diff --git a/dashboard/data.js b/dashboard/data.js deleted file mode 100644 index 6cc210f..0000000 --- a/dashboard/data.js +++ /dev/null @@ -1,348 +0,0 @@ -// Auto-generated by siem_analyzer.py -- do not edit by hand -const SIEM_DATA = { - "generated_at": "2026-07-29T00:57:48.516747Z", - "meta": { - "endpoints": [ - "web-server (endpoint-1)", - "firewall (endpoint-2)", - "ssh-auth (endpoint-3)" - ], - "lines_parsed": { - "web-server (endpoint-1)": 45, - "firewall (endpoint-2)": 34, - "ssh-auth (endpoint-3)": 27 - } - }, - "stats": { - "total_alerts": 17, - "by_severity": { - "critical": 9, - "high": 5, - "medium": 3, - "low": 0 - }, - "unique_malicious_ips": 4, - "total_events_parsed": 106 - }, - "alerts": [ - { - "id": "ALT-0012", - "timestamp": "2026-07-27T10:07:41", - "endpoint": "ssh-auth (endpoint-3)", - "src_ip": "198.51.100.234", - "alert_type": "BRUTE_FORCE_SSH", - "severity": "high", - "description": "12 failed SSH login attempts within 300s trying 9 usernames (admin, administrator, backup, guest, oracle, postgres)", - "evidence": [ - "Jul 27 10:07:41 app-srv-05 sshd[10201]: Failed password for invalid user admin from 198.51.100.234 port 39001 ssh2", - "Jul 27 10:07:43 app-srv-05 sshd[10202]: Failed password for invalid user admin from 198.51.100.234 port 39002 ssh2", - "Jul 27 10:07:45 app-srv-05 sshd[10203]: Failed password for invalid user administrator from 198.51.100.234 port 39003 ssh2", - "Jul 27 10:07:47 app-srv-05 sshd[10204]: Failed password for invalid user user from 198.51.100.234 port 39004 ssh2", - "Jul 27 10:07:49 app-srv-05 sshd[10205]: Failed password for invalid user guest from 198.51.100.234 port 39005 ssh2" - ] - }, - { - "id": "ALT-0006", - "timestamp": "2026-07-27T10:06:11", - "endpoint": "web-server (endpoint-1)", - "src_ip": "192.0.2.77", - "alert_type": "SQL_INJECTION", - "severity": "critical", - "description": "Sql Injection attempt detected in request to /api/users?id=1'%20OR%20'1'='1", - "evidence": [ - "192.0.2.77 - - [27/Jul/2026:10:06:11 +0000] \"GET /api/users?id=1'%20OR%20'1'='1 HTTP/1.1\" 500 640 \"-\" \"python-requests/2.31\"" - ] - }, - { - "id": "ALT-0009", - "timestamp": "2026-07-27T10:06:00", - "endpoint": "web-server (endpoint-1)", - "src_ip": "192.0.2.77", - "alert_type": "HIGH_REQUEST_RATE", - "severity": "medium", - "description": "21 requests from a single IP within 60s (possible scraping/DoS/automation)", - "evidence": [ - "192.0.2.77 - - [27/Jul/2026:10:06:00 +0000] \"GET /api/data?page=1 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"", - "192.0.2.77 - - [27/Jul/2026:10:06:01 +0000] \"GET /api/data?page=2 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"", - "192.0.2.77 - - [27/Jul/2026:10:06:01 +0000] \"GET /api/data?page=3 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"", - "192.0.2.77 - - [27/Jul/2026:10:06:02 +0000] \"GET /api/data?page=4 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"", - "192.0.2.77 - - [27/Jul/2026:10:06:02 +0000] \"GET /api/data?page=5 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"" - ] - }, - { - "id": "ALT-0016", - "timestamp": "2026-07-27T10:06:00", - "endpoint": "web-server (endpoint-1)", - "src_ip": "192.0.2.77", - "alert_type": "BLACKLISTED_IP_ACTIVITY", - "severity": "critical", - "description": "Traffic from known-malicious IP 192.0.2.77: Listed in external threat-intel feed (example seed entry)", - "evidence": [ - "192.0.2.77 - - [27/Jul/2026:10:06:00 +0000] \"GET /api/data?page=1 HTTP/1.1\" 200 1200 \"-\" \"python-requests/2.31\"" - ] - }, - { - "id": "ALT-0013", - "timestamp": "2026-07-27T10:05:24", - "endpoint": "ssh-auth (endpoint-3)", - "src_ip": "192.0.2.77", - "alert_type": "ACCOUNT_COMPROMISE_SUSPECTED", - "severity": "critical", - "description": "Successful SSH login as 'root' immediately following a brute-force burst from the same IP -- account may be compromised", - "evidence": [ - "Jul 27 10:05:24 app-srv-05 sshd[10111]: Accepted password for root from 192.0.2.77 port 41011 ssh2" - ] - }, - { - "id": "ALT-0011", - "timestamp": "2026-07-27T10:05:12", - "endpoint": "ssh-auth (endpoint-3)", - "src_ip": "192.0.2.77", - "alert_type": "BRUTE_FORCE_SSH", - "severity": "high", - "description": "10 failed SSH login attempts within 300s trying 7 usernames (admin, deploy, oracle, postgres, root, test)", - "evidence": [ - "Jul 27 10:05:12 app-srv-05 sshd[10101]: Failed password for invalid user admin from 192.0.2.77 port 41001 ssh2", - "Jul 27 10:05:13 app-srv-05 sshd[10102]: Failed password for invalid user root from 192.0.2.77 port 41002 ssh2", - "Jul 27 10:05:14 app-srv-05 sshd[10103]: Failed password for invalid user test from 192.0.2.77 port 41003 ssh2", - "Jul 27 10:05:15 app-srv-05 sshd[10104]: Failed password for invalid user oracle from 192.0.2.77 port 41004 ssh2", - "Jul 27 10:05:16 app-srv-05 sshd[10105]: Failed password for invalid user ubuntu from 192.0.2.77 port 41005 ssh2" - ] - }, - { - "id": "ALT-0015", - "timestamp": "2026-07-27T10:05:12", - "endpoint": "ssh-auth (endpoint-3)", - "src_ip": "192.0.2.77", - "alert_type": "BLACKLISTED_IP_ACTIVITY", - "severity": "critical", - "description": "Traffic from known-malicious IP 192.0.2.77: Listed in external threat-intel feed (example seed entry)", - "evidence": [ - "Jul 27 10:05:12 app-srv-05 sshd[10101]: Failed password for invalid user admin from 192.0.2.77 port 41001 ssh2" - ] - }, - { - "id": "ALT-0010", - "timestamp": "2026-07-27T10:05:01", - "endpoint": "firewall (endpoint-2)", - "src_ip": "192.0.2.77", - "alert_type": "PORT_SCAN", - "severity": "high", - "description": "Port scan detected: 20 distinct destination ports probed against 10.0.0.5 within 120s (17 denied, 3 allowed)", - "evidence": [ - "2026-07-27 10:05:01 SRC=192.0.2.77 SPT=33001 DST=10.0.0.5 DPT=20 PROTO=TCP ACTION=DENY", - "2026-07-27 10:05:01 SRC=192.0.2.77 SPT=33002 DST=10.0.0.5 DPT=21 PROTO=TCP ACTION=DENY", - "2026-07-27 10:05:02 SRC=192.0.2.77 SPT=33003 DST=10.0.0.5 DPT=22 PROTO=TCP ACTION=ALLOW", - "2026-07-27 10:05:02 SRC=192.0.2.77 SPT=33004 DST=10.0.0.5 DPT=23 PROTO=TCP ACTION=DENY", - "2026-07-27 10:05:03 SRC=192.0.2.77 SPT=33005 DST=10.0.0.5 DPT=25 PROTO=TCP ACTION=DENY" - ] - }, - { - "id": "ALT-0014", - "timestamp": "2026-07-27T10:05:01", - "endpoint": "firewall (endpoint-2)", - "src_ip": "192.0.2.77", - "alert_type": "BLACKLISTED_IP_ACTIVITY", - "severity": "critical", - "description": "Traffic from known-malicious IP 192.0.2.77: Listed in external threat-intel feed (example seed entry)", - "evidence": [ - "2026-07-27 10:05:01 SRC=192.0.2.77 SPT=33001 DST=10.0.0.5 DPT=20 PROTO=TCP ACTION=DENY" - ] - }, - { - "id": "ALT-0017", - "timestamp": "2026-07-27T10:05:01", - "endpoint": "correlation-engine", - "src_ip": "192.0.2.77", - "alert_type": "MULTI_VECTOR_ATTACK", - "severity": "critical", - "description": "IP 192.0.2.77 triggered alerts across 3 different endpoints (firewall (endpoint-2), ssh-auth (endpoint-3), web-server (endpoint-1)) -- consistent with a coordinated, multi-stage attack (recon -> exploitation -> access)", - "evidence": [] - }, - { - "id": "ALT-0008", - "timestamp": "2026-07-27T10:03:01", - "endpoint": "web-server (endpoint-1)", - "src_ip": "203.0.113.99", - "alert_type": "RECON_SCANNER", - "severity": "medium", - "description": "Automated vulnerability scan detected (nikto): 7 probe requests against paths such as /admin, /admin.php, /phpmyadmin/", - "evidence": [ - "203.0.113.99 - - [27/Jul/2026:10:03:01 +0000] \"GET /admin HTTP/1.1\" 404 190 \"-\" \"Mozilla/5.0 (compatible; Nikto/2.5.0)\"", - "203.0.113.99 - - [27/Jul/2026:10:03:02 +0000] \"GET /admin.php HTTP/1.1\" 404 190 \"-\" \"Mozilla/5.0 (compatible; Nikto/2.5.0)\"", - "203.0.113.99 - - [27/Jul/2026:10:03:03 +0000] \"GET /phpmyadmin/ HTTP/1.1\" 404 190 \"-\" \"Mozilla/5.0 (compatible; Nikto/2.5.0)\"", - "203.0.113.99 - - [27/Jul/2026:10:03:04 +0000] \"GET /.env HTTP/1.1\" 404 190 \"-\" \"Mozilla/5.0 (compatible; Nikto/2.5.0)\"", - "203.0.113.99 - - [27/Jul/2026:10:03:05 +0000] \"GET /wp-login.php HTTP/1.1\" 404 190 \"-\" \"Mozilla/5.0 (compatible; Nikto/2.5.0)\"" - ] - }, - { - "id": "ALT-0005", - "timestamp": "2026-07-27T10:01:12", - "endpoint": "web-server (endpoint-1)", - "src_ip": "203.0.113.66", - "alert_type": "PATH_TRAVERSAL", - "severity": "high", - "description": "Path Traversal attempt detected in request to /download?file=../../../../etc/passwd", - "evidence": [ - "203.0.113.66 - - [27/Jul/2026:10:01:12 +0000] \"GET /download?file=../../../../etc/passwd HTTP/1.1\" 403 210 \"-\" \"sqlmap/1.7.2#stable\"" - ] - }, - { - "id": "ALT-0004", - "timestamp": "2026-07-27T10:01:09", - "endpoint": "web-server (endpoint-1)", - "src_ip": "203.0.113.66", - "alert_type": "XSS", - "severity": "high", - "description": "Xss attempt detected in request to /search?q=