Index: server.py =================================================================== --- server.py (revision 505f39ae7b51fc1db15123d66bf06aec0dca2f62) +++ server.py (revision d42aac31fe37e6e42a1b0515b54b86e8706d90a8) @@ -255,4 +255,50 @@ ) """) + + # Environment settings (switch-ови по env) + c.execute(""" + CREATE TABLE IF NOT EXISTS env_settings( + tenant_id INTEGER NOT NULL, + env_name TEXT NOT NULL, + save_process_history INTEGER DEFAULT 0, + created_at TEXT, + updated_at TEXT, + PRIMARY KEY(tenant_id, env_name), + FOREIGN KEY(tenant_id) REFERENCES tenants(id) + ) + """) + + # Latest processes (only current snapshot) + c.execute(""" + CREATE TABLE IF NOT EXISTS computer_processes_current( + id INTEGER PRIMARY KEY AUTOINCREMENT, + computer_id INTEGER NOT NULL, + pid INTEGER, + name TEXT, + cpu_percent REAL, + memory_mb REAL, + username TEXT, + cmdline TEXT, + timestamp TEXT, + FOREIGN KEY(computer_id) REFERENCES computers(id) + ) + """) + + # History processes (optional, controlled by switch) + c.execute(""" + CREATE TABLE IF NOT EXISTS computer_processes_history( + id INTEGER PRIMARY KEY AUTOINCREMENT, + computer_id INTEGER NOT NULL, + pid INTEGER, + name TEXT, + cpu_percent REAL, + memory_mb REAL, + username TEXT, + cmdline TEXT, + timestamp TEXT, + FOREIGN KEY(computer_id) REFERENCES computers(id) + ) + """) + conn.commit() @@ -291,4 +337,18 @@ return deco +def is_process_history_enabled(tenant_id: int, env_name: str) -> bool: + conn = db() + c = conn.cursor() + c.execute(""" + SELECT save_process_history + FROM env_settings + WHERE tenant_id=? AND env_name=? + LIMIT 1 + """, (tenant_id, env_name)) + row = c.fetchone() + conn.close() + + # default: OFF ако нема запис + return bool(row["save_process_history"]) if row else False @@ -381,7 +441,7 @@ c.execute("DELETE FROM computer_history WHERE timestamp < ?", (cutoff,)) - c.execute("DELETE FROM computer_processes WHERE timestamp < ?", (cutoff,)) c.execute("DELETE FROM sysmon_events WHERE timestamp < ?", (cutoff,)) c.execute("DELETE FROM network_connections WHERE timestamp < ?", (cutoff,)) + c.execute("DELETE FROM computer_processes_history WHERE timestamp < ?", (cutoff,)) conn.commit() @@ -569,4 +629,45 @@ return jsonify({"ok": True, "env": env, "token": token}) +@app.route("/api/admin/env-settings/", methods=["GET"]) +@require_tenant_admin() +def admin_get_env_settings(env_name): + tenant_id = request.user["tenant_id"] + + conn = db() + c = conn.cursor() + c.execute(""" + SELECT save_process_history + FROM env_settings + WHERE tenant_id=? AND env_name=? + LIMIT 1 + """, (tenant_id, env_name)) + row = c.fetchone() + conn.close() + + return jsonify({ + "env": env_name, + "save_process_history": bool(row["save_process_history"]) if row else False + }) + +@app.route("/api/admin/env-settings/", methods=["POST"]) +@require_tenant_admin() +def admin_set_env_settings(env_name): + tenant_id = request.user["tenant_id"] + data = request.get_json(force=True, silent=True) or {} + enabled = 1 if bool(data.get("save_process_history")) else 0 + + conn = db() + c = conn.cursor() + c.execute(""" + INSERT INTO env_settings(tenant_id, env_name, save_process_history, created_at, updated_at) + VALUES(?, ?, ?, datetime('now'), datetime('now')) + ON CONFLICT(tenant_id, env_name) DO UPDATE SET + save_process_history=excluded.save_process_history, + updated_at=datetime('now') + """, (tenant_id, env_name, enabled)) + conn.commit() + conn.close() + + return jsonify({"ok": True, "env": env_name, "save_process_history": bool(enabled)}) # ---------------------------- @@ -596,5 +697,8 @@ # Find by (tenant_id + name) - c.execute("SELECT id FROM computers WHERE tenant_id=? AND name=? LIMIT 1", (tenant_id, computer_name)) + c.execute( + "SELECT id FROM computers WHERE tenant_id=? AND name=? LIMIT 1", + (tenant_id, computer_name), + ) row = c.fetchone() @@ -602,8 +706,8 @@ computer_id = row["id"] c.execute(""" - UPDATE computers - SET user=?, ip=?, os=?, last_seen=?, sysmon_available=?, env_name=? - WHERE id=? AND tenant_id=? - """, ( + UPDATE computers + SET user=?, ip=?, os=?, last_seen=?, sysmon_available=?, env_name=? + WHERE id=? AND tenant_id=? + """, ( info.get("user"), info.get("ip_address"), @@ -617,7 +721,10 @@ else: c.execute(""" - INSERT INTO computers(tenant_id, env_name, name, user, ip, os, first_seen, last_seen, sysmon_available) - VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?) - """, ( + INSERT INTO computers( + tenant_id, env_name, name, user, ip, os, + first_seen, last_seen, sysmon_available + ) + VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?) + """, ( tenant_id, env_name, @@ -634,8 +741,10 @@ # history row c.execute(""" - INSERT INTO computer_history(computer_id, cpu_usage, ram_usage, disk_usage, - network_sent_mb, network_recv_mb, timestamp) - VALUES(?, ?, ?, ?, ?, ?, ?) - """, ( + INSERT INTO computer_history( + computer_id, cpu_usage, ram_usage, disk_usage, + network_sent_mb, network_recv_mb, timestamp + ) + VALUES(?, ?, ?, ?, ?, ?, ?) + """, ( computer_id, float(info.get("cpu_usage") or 0), @@ -647,10 +756,18 @@ )) - # processes + # ---------------------------- + # processes: CURRENT (always) + # ---------------------------- + # Clear old current snapshot for this computer + c.execute("DELETE FROM computer_processes_current WHERE computer_id=?", (computer_id,)) + + # Insert new snapshot for proc in (data.get("processes") or []): c.execute(""" - INSERT INTO computer_processes(computer_id, pid, name, cpu_percent, memory_mb, username, cmdline, timestamp) - VALUES(?, ?, ?, ?, ?, ?, ?, ?) - """, ( + INSERT INTO computer_processes_current( + computer_id, pid, name, cpu_percent, memory_mb, username, cmdline, timestamp + ) + VALUES(?, ?, ?, ?, ?, ?, ?, ?) + """, ( computer_id, proc.get("pid"), @@ -663,11 +780,34 @@ )) + # ---------------------------- + # processes: HISTORY (optional) + # ---------------------------- + if is_process_history_enabled(tenant_id, env_name): + for proc in (data.get("processes") or []): + c.execute(""" + INSERT INTO computer_processes_history( + computer_id, pid, name, cpu_percent, memory_mb, username, cmdline, timestamp + ) + VALUES(?, ?, ?, ?, ?, ?, ?, ?) + """, ( + computer_id, + proc.get("pid"), + proc.get("name"), + float(proc.get("cpu_percent") or 0), + float(proc.get("memory_mb") or 0), + proc.get("user") or proc.get("username"), + proc.get("cmdline"), + info.get("timestamp") or now_iso, + )) + # sysmon events sysmon_count = 0 for ev in (security_data.get("sysmon_events") or []): c.execute(""" - INSERT INTO sysmon_events(computer_id, event_id, event_type, message, timestamp, details) - VALUES(?, ?, ?, ?, ?, ?) - """, ( + INSERT INTO sysmon_events( + computer_id, event_id, event_type, message, timestamp, details + ) + VALUES(?, ?, ?, ?, ?, ?) + """, ( computer_id, ev.get("event_id"), @@ -682,7 +822,9 @@ for nc in (security_data.get("network_connections") or []): c.execute(""" - INSERT INTO network_connections(computer_id, pid, local_address, remote_address, status, process_name, timestamp) - VALUES(?, ?, ?, ?, ?, ?, ?) - """, ( + INSERT INTO network_connections( + computer_id, pid, local_address, remote_address, status, process_name, timestamp + ) + VALUES(?, ?, ?, ?, ?, ?, ?) + """, ( computer_id, nc.get("pid"), @@ -710,4 +852,5 @@ "sysmon_events_saved": sysmon_count, "server_time": now_iso, + "process_history_enabled": bool(is_process_history_enabled(tenant_id, env_name)), }) @@ -868,10 +1011,10 @@ c.execute(""" - SELECT pid, name, username, cpu_percent, memory_mb, cmdline, timestamp - FROM computer_processes - WHERE computer_id=? - ORDER BY timestamp DESC - LIMIT 100 - """, (computer_id,)) + SELECT pid, name, username, cpu_percent, memory_mb, cmdline, timestamp + FROM computer_processes_current + WHERE computer_id=? + ORDER BY timestamp DESC + LIMIT 200 + """, (computer_id,)) processes = [dict(r) for r in c.fetchall()] @@ -956,6 +1099,9 @@ out["sysmon_events"] = [dict(r) for r in c.fetchall()] - c.execute("SELECT * FROM computer_processes WHERE computer_id=? ORDER BY timestamp", (computer_id,)) - out["processes"] = [dict(r) for r in c.fetchall()] + c.execute("SELECT * FROM computer_processes_current WHERE computer_id=? ORDER BY timestamp", (computer_id,)) + out["processes_current"] = [dict(r) for r in c.fetchall()] + + c.execute("SELECT * FROM computer_processes_history WHERE computer_id=? ORDER BY timestamp", (computer_id,)) + out["processes_history"] = [dict(r) for r in c.fetchall()] c.execute("SELECT * FROM network_connections WHERE computer_id=? ORDER BY timestamp", (computer_id,)) @@ -1009,5 +1155,5 @@ c.execute(f""" SELECT p.timestamp, p.pid, p.name, p.cpu_percent, p.memory_mb - FROM computer_processes p + FROM computer_processes_current p JOIN computers c2 ON c2.id = p.computer_id WHERE c2.tenant_id = ? {comp_clause} @@ -1106,5 +1252,5 @@ cleanup_thread.start() - print("🚀 netIntel server running on 0.0.0.0:5555") + print(" netIntel server running on 0.0.0.0:5555") # debug=False recommended; if you need debug, set True temporarily app.run(host="0.0.0.0", port=5555, debug=False, threaded=True)