"""
COMPLETE FIXED SYSMON SERVER - Working Dashboard
"""
from flask import Flask, request, jsonify, render_template, send_from_directory
import sqlite3
import json
from datetime import datetime, timedelta
import os
import re
app = Flask(__name__)
def init_database():
"""Inicializiraј ja bazata"""
conn = sqlite3.connect('sysmon_server.db', check_same_thread=False)
cursor = conn.cursor()
# Kreiraј tabeli
cursor.execute('''
CREATE TABLE IF NOT EXISTS sysmon_events (
id INTEGER PRIMARY KEY AUTOINCREMENT,
event_id INTEGER,
event_type TEXT,
timestamp TEXT,
computer TEXT,
process_name TEXT,
command_line TEXT,
process_user TEXT,
parent_process TEXT,
dns_query TEXT,
dns_results TEXT,
dns_process TEXT,
source_ip TEXT,
dest_ip TEXT,
dest_port TEXT,
file_path TEXT,
raw_data TEXT,
received_at TEXT
)
''')
cursor.execute('''
CREATE TABLE IF NOT EXISTS processes (
id INTEGER PRIMARY KEY AUTOINCREMENT,
pid INTEGER,
name TEXT,
user TEXT,
cpu_percent REAL,
memory_mb REAL,
cmdline TEXT,
computer TEXT,
received_at TEXT
)
''')
cursor.execute('''
CREATE TABLE IF NOT EXISTS computers (
id INTEGER PRIMARY KEY AUTOINCREMENT,
computer_name TEXT UNIQUE,
user TEXT,
ip_address TEXT,
os TEXT,
last_seen TEXT,
status TEXT DEFAULT 'online'
)
''')
# Indeksi
cursor.execute('CREATE INDEX IF NOT EXISTS idx_computer ON sysmon_events(computer)')
cursor.execute('CREATE INDEX IF NOT EXISTS idx_dns_query ON sysmon_events(dns_query)')
conn.commit()
conn.close()
print("✅ Database initialized")
def get_db_connection():
"""Vrati database connection"""
conn = sqlite3.connect('sysmon_server.db', check_same_thread=False)
conn.row_factory = sqlite3.Row
return conn
def update_computer_status(computer_name, user, ip_address, os_info):
"""Update computer status"""
conn = get_db_connection()
cursor = conn.cursor()
try:
cursor.execute('''
INSERT OR REPLACE INTO computers
(computer_name, user, ip_address, os, last_seen, status)
VALUES (?, ?, ?, ?, ?, ?)
''', (computer_name, user, ip_address, os_info, datetime.now().isoformat(), 'online'))
conn.commit()
except Exception as e:
print(f"Error updating computer: {e}")
finally:
conn.close()
@app.route('/')
def index():
"""Main dashboard page"""
return '''
Sysmon Dashboard
-
-
-
-
-
| Time |
Computer |
Domain |
Result |
Process |
| Loading... |
| Time |
Computer |
Process |
User |
Command |
| Loading... |
| Time |
Computer |
Process |
Destination |
Port |
| Loading... |
| Computer |
User |
IP |
Status |
OS |
Last Seen |
| Loading... |
'''
# API ENDPOINTS - SIMPLE AND WORKING
@app.route('/api/stats', methods=['GET'])
def api_stats():
"""Get statistics"""
conn = get_db_connection()
cursor = conn.cursor()
try:
cursor.execute("SELECT COUNT(*) FROM sysmon_events")
total_events = cursor.fetchone()[0] or 0
cursor.execute("SELECT COUNT(DISTINCT computer) FROM sysmon_events")
total_computers = cursor.fetchone()[0] or 0
cursor.execute("SELECT COUNT(*) FROM sysmon_events WHERE dns_query != ''")
dns_queries = cursor.fetchone()[0] or 0
cursor.execute("SELECT COUNT(*) FROM sysmon_events WHERE event_id = 1")
process_creations = cursor.fetchone()[0] or 0
cursor.execute("SELECT COUNT(*) FROM sysmon_events WHERE event_id = 3")
network_connections = cursor.fetchone()[0] or 0
return jsonify({
"total_events": total_events,
"total_computers": total_computers,
"dns_queries": dns_queries,
"process_creations": process_creations,
"network_connections": network_connections,
"timestamp": datetime.now().isoformat()
})
except Exception as e:
return jsonify({"error": str(e)}), 500
finally:
conn.close()
@app.route('/api/events', methods=['GET'])
def api_events():
"""Get all events"""
conn = get_db_connection()
cursor = conn.cursor()
try:
limit = request.args.get('limit', 50, type=int)
cursor.execute('SELECT * FROM sysmon_events ORDER BY timestamp DESC LIMIT ?', (limit,))
events = [dict(row) for row in cursor.fetchall()]
return jsonify({
"events": events,
"count": len(events)
})
except Exception as e:
return jsonify({"error": str(e)}), 500
finally:
conn.close()
@app.route('/api/dns', methods=['GET'])
def api_dns():
"""Get DNS queries"""
conn = get_db_connection()
cursor = conn.cursor()
try:
limit = request.args.get('limit', 50, type=int)
cursor.execute('''
SELECT timestamp, computer, dns_query, dns_results, dns_process
FROM sysmon_events
WHERE dns_query != ''
ORDER BY timestamp DESC
LIMIT ?
''', (limit,))
queries = [dict(row) for row in cursor.fetchall()]
return jsonify({
"dns_queries": queries,
"count": len(queries)
})
except Exception as e:
return jsonify({"error": str(e)}), 500
finally:
conn.close()
@app.route('/api/processes', methods=['GET'])
def api_processes():
"""Get process executions"""
conn = get_db_connection()
cursor = conn.cursor()
try:
limit = request.args.get('limit', 50, type=int)
cursor.execute('''
SELECT timestamp, computer, process_name, command_line, process_user
FROM sysmon_events
WHERE event_id = 1 AND process_name != ''
ORDER BY timestamp DESC
LIMIT ?
''', (limit,))
processes = [dict(row) for row in cursor.fetchall()]
return jsonify({
"processes": processes,
"count": len(processes)
})
except Exception as e:
return jsonify({"error": str(e)}), 500
finally:
conn.close()
@app.route('/api/network', methods=['GET'])
def api_network():
"""Get network connections"""
conn = get_db_connection()
cursor = conn.cursor()
try:
limit = request.args.get('limit', 50, type=int)
cursor.execute('''
SELECT timestamp, computer, process_name, dest_ip, dest_port
FROM sysmon_events
WHERE event_id = 3 AND dest_ip != ''
ORDER BY timestamp DESC
LIMIT ?
''', (limit,))
connections = [dict(row) for row in cursor.fetchall()]
return jsonify({
"connections": connections,
"count": len(connections)
})
except Exception as e:
return jsonify({"error": str(e)}), 500
finally:
conn.close()
@app.route('/api/computers', methods=['GET'])
def api_computers():
"""Get computers list"""
conn = get_db_connection()
cursor = conn.cursor()
try:
cursor.execute('SELECT * FROM computers ORDER BY last_seen DESC')
computers = [dict(row) for row in cursor.fetchall()]
return jsonify({
"computers": computers,
"count": len(computers)
})
except Exception as e:
return jsonify({"error": str(e)}), 500
finally:
conn.close()
@app.route('/receive_data', methods=['POST'])
def receive_data():
"""Receive data from client"""
try:
data = request.json
if not data:
return jsonify({"error": "No data"}), 400
metadata = data.get("metadata", {})
computer_name = metadata.get("computer", "Unknown")
user = metadata.get("user", "Unknown")
conn = get_db_connection()
cursor = conn.cursor()
events_inserted = 0
# Update computer
system_info = data.get("system_info", {})
update_computer_status(
computer_name,
user,
system_info.get("ip_address", "Unknown"),
system_info.get("os", "Unknown")
)
# Save sysmon events
if "sysmon_events" in data:
for event in data["sysmon_events"]:
try:
event_data = event.get("data", {})
cursor.execute('''
INSERT INTO sysmon_events
(event_id, event_type, timestamp, computer,
process_name, command_line, process_user, parent_process,
dns_query, dns_results, dns_process,
source_ip, dest_ip, dest_port, file_path,
raw_data, received_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
''', (
event.get("event_id"),
event.get("event_type"),
event.get("timestamp"),
event.get("computer"),
event_data.get("Image", ""),
event_data.get("CommandLine", ""),
event_data.get("User", ""),
event_data.get("ParentImage", ""),
event_data.get("QueryName", ""),
event_data.get("QueryResults", ""),
event_data.get("Image", ""),
event_data.get("SourceIp", ""),
event_data.get("DestinationIp", ""),
event_data.get("DestinationPort", ""),
event_data.get("TargetFilename", ""),
json.dumps(event_data),
datetime.now().isoformat()
))
events_inserted += 1
except Exception as e:
print(f"Error saving event: {e}")
continue
# Save processes
if "processes" in data:
for proc in data["processes"]:
try:
cursor.execute('''
INSERT INTO processes
(pid, name, user, cpu_percent, memory_mb, cmdline, computer, received_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
''', (
proc.get("pid"),
proc.get("name"),
proc.get("user"),
proc.get("cpu_percent", 0),
proc.get("memory_mb", 0),
proc.get("cmdline", ""),
computer_name,
datetime.now().isoformat()
))
except Exception as e:
print(f"Error saving process: {e}")
continue
conn.commit()
conn.close()
return jsonify({
"message": "Data received successfully",
"events_inserted": events_inserted
}), 200
except Exception as e:
return jsonify({"error": str(e)}), 500
@app.route('/ping', methods=['GET'])
def ping():
"""Ping endpoint"""
return jsonify({
"message": "pong",
"status": "ok",
"server": "Sysmon Server",
"time": datetime.now().isoformat()
})
if __name__ == '__main__':
# Initialize database
init_database()
print("\n" + "=" * 60)
print("🚀 WORKING SYSMON SERVER")
print("=" * 60)
print("📊 Dashboard: http://localhost:5555/")
print("📡 API Endpoints (ALL WORKING):")
print(" - GET / - Dashboard")
print(" - GET /api/stats - Statistics")
print(" - GET /api/events - All events")
print(" - GET /api/dns - DNS queries")
print(" - GET /api/processes - Process executions")
print(" - GET /api/network - Network connections")
print(" - GET /api/computers - Computers list")
print(" - POST /receive_data - Receive client data")
print(" - GET /ping - Test endpoint")
print("=" * 60)
app.run(host='0.0.0.0', port=5555, debug=True)