diff --git a/dashboard/siem_report.json b/dashboard/siem_report.json deleted file mode 100644 index 85b0d77..0000000 --- a/dashboard/siem_report.json +++ /dev/null @@ -1,347 +0,0 @@ -{ - "generated_at": "2026-07-29T00:57:48.516747Z", - "meta": { - "endpoints": [ - "web-server (endpoint-1)", - "firewall (endpoint-2)", - "ssh-auth (endpoint-3)" - ], - "lines_parsed": { - "web-server (endpoint-1)": 45, - "firewall (endpoint-2)": 34, - "ssh-auth (endpoint-3)": 27 - } - }, - "stats": { - "total_alerts": 17, - "by_severity": { - "critical": 9, - "high": 5, - "medium": 3, - "low": 0 - }, - "unique_malicious_ips": 4, - "total_events_parsed": 106 - }, - "alerts": [ - { - "id": "ALT-0012", - "timestamp": "2026-07-27T10:07:41", - "endpoint": "ssh-auth (endpoint-3)", - "src_ip": "198.51.100.234", - "alert_type": "BRUTE_FORCE_SSH", - "severity": "high", - "description": "12 failed SSH login attempts within 300s trying 9 usernames (admin, administrator, backup, guest, oracle, postgres)", - "evidence": [ - "Jul 27 10:07:41 app-srv-05 sshd[10201]: Failed password for invalid user admin from 198.51.100.234 port 39001 ssh2", - "Jul 27 10:07:43 app-srv-05 sshd[10202]: Failed password for invalid user admin from 198.51.100.234 port 39002 ssh2", - "Jul 27 10:07:45 app-srv-05 sshd[10203]: Failed password for invalid user administrator from 198.51.100.234 port 39003 ssh2", - "Jul 27 10:07:47 app-srv-05 sshd[10204]: Failed password for invalid user user from 198.51.100.234 port 39004 ssh2", - "Jul 27 10:07:49 app-srv-05 sshd[10205]: Failed password for invalid user guest from 198.51.100.234 port 39005 ssh2" - ] - }, - { - "id": "ALT-0006", - "timestamp": "2026-07-27T10:06:11", - "endpoint": "web-server (endpoint-1)", - "src_ip": "192.0.2.77", - "alert_type": "SQL_INJECTION", - "severity": "critical", - "description": "Sql Injection attempt detected in request to /api/users?id=1'%20OR%20'1'='1", - "evidence": [ - "192.0.2.77 - - [27/Jul/2026:10:06:11 +0000] \"GET /api/users?id=1'%20OR%20'1'='1 HTTP/1.1\" 500 640 \"-\" \"python-requests/2.31\"" - ] - }, - { - "id": "ALT-0009", - "timestamp": "2026-07-27T10:06:00", - "endpoint": "web-server (endpoint-1)", - "src_ip": "192.0.2.77", - "alert_type": "HIGH_REQUEST_RATE", - "severity": "medium", - "description": "21 requests from a single IP within 60s (possible scraping/DoS/automation)", - "evidence": [ - "192.0.2.77 - - [27/Jul/2026:10:06:00 +0000] \"GET /api/data?page=1 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"", - "192.0.2.77 - - [27/Jul/2026:10:06:01 +0000] \"GET /api/data?page=2 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"", - "192.0.2.77 - - [27/Jul/2026:10:06:01 +0000] \"GET /api/data?page=3 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"", - "192.0.2.77 - - [27/Jul/2026:10:06:02 +0000] \"GET /api/data?page=4 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"", - "192.0.2.77 - - [27/Jul/2026:10:06:02 +0000] \"GET /api/data?page=5 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"" - ] - }, - { - "id": "ALT-0016", - "timestamp": "2026-07-27T10:06:00", - "endpoint": "web-server (endpoint-1)", - "src_ip": "192.0.2.77", - "alert_type": "BLACKLISTED_IP_ACTIVITY", - "severity": "critical", - "description": "Traffic from known-malicious IP 192.0.2.77: Listed in external threat-intel feed (example seed entry)", - "evidence": [ - "192.0.2.77 - - [27/Jul/2026:10:06:00 +0000] \"GET /api/data?page=1 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"" - ] - }, - { - "id": "ALT-0013", - "timestamp": "2026-07-27T10:05:24", - "endpoint": "ssh-auth (endpoint-3)", - "src_ip": "192.0.2.77", - "alert_type": "ACCOUNT_COMPROMISE_SUSPECTED", - "severity": "critical", - "description": "Successful SSH login as 'root' immediately following a brute-force burst from the same IP -- account may be compromised", - "evidence": [ - "Jul 27 10:05:24 app-srv-05 sshd[10111]: Accepted password for root from 192.0.2.77 port 41011 ssh2" - ] - }, - { - "id": "ALT-0011", - "timestamp": "2026-07-27T10:05:12", - "endpoint": "ssh-auth (endpoint-3)", - "src_ip": "192.0.2.77", - "alert_type": "BRUTE_FORCE_SSH", - "severity": "high", - "description": "10 failed SSH login attempts within 300s trying 7 usernames (admin, deploy, oracle, postgres, root, test)", - "evidence": [ - "Jul 27 10:05:12 app-srv-05 sshd[10101]: Failed password for invalid user admin from 192.0.2.77 port 41001 ssh2", - "Jul 27 10:05:13 app-srv-05 sshd[10102]: Failed password for invalid user root from 192.0.2.77 port 41002 ssh2", - "Jul 27 10:05:14 app-srv-05 sshd[10103]: Failed password for invalid user test from 192.0.2.77 port 41003 ssh2", - "Jul 27 10:05:15 app-srv-05 sshd[10104]: Failed password for invalid user oracle from 192.0.2.77 port 41004 ssh2", - "Jul 27 10:05:16 app-srv-05 sshd[10105]: Failed password for invalid user ubuntu from 192.0.2.77 port 41005 ssh2" - ] - }, - { - "id": "ALT-0015", - "timestamp": "2026-07-27T10:05:12", - "endpoint": "ssh-auth (endpoint-3)", - "src_ip": "192.0.2.77", - "alert_type": "BLACKLISTED_IP_ACTIVITY", - "severity": "critical", - "description": "Traffic from known-malicious IP 192.0.2.77: Listed in external threat-intel feed (example seed entry)", - "evidence": [ - "Jul 27 10:05:12 app-srv-05 sshd[10101]: Failed password for invalid user admin from 192.0.2.77 port 41001 ssh2" - ] - }, - { - "id": "ALT-0010", - "timestamp": "2026-07-27T10:05:01", - "endpoint": "firewall (endpoint-2)", - "src_ip": "192.0.2.77", - "alert_type": "PORT_SCAN", - "severity": "high", - "description": "Port scan detected: 20 distinct destination ports probed against 10.0.0.5 within 120s (17 denied, 3 allowed)", - "evidence": [ - "2026-07-27 10:05:01 SRC=192.0.2.77 SPT=33001 DST=10.0.0.5 DPT=20 PROTO=TCP ACTION=DENY", - "2026-07-27 10:05:01 SRC=192.0.2.77 SPT=33002 DST=10.0.0.5 DPT=21 PROTO=TCP ACTION=DENY", - "2026-07-27 10:05:02 SRC=192.0.2.77 SPT=33003 DST=10.0.0.5 DPT=22 PROTO=TCP ACTION=ALLOW", - "2026-07-27 10:05:02 SRC=192.0.2.77 SPT=33004 DST=10.0.0.5 DPT=23 PROTO=TCP ACTION=DENY", - "2026-07-27 10:05:03 SRC=192.0.2.77 SPT=33005 DST=10.0.0.5 DPT=25 PROTO=TCP ACTION=DENY" - ] - }, - { - "id": "ALT-0014", - "timestamp": "2026-07-27T10:05:01", - "endpoint": "firewall (endpoint-2)", - "src_ip": "192.0.2.77", - "alert_type": "BLACKLISTED_IP_ACTIVITY", - "severity": "critical", - "description": "Traffic from known-malicious IP 192.0.2.77: Listed in external threat-intel feed (example seed entry)", - "evidence": [ - "2026-07-27 10:05:01 SRC=192.0.2.77 SPT=33001 DST=10.0.0.5 DPT=20 PROTO=TCP ACTION=DENY" - ] - }, - { - "id": "ALT-0017", - "timestamp": "2026-07-27T10:05:01", - "endpoint": "correlation-engine", - "src_ip": "192.0.2.77", - "alert_type": "MULTI_VECTOR_ATTACK", - "severity": "critical", - "description": "IP 192.0.2.77 triggered alerts across 3 different endpoints (firewall (endpoint-2), ssh-auth (endpoint-3), web-server (endpoint-1)) -- consistent with a coordinated, multi-stage attack (recon -> exploitation -> access)", - "evidence": [] - }, - { - "id": "ALT-0008", - "timestamp": "2026-07-27T10:03:01", - "endpoint": "web-server (endpoint-1)", - "src_ip": "203.0.113.99", - "alert_type": "RECON_SCANNER", - "severity": "medium", - "description": "Automated vulnerability scan detected (nikto): 7 probe requests against paths such as /admin, /admin.php, /phpmyadmin/", - "evidence": [ - "203.0.113.99 - - [27/Jul/2026:10:03:01 +0000] \"GET /admin HTTP/1.1\" 404 190 \"-\" \"Mozilla/5.0 (compatible; Nikto/2.5.0)\"", - "203.0.113.99 - - [27/Jul/2026:10:03:02 +0000] \"GET /admin.php HTTP/1.1\" 404 190 \"-\" \"Mozilla/5.0 (compatible; Nikto/2.5.0)\"", - "203.0.113.99 - - [27/Jul/2026:10:03:03 +0000] \"GET /phpmyadmin/ HTTP/1.1\" 404 190 \"-\" \"Mozilla/5.0 (compatible; Nikto/2.5.0)\"", - "203.0.113.99 - - [27/Jul/2026:10:03:04 +0000] \"GET /.env HTTP/1.1\" 404 190 \"-\" \"Mozilla/5.0 (compatible; Nikto/2.5.0)\"", - "203.0.113.99 - - [27/Jul/2026:10:03:05 +0000] \"GET /wp-login.php HTTP/1.1\" 404 190 \"-\" \"Mozilla/5.0 (compatible; Nikto/2.5.0)\"" - ] - }, - { - "id": "ALT-0005", - "timestamp": "2026-07-27T10:01:12", - "endpoint": "web-server (endpoint-1)", - "src_ip": "203.0.113.66", - "alert_type": "PATH_TRAVERSAL", - "severity": "high", - "description": "Path Traversal attempt detected in request to /download?file=../../../../etc/passwd", - "evidence": [ - "203.0.113.66 - - [27/Jul/2026:10:01:12 +0000] \"GET /download?file=../../../../etc/passwd HTTP/1.1\" 403 210 \"-\" \"sqlmap/1.7.2#stable\"" - ] - }, - { - "id": "ALT-0004", - "timestamp": "2026-07-27T10:01:09", - "endpoint": "web-server (endpoint-1)", - "src_ip": "203.0.113.66", - "alert_type": "XSS", - "severity": "high", - "description": "Xss attempt detected in request to /search?q=", - "evidence": [ - "203.0.113.66 - - [27/Jul/2026:10:01:09 +0000] \"GET /search?q= HTTP/1.1\" 200 998 \"-\" \"sqlmap/1.7.2#stable\"" - ] - }, - { - "id": "ALT-0003", - "timestamp": "2026-07-27T10:01:06", - "endpoint": "web-server (endpoint-1)", - "src_ip": "203.0.113.66", - "alert_type": "SQL_INJECTION", - "severity": "critical", - "description": "Sql Injection attempt detected in request to /products?id=1'%20AND%20SLEEP(5)--", - "evidence": [ - "203.0.113.66 - - [27/Jul/2026:10:01:06 +0000] \"GET /products?id=1'%20AND%20SLEEP(5)-- HTTP/1.1\" 500 812 \"-\" \"sqlmap/1.7.2#stable\"" - ] - }, - { - "id": "ALT-0002", - "timestamp": "2026-07-27T10:01:04", - "endpoint": "web-server (endpoint-1)", - "src_ip": "203.0.113.66", - "alert_type": "SQL_INJECTION", - "severity": "critical", - "description": "Sql Injection attempt detected in request to /products?id=1%20UNION%20SELECT%20username,password%20FROM%20users--", - "evidence": [ - "203.0.113.66 - - [27/Jul/2026:10:01:04 +0000] \"GET /products?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1\" 500 812 \"-\" \"sqlmap/1.7.2#stable\"" - ] - }, - { - "id": "ALT-0001", - "timestamp": "2026-07-27T10:01:02", - "endpoint": "web-server (endpoint-1)", - "src_ip": "203.0.113.66", - "alert_type": "SQL_INJECTION", - "severity": "critical", - "description": "Sql Injection attempt detected in request to /login.php?user=admin'%20OR%20'1'='1'--", - "evidence": [ - "203.0.113.66 - - [27/Jul/2026:10:01:02 +0000] \"GET /login.php?user=admin'%20OR%20'1'='1'-- HTTP/1.1\" 401 512 \"-\" \"sqlmap/1.7.2#stable\"" - ] - }, - { - "id": "ALT-0007", - "timestamp": "2026-07-27T10:01:02", - "endpoint": "web-server (endpoint-1)", - "src_ip": "203.0.113.66", - "alert_type": "RECON_SCANNER", - "severity": "medium", - "description": "Automated vulnerability scan detected (sqlmap): 5 probe requests against paths such as /login.php?user=admin'%20OR%20'1'='1'--, /products?id=1%20UNION%20SELECT%20username,password%20FROM%20users--, /products?id=1'%20AND%20SLEEP(5)--", - "evidence": [ - "203.0.113.66 - - [27/Jul/2026:10:01:02 +0000] \"GET /login.php?user=admin'%20OR%20'1'='1'-- HTTP/1.1\" 401 512 \"-\" \"sqlmap/1.7.2#stable\"", - "203.0.113.66 - - [27/Jul/2026:10:01:04 +0000] \"GET /products?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1\" 500 812 \"-\" \"sqlmap/1.7.2#stable\"", - "203.0.113.66 - - [27/Jul/2026:10:01:06 +0000] \"GET /products?id=1'%20AND%20SLEEP(5)-- HTTP/1.1\" 500 812 \"-\" \"sqlmap/1.7.2#stable\"", - "203.0.113.66 - - [27/Jul/2026:10:01:09 +0000] \"GET /search?q= HTTP/1.1\" 200 998 \"-\" \"sqlmap/1.7.2#stable\"", - "203.0.113.66 - - [27/Jul/2026:10:01:12 +0000] \"GET /download?file=../../../../etc/passwd HTTP/1.1\" 403 210 \"-\" \"sqlmap/1.7.2#stable\"" - ] - } - ], - "malicious_ips": [ - { - "ip": "192.0.2.77", - "threat_score": 72, - "severity_counts": { - "critical": 6, - "high": 2, - "medium": 1, - "low": 0 - }, - "total_alerts": 9, - "alert_types": [ - "ACCOUNT_COMPROMISE_SUSPECTED", - "BLACKLISTED_IP_ACTIVITY", - "BRUTE_FORCE_SSH", - "HIGH_REQUEST_RATE", - "MULTI_VECTOR_ATTACK", - "PORT_SCAN", - "SQL_INJECTION" - ], - "endpoints_involved": [ - "firewall (endpoint-2)", - "ssh-auth (endpoint-3)", - "web-server (endpoint-1)" - ], - "first_seen": "2026-07-27T10:05:01", - "last_seen": "2026-07-27T10:06:11", - "known_threat_intel": "Listed in external threat-intel feed (example seed entry)" - }, - { - "ip": "203.0.113.66", - "threat_score": 42, - "severity_counts": { - "critical": 3, - "high": 2, - "medium": 1, - "low": 0 - }, - "total_alerts": 6, - "alert_types": [ - "PATH_TRAVERSAL", - "RECON_SCANNER", - "SQL_INJECTION", - "XSS" - ], - "endpoints_involved": [ - "web-server (endpoint-1)" - ], - "first_seen": "2026-07-27T10:01:02", - "last_seen": "2026-07-27T10:01:12", - "known_threat_intel": null - }, - { - "ip": "198.51.100.234", - "threat_score": 5, - "severity_counts": { - "critical": 0, - "high": 1, - "medium": 0, - "low": 0 - }, - "total_alerts": 1, - "alert_types": [ - "BRUTE_FORCE_SSH" - ], - "endpoints_involved": [ - "ssh-auth (endpoint-3)" - ], - "first_seen": "2026-07-27T10:07:41", - "last_seen": "2026-07-27T10:07:41", - "known_threat_intel": null - }, - { - "ip": "203.0.113.99", - "threat_score": 2, - "severity_counts": { - "critical": 0, - "high": 0, - "medium": 1, - "low": 0 - }, - "total_alerts": 1, - "alert_types": [ - "RECON_SCANNER" - ], - "endpoints_involved": [ - "web-server (endpoint-1)" - ], - "first_seen": "2026-07-27T10:03:01", - "last_seen": "2026-07-27T10:03:01", - "known_threat_intel": null - } - ] -} \ No newline at end of file