" ""RootObject.rule.gdpr{}"" "RootObject.rule.groups{}" ""RootObject.rule.groups{}{}"" "RootObject.rule.id" "RootObject.rule.level" "RootObject.rule.mail" "RootObject.splunk_server" "RootObject.timeendpos" "RootObject.timestamp" "RootObject.timestartpos" | eval "RootObject.data.vulnerability.severity"='RootObject.data.vulnerability.severity', "agent.name"='RootObject.agent.name' | chart dedup_splitvals=t limit=100 useother=t count AS "Count of 1532686833.50" by agent.name RootObject.data.vulnerability.severity format=$$VAL$$:::$$AGG$$ | sort limit=100 RootObject.agent.name | fields - _span | fields agent.name *`, + 'severityDist', + this.scope + ), + new PieChart( + 'commonAffectedPackages', + `${this.filters} | top 5 data.vulnerability.package.name`, + 'commonAffectedPackages', + this.scope + ), + new BarChart( + 'commonCves', + `${ this.filters - } rule.groups{}=vulnerability-detector | top data.vulnerability.cve limit=5`, - 'commonCves', - this.scope - ), - new Table( - 'alertsSummary', - `${ + } rule.groups{}=vulnerability-detector | top data.vulnerability.cve limit=5`, + 'commonCves', + this.scope + ), + new Table( + 'alertsSummary', + `${ this.filters - } | stats count sparkline by data.vulnerability.title, data.vulnerability.severity, data.vulnerability.reference | rename data.vulnerability.title as Title, data.vulnerability.severity as Severity, data.vulnerability.reference as Reference, count as Count, sparkline as Sparkline`, - 'alertsSummary', - this.scope - ), - new RawTableDataService( - 'alertsSummaryTable', - `${ + } | stats count sparkline by data.vulnerability.title, data.vulnerability.severity, data.vulnerability.reference | sort count DESC | rename data.vulnerability.title as Title, data.vulnerability.severity as Severity, data.vulnerability.reference as Reference, count as Count, sparkline as Sparkline`, + 'alertsSummary', + this.scope + ), + new RawTableDataService( + 'alertsSummaryTable', + `${ this.filters - } | stats count sparkline by data.vulnerability.title, data.vulnerability.severity | rename data.vulnerability.title as Title, data.vulnerability.severity as Severity, count as Count, sparkline as Sparkline`, - 'alertsSummaryTableToken', - '$result$', - this.scope, - 'Alerts Summary' - ) - ] + } | stats count sparkline by data.vulnerability.title, data.vulnerability.severity | sort count DESC | rename data.vulnerability.title as Title, data.vulnerability.severity as Severity, count as Count, sparkline as Sparkline`, + 'alertsSummaryTableToken', + '$result$', + this.scope, + 'Alerts Summary' + ) + ] + } - /** - * Generates report - */ - this.scope.startVis2Png = () => - this.reportingService.startVis2Png( - 'overview-vulnerabilities', - 'Vulnerabilities', - this.filters, - [ - 'affectedAgents', - 'alertsEvolution', - 'severityDist', - 'commonAffectedPackages', - 'commonCves', - 'alertsSummary' - ], - {}, //Metrics - this.tableResults - ) + $onInit() { + try { + this.scope.loadingVizz = true + /** + * Generates report + */ + this.scope.startVis2Png = () => + this.reportingService.startVis2Png( + 'overview-vulnerabilities', + 'Vulnerabilities', + this.filters, + [ + 'affectedAgents', + 'alertsEvolution', + 'severityDist', + 'commonAffectedPackages', + 'commonCves', + 'alertsSummary' + ], + {}, //Metrics + this.tableResults + ) - this.scope.$on('loadingReporting', (event, data) => { - this.scope.loadingReporting = data.status - }) + this.scope.$on('loadingReporting', (event, data) => { + this.scope.loadingReporting = data.status + }) - this.scope.$on('checkReportingStatus', () => { - this.vizzReady = !this.vizz.filter(v => { - return v.finish === false - }).length - if (this.vizzReady) { - this.scope.loadingVizz = false - } else { - this.vizz.map(v => { - if (v.constructor.name === 'RawTableData') { - this.tableResults[v.name] = v.results + this.scope.$on('checkReportingStatus', () => { + this.vizzReady = !this.vizz.filter(v => { + return v.finish === false + }).length + if (this.vizzReady) { + this.scope.loadingVizz = false + } else { + this.vizz.map(v => { + if (v.constructor.name === 'RawTableData') { + this.tableResults[v.name] = v.results + } + }) + this.scope.loadingVizz = true } + if (!this.scope.$$phase) this.scope.$digest() }) - this.scope.loadingVizz = true - } - if (!this.scope.$$phase) this.scope.$digest() - }) + + /** + * On controller destroy + */ + this.scope.$on('$destroy', () => { + this.timePicker.destroy() + this.vizz.map(vizz => vizz.destroy()) + }) + } catch (error) { } + } /** - * On controller destroy + * Get filters and launches the search */ - this.scope.$on('$destroy', () => { - this.timePicker.destroy() - this.vizz.map(vizz => vizz.destroy()) - }) - } - - /** - * Get filters and launches the search - */ - launchSearches() { - this.filters = this.getFilters() - this.state.reload() - } + launchSearches() { + this.filters = this.getFilters() + this.state.reload() + } - expand(i, id) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - let vis = $( - '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' - ) - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') + expand(i, id) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + let vis = $( + '#' + id + ' .panel-body .splunk-view .shared-reportvisualizer' + ) + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') - let vis_header = $('.wz-headline-title') - vis_header.dblclick(e => { - if (this.scope.expandArray[i]) { - this.scope.expandArray[i] = !this.scope.expandArray[i] - this.scope.expandArray[i] - ? vis.css('height', 'calc(100vh - 200px)') - : vis.css('height', '250px') - this.scope.$applyAsync() - } else { - e.preventDefault() - } - }) + let vis_header = $('.wz-headline-title') + vis_header.dblclick(e => { + if (this.scope.expandArray[i]) { + this.scope.expandArray[i] = !this.scope.expandArray[i] + this.scope.expandArray[i] + ? vis.css('height', 'calc(100vh - 200px)') + : vis.css('height', '250px') + this.scope.$applyAsync() + } else { + e.preventDefault() + } + }) + } } - } - app.controller('overviewVulnerabilitiesCtrl', OverviewVulnerabilities) -}) + app.controller('overviewVulnerabilitiesCtrl', OverviewVulnerabilities) + }) diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/overview/welcome/overview-welcome.html b/SplunkAppForWazuh/appserver/static/js/controllers/overview/welcome/overview-welcome.html index 5ea18a47f..4cbbbb862 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/overview/welcome/overview-welcome.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/overview/welcome/overview-welcome.html @@ -47,7 +47,10 @@

Auditing and Policy Monitoring

- + @@ -69,7 +72,7 @@

Threat Detection and Response

- diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/settings/api/api.html b/SplunkAppForWazuh/appserver/static/js/controllers/settings/api/api.html index a4d9ec6c8..0f4aebc19 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/settings/api/api.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/settings/api/api.html @@ -2,37 +2,95 @@
- - Welcome to - the - Wazuh app for Splunk - -
- Wazuh Splunk plugin provides management and monitoring capabilities, giving users control - over the Wazuh infrastructure. Using this plugin you can monitor your agents status and - configuration, query and visualize your alert data and monitor manager rules and - configuration. -
-
+ + + + + Welcome to + the + Wazuh app for Splunk + +
+ Wazuh Splunk plugin provides management and monitoring capabilities, giving users control + over the Wazuh infrastructure. Using this plugin you can monitor your agents status and + configuration, query and visualize your alert data and monitor manager rules and + configuration. +
+
- - Community - -
- Enjoy your Wazuh experience and please don't hesitate to give us your feedback. -
-
- - - - -
- -
+ + + + + Community + +
+ Enjoy your Wazuh experience and please don't hesitate to give us your feedback. +
+ + +
- +
@@ -61,38 +119,43 @@

- {{ (entry.filterType === 'cluster.name') ? entry.filterName : 'Disabled'}} - - This is the default Manager - -

+ + {{ (entry.filterType === 'cluster.name') ? entry.filterName : 'Disabled'}} + + This is the default Manager + +

{{entry.managerName}}

{{entry.url}}

{{entry.portapi}}

{{entry.userapi}}

- -

-
@@ -118,31 +182,40 @@ - + - + - + - +

{{messageError}}

-
- - +
+
+
    +
  • {{ err }}
  • +
+
+
+ + +
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/settings/api/settingsApiCtrl.js b/SplunkAppForWazuh/appserver/static/js/controllers/settings/api/settingsApiCtrl.js index 405d0ba32..fd5e325db 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/settings/api/settingsApiCtrl.js +++ b/SplunkAppForWazuh/appserver/static/js/controllers/settings/api/settingsApiCtrl.js @@ -87,8 +87,13 @@ define(['../../module'], function(controllers) { const index = this.scope.apiList.indexOf(entry) if (index > -1) { await this.currentDataService.remove(entry) + const usedApi = this.currentDataService.getApi() + if (entry._key === usedApi._key) { + this.currentDataService.removeCurrentApi() + } this.scope.apiList.splice(index, 1) this.notification.showSuccessToast('Manager was removed') + this.scope.$emit('updatedAPI', () => {}) } } catch (err) { this.notification.showErrorToast( @@ -113,7 +118,7 @@ define(['../../module'], function(controllers) { break } } - this.notification.showSuccessToast('Established connection') + this.notification.showSuccessToast('Connection established') if (!this.scope.$$phase) this.scope.$digest() } catch (err) { this.notification.showErrorToast('Unreachable API') @@ -225,6 +230,7 @@ define(['../../module'], function(controllers) { */ async submitApiForm() { try { + this.scope.validatingError = [] if (this.savingApi) { this.notification.showWarningToast('Please, wait for success message') return @@ -283,7 +289,12 @@ define(['../../module'], function(controllers) { * @param {String} url */ validUrl(url) { - return this.urlRegEx.test(url) || this.urlRegExIP.test(url) + if (this.urlRegEx.test(url) || this.urlRegExIP.test(url)) { + return true + } else { + this.scope.validatingError.push('Invalid url format') + return false + } } /** @@ -291,7 +302,12 @@ define(['../../module'], function(controllers) { * @param {String} port */ validPort(port) { - return this.portRegEx.test(port) + if (this.portRegEx.test(port)) { + return true + } else { + this.scope.validatingError.push('Invalid port format') + return false + } } /** @@ -299,7 +315,12 @@ define(['../../module'], function(controllers) { * @param {String} user */ validUsername(user) { - return this.userRegEx.test(user) + if (this.userRegEx.test(user)) { + return true + } else { + this.scope.validatingError.push('Invalid username format, it must have a length between 3 and 100 characters.') + return false + } } /** @@ -307,7 +328,12 @@ define(['../../module'], function(controllers) { * @param {String} pass */ validPassword(pass) { - return this.passRegEx.test(pass) + if (this.passRegEx.test(pass)) { + return true + } else { + this.scope.validatingError.push('Invalid password format, it must have a length between 3 and 100 characters.') + return false + } } /** diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/settings/extensions/extensions.html b/SplunkAppForWazuh/appserver/static/js/controllers/settings/extensions/extensions.html index c216f62dd..0b313d9dc 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/settings/extensions/extensions.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/settings/extensions/extensions.html @@ -26,7 +26,7 @@
- +
@@ -52,7 +52,7 @@
- +
@@ -76,7 +76,7 @@
- +
@@ -100,7 +100,7 @@
- +
@@ -124,7 +124,7 @@
- +
@@ -147,7 +147,7 @@
- +
@@ -170,7 +170,7 @@
- +
@@ -194,8 +194,7 @@
- +
@@ -216,8 +215,7 @@
- +
@@ -241,7 +239,7 @@
- +
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/settings/logs/logs.html b/SplunkAppForWazuh/appserver/static/js/controllers/settings/logs/logs.html index 76857b132..6ccc2ddb0 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/settings/logs/logs.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/settings/logs/logs.html @@ -6,7 +6,7 @@
- Refresh + Refresh
diff --git a/SplunkAppForWazuh/appserver/static/js/directives/index.js b/SplunkAppForWazuh/appserver/static/js/directives/index.js index 2d9d43fd6..9b668850b 100644 --- a/SplunkAppForWazuh/appserver/static/js/directives/index.js +++ b/SplunkAppForWazuh/appserver/static/js/directives/index.js @@ -14,6 +14,8 @@ define([ './wz-multiple-selector/wz-multiple-selector', './wz-config-viewer/wz-config-viewer', './wz-discover/wz-discover', + './wz-svg/wz-svg', './wz-add-filter-chip/wz-add-filter-chip', - './wz-head-toaster/wz-head-toaster' + './wz-head-toaster/wz-head-toaster', + './wz-kbn-switch/wz-kbn-switch' ], function() {}) diff --git a/SplunkAppForWazuh/appserver/static/js/directives/wz-bar/wz-bar.js b/SplunkAppForWazuh/appserver/static/js/directives/wz-bar/wz-bar.js index 130f773a5..73b757d2e 100644 --- a/SplunkAppForWazuh/appserver/static/js/directives/wz-bar/wz-bar.js +++ b/SplunkAppForWazuh/appserver/static/js/directives/wz-bar/wz-bar.js @@ -25,9 +25,9 @@ define(['../module'], function(directives) { if (uglyFilters && uglyFilters.length > 0) { for (const filter of uglyFilters) { const key = Object.keys(filter)[0] - const cleanKey = key.replace('{}','') + const cleanKey = key.replace('{}', '') if (key !== 'index') { - prettyFilters.push(`${cleanKey}:${filter[key]}`) + prettyFilters.push(`${cleanKey}:${filter[key]}`) } } } @@ -42,14 +42,23 @@ define(['../module'], function(directives) { * @returns {Boolean} */ function filterStatic(filter) { + let keyStatic = false const key = filter.split(':')[0] const staticTrue = $currentDataService .getFilters() .filter(item => !!item.implicit) - const isIncluded = staticTrue.filter( - item => typeof item[key] !== 'undefined' + staticTrue.map( + item => { + let k = Object.keys(item)[0] + if (k.endsWith('{}')) { + k = k.substring(0, k.length - 2) + } + if (k === key) { + keyStatic = item['implicit'] + } + } ) - return !!isIncluded.length + return keyStatic } /** diff --git a/SplunkAppForWazuh/appserver/static/js/directives/wz-config-item/wz-config-item.html b/SplunkAppForWazuh/appserver/static/js/directives/wz-config-item/wz-config-item.html index 48cea8060..8a764c050 100644 --- a/SplunkAppForWazuh/appserver/static/js/directives/wz-config-item/wz-config-item.html +++ b/SplunkAppForWazuh/appserver/static/js/directives/wz-config-item/wz-config-item.html @@ -6,7 +6,7 @@ {{ value }}
-
    +
    • {{ item }}
diff --git a/SplunkAppForWazuh/appserver/static/js/directives/wz-config-viewer/wz-config-viewer.html b/SplunkAppForWazuh/appserver/static/js/directives/wz-config-viewer/wz-config-viewer.html index 44f802e3f..a4138e0c1 100644 --- a/SplunkAppForWazuh/appserver/static/js/directives/wz-config-viewer/wz-config-viewer.html +++ b/SplunkAppForWazuh/appserver/static/js/directives/wz-config-viewer/wz-config-viewer.html @@ -1,5 +1,4 @@ -
- +
@@ -42,7 +41,9 @@ XML
- +
+ Viewing {{noLocal}} file +
diff --git a/SplunkAppForWazuh/appserver/static/js/directives/wz-config-viewer/wz-config-viewer.js b/SplunkAppForWazuh/appserver/static/js/directives/wz-config-viewer/wz-config-viewer.js index d840d6670..a23d34aec 100644 --- a/SplunkAppForWazuh/appserver/static/js/directives/wz-config-viewer/wz-config-viewer.js +++ b/SplunkAppForWazuh/appserver/static/js/directives/wz-config-viewer/wz-config-viewer.js @@ -25,7 +25,8 @@ define(['../module', '../../libs/codemirror-conv/lib/codemirror'], function( getxml: '&', jsoncontent: '=', xmlcontent: '=', - hideHeader: '=' + hideHeader: '=', + noLocal: '=' } this.templateUrl = BASE_URL + diff --git a/SplunkAppForWazuh/appserver/static/js/directives/wz-data-table/wz-data-table.html b/SplunkAppForWazuh/appserver/static/js/directives/wz-data-table/wz-data-table.html index 8a30431c6..ce9678138 100644 --- a/SplunkAppForWazuh/appserver/static/js/directives/wz-data-table/wz-data-table.html +++ b/SplunkAppForWazuh/appserver/static/js/directives/wz-data-table/wz-data-table.html @@ -3,7 +3,10 @@
- + +
diff --git a/SplunkAppForWazuh/appserver/static/js/directives/wz-discover/wz-discover.html b/SplunkAppForWazuh/appserver/static/js/directives/wz-discover/wz-discover.html index 7e51c6e19..cce0a0452 100644 --- a/SplunkAppForWazuh/appserver/static/js/directives/wz-discover/wz-discover.html +++ b/SplunkAppForWazuh/appserver/static/js/directives/wz-discover/wz-discover.html @@ -1,6 +1,7 @@
@@ -260,6 +248,10 @@ ng-repeat-end=""> -
Key {{item[0]}} - - {{item[1]}} +
+ +
+
+ {{item[1]}} +
- - - Edit - - + + @@ -117,14 +121,10 @@ Apply - - + icon="trash" svg-tooltip="Remove this entry"> +
This entry will be @@ -178,7 +178,7 @@ -  Formatted +  Formatted
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/cdb/manager-cdb.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/cdb/manager-cdb.html index de0bbcbb0..579b89d25 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/cdb/manager-cdb.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/cdb/manager-cdb.html @@ -1,6 +1,6 @@
-
+
Management / Ruleset / CDB Lists @@ -21,8 +21,10 @@
- + @@ -75,7 +77,7 @@ @@ -118,17 +120,17 @@
- + - + +
{{item[0]}} - - {{item[1]}} +
+ +
+
+ {{item[1]}} +
- - - Edit - - + + Cancel @@ -161,12 +164,10 @@ Apply - + + +
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/amazon-s3/amazon-s3.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/amazon-s3/amazon-s3.html index 3fde44877..db56cbf9f 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/amazon-s3/amazon-s3.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/amazon-s3/amazon-s3.html @@ -16,6 +16,7 @@ General Buckets + Services @@ -105,6 +106,73 @@ + + + +
+
+ Services +
+ Amazon services from where logs are read +
+
+ + JSON +  ·  + XML +
+ + + +
+ + +
+ + + {{item.type}} + + + +
+ + + +
+
+ + + + + + + + + + + + +
+ +
+ +
+ +
+
+ + + diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/breadcrumbs/breadcrumbs.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/breadcrumbs/breadcrumbs.html index c2d0a9db1..4aa666acd 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/breadcrumbs/breadcrumbs.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/breadcrumbs/breadcrumbs.html @@ -1,11 +1,11 @@ -
-
+
+
-
+
Management @@ -33,7 +33,7 @@
-
+
Agents @@ -52,7 +52,7 @@
-
+
{{formatAgentStatus(currentAgent.status)}}
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/edit-configuration/manager-edit-groups.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/edit-configuration/manager-edit-groups.html index 777fd0a95..fc7e073e8 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/edit-configuration/manager-edit-groups.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/edit-configuration/manager-edit-groups.html @@ -3,7 +3,7 @@
Edit the groups - +
- + diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/global-configuration/global-configuration.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/global-configuration/global-configuration.html index b317bd46b..87223d8f5 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/global-configuration/global-configuration.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/global-configuration/global-configuration.html @@ -88,19 +88,19 @@ - + - + - + - + - + - + - +
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/log-collection/log-collection.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/log-collection/log-collection.html index db0d9cca1..0212acad8 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/log-collection/log-collection.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/log-collection/log-collection.html @@ -1,5 +1,5 @@
+ ng-init="switchConfigurationSubTab('logs')">
@@ -13,7 +13,9 @@ - Localfiles + Logs + + Commands Sockets @@ -22,7 +24,8 @@ -
+ +
Logs files and command monitoring
- List of log files that will be analyzed + List of log files that will be analyzed
@@ -62,50 +65,39 @@ - {{ item.file || item.alias || item.command }} - {{ item.logformat }} - - {{ item.targetStr }} - + ng-repeat="item in currentConfig['logcollector-localfile']['localfile-logs']"> + {{ item.file || item.alias || + item.command }} + {{ item.logformat }} - {{ + item.targetStr }}
-
+
+ value="currentConfig['logcollector-localfile']['localfile-logs'][selectedItem].logformat"> - - - - - - + value="currentConfig['logcollector-localfile']['localfile-logs'][selectedItem].file || '-'"> + ng-if="agent && agent.os && agent.os.platform === 'windows'" + value="currentConfig['logcollector-localfile']['localfile-logs'][selectedItem]['only-future-events'] || '-'"> + ng-if="agent && agent.os && agent.os.platform === 'windows'" + value="currentConfig['logcollector-localfile']['localfile-logs'][selectedItem].query || '-'"> + value="currentConfig['logcollector-localfile']['localfile-logs'][selectedItem].labels || '-'"> - - + value="currentConfig['logcollector-localfile']['localfile-logs'][selectedItem].target || 'agent'">
@@ -145,6 +137,115 @@
+ + +
+ + + + + + + + +
+ + + + +
+
+ Command monitoring +
+ All output from these commands will be read as one or more + log messages depending on whether command or full_command is used. +
+
+ + JSON +  ·  + XML +
+ + + +
+ + +
+ + + + {{ item.file || item.alias || + item.command }} + {{ item.logformat }} - {{ + item.targetStr }} + + +
+ + + +
+ +
+ + + + + + + + + + +
+ +
+ +
+ +
+
+ + + + +
+ + + + + + + + + + + More info about this section + Log + data collection documentation + Localfile + reference + + + + +
+
diff --git a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/welcome/welcome.html b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/welcome/welcome.html index 7947a6f51..49efd168f 100644 --- a/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/welcome/welcome.html +++ b/SplunkAppForWazuh/appserver/static/js/controllers/management/configuration/welcome/welcome.html @@ -28,7 +28,9 @@ @@ -42,7 +44,7 @@
Name Description
Global configuration Global and remote settings
{{item.date}} - + + + Download report + - + + + Delete report +
+ ng-if="path !== '/decoders' && path !== '/rules'" >
{{ parseValue(key,item) }}
-
{{ - parseValue(key,item) - }}
+
+ + {{parseValue(key,item)}} + +
{{ parseValue(key,item) }}
+ ng-if="path === '/rules'" ng-click="key === 'id' && searchRuleId($event,item.id)">
{{ parseValue(key,item) }}
-
{{ - parseValue(key,item) - }}
+
+ + {{parseValue(key,item)}} + +
{{ parseValue(key,item) }}
+ ng-if="path === '/decoders'" >
-
{{ - parseValue(key,item) - }}
+
+ + {{parseValue(key,item)}} + +
{{ parseValue(key,item) }}
@@ -90,35 +95,30 @@
- - Open Discover panel for this agent" - - Open Configuration for this agent" + + + + - + icon="pencil" svg-tooltip="Edit this file" color="#0079a5"> + - + icon="trash" color="#0079a5" svg-tooltip="Remove this file"> +
@@ -137,22 +137,13 @@
- - - - Remove this group - - - - - - Edit this group configuration - - + + + + -
@@ -168,14 +159,11 @@
- + icon="trash" color="#0079a5" svg-tooltip="Remove agent"> + +
The agent {{item.id}} will be removed from @@ -246,11 +234,11 @@ ng-click="expandPolicyMonitoringCheck(item)">
-

   +

  
{{ - parseValue(key,item) + key === 'result' && !item.result ? item.status : parseValue(key,item) }}
+
+ Check not applicable due to: +

{{ item.reason }}

+
Rationale

{{item.rationale}}

@@ -330,7 +322,7 @@
+ {{ parseValue(key,item) @@ -388,7 +380,7 @@
-
-
    @@ -25,7 +25,7 @@
- Remove all filters diff --git a/SplunkAppForWazuh/appserver/static/js/directives/wz-xml-file-editor/wz-xml-file-editor.js b/SplunkAppForWazuh/appserver/static/js/directives/wz-xml-file-editor/wz-xml-file-editor.js index 0cb7d574b..c19f1b394 100644 --- a/SplunkAppForWazuh/appserver/static/js/directives/wz-xml-file-editor/wz-xml-file-editor.js +++ b/SplunkAppForWazuh/appserver/static/js/directives/wz-xml-file-editor/wz-xml-file-editor.js @@ -203,7 +203,9 @@ define([ let msg = null if (params.file === 'ossec.conf') { if (params.node) { - msg = `Succes. Node(${params.node}) configuration has been updated.` + msg = `Succes. Node(${ + params.node + }) configuration has been updated.` } else { msg = 'Succes. Manager configuration has been updated.' } diff --git a/SplunkAppForWazuh/appserver/static/js/libs/angular-chart.js b/SplunkAppForWazuh/appserver/static/js/libs/angular-chart.js index a42d9cc97..27704b432 100644 --- a/SplunkAppForWazuh/appserver/static/js/libs/angular-chart.js +++ b/SplunkAppForWazuh/appserver/static/js/libs/angular-chart.js @@ -28,7 +28,6 @@ } }(function (angular, Chart) { 'use strict'; -console.log("loaded chart") Chart.defaults.global.multiTooltipTemplate = '<%if (datasetLabel){%><%=datasetLabel%>: <%}%><%= value %>'; Chart.defaults.global.tooltips.mode = 'label'; Chart.defaults.global.elements.line.borderWidth = 2; diff --git a/SplunkAppForWazuh/appserver/static/js/libs/col-resizable/col-resizable.js b/SplunkAppForWazuh/appserver/static/js/libs/col-resizable/col-resizable.js deleted file mode 100644 index 50bf6d0f5..000000000 --- a/SplunkAppForWazuh/appserver/static/js/libs/col-resizable/col-resizable.js +++ /dev/null @@ -1,422 +0,0 @@ -/** - _ _____ _ _ _ - | | __ \ (_) | | | | - ___ ___ | | |__) |___ ___ _ ______ _| |__ | | ___ - / __/ _ \| | _ // _ \/ __| |_ / _` | '_ \| |/ _ \ - | (_| (_) | | | \ \ __/\__ \ |/ / (_| | |_) | | __/ - \___\___/|_|_| \_\___||___/_/___\__,_|_.__/|_|\___| - - v1.6 - jQuery plugin created by Alvaro Prieto Lauroba - - Licences: MIT & GPL - Feel free to use or modify this plugin as far as my full name is kept - - If you are going to use this plug-in in production environments it is - strongly recommended to use its minified version: colResizable.min.js - -*/ - -(function(global, factory) { - typeof exports === 'object' && typeof module !== 'undefined' - ? (module.exports = factory()) - : typeof define === 'function' && define.amd - ? define(factory) - : (global.ColResizable = factory()); - })(this, function() { - 'use strict'; - - var d = $(document); //window object - var h = $("head"); //head object - var drag = null; //reference to the current grip that is being dragged - var tables = {}; //object of the already processed tables (table.id as key) - var count = 0; //internal count to create unique IDs when needed. - - //common strings for packing - var ID = "id"; - var PX = "px"; - var SIGNATURE ="JColResizer"; - var FLEX = "JCLRFlex"; - - //short-cuts - var I = parseInt; - var M = Math; - var ie = navigator.userAgent.indexOf('Trident/4.0')>0; - var S; - try{S = sessionStorage;}catch(e){} //Firefox crashes when executed as local file system - - //append required CSS rules - h.append(""); - - - /** - * Function to allow column resizing for table objects. It is the starting point to apply the plugin. - * @param {DOM node} tb - reference to the DOM table object to be enhanced - * @param {Object} options - some customization values - */ - var init = function( tb, options){ - var t = $(tb); //the table object is wrapped - t.opt = options; //each table has its own options available at anytime - t.mode = options.resizeMode; //shortcuts - t.dc = t.opt.disabledColumns; - if(t.opt.disable) return destroy(t); //the user is asking to destroy a previously colResized table - var id = t.id = t.attr(ID) || SIGNATURE+count++; //its id is obtained, if null new one is generated - t.p = t.opt.postbackSafe; //short-cut to detect postback safe - if(!t.is("table") || tables[id] && !t.opt.partialRefresh) return; //if the object is not a table or if it was already processed then it is ignored. - if (t.opt.hoverCursor !== 'e-resize') h.append(""); //if hoverCursor has been set, append the style - $(".JCLRgrips").remove(); - t.addClass(SIGNATURE).attr(ID, id).before('
'); //the grips container object is added. Signature class forces table rendering in fixed-layout mode to prevent column's min-width - t.g = []; t.c = []; t.w = t.width(); t.gc = t.prev(); t.f=t.opt.fixed; //t.c and t.g are arrays of columns and grips respectively - if(options.marginLeft) t.gc.css("marginLeft", options.marginLeft); //if the table contains margins, it must be specified - if(options.marginRight) t.gc.css("marginRight", options.marginRight); //since there is no (direct) way to obtain margin values in its original units (%, em, ...) - t.cs = I(ie? tb.cellSpacing || tb.currentStyle.borderSpacing :t.css('border-spacing'))||2; //table cellspacing (not even jQuery is fully cross-browser) - t.b = I(ie? tb.border || tb.currentStyle.borderLeftWidth :t.css('border-left-width'))||1; //outer border width (again cross-browser issues) - // if(!(tb.style.width || tb.width)) t.width(t.width()); //I am not an IE fan at all, but it is a pity that only IE has the currentStyle attribute working as expected. For this reason I can not check easily if the table has an explicit width or if it is rendered as "auto" - tables[id] = t; //the table object is stored using its id as key - createGrips(t); //grips are created - - }; - - - /** - * This function allows to remove any enhancements performed by this plugin on a previously processed table. - * @param {jQuery ref} t - table object - */ - var destroy = function(t){ - var id=t.attr(ID), t=tables[id]; //its table object is found - if(!t||!t.is("table")) return; //if none, then it wasn't processed - t.removeClass(SIGNATURE+" "+FLEX).gc.remove(); //class and grips are removed - delete tables[id]; //clean up data - }; - - - /** - * Function to create all the grips associated with the table given by parameters - * @param {jQuery ref} t - table object - */ - var createGrips = function(t){ - - var th = t.find(">thead>tr:first>th,>thead>tr:first>td"); //table headers are obtained - if(!th.length) th = t.find(">tbody>tr:first>th,>tr:first>th,>tbody>tr:first>td, >tr:first>td"); //but headers can also be included in different ways - th = th.filter(":visible"); //filter invisible columns - t.cg = t.find("col"); //a table can also contain a colgroup with col elements - t.ln = th.length; //table length is stored - if(t.p && S && S[t.id])memento(t,th); //if 'postbackSafe' is enabled and there is data for the current table, its coloumn layout is restored - th.each(function(i){ //iterate through the table column headers - var c = $(this); //jquery wrap for the current column - var dc = t.dc.indexOf(i)!=-1; //is this a disabled column? - var g = $(t.gc.append('
')[0].lastChild); //add the visual node to be used as grip - g.append(dc ? "": t.opt.gripInnerHtml).append('
'); - if(i == t.ln-1){ //if the current grip is the las one - g.addClass("JCLRLastGrip"); //add a different css class to stlye it in a different way if needed - if(t.f) g.html(""); //if the table resizing mode is set to fixed, the last grip is removed since table with can not change - } - g.bind('touchstart mousedown', onGripMouseDown); //bind the mousedown event to start dragging - - if (!dc){ - //if normal column bind the mousedown event to start dragging, if disabled then apply its css class - g.removeClass('JCLRdisabledGrip').bind('touchstart mousedown', onGripMouseDown); - }else{ - g.addClass('JCLRdisabledGrip'); - } - - g.t = t; g.i = i; g.c = c; c.w =c.width(); //some values are stored in the grip's node data as shortcut - t.g.push(g); t.c.push(c); //the current grip and column are added to its table object - c.width(c.w).removeAttr("width"); //the width of the column is converted into pixel-based measurements - g.data(SIGNATURE, {i:i, t:t.attr(ID), last: i == t.ln-1}); //grip index and its table name are stored in the HTML - }); - t.cg.removeAttr("width"); //remove the width attribute from elements in the colgroup - - t.find('td, th').not(th).not('table th, table td').each(function(){ - $(this).removeAttr('width'); //the width attribute is removed from all table cells which are not nested in other tables and dont belong to the header - }); - if(!t.f){ - t.removeAttr('width').addClass(FLEX); //if not fixed, let the table grow as needed - } - syncGrips(t); //the grips are positioned according to the current table layout - //there is a small problem, some cells in the table could contain dimension values interfering with the - //width value set by this plugin. Those values are removed - - }; - - - /** - * Function to allow the persistence of columns dimensions after a browser postback. It is based in - * the HTML5 sessionStorage object, which can be emulated for older browsers using sessionstorage.js - * @param {jQuery ref} t - table object - * @param {jQuery ref} th - reference to the first row elements (only set in deserialization) - */ - var memento = function(t, th){ - var w,m=0,i=0,aux =[],tw; - if(th){ //in deserialization mode (after a postback) - t.cg.removeAttr("width"); - if(t.opt.flush){ S[t.id] =""; return;} //if flush is activated, stored data is removed - w = S[t.id].split(";"); //column widths is obtained - tw = w[t.ln+1]; - if(!t.f && tw){ //if not fixed and table width data available its size is restored - t.width(tw*=1); - if(t.opt.overflow) { //if overfolw flag is set, restore table width also as table min-width - t.css('min-width', tw + PX); - t.w = tw; - } - } - for(;i*{cursor:"+ t.opt.dragCursor +"!important}"); //change the mouse cursor - g.addClass(t.opt.draggingClass); //add the dragging class (to allow some visual feedback) - drag = g; //the current grip is stored as the current dragging object - if(t.c[o.i].l) for(var i=0,c; ia;a++)for(i in o[a])n=o[a][i],o[a].hasOwnProperty(i)&&void 0!==n&&(e[i]=t.isPlainObject(n)?t.isPlainObject(e[i])?t.widget.extend({},e[i],n):t.widget.extend({},n):n);return e},t.widget.bridge=function(e,i){var n=i.prototype.widgetFullName||e;t.fn[e]=function(o){var a="string"==typeof o,r=s.call(arguments,1),l=this;return a?this.length||"instance"!==o?this.each(function(){var i,s=t.data(this,n);return"instance"===o?(l=s,!1):s?t.isFunction(s[o])&&"_"!==o.charAt(0)?(i=s[o].apply(s,r),i!==s&&void 0!==i?(l=i&&i.jquery?l.pushStack(i.get()):i,!1):void 0):t.error("no such method '"+o+"' for "+e+" widget instance"):t.error("cannot call methods on "+e+" prior to initialization; "+"attempted to call method '"+o+"'")}):l=void 0:(r.length&&(o=t.widget.extend.apply(null,[o].concat(r))),this.each(function(){var e=t.data(this,n);e?(e.option(o||{}),e._init&&e._init()):t.data(this,n,new i(o,this))})),l}},t.Widget=function(){},t.Widget._childConstructors=[],t.Widget.prototype={widgetName:"widget",widgetEventPrefix:"",defaultElement:"
",options:{classes:{},disabled:!1,create:null},_createWidget:function(e,s){s=t(s||this.defaultElement||this)[0],this.element=t(s),this.uuid=i++,this.eventNamespace="."+this.widgetName+this.uuid,this.bindings=t(),this.hoverable=t(),this.focusable=t(),this.classesElementLookup={},s!==this&&(t.data(s,this.widgetFullName,this),this._on(!0,this.element,{remove:function(t){t.target===s&&this.destroy()}}),this.document=t(s.style?s.ownerDocument:s.document||s),this.window=t(this.document[0].defaultView||this.document[0].parentWindow)),this.options=t.widget.extend({},this.options,this._getCreateOptions(),e),this._create(),this.options.disabled&&this._setOptionDisabled(this.options.disabled),this._trigger("create",null,this._getCreateEventData()),this._init()},_getCreateOptions:function(){return{}},_getCreateEventData:t.noop,_create:t.noop,_init:t.noop,destroy:function(){var e=this;this._destroy(),t.each(this.classesElementLookup,function(t,i){e._removeClass(i,t)}),this.element.off(this.eventNamespace).removeData(this.widgetFullName),this.widget().off(this.eventNamespace).removeAttr("aria-disabled"),this.bindings.off(this.eventNamespace)},_destroy:t.noop,widget:function(){return this.element},option:function(e,i){var s,n,o,a=e;if(0===arguments.length)return t.widget.extend({},this.options);if("string"==typeof e)if(a={},s=e.split("."),e=s.shift(),s.length){for(n=a[e]=t.widget.extend({},this.options[e]),o=0;s.length-1>o;o++)n[s[o]]=n[s[o]]||{},n=n[s[o]];if(e=s.pop(),1===arguments.length)return void 0===n[e]?null:n[e];n[e]=i}else{if(1===arguments.length)return void 0===this.options[e]?null:this.options[e];a[e]=i}return this._setOptions(a),this},_setOptions:function(t){var e;for(e in t)this._setOption(e,t[e]);return this},_setOption:function(t,e){return"classes"===t&&this._setOptionClasses(e),this.options[t]=e,"disabled"===t&&this._setOptionDisabled(e),this},_setOptionClasses:function(e){var i,s,n;for(i in e)n=this.classesElementLookup[i],e[i]!==this.options.classes[i]&&n&&n.length&&(s=t(n.get()),this._removeClass(n,i),s.addClass(this._classes({element:s,keys:i,classes:e,add:!0})))},_setOptionDisabled:function(t){this._toggleClass(this.widget(),this.widgetFullName+"-disabled",null,!!t),t&&(this._removeClass(this.hoverable,null,"ui-state-hover"),this._removeClass(this.focusable,null,"ui-state-focus"))},enable:function(){return this._setOptions({disabled:!1})},disable:function(){return this._setOptions({disabled:!0})},_classes:function(e){function i(i,o){var a,r;for(r=0;i.length>r;r++)a=n.classesElementLookup[i[r]]||t(),a=e.add?t(t.unique(a.get().concat(e.element.get()))):t(a.not(e.element).get()),n.classesElementLookup[i[r]]=a,s.push(i[r]),o&&e.classes[i[r]]&&s.push(e.classes[i[r]])}var s=[],n=this;return e=t.extend({element:this.element,classes:this.options.classes||{}},e),this._on(e.element,{remove:"_untrackClassesElement"}),e.keys&&i(e.keys.match(/\S+/g)||[],!0),e.extra&&i(e.extra.match(/\S+/g)||[]),s.join(" ")},_untrackClassesElement:function(e){var i=this;t.each(i.classesElementLookup,function(s,n){-1!==t.inArray(e.target,n)&&(i.classesElementLookup[s]=t(n.not(e.target).get()))})},_removeClass:function(t,e,i){return this._toggleClass(t,e,i,!1)},_addClass:function(t,e,i){return this._toggleClass(t,e,i,!0)},_toggleClass:function(t,e,i,s){s="boolean"==typeof s?s:i;var n="string"==typeof t||null===t,o={extra:n?e:i,keys:n?t:e,element:n?this.element:t,add:s};return o.element.toggleClass(this._classes(o),s),this},_on:function(e,i,s){var n,o=this;"boolean"!=typeof e&&(s=i,i=e,e=!1),s?(i=n=t(i),this.bindings=this.bindings.add(i)):(s=i,i=this.element,n=this.widget()),t.each(s,function(s,a){function r(){return e||o.options.disabled!==!0&&!t(this).hasClass("ui-state-disabled")?("string"==typeof a?o[a]:a).apply(o,arguments):void 0}"string"!=typeof a&&(r.guid=a.guid=a.guid||r.guid||t.guid++);var l=s.match(/^([\w:-]*)\s*(.*)$/),h=l[1]+o.eventNamespace,c=l[2];c?n.on(h,c,r):i.on(h,r)})},_off:function(e,i){i=(i||"").split(" ").join(this.eventNamespace+" ")+this.eventNamespace,e.off(i).off(i),this.bindings=t(this.bindings.not(e).get()),this.focusable=t(this.focusable.not(e).get()),this.hoverable=t(this.hoverable.not(e).get())},_delay:function(t,e){function i(){return("string"==typeof t?s[t]:t).apply(s,arguments)}var s=this;return setTimeout(i,e||0)},_hoverable:function(e){this.hoverable=this.hoverable.add(e),this._on(e,{mouseenter:function(e){this._addClass(t(e.currentTarget),null,"ui-state-hover")},mouseleave:function(e){this._removeClass(t(e.currentTarget),null,"ui-state-hover")}})},_focusable:function(e){this.focusable=this.focusable.add(e),this._on(e,{focusin:function(e){this._addClass(t(e.currentTarget),null,"ui-state-focus")},focusout:function(e){this._removeClass(t(e.currentTarget),null,"ui-state-focus")}})},_trigger:function(e,i,s){var n,o,a=this.options[e];if(s=s||{},i=t.Event(i),i.type=(e===this.widgetEventPrefix?e:this.widgetEventPrefix+e).toLowerCase(),i.target=this.element[0],o=i.originalEvent)for(n in o)n in i||(i[n]=o[n]);return this.element.trigger(i,s),!(t.isFunction(a)&&a.apply(this.element[0],[i].concat(s))===!1||i.isDefaultPrevented())}},t.each({show:"fadeIn",hide:"fadeOut"},function(e,i){t.Widget.prototype["_"+e]=function(s,n,o){"string"==typeof n&&(n={effect:n});var a,r=n?n===!0||"number"==typeof n?i:n.effect||i:e;n=n||{},"number"==typeof n&&(n={duration:n}),a=!t.isEmptyObject(n),n.complete=o,n.delay&&s.delay(n.delay),a&&t.effects&&t.effects.effect[r]?s[e](n):r!==e&&s[r]?s[r](n.duration,n.easing,o):s.queue(function(i){t(this)[e](),o&&o.call(s[0]),i()})}}),t.widget,function(){function e(t,e,i){return[parseFloat(t[0])*(u.test(t[0])?e/100:1),parseFloat(t[1])*(u.test(t[1])?i/100:1)]}function i(e,i){return parseInt(t.css(e,i),10)||0}function s(e){var i=e[0];return 9===i.nodeType?{width:e.width(),height:e.height(),offset:{top:0,left:0}}:t.isWindow(i)?{width:e.width(),height:e.height(),offset:{top:e.scrollTop(),left:e.scrollLeft()}}:i.preventDefault?{width:0,height:0,offset:{top:i.pageY,left:i.pageX}}:{width:e.outerWidth(),height:e.outerHeight(),offset:e.offset()}}var n,o=Math.max,a=Math.abs,r=/left|center|right/,l=/top|center|bottom/,h=/[\+\-]\d+(\.[\d]+)?%?/,c=/^\w+/,u=/%$/,d=t.fn.position;t.position={scrollbarWidth:function(){if(void 0!==n)return n;var e,i,s=t("
"),o=s.children()[0];return t("body").append(s),e=o.offsetWidth,s.css("overflow","scroll"),i=o.offsetWidth,e===i&&(i=s[0].clientWidth),s.remove(),n=e-i},getScrollInfo:function(e){var i=e.isWindow||e.isDocument?"":e.element.css("overflow-x"),s=e.isWindow||e.isDocument?"":e.element.css("overflow-y"),n="scroll"===i||"auto"===i&&e.widthi?"left":e>0?"right":"center",vertical:0>r?"top":s>0?"bottom":"middle"};h>p&&p>a(e+i)&&(u.horizontal="center"),c>f&&f>a(s+r)&&(u.vertical="middle"),u.important=o(a(e),a(i))>o(a(s),a(r))?"horizontal":"vertical",n.using.call(this,t,u)}),l.offset(t.extend(C,{using:r}))})},t.ui.position={fit:{left:function(t,e){var i,s=e.within,n=s.isWindow?s.scrollLeft:s.offset.left,a=s.width,r=t.left-e.collisionPosition.marginLeft,l=n-r,h=r+e.collisionWidth-a-n;e.collisionWidth>a?l>0&&0>=h?(i=t.left+l+e.collisionWidth-a-n,t.left+=l-i):t.left=h>0&&0>=l?n:l>h?n+a-e.collisionWidth:n:l>0?t.left+=l:h>0?t.left-=h:t.left=o(t.left-r,t.left)},top:function(t,e){var i,s=e.within,n=s.isWindow?s.scrollTop:s.offset.top,a=e.within.height,r=t.top-e.collisionPosition.marginTop,l=n-r,h=r+e.collisionHeight-a-n;e.collisionHeight>a?l>0&&0>=h?(i=t.top+l+e.collisionHeight-a-n,t.top+=l-i):t.top=h>0&&0>=l?n:l>h?n+a-e.collisionHeight:n:l>0?t.top+=l:h>0?t.top-=h:t.top=o(t.top-r,t.top)}},flip:{left:function(t,e){var i,s,n=e.within,o=n.offset.left+n.scrollLeft,r=n.width,l=n.isWindow?n.scrollLeft:n.offset.left,h=t.left-e.collisionPosition.marginLeft,c=h-l,u=h+e.collisionWidth-r-l,d="left"===e.my[0]?-e.elemWidth:"right"===e.my[0]?e.elemWidth:0,p="left"===e.at[0]?e.targetWidth:"right"===e.at[0]?-e.targetWidth:0,f=-2*e.offset[0];0>c?(i=t.left+d+p+f+e.collisionWidth-r-o,(0>i||a(c)>i)&&(t.left+=d+p+f)):u>0&&(s=t.left-e.collisionPosition.marginLeft+d+p+f-l,(s>0||u>a(s))&&(t.left+=d+p+f))},top:function(t,e){var i,s,n=e.within,o=n.offset.top+n.scrollTop,r=n.height,l=n.isWindow?n.scrollTop:n.offset.top,h=t.top-e.collisionPosition.marginTop,c=h-l,u=h+e.collisionHeight-r-l,d="top"===e.my[1],p=d?-e.elemHeight:"bottom"===e.my[1]?e.elemHeight:0,f="top"===e.at[1]?e.targetHeight:"bottom"===e.at[1]?-e.targetHeight:0,g=-2*e.offset[1];0>c?(s=t.top+p+f+g+e.collisionHeight-r-o,(0>s||a(c)>s)&&(t.top+=p+f+g)):u>0&&(i=t.top-e.collisionPosition.marginTop+p+f+g-l,(i>0||u>a(i))&&(t.top+=p+f+g))}},flipfit:{left:function(){t.ui.position.flip.left.apply(this,arguments),t.ui.position.fit.left.apply(this,arguments)},top:function(){t.ui.position.flip.top.apply(this,arguments),t.ui.position.fit.top.apply(this,arguments)}}}}(),t.ui.position,t.extend(t.expr[":"],{data:t.expr.createPseudo?t.expr.createPseudo(function(e){return function(i){return!!t.data(i,e)}}):function(e,i,s){return!!t.data(e,s[3])}}),t.fn.extend({disableSelection:function(){var t="onselectstart"in document.createElement("div")?"selectstart":"mousedown";return function(){return this.on(t+".ui-disableSelection",function(t){t.preventDefault()})}}(),enableSelection:function(){return this.off(".ui-disableSelection")}}),t.ui.focusable=function(i,s){var n,o,a,r,l,h=i.nodeName.toLowerCase();return"area"===h?(n=i.parentNode,o=n.name,i.href&&o&&"map"===n.nodeName.toLowerCase()?(a=t("img[usemap='#"+o+"']"),a.length>0&&a.is(":visible")):!1):(/^(input|select|textarea|button|object)$/.test(h)?(r=!i.disabled,r&&(l=t(i).closest("fieldset")[0],l&&(r=!l.disabled))):r="a"===h?i.href||s:s,r&&t(i).is(":visible")&&e(t(i)))},t.extend(t.expr[":"],{focusable:function(e){return t.ui.focusable(e,null!=t.attr(e,"tabindex"))}}),t.ui.focusable,t.fn.form=function(){return"string"==typeof this[0].form?this.closest("form"):t(this[0].form)},t.ui.formResetMixin={_formResetHandler:function(){var e=t(this);setTimeout(function(){var i=e.data("ui-form-reset-instances");t.each(i,function(){this.refresh()})})},_bindFormResetHandler:function(){if(this.form=this.element.form(),this.form.length){var t=this.form.data("ui-form-reset-instances")||[];t.length||this.form.on("reset.ui-form-reset",this._formResetHandler),t.push(this),this.form.data("ui-form-reset-instances",t)}},_unbindFormResetHandler:function(){if(this.form.length){var e=this.form.data("ui-form-reset-instances");e.splice(t.inArray(this,e),1),e.length?this.form.data("ui-form-reset-instances",e):this.form.removeData("ui-form-reset-instances").off("reset.ui-form-reset")}}},"1.7"===t.fn.jquery.substring(0,3)&&(t.each(["Width","Height"],function(e,i){function s(e,i,s,o){return t.each(n,function(){i-=parseFloat(t.css(e,"padding"+this))||0,s&&(i-=parseFloat(t.css(e,"border"+this+"Width"))||0),o&&(i-=parseFloat(t.css(e,"margin"+this))||0)}),i}var n="Width"===i?["Left","Right"]:["Top","Bottom"],o=i.toLowerCase(),a={innerWidth:t.fn.innerWidth,innerHeight:t.fn.innerHeight,outerWidth:t.fn.outerWidth,outerHeight:t.fn.outerHeight};t.fn["inner"+i]=function(e){return void 0===e?a["inner"+i].call(this):this.each(function(){t(this).css(o,s(this,e)+"px")})},t.fn["outer"+i]=function(e,n){return"number"!=typeof e?a["outer"+i].call(this,e):this.each(function(){t(this).css(o,s(this,e,!0,n)+"px")})}}),t.fn.addBack=function(t){return this.add(null==t?this.prevObject:this.prevObject.filter(t))}),t.ui.keyCode={BACKSPACE:8,COMMA:188,DELETE:46,DOWN:40,END:35,ENTER:13,ESCAPE:27,HOME:36,LEFT:37,PAGE_DOWN:34,PAGE_UP:33,PERIOD:190,RIGHT:39,SPACE:32,TAB:9,UP:38},t.ui.escapeSelector=function(){var t=/([!"#$%&'()*+,./:;<=>?@[\]^`{|}~])/g;return function(e){return e.replace(t,"\\$1")}}(),t.fn.labels=function(){var e,i,s,n,o;return this[0].labels&&this[0].labels.length?this.pushStack(this[0].labels):(n=this.eq(0).parents("label"),s=this.attr("id"),s&&(e=this.eq(0).parents().last(),o=e.add(e.length?e.siblings():this.siblings()),i="label[for='"+t.ui.escapeSelector(s)+"']",n=n.add(o.find(i).addBack(i))),this.pushStack(n))},t.fn.scrollParent=function(e){var i=this.css("position"),s="absolute"===i,n=e?/(auto|scroll|hidden)/:/(auto|scroll)/,o=this.parents().filter(function(){var e=t(this);return s&&"static"===e.css("position")?!1:n.test(e.css("overflow")+e.css("overflow-y")+e.css("overflow-x"))}).eq(0);return"fixed"!==i&&o.length?o:t(this[0].ownerDocument||document)},t.extend(t.expr[":"],{tabbable:function(e){var i=t.attr(e,"tabindex"),s=null!=i;return(!s||i>=0)&&t.ui.focusable(e,s)}}),t.fn.extend({uniqueId:function(){var t=0;return function(){return this.each(function(){this.id||(this.id="ui-id-"+ ++t)})}}(),removeUniqueId:function(){return this.each(function(){/^ui-id-\d+$/.test(this.id)&&t(this).removeAttr("id")})}})}); \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/main.js b/SplunkAppForWazuh/appserver/static/js/main.js index 673c91619..87c8d4372 100644 --- a/SplunkAppForWazuh/appserver/static/js/main.js +++ b/SplunkAppForWazuh/appserver/static/js/main.js @@ -21,14 +21,14 @@ require.config({ // JSON2XML js2xmlparser: 'js/libs/json2xml/jsontoxml', - // COL RESIZABLE - colResizable: 'js/libs/col-resizable/col-resizable', - // File saver FileSaver: 'js/libs/file-saver/file-saver', // dom-to-image - domToImg: 'js/libs/required-dom-to-image/src/dom-to-image' + domToImg: 'js/libs/required-dom-to-image/src/dom-to-image', + + // JqueryUI + JqueryUI: 'js/libs/jquery-ui' }, // Add angular modules that does not support AMD out of the box, put it in a shim diff --git a/SplunkAppForWazuh/appserver/static/js/run/run.js b/SplunkAppForWazuh/appserver/static/js/run/run.js index 4f7e4b53c..2b3f718b2 100644 --- a/SplunkAppForWazuh/appserver/static/js/run/run.js +++ b/SplunkAppForWazuh/appserver/static/js/run/run.js @@ -73,6 +73,10 @@ define(['./module'], function(module) { $transitions.onStart({}, async trans => { $rootScope.$broadcast('loading', { status: true }) const to = trans.to().name + const from = trans.from().name + if (to !== from && from !== 'discover') { + $currentDataService.cleanFilters() + } if ( to != 'settings.about' && to != 'settings.extensions' && @@ -100,14 +104,6 @@ define(['./module'], function(module) { $rootScope.$broadcast('stateChanged', to) } //Select secondary states - if ( - to === 'overview' || - to === 'agents' || - to === 'agent-overview' || - to === 'manager' - ) { - $currentDataService.cleanFilters() - } if (to.startsWith('agent') || to.startsWith('ag-')) { if ( diff --git a/SplunkAppForWazuh/appserver/static/js/services/file-editor/file-editor.js b/SplunkAppForWazuh/appserver/static/js/services/file-editor/file-editor.js index d3ba51aea..695be63b8 100644 --- a/SplunkAppForWazuh/appserver/static/js/services/file-editor/file-editor.js +++ b/SplunkAppForWazuh/appserver/static/js/services/file-editor/file-editor.js @@ -49,10 +49,12 @@ define(['../module'], function(module) { } } - async getConfiguration(file, dir, node) { + async getConfiguration(file, dir, node, readOnly = false) { try { let path = dir ? `${dir}/${file}` : file - path = path.startsWith('etc/') ? path : `etc/${path}` + if (!readOnly) { + path = path.startsWith('etc/') ? path : `etc/${path}` + } node = node ? `cluster/${node}` : 'manager' const url = `/${node}/files?path=${path}` const result = await this.getConfig(url) diff --git a/SplunkAppForWazuh/appserver/static/js/services/visualizations/chart/gauge-chart.js b/SplunkAppForWazuh/appserver/static/js/services/visualizations/chart/gauge-chart.js new file mode 100644 index 000000000..496d35096 --- /dev/null +++ b/SplunkAppForWazuh/appserver/static/js/services/visualizations/chart/gauge-chart.js @@ -0,0 +1,42 @@ +define(['splunkjs/mvc/simplexml/element/chart', '../viz/viz'], function( + ChartElement, + Viz + ) { + 'use strict' + + return class GaugeChart extends Viz { + /** + * Generates a new Column Chart Splunk visualization + * @param {String} id + * @param {String} search + * @param {String} attachedElement + * @param {scope} scope + */ + constructor(id, search, attachedElement,conf, scope) { + const gaugeType = conf.gaugeType ? conf.gaugeType : false + const trellisEnabled = conf.trellisEnabled ? conf.trellisEnabled : false + super( + new ChartElement( + { + id: `${id}`, + resizable: true, + 'charting.drilldown': 'none', + 'charting.chart': gaugeType, + 'trellis.enabled': trellisEnabled, + 'charting.chart.usePercentageRange' : true, + 'charting.chart.usePercentageValue' : true, + 'charting.chart.style' : 'minimal', + 'charting.gaugeColors' : "[0xB84B56,0xECDA47,0x26AC85]", + 'height' : '250', + managerid: `${id}Search`, + el: $(`#${attachedElement}`) + }, + { tokens: true, tokenNamespace: 'submitted' } + ).render(), + id, + search, + scope + ) + } + } + }) \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/services/visualizations/chart/pie-chart.js b/SplunkAppForWazuh/appserver/static/js/services/visualizations/chart/pie-chart.js index aa4219702..63f300744 100644 --- a/SplunkAppForWazuh/appserver/static/js/services/visualizations/chart/pie-chart.js +++ b/SplunkAppForWazuh/appserver/static/js/services/visualizations/chart/pie-chart.js @@ -12,7 +12,10 @@ define(['splunkjs/mvc/simplexml/element/chart', '../viz/viz'], function( * @param {String} attachedElement * @param {scope} scope */ - constructor(id, search, attachedElement, scope) { + constructor(id, search, attachedElement,scope, options) { + let trellisEnabled = false + if(options) + trellisEnabled = options.trellisEnabled ? options.trellisEnabled : false super( new ChartElement( { @@ -20,6 +23,7 @@ define(['splunkjs/mvc/simplexml/element/chart', '../viz/viz'], function( resizable: true, 'charting.drilldown': 'none', 'charting.chart': 'pie', + 'trellis.enabled': trellisEnabled, managerid: `${id}Search`, el: $(`#${attachedElement}`) }, diff --git a/SplunkAppForWazuh/appserver/static/js/services/visualizations/chart/single-value.js b/SplunkAppForWazuh/appserver/static/js/services/visualizations/chart/single-value.js new file mode 100644 index 000000000..ac5b3f2e6 --- /dev/null +++ b/SplunkAppForWazuh/appserver/static/js/services/visualizations/chart/single-value.js @@ -0,0 +1,32 @@ +define(['splunkjs/mvc/simplexml/element/single', '../viz/viz'], function( + SingleElement, + Viz + ) { + 'use strict' + + return class SingleValue extends Viz { + /** + * Generates a new Single Value Splunk visualization + * @param {String} id + * @param {String} search + * @param {String} attachedElement + * @param {scope} scope + */ + constructor(id, search, attachedElement, scope) { + super( + new SingleElement( + { + id: `${id}`, + managerid: `${id}Search`, + 'height' : '190', + el: $(`#${attachedElement}`) + }, + { tokens: true, tokenNamespace: 'submitted' } + ).render(), + id, + search, + scope + ) + } + } + }) \ No newline at end of file diff --git a/SplunkAppForWazuh/appserver/static/js/utils/config-handler.js b/SplunkAppForWazuh/appserver/static/js/utils/config-handler.js index 2fd04a8f0..03daf677b 100644 --- a/SplunkAppForWazuh/appserver/static/js/utils/config-handler.js +++ b/SplunkAppForWazuh/appserver/static/js/utils/config-handler.js @@ -66,8 +66,11 @@ define([ $scope ) } else if (sections[0].component === 'logcollector') { - const logcollector = - currentConfigReq['logcollector-localfile'].localfile + const logcollector = currentConfigReq['logcollector-localfile'].localfile + $scope.currentConfig['logcollector-localfile']['localfile-logs'] = + logcollector.filter(log => log.logformat !== 'command' && log.logformat !== 'full_command') + $scope.currentConfig['logcollector-localfile']['localfile-commands'] = + logcollector.filter(log => log.logformat === 'command' || log.logformat === 'full_command') logcollector.map(log => { const keys = Object.keys(log) if ( diff --git a/SplunkAppForWazuh/default/data/ui/html/index.html b/SplunkAppForWazuh/default/data/ui/html/index.html index 1afbdd3cb..84753428e 100644 --- a/SplunkAppForWazuh/default/data/ui/html/index.html +++ b/SplunkAppForWazuh/default/data/ui/html/index.html @@ -22,7 +22,7 @@ - +
diff --git a/SplunkAppForWazuh/default/package.conf b/SplunkAppForWazuh/default/package.conf index 97c30d968..26ed66adc 100644 --- a/SplunkAppForWazuh/default/package.conf +++ b/SplunkAppForWazuh/default/package.conf @@ -1,9 +1,9 @@ [app] version = 3.9.0 -revision = 23 +revision = 25 [wazuh] version = 3.9.0 [splunk] -version = 7.2.4 \ No newline at end of file +version = 7.2.5 \ No newline at end of file diff --git a/SplunkAppForWazuh/default/props.conf b/SplunkAppForWazuh/default/props.conf new file mode 100644 index 000000000..bce9b0844 --- /dev/null +++ b/SplunkAppForWazuh/default/props.conf @@ -0,0 +1,4 @@ +[wazuh] +INDEXED_EXTRACTIONS = JSON +KV_MODE = none +AUTO_KV_JSON = false \ No newline at end of file diff --git a/package.json b/package.json index 051a701bd..389538b19 100644 --- a/package.json +++ b/package.json @@ -1,8 +1,8 @@ { "name": "wazuh-splunk", "version": "3.9.0", - "revision": "23", - "code": "23-0", + "revision": "25", + "code": "25-0", "description": "Splunk app for Wazuh", "main": "index.js", "keywords": [