#!/usr/bin/env python3 """ netIntel Flask Server (multi-tenant + Google login + JWT cookie session + env tokens) Auth: - POST /api/auth/google -> sets HttpOnly cookie "session" - GET /api/me -> returns current user claims - POST /api/auth/logout -> clears cookie Tenant admin (JWT cookie; admin role): - GET/POST /api/admin/environments - POST /api/admin/tokens Agent (X-Env-Token): - POST /receive Tenant-scoped dashboard (JWT cookie): - GET /api/stats - GET /api/computers - GET /api/computer/ - GET /api/export/ - POST /api/chat """ import os import json import time import sqlite3 import traceback import threading import secrets from datetime import datetime, timedelta from functools import wraps from flask import Flask, request, jsonify, Response from dotenv import load_dotenv import jwt from google.oauth2 import id_token from google.auth.transport import requests as grequests # Optional OpenAI try: from openai import OpenAI except Exception: OpenAI = None from flask_cors import CORS from dotenv import load_dotenv from pathlib import Path BASE_DIR = Path(__file__).resolve().parent load_dotenv(BASE_DIR / ".env") print("GRAFANA_API_TOKEN =", os.environ.get("GRAFANA_API_TOKEN")) # ---------------------------- # Config # ---------------------------- DB_FILE = os.environ.get("DB_FILE", "lan_logs_sysmon.db") LOG_DIR = os.environ.get("LOG_DIR", "received_data_sysmon") OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY", "") GOOGLE_CLIENT_ID = os.environ.get("GOOGLE_CLIENT_ID", "") JWT_SECRET = os.environ.get("JWT_SECRET", "dev-change-me") JWT_ISSUER = os.environ.get("JWT_ISSUER", "netintel") COOKIE_SECURE = os.environ.get("COOKIE_SECURE", "0") == "1" # set 1 only on HTTPS GRAFANA_TOKEN = os.environ.get("GRAFANA_TOKEN", "") # CORS origins (add your LAN origins if needed) EXTRA_ORIGINS = [o.strip() for o in os.environ.get("CORS_ORIGINS", "").split(",") if o.strip()] DEFAULT_ORIGINS = [ "http://localhost:5173", "http://127.0.0.1:5173", ] ALLOWED_ORIGINS = list(dict.fromkeys(DEFAULT_ORIGINS + EXTRA_ORIGINS)) client = OpenAI(api_key=OPENAI_API_KEY, timeout=15) if (OPENAI_API_KEY and OpenAI) else None # ---------------------------- # App # ---------------------------- app = Flask(__name__) os.makedirs(LOG_DIR, exist_ok=True) CORS( app, supports_credentials=True, origins=ALLOWED_ORIGINS, allow_headers=[ "Content-Type", "X-Admin-Session", "X-Env", "X-Env-Token", ], methods=["GET", "POST", "OPTIONS"], ) # ---------------------------- # DB helpers # ---------------------------- def db(): conn = sqlite3.connect(DB_FILE) conn.row_factory = sqlite3.Row return conn def init_db(): """Create tables if missing + light migrations.""" conn = db() c = conn.cursor() c.execute("PRAGMA foreign_keys = ON;") # Tenants / users / memberships c.execute(""" CREATE TABLE IF NOT EXISTS tenants( id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, owner_email TEXT NOT NULL, created_at TEXT ) """) c.execute(""" CREATE TABLE IF NOT EXISTS users( id INTEGER PRIMARY KEY AUTOINCREMENT, email TEXT UNIQUE NOT NULL, name TEXT, picture TEXT, created_at TEXT ) """) c.execute(""" CREATE TABLE IF NOT EXISTS memberships( user_id INTEGER NOT NULL, tenant_id INTEGER NOT NULL, role TEXT DEFAULT 'admin', created_at TEXT, PRIMARY KEY(user_id, tenant_id), FOREIGN KEY(user_id) REFERENCES users(id), FOREIGN KEY(tenant_id) REFERENCES tenants(id) ) """) # Environments (unique per tenant) c.execute(""" CREATE TABLE IF NOT EXISTS environments( id INTEGER PRIMARY KEY AUTOINCREMENT, tenant_id INTEGER NOT NULL, name TEXT NOT NULL, created_at TEXT, UNIQUE(tenant_id, name), FOREIGN KEY(tenant_id) REFERENCES tenants(id) ) """) # Env tokens (agent tokens) c.execute(""" CREATE TABLE IF NOT EXISTS env_tokens( id INTEGER PRIMARY KEY AUTOINCREMENT, tenant_id INTEGER NOT NULL, env_name TEXT NOT NULL, token TEXT UNIQUE NOT NULL, created_at TEXT, expires_at TEXT, FOREIGN KEY(tenant_id) REFERENCES tenants(id) ) """) # Computers c.execute(""" CREATE TABLE IF NOT EXISTS computers( id INTEGER PRIMARY KEY AUTOINCREMENT, tenant_id INTEGER NOT NULL, env_name TEXT DEFAULT 'default', name TEXT NOT NULL, user TEXT, ip TEXT, os TEXT, first_seen TEXT, last_seen TEXT, sysmon_available INTEGER DEFAULT 0, UNIQUE(tenant_id, name) ) """) # History c.execute(""" CREATE TABLE IF NOT EXISTS computer_history( id INTEGER PRIMARY KEY AUTOINCREMENT, computer_id INTEGER, cpu_usage REAL, ram_usage REAL, disk_usage REAL, network_sent_mb REAL, network_recv_mb REAL, timestamp TEXT, FOREIGN KEY(computer_id) REFERENCES computers(id) ) """) # Processes c.execute(""" CREATE TABLE IF NOT EXISTS computer_processes( id INTEGER PRIMARY KEY AUTOINCREMENT, computer_id INTEGER, pid INTEGER, name TEXT, cpu_percent REAL, memory_mb REAL, username TEXT, cmdline TEXT, timestamp TEXT, FOREIGN KEY(computer_id) REFERENCES computers(id) ) """) # Sysmon events c.execute(""" CREATE TABLE IF NOT EXISTS sysmon_events( id INTEGER PRIMARY KEY AUTOINCREMENT, computer_id INTEGER, event_id INTEGER, event_type TEXT, message TEXT, timestamp TEXT, details TEXT, FOREIGN KEY(computer_id) REFERENCES computers(id) ) """) # Network connections c.execute(""" CREATE TABLE IF NOT EXISTS network_connections( id INTEGER PRIMARY KEY AUTOINCREMENT, computer_id INTEGER, pid INTEGER, local_address TEXT, remote_address TEXT, status TEXT, process_name TEXT, timestamp TEXT, FOREIGN KEY(computer_id) REFERENCES computers(id) ) """) # Security alerts c.execute(""" CREATE TABLE IF NOT EXISTS security_alerts( id INTEGER PRIMARY KEY AUTOINCREMENT, computer_id INTEGER, alert_type TEXT, severity TEXT, description TEXT, timestamp TEXT, resolved INTEGER DEFAULT 0, FOREIGN KEY(computer_id) REFERENCES computers(id) ) """) # Environment settings (switch-ови по env) c.execute(""" CREATE TABLE IF NOT EXISTS env_settings( tenant_id INTEGER NOT NULL, env_name TEXT NOT NULL, save_process_history INTEGER DEFAULT 0, created_at TEXT, updated_at TEXT, PRIMARY KEY(tenant_id, env_name), FOREIGN KEY(tenant_id) REFERENCES tenants(id) ) """) # Latest processes (only current snapshot) c.execute(""" CREATE TABLE IF NOT EXISTS computer_processes_current( id INTEGER PRIMARY KEY AUTOINCREMENT, computer_id INTEGER NOT NULL, pid INTEGER, name TEXT, cpu_percent REAL, memory_mb REAL, username TEXT, cmdline TEXT, timestamp TEXT, FOREIGN KEY(computer_id) REFERENCES computers(id) ) """) # History processes (optional, controlled by switch) c.execute(""" CREATE TABLE IF NOT EXISTS computer_processes_history( id INTEGER PRIMARY KEY AUTOINCREMENT, computer_id INTEGER NOT NULL, pid INTEGER, name TEXT, cpu_percent REAL, memory_mb REAL, username TEXT, cmdline TEXT, timestamp TEXT, FOREIGN KEY(computer_id) REFERENCES computers(id) ) """) conn.commit() conn.close() print(f"✅ DB ready: {DB_FILE}") # ---------------------------- # JWT helpers # ---------------------------- def make_jwt(payload: dict, minutes=60 * 24): exp = datetime.utcnow() + timedelta(minutes=minutes) data = {**payload, "iss": JWT_ISSUER, "exp": exp} return jwt.encode(data, JWT_SECRET, algorithm="HS256") def read_jwt(token: str): return jwt.decode(token, JWT_SECRET, algorithms=["HS256"], issuer=JWT_ISSUER) def require_user(): def deco(fn): @wraps(fn) def wrap(*args, **kwargs): tok = request.cookies.get("session") or "" if not tok: return jsonify({"error": "Unauthorized"}), 401 try: claims = read_jwt(tok) except Exception: return jsonify({"error": "Unauthorized"}), 401 request.user = claims return fn(*args, **kwargs) return wrap return deco def is_process_history_enabled(tenant_id: int, env_name: str) -> bool: conn = db() c = conn.cursor() c.execute(""" SELECT save_process_history FROM env_settings WHERE tenant_id=? AND env_name=? LIMIT 1 """, (tenant_id, env_name)) row = c.fetchone() conn.close() # default: OFF ако нема запис return bool(row["save_process_history"]) if row else False def require_tenant_admin(): def deco(fn): @wraps(fn) def wrap(*args, **kwargs): tok = request.cookies.get("session") or "" if not tok: return jsonify({"error": "Unauthorized"}), 401 try: claims = read_jwt(tok) except Exception: return jsonify({"error": "Unauthorized"}), 401 if claims.get("role") != "admin": return jsonify({"error": "Forbidden"}), 403 request.user = claims return fn(*args, **kwargs) return wrap return deco # ---------------------------- # Env-token helpers (agents) # ---------------------------- def get_env_from_token(req): tok = req.headers.get("X-Env-Token", "") if not tok: return (None, None) conn = db() c = conn.cursor() c.execute(""" SELECT env_name, tenant_id FROM env_tokens WHERE token = ? AND (expires_at IS NULL OR expires_at > datetime('now')) LIMIT 1 """, (tok,)) row = c.fetchone() conn.close() if not row: return (None, None) return (row["env_name"], row["tenant_id"]) # ---------------------------- # Utility # ---------------------------- def save_json_file(data): info = data.get("info") or {} computer_name = info.get("computer_name", "unknown") date_str = datetime.now().strftime("%Y%m%d_%H") computer_dir = os.path.join(LOG_DIR, computer_name) os.makedirs(computer_dir, exist_ok=True) filepath = os.path.join(computer_dir, f"{date_str}.json") if os.path.exists(filepath): try: with open(filepath, "r", encoding="utf-8") as f: existing_data = json.load(f) except Exception: existing_data = [] else: existing_data = [] existing_data.append({ "timestamp": info.get("timestamp"), "info": info, "processes_count": len(data.get("processes", [])), "sysmon_events_count": len((data.get("security_data") or {}).get("sysmon_events", [])), }) with open(filepath, "w", encoding="utf-8") as f: json.dump(existing_data, f, indent=2, ensure_ascii=False) def cleanup_old_data(): """Deletes old rows (30 days) every hour.""" while True: time.sleep(3600) try: conn = db() c = conn.cursor() cutoff = (datetime.now() - timedelta(days=30)).isoformat() c.execute("DELETE FROM computer_history WHERE timestamp < ?", (cutoff,)) c.execute("DELETE FROM sysmon_events WHERE timestamp < ?", (cutoff,)) c.execute("DELETE FROM network_connections WHERE timestamp < ?", (cutoff,)) c.execute("DELETE FROM computer_processes_history WHERE timestamp < ?", (cutoff,)) conn.commit() conn.close() print(f"[Cleanup] Deleted entries older than {cutoff}") except Exception as e: print("[Cleanup] Error:", e) # ---------------------------- # Auth endpoints # ---------------------------- @app.route("/api/auth/google", methods=["POST"]) def auth_google(): data = request.get_json(force=True, silent=True) or {} credential = (data.get("credential") or "").strip() if not credential: return jsonify({"error": "Missing credential"}), 400 if not GOOGLE_CLIENT_ID: return jsonify({"error": "Server missing GOOGLE_CLIENT_ID"}), 500 try: idinfo = id_token.verify_oauth2_token( credential, grequests.Request(), GOOGLE_CLIENT_ID, ) email = idinfo.get("email") name = idinfo.get("name") or "" picture = idinfo.get("picture") or "" if not email: return jsonify({"error": "No email in token"}), 400 conn = db() c = conn.cursor() # upsert user c.execute("SELECT id FROM users WHERE email=?", (email,)) row = c.fetchone() if row: user_id = row["id"] c.execute("UPDATE users SET name=?, picture=? WHERE id=?", (name, picture, user_id)) else: c.execute( "INSERT INTO users(email, name, picture, created_at) VALUES(?,?,?, datetime('now'))", (email, name, picture), ) user_id = c.lastrowid # membership -> tenant (create tenant if first time) c.execute("SELECT tenant_id, role FROM memberships WHERE user_id=? LIMIT 1", (user_id,)) m = c.fetchone() if not m: tenant_name = email.split("@")[0] c.execute( "INSERT INTO tenants(name, owner_email, created_at) VALUES(?,?, datetime('now'))", (tenant_name, email), ) tenant_id = c.lastrowid role = "admin" c.execute( "INSERT INTO memberships(user_id, tenant_id, role, created_at) VALUES(?,?, 'admin', datetime('now'))", (user_id, tenant_id), ) # default env for this tenant c.execute( "INSERT OR IGNORE INTO environments(tenant_id, name, created_at) VALUES(?, 'default', datetime('now'))", (tenant_id,), ) else: tenant_id = m["tenant_id"] role = m["role"] or "admin" conn.commit() conn.close() session = make_jwt( { "uid": user_id, "email": email, "name": name, "role": role, "tenant_id": tenant_id, }, minutes=60 * 24, ) resp = jsonify({"ok": True, "user": {"email": email, "name": name, "role": role, "tenant_id": tenant_id}}) resp.set_cookie( "session", session, httponly=True, samesite="Lax", secure=COOKIE_SECURE, max_age=60 * 60 * 24, ) return resp except Exception as e: return jsonify({"error": "Invalid Google token", "details": str(e)}), 401 @app.route("/api/me", methods=["GET"]) @require_user() def api_me(): return jsonify({"user": request.user}) @app.route("/api/auth/logout", methods=["POST"]) def auth_logout(): resp = jsonify({"ok": True}) resp.set_cookie("session", "", expires=0) return resp # ---------------------------- # Admin endpoints # ---------------------------- @app.route("/api/admin/environments", methods=["GET"]) @require_tenant_admin() def admin_list_envs(): tenant_id = request.user["tenant_id"] conn = db() c = conn.cursor() c.execute("SELECT name FROM environments WHERE tenant_id=? ORDER BY name", (tenant_id,)) envs = [r["name"] for r in c.fetchall()] conn.close() if not envs: envs = ["default"] return jsonify({"environments": envs}) @app.route("/api/admin/environments", methods=["POST"]) @require_tenant_admin() def admin_create_env(): tenant_id = request.user["tenant_id"] data = request.get_json(force=True, silent=True) or {} name = (data.get("name") or "").strip() if not name: return jsonify({"error": "Missing env name"}), 400 conn = db() c = conn.cursor() try: c.execute( "INSERT INTO environments(tenant_id, name, created_at) VALUES(?, ?, datetime('now'))", (tenant_id, name), ) conn.commit() except Exception as e: conn.close() return jsonify({"error": str(e)}), 400 conn.close() return jsonify({"ok": True, "name": name}) @app.route("/api/admin/tokens", methods=["POST"]) @require_tenant_admin() def admin_generate_token(): tenant_id = request.user["tenant_id"] data = request.get_json(force=True, silent=True) or {} env = (data.get("env") or "").strip() if not env: return jsonify({"error": "Missing env"}), 400 conn = db() c = conn.cursor() c.execute("SELECT 1 FROM environments WHERE tenant_id=? AND name=? LIMIT 1", (tenant_id, env)) if not c.fetchone(): conn.close() return jsonify({"error": "Environment not found"}), 404 token = secrets.token_urlsafe(32) c.execute(""" INSERT INTO env_tokens(tenant_id, env_name, token, created_at, expires_at) VALUES(?, ?, ?, datetime('now'), datetime('now', '+90 days')) """, (tenant_id, env, token)) conn.commit() conn.close() return jsonify({"ok": True, "env": env, "token": token}) @app.route("/api/admin/env-settings/", methods=["GET"]) @require_tenant_admin() def admin_get_env_settings(env_name): tenant_id = request.user["tenant_id"] conn = db() c = conn.cursor() c.execute(""" SELECT save_process_history FROM env_settings WHERE tenant_id=? AND env_name=? LIMIT 1 """, (tenant_id, env_name)) row = c.fetchone() conn.close() return jsonify({ "env": env_name, "save_process_history": bool(row["save_process_history"]) if row else False }) @app.route("/api/admin/env-settings/", methods=["POST"]) @require_tenant_admin() def admin_set_env_settings(env_name): tenant_id = request.user["tenant_id"] data = request.get_json(force=True, silent=True) or {} enabled = 1 if bool(data.get("save_process_history")) else 0 conn = db() c = conn.cursor() c.execute(""" INSERT INTO env_settings(tenant_id, env_name, save_process_history, created_at, updated_at) VALUES(?, ?, ?, datetime('now'), datetime('now')) ON CONFLICT(tenant_id, env_name) DO UPDATE SET save_process_history=excluded.save_process_history, updated_at=datetime('now') """, (tenant_id, env_name, enabled)) conn.commit() conn.close() return jsonify({"ok": True, "env": env_name, "save_process_history": bool(enabled)}) # ---------------------------- # Agent endpoint # ---------------------------- @app.route("/receive", methods=["POST"]) def receive_data(): try: data = request.get_json(force=True, silent=True) or {} if not data: return jsonify({"error": "No data"}), 400 env_name, tenant_id = get_env_from_token(request) if not env_name or not tenant_id: return jsonify({"error": "Missing or invalid X-Env-Token"}), 401 info = data.get("info") or {} computer_name = info.get("computer_name") if not computer_name: return jsonify({"error": "Missing info.computer_name"}), 400 now_iso = datetime.now().isoformat() security_data = data.get("security_data") or {} conn = db() c = conn.cursor() # Find by (tenant_id + name) c.execute( "SELECT id FROM computers WHERE tenant_id=? AND name=? LIMIT 1", (tenant_id, computer_name), ) row = c.fetchone() if row: computer_id = row["id"] c.execute(""" UPDATE computers SET user=?, ip=?, os=?, last_seen=?, sysmon_available=?, env_name=? WHERE id=? AND tenant_id=? """, ( info.get("user"), info.get("ip_address"), info.get("os"), now_iso, int(info.get("is_sysmon_available", 0) or 0), env_name, computer_id, tenant_id, )) else: c.execute(""" INSERT INTO computers( tenant_id, env_name, name, user, ip, os, first_seen, last_seen, sysmon_available ) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?) """, ( tenant_id, env_name, computer_name, info.get("user"), info.get("ip_address"), info.get("os"), now_iso, now_iso, int(info.get("is_sysmon_available", 0) or 0), )) computer_id = c.lastrowid # history row c.execute(""" INSERT INTO computer_history( computer_id, cpu_usage, ram_usage, disk_usage, network_sent_mb, network_recv_mb, timestamp ) VALUES(?, ?, ?, ?, ?, ?, ?) """, ( computer_id, float(info.get("cpu_usage") or 0), float(info.get("ram_usage") or 0), float(info.get("disk_usage") or 0), float(info.get("network_sent_mb") or 0), float(info.get("network_recv_mb") or 0), info.get("timestamp") or now_iso, )) # ---------------------------- # processes: CURRENT (always) # ---------------------------- # Clear old current snapshot for this computer c.execute("DELETE FROM computer_processes_current WHERE computer_id=?", (computer_id,)) # Insert new snapshot for proc in (data.get("processes") or []): c.execute(""" INSERT INTO computer_processes_current( computer_id, pid, name, cpu_percent, memory_mb, username, cmdline, timestamp ) VALUES(?, ?, ?, ?, ?, ?, ?, ?) """, ( computer_id, proc.get("pid"), proc.get("name"), float(proc.get("cpu_percent") or 0), float(proc.get("memory_mb") or 0), proc.get("user") or proc.get("username"), proc.get("cmdline"), info.get("timestamp") or now_iso, )) # ---------------------------- # processes: HISTORY (optional) # ---------------------------- if is_process_history_enabled(tenant_id, env_name): for proc in (data.get("processes") or []): c.execute(""" INSERT INTO computer_processes_history( computer_id, pid, name, cpu_percent, memory_mb, username, cmdline, timestamp ) VALUES(?, ?, ?, ?, ?, ?, ?, ?) """, ( computer_id, proc.get("pid"), proc.get("name"), float(proc.get("cpu_percent") or 0), float(proc.get("memory_mb") or 0), proc.get("user") or proc.get("username"), proc.get("cmdline"), info.get("timestamp") or now_iso, )) # sysmon events sysmon_count = 0 for ev in (security_data.get("sysmon_events") or []): c.execute(""" INSERT INTO sysmon_events( computer_id, event_id, event_type, message, timestamp, details ) VALUES(?, ?, ?, ?, ?, ?) """, ( computer_id, ev.get("event_id"), ev.get("event_type", "Unknown"), ev.get("message", ""), ev.get("timestamp") or (info.get("timestamp") or now_iso), json.dumps(ev, ensure_ascii=False), )) sysmon_count += 1 # network connections for nc in (security_data.get("network_connections") or []): c.execute(""" INSERT INTO network_connections( computer_id, pid, local_address, remote_address, status, process_name, timestamp ) VALUES(?, ?, ?, ?, ?, ?, ?) """, ( computer_id, nc.get("pid"), nc.get("local_address"), nc.get("remote_address"), nc.get("status"), nc.get("process_name"), info.get("timestamp") or now_iso, )) conn.commit() conn.close() # optional JSON archive try: save_json_file(data) except Exception: pass return jsonify({ "ok": True, "computer_id": computer_id, "env": env_name, "tenant_id": tenant_id, "sysmon_events_saved": sysmon_count, "server_time": now_iso, "process_history_enabled": bool(is_process_history_enabled(tenant_id, env_name)), }) except Exception as e: traceback.print_exc() return jsonify({"error": str(e)}), 500 # ---------------------------- # Dashboard API (tenant scoped) # ---------------------------- @app.route("/api/computers", methods=["GET"]) @require_user() def api_computers(): tenant_id = request.user["tenant_id"] env = request.headers.get("X-Env", "default") conn = db() c = conn.cursor() c.execute(""" SELECT id, name, user, ip, os, first_seen, last_seen, sysmon_available FROM computers WHERE tenant_id=? AND env_name=? ORDER BY last_seen DESC """, (tenant_id, env)) rows = c.fetchall() computers = [] for r in rows: cid = r["id"] c.execute(""" SELECT COUNT(*) AS n FROM computer_history WHERE computer_id=? AND timestamp > datetime('now','-24 hours') """, (cid,)) recent_logs = int(c.fetchone()["n"] or 0) c.execute(""" SELECT COUNT(*) AS n FROM sysmon_events WHERE computer_id=? AND timestamp > datetime('now','-24 hours') """, (cid,)) recent_sysmon = int(c.fetchone()["n"] or 0) c.execute(""" SELECT cpu_usage, ram_usage, timestamp FROM computer_history WHERE computer_id=? ORDER BY timestamp DESC LIMIT 5 """, (cid,)) metrics = c.fetchall() avg_cpu = round(sum(m["cpu_usage"] for m in metrics) / len(metrics), 1) if metrics else 0.0 avg_ram = round(sum(m["ram_usage"] for m in metrics) / len(metrics), 1) if metrics else 0.0 status = "offline" status_color = "gray" try: last_seen = r["last_seen"] if last_seen: dt = datetime.fromisoformat( last_seen.replace("Z", "+00:00")) if "T" in last_seen else datetime.fromisoformat(last_seen) diff = (datetime.now() - dt).total_seconds() if diff < 60: status, status_color = "online", "green" elif diff < 300: status, status_color = "idle", "orange" except Exception: pass computers.append({ "name": r["name"], "user": r["user"], "ip": r["ip"], "os": r["os"], "first_seen": r["first_seen"], "last_seen": r["last_seen"], "sysmon_available": bool(r["sysmon_available"]), "recent_logs": recent_logs, "recent_sysmon": recent_sysmon, "avg_cpu": avg_cpu, "avg_ram": avg_ram, "status": status, "status_color": status_color, }) conn.close() return jsonify(computers) @app.route("/api/stats", methods=["GET"]) @require_user() def api_stats(): tenant_id = request.user["tenant_id"] conn = db() c = conn.cursor() c.execute(""" SELECT COUNT(*) AS n FROM sysmon_events s JOIN computers c2 ON c2.id = s.computer_id WHERE s.timestamp > datetime('now','-24 hours') AND c2.tenant_id = ? """, (tenant_id,)) total_sysmon = int(c.fetchone()["n"] or 0) c.execute(""" SELECT COUNT(*) AS n FROM network_connections n JOIN computers c2 ON c2.id = n.computer_id WHERE n.timestamp > datetime('now','-24 hours') AND c2.tenant_id = ? """, (tenant_id,)) total_net = int(c.fetchone()["n"] or 0) conn.close() return jsonify({ "total_sysmon_events": total_sysmon, "total_network_connections": total_net, "server_time": datetime.now().isoformat(), }) @app.route("/api/computer/", methods=["GET"]) @require_user() def api_computer_details(computer_name): tenant_id = request.user["tenant_id"] conn = db() c = conn.cursor() c.execute(""" SELECT id, name, user, ip, os, first_seen, last_seen, env_name FROM computers WHERE tenant_id=? AND name=? LIMIT 1 """, (tenant_id, computer_name)) comp = c.fetchone() if not comp: conn.close() return jsonify({"error": "Computer not found"}), 404 computer_id = comp["id"] c.execute("SELECT COUNT(*) AS n FROM computer_history WHERE computer_id=?", (computer_id,)) total_logs = int(c.fetchone()["n"] or 0) c.execute(""" SELECT cpu_usage, ram_usage, disk_usage, network_sent_mb, network_recv_mb, timestamp FROM computer_history WHERE computer_id=? ORDER BY timestamp DESC LIMIT 100 """, (computer_id,)) history = [dict(r) for r in c.fetchall()] current_metrics = history[0] if history else {} c.execute(""" SELECT pid, name, username, cpu_percent, memory_mb, cmdline, timestamp FROM computer_processes_current WHERE computer_id=? ORDER BY timestamp DESC LIMIT 200 """, (computer_id,)) processes = [dict(r) for r in c.fetchall()] c.execute(""" SELECT event_id, event_type, message, timestamp, details FROM sysmon_events WHERE computer_id=? ORDER BY timestamp DESC LIMIT 200 """, (computer_id,)) sysmon = [] for r in c.fetchall(): d = {} try: d = json.loads(r["details"]) if r["details"] else {} except Exception: d = {} sysmon.append({ "event_id": r["event_id"], "event_type": r["event_type"], "message": r["message"], "timestamp": r["timestamp"], "details": d, }) c.execute(""" SELECT pid, process_name, local_address, remote_address, status, timestamp FROM network_connections WHERE computer_id=? ORDER BY timestamp DESC LIMIT 100 """, (computer_id,)) net = [dict(r) for r in c.fetchall()] conn.close() return jsonify({ "computer": { "id": comp["id"], "name": comp["name"], "user": comp["user"], "ip": comp["ip"], "os": comp["os"], "first_seen": comp["first_seen"], "last_seen": comp["last_seen"], "env_name": comp["env_name"], "total_logs": total_logs, }, "history": history, "current_metrics": current_metrics, "recent_processes": processes, "sysmon_events": sysmon, "network_connections": net, }) @app.route("/api/export/", methods=["GET"]) @require_user() def api_export(computer_name): tenant_id = request.user["tenant_id"] conn = db() c = conn.cursor() c.execute(""" SELECT * FROM computers WHERE tenant_id=? AND name=? LIMIT 1 """, (tenant_id, computer_name)) comp = c.fetchone() if not comp: conn.close() return jsonify({"error": "Computer not found"}), 404 computer_id = comp["id"] out = {"computer": dict(comp)} c.execute("SELECT * FROM computer_history WHERE computer_id=? ORDER BY timestamp", (computer_id,)) out["history"] = [dict(r) for r in c.fetchall()] c.execute("SELECT * FROM sysmon_events WHERE computer_id=? ORDER BY timestamp", (computer_id,)) out["sysmon_events"] = [dict(r) for r in c.fetchall()] c.execute("SELECT * FROM computer_processes_current WHERE computer_id=? ORDER BY timestamp", (computer_id,)) out["processes_current"] = [dict(r) for r in c.fetchall()] c.execute("SELECT * FROM computer_processes_history WHERE computer_id=? ORDER BY timestamp", (computer_id,)) out["processes_history"] = [dict(r) for r in c.fetchall()] c.execute("SELECT * FROM network_connections WHERE computer_id=? ORDER BY timestamp", (computer_id,)) out["network_connections"] = [dict(r) for r in c.fetchall()] conn.close() return Response( json.dumps(out, indent=2, default=str, ensure_ascii=False), mimetype="application/json", headers={"Content-Disposition": f"attachment; filename={computer_name}_export.json"}, ) # ---------------------------- # Simple RAG chat # ---------------------------- # def build_rag_context(tenant_id: int, question: str, computer_name=None, limit_per_table=10): # conn = db() # c = conn.cursor() # # params = [tenant_id] # comp_clause = "" # if computer_name: # comp_clause = "AND c2.name = ?" # params.append(computer_name) # # # sysmon # c.execute(f""" # SELECT s.timestamp, s.event_id, s.event_type, s.message # FROM sysmon_events s # JOIN computers c2 ON c2.id = s.computer_id # WHERE c2.tenant_id = ? {comp_clause} # ORDER BY s.timestamp DESC # LIMIT ? # """, (*params, limit_per_table)) # sysmon_rows = c.fetchall() # # # perf # c.execute(f""" # SELECT h.timestamp, h.cpu_usage, h.ram_usage, h.disk_usage, h.network_sent_mb, h.network_recv_mb # FROM computer_history h # JOIN computers c2 ON c2.id = h.computer_id # WHERE c2.tenant_id = ? {comp_clause} # ORDER BY h.timestamp DESC # LIMIT ? # """, (*params, limit_per_table)) # perf_rows = c.fetchall() # # # proc # c.execute(f""" # SELECT p.timestamp, p.pid, p.name, p.cpu_percent, p.memory_mb # FROM computer_processes_current p # JOIN computers c2 ON c2.id = p.computer_id # WHERE c2.tenant_id = ? {comp_clause} # ORDER BY p.timestamp DESC # LIMIT ? # """, (*params, limit_per_table)) # proc_rows = c.fetchall() # # conn.close() # # lines = [] # for r in sysmon_rows: # lines.append(f"[SYSMON] {r['timestamp']} | Event {r['event_id']} ({r['event_type']}): {r['message']}") # for r in perf_rows: # lines.append( # f"[PERF] {r['timestamp']} | CPU {r['cpu_usage']}% | RAM {r['ram_usage']}% | Disk {r['disk_usage']}% | " # f"Net sent {r['network_sent_mb']}MB / recv {r['network_recv_mb']}MB" # ) # for r in proc_rows: # lines.append( # f"[PROC] {r['timestamp']} | PID {r['pid']} | {r['name']} | CPU {r['cpu_percent']}% | RAM {r['memory_mb']}MB" # ) # # return "\n".join(lines) def ask_llm_with_context(question, context): if not client: return "Немаш поставено OPENAI_API_KEY на серверот." prompt = f"""Ти си асистент за безбедност и систем мониторинг. Одговарај базирано ИСКЛУЧИВО на дадените логови. Ако нема доволно податоци, кажи: 'Нема доволно информации во логовите.'. Прашање: {question} Логови: {context or 'Нема логови.'} """ resp = client.responses.create( model="gpt-4.1-mini", input=[{"role": "user", "content": [{"type": "input_text", "text": prompt}]}], ) text = getattr(resp, "output_text", "") or "" return text.strip() or "Нема доволно информации во логовите." def require_grafana(): def deco(fn): @wraps(fn) def wrap(*args, **kwargs): tok = request.headers.get("X-Grafana-Token", "") if not GRAFANA_TOKEN or tok != GRAFANA_TOKEN: return jsonify({"error": "Unauthorized"}), 401 return fn(*args, **kwargs) return wrap return deco @app.route("/api/public/stats", methods=["GET"]) @require_grafana() def grafana_stats(): # ако сакаш само една околина: env = request.args.get("env", "default") conn = db() c = conn.cursor() # вкупно sysmon во 24h (за сите tenants, или ако сакаш само 1 tenant додади филтер) c.execute(""" SELECT COUNT(*) AS n FROM sysmon_events s JOIN computers c2 ON c2.id = s.computer_id WHERE s.timestamp > datetime('now','-24 hours') AND c2.env_name = ? """, (env,)) total_sysmon = int(c.fetchone()["n"] or 0) c.execute(""" SELECT COUNT(*) AS n FROM network_connections n JOIN computers c2 ON c2.id = n.computer_id WHERE n.timestamp > datetime('now','-24 hours') AND c2.env_name = ? """, (env,)) total_net = int(c.fetchone()["n"] or 0) conn.close() return jsonify({ "total_sysmon_events": total_sysmon, "total_network_connections": total_net, "server_time": datetime.now().isoformat(), "env": env, }) def require_grafana_token(fn): @wraps(fn) def wrapper(*args, **kwargs): expected = os.environ.get("GRAFANA_API_TOKEN") or "" # 1) пробај Authorization: Bearer auth = request.headers.get("Authorization", "") token = "" if auth.startswith("Bearer "): token = auth.replace("Bearer ", "").strip() # 2) ако нема header, пробај query param ?token= if not token: token = (request.args.get("token") or "").strip() if not expected or token != expected: return jsonify({"error": "Invalid Grafana token"}), 401 return fn(*args, **kwargs) return wrapper @app.route("/api/public/ips", methods=["GET"]) @require_grafana_token def api_public_ips(): tenant_id = request.args.get("tenant_id", type=int) env = request.args.get("env", "default") hours = int(request.args.get("hours", "24")) limit = int(request.args.get("limit", "200")) if not tenant_id: return jsonify({"error": "Missing tenant_id"}), 400 conn = db() c = conn.cursor() c.execute(""" SELECT DISTINCT substr(nc.remote_address, 1, CASE WHEN instr(nc.remote_address, ':') > 0 THEN instr(nc.remote_address, ':') - 1 ELSE length(nc.remote_address) END ) AS ip FROM network_connections nc JOIN computers c2 ON c2.id = nc.computer_id WHERE c2.tenant_id = ? AND c2.env_name = ? AND nc.timestamp > datetime('now', ?) AND nc.remote_address IS NOT NULL AND nc.remote_address != '' ORDER BY ip LIMIT ? """, (tenant_id, env, f"-{hours} hours", limit)) ips = [r["ip"] for r in c.fetchall()] conn.close() return jsonify({"ips": ips}) @app.route("/api/public/sankey", methods=["GET"]) @require_grafana_token def api_public_sankey(): tenant_id = int(request.args.get("tenant_id", "1")) env = request.args.get("env", "office1") hours = int(request.args.get("hours", "24")) limit = int(request.args.get("limit", "20")) computers = (request.args.get("computers") or "all").strip() ips = (request.args.get("ips") or "all").strip() # normalize grafana All values if computers in ("", "__all"): computers = "all" if ips in ("", "__all"): ips = "all" comp_list = [c.strip() for c in computers.split(",") if c.strip()] if computers != "all" else [] ip_list = [i.strip() for i in ips.split(",") if i.strip()] if ips != "all" else [] comp_clause = "" ip_clause = "" params = [tenant_id, env, f"-{hours} hours"] # ✅ target без port за IPv4: "1.2.3.4:443" -> "1.2.3.4" # ⚠️ за IPv6 ќе го остави како што е (за да не го расипеме со split по ':') target_expr = """ CASE WHEN nc.remote_address LIKE '%:%' AND nc.remote_address NOT LIKE '%:%:%' THEN substr(nc.remote_address, 1, instr(nc.remote_address, ':') - 1) ELSE nc.remote_address END """ if comp_list: comp_clause = "AND comp.name IN (" + ",".join(["?"] * len(comp_list)) + ")" params.extend(comp_list) # ✅ Филтер по IP без порт (истиот expr) if ip_list: ip_clause = f"AND ({target_expr}) IN (" + ",".join(["?"] * len(ip_list)) + ")" params.extend(ip_list) # LIMIT на крај params.append(limit) conn = db() c = conn.cursor() c.execute(f""" SELECT comp.name AS source, ({target_expr}) AS target, COUNT(*) AS value FROM network_connections nc JOIN computers comp ON comp.id = nc.computer_id WHERE comp.tenant_id = ? AND comp.env_name = ? AND nc.timestamp > datetime('now', ?) AND nc.remote_address IS NOT NULL AND nc.remote_address != '' -- ✅ тргни loopback spam (овие прават да изгледа како да нема линии) AND nc.remote_address NOT LIKE '127.0.0.1%' AND nc.remote_address NOT LIKE '::1%' {comp_clause} {ip_clause} GROUP BY comp.name, target ORDER BY value DESC LIMIT ? """, params) rows = [dict(r) for r in c.fetchall()] conn.close() return jsonify(rows) from urllib.parse import urlparse def _ip_only(addr: str): # addr може да е "1.2.3.4:443" или "hostname:port" if not addr: return None # ако има повеќе ':' (ipv6), ќе го оставиме целото; за ipv4 split е ок if addr.count(":") == 1: return addr.split(":")[0] return addr @app.route("/api/graph/net", methods=["GET"]) @require_user() def api_graph_net(): tenant_id = request.user["tenant_id"] env = request.args.get("env") or request.headers.get("X-Env", "default") computer = request.args.get("computer") # optional since_hours = int(request.args.get("since_hours") or 24) conn = db() c = conn.cursor() params = [tenant_id, env, since_hours] comp_clause = "" if computer: comp_clause = "AND c2.name = ?" params.append(computer) # Вади top remote IP по број на конекции c.execute(f""" SELECT c2.name AS computer_name, n.remote_address AS remote_address, COUNT(*) AS cnt FROM network_connections n JOIN computers c2 ON c2.id = n.computer_id WHERE c2.tenant_id = ? AND c2.env_name = ? AND n.timestamp > datetime('now', '-' || ? || ' hours') {comp_clause} AND n.remote_address IS NOT NULL AND n.remote_address <> '' GROUP BY c2.name, n.remote_address ORDER BY cnt DESC LIMIT 200 """, params) rows = c.fetchall() conn.close() # Build NodeGraph-like structure nodes = {} edges = [] def add_node(node_id, title, ntype): if node_id not in nodes: nodes[node_id] = {"id": node_id, "title": title, "subTitle": ntype} for r in rows: comp_name = r["computer_name"] remote = _ip_only(r["remote_address"]) or r["remote_address"] cnt = int(r["cnt"] or 0) comp_id = f"comp:{comp_name}" ip_id = f"ip:{remote}" add_node(comp_id, comp_name, "computer") add_node(ip_id, remote, "remote_ip") edges.append({ "id": f"{comp_id}->{ip_id}", "source": comp_id, "target": ip_id, "mainStat": str(cnt), }) return jsonify({ "nodes": list(nodes.values()), "edges": edges, "meta": {"env": env, "computer": computer, "since_hours": since_hours} }) @app.route("/api/public/netgraph", methods=["GET"]) @require_grafana_token def api_public_netgraph(): tenant_id = int(request.args.get("tenant_id", "1")) env = request.args.get("env", "default") hours = int(request.args.get("hours", "6")) limit_edges = int(request.args.get("limit", "200")) computer = request.args.get("computer") # <-- NEW (optional) conn = db() c = conn.cursor() comp_clause = "" params = [tenant_id, env, f"-{hours} hours"] if computer and computer != "all": comp_clause = "AND comp.name = ?" params.append(computer) params.append(limit_edges) c.execute(f""" SELECT comp.name AS src, nc.remote_address AS remote, COUNT(*) AS cnt FROM network_connections nc JOIN computers comp ON comp.id = nc.computer_id WHERE comp.tenant_id = ? AND comp.env_name = ? AND nc.timestamp > datetime('now', ?) {comp_clause} AND nc.remote_address IS NOT NULL AND nc.remote_address != '' GROUP BY comp.name, nc.remote_address ORDER BY cnt DESC LIMIT ? """, params) rows = c.fetchall() conn.close() def ip_only(addr: str) -> str: if not addr: return "" if addr.startswith("[") and "]" in addr: return addr[1:addr.index("]")] if ":" in addr: return addr.split(":")[0] return addr nodes = {} edges = [] for r in rows: src = r["src"] remote_ip = ip_only(r["remote"]) cnt = int(r["cnt"] or 0) if not remote_ip: continue nodes[src] = {"id": src, "title": src, "subTitle": env, "mainStat": "PC"} ip_id = f"IP:{remote_ip}" if ip_id not in nodes: nodes[ip_id] = {"id": ip_id, "title": remote_ip, "subTitle": "remote", "mainStat": "IP"} edges.append({ "id": f"{src}->{ip_id}", "source": src, "target": ip_id, "mainStat": cnt }) return jsonify({"nodes": list(nodes.values()), "edges": edges}) @app.route("/api/public/computers", methods=["GET"]) @require_grafana_token def api_public_computers(): tenant_id = int(request.args.get("tenant_id", "1")) env = request.args.get("env", "default") conn = db() c = conn.cursor() c.execute(""" SELECT name FROM computers WHERE tenant_id = ? AND env_name = ? ORDER BY name """, (tenant_id, env)) names = [r["name"] for r in c.fetchall()] conn.close() return jsonify({"computers": names}) @app.route("/api/public/stats", methods=["GET"]) @require_grafana_token def public_stats(): # ⚠️ ако сакаш tenant по tenant, ќе мора да додадеш tenant_id како query param, # или да имаш 1 tenant во проект за сега. tenant_id = request.args.get("tenant_id", type=int) if not tenant_id: return jsonify({"error": "Missing tenant_id"}), 400 conn = db() c = conn.cursor() c.execute(""" SELECT COUNT(*) AS n FROM sysmon_events s JOIN computers c2 ON c2.id = s.computer_id WHERE s.timestamp > datetime('now','-24 hours') AND c2.tenant_id = ? """, (tenant_id,)) total_sysmon = int(c.fetchone()["n"] or 0) c.execute(""" SELECT COUNT(*) AS n FROM network_connections n JOIN computers c2 ON c2.id = n.computer_id WHERE n.timestamp > datetime('now','-24 hours') AND c2.tenant_id = ? """, (tenant_id,)) total_net = int(c.fetchone()["n"] or 0) conn.close() return jsonify({ "total_sysmon_events": total_sysmon, "total_network_connections": total_net, "server_time": datetime.now().isoformat(), }) def ask_llm_sql_generator(question: str, tenant_id: int, env: str, computer_name: str | None): """ Returns dict: { "queries": [...], "notes": "...", "scope": {...} } Only SELECT/WITH queries, no modifications. """ if not client: return { "queries": [], "notes": "Немаш поставено OPENAI_API_KEY на серверот.", "scope": {"tenant_id": tenant_id, "env": env, "computer_name": computer_name}, } schema = """ SQLite schema (важни табели): - computers(id, tenant_id, env_name, name, user, ip, os, first_seen, last_seen, sysmon_available) - computer_history(computer_id, cpu_usage, ram_usage, disk_usage, network_sent_mb, network_recv_mb, timestamp) - computer_processes_current(computer_id, pid, name, cpu_percent, memory_mb, username, cmdline, timestamp) - computer_processes_history(computer_id, pid, name, cpu_percent, memory_mb, username, cmdline, timestamp) - sysmon_events(computer_id, event_id, event_type, message, timestamp, details) - network_connections(computer_id, pid, local_address, remote_address, status, process_name, timestamp) Правила: - Врати САМО валиден JSON. - JSON формат: {"queries":[...], "notes":"..."}. - queries мора да бидат само SELECT или WITH (никако INSERT/UPDATE/DELETE/ALTER/DROP). - максимум 3 queries. - користи placeholders: :tenant_id, :env, :computer_name (ако е дадено). - ако нема доволно инфо -> queries празно и notes објаснува. """.strip() user_scope = { "tenant_id": tenant_id, "env": env, "computer_name": computer_name, } user_msg = f""" Прашање од корисник: {question} Scope (вметни во WHERE): - tenant_id = :tenant_id - env = :env - computer_name = :computer_name (ако не е null) Врати 1-3 SELECT/WITH queries за да се добијат потребните податоци. """.strip() completion = client.chat.completions.create( model="gpt-4.1-mini", messages=[ {"role": "system", "content": schema}, {"role": "user", "content": user_msg}, ], temperature=0.1, ) raw = completion.choices[0].message.content or "" # Safe parse JSON try: out = json.loads(raw) if not isinstance(out, dict): raise ValueError("Not an object") queries = out.get("queries") or [] notes = out.get("notes") or "" # hard safety filter: keep only SELECT/WITH safe_queries = [] for q in queries: if not isinstance(q, str): continue qs = q.strip().lower() if qs.startswith("select") or qs.startswith("with"): # block obvious multi-statement if ";" in q.strip().rstrip(";"): continue safe_queries.append(q.strip()) return {"queries": safe_queries[:3], "notes": notes, "scope": user_scope} except Exception: # fallback ако AI не врати JSON return { "queries": [], "notes": "AI не врати валиден JSON. Обиди се повторно (или намали прашање).", "scope": user_scope, "raw": raw[:1200], } @app.route("/api/chat", methods=["POST"]) @require_user() def api_chat(): try: tenant_id = request.user["tenant_id"] env = request.headers.get("X-Env", "default") # важно! data = request.get_json(force=True, silent=True) or {} question = (data.get("question") or "").strip() computer_name = data.get("computer_name") or None if not question: return jsonify({"error": "No question provided"}), 400 out = ask_llm_sql_generator( question=question, tenant_id=tenant_id, env=env, computer_name=computer_name, ) # Тука не извршуваме SQL, само враќаме query за копирање. return jsonify({ "ok": True, "queries": out.get("queries", []), "notes": out.get("notes", ""), "scope": out.get("scope", {}), # "raw": out.get("raw") # ако сакаш debug }), 200 except Exception as e: traceback.print_exc() return jsonify({"error": str(e)}), 500 # ---------------------------- # Misc # ---------------------------- @app.route("/ping") def ping(): return jsonify({ "status": "alive", "server_time": datetime.now().isoformat(), "database": DB_FILE, "cors_origins": ALLOWED_ORIGINS, }) @app.route("/") def root(): return jsonify({ "ok": True, "service": "netIntel server", "hint": "frontend should call /api/* endpoints", }) if __name__ == "__main__": init_db() cleanup_thread = threading.Thread(target=cleanup_old_data, daemon=True) cleanup_thread.start() print(" netIntel server running on 0.0.0.0:5555") # debug=False recommended; if you need debug, set True temporarily app.run(host="0.0.0.0", port=5555, debug=False, threaded=True)