OSSIM寮€婧愬畨鍏ㄤ俊鎭鐞嗙郴缁燂紙鍥涳級

简介2021SC@SDUSC涓€銆乄eb閮ㄥ垎婧愪唬鐮佸垎鏋?銆佺畝杩扮敤鎴锋帴瑙SSIM骞冲彴鏈€澶氱殑鏄?Web UI锛岄€氳繃Web 浠ュ彲瑙嗗寲鏂瑰紡杞绘澗鑾峰彇鍚勭瀹夊叏鍒嗘瀽鐨勫浘琛紝浣滀负鏅€氳繍缁翠汉鍛樻垨鑰呯洃鎺т汉鍛橈紝缁濆ぇ澶氭暟鎿嶄綔閮芥槸閫氳繃Web UI 鏉ュ畬鎴愩€俉eb UI 鐣岄潰浠ュ強鍚勯儴鍒嗘墍瀵瑰簲鐨勫姛鑳斤紝宸插湪鍓嶉潰鐨勫崥鏂囦腑杩涜浜嗚缁嗙殑闃愯堪璁茶В锛屾湰绡囧崥鏂囦究涓嶅啀璧樿堪2銆乄eb UI瀵瑰簲婧愪唬鐮佺洰褰曠粨鏋刉eb UI 浠?php 涓

2021SC@SDUSC

涓€銆乄eb閮ㄥ垎婧愪唬鐮佸垎鏋?/h1>

1銆佺畝杩?/h2>鐢ㄦ埛鎺ヨЕOSSIM骞冲彴鏈€澶氱殑鏄?Web UI，閫氳繃Web 浠ュ彲瑙嗗寲鏂瑰紡杞绘澗鑾峰彇鍚勭瀹夊叏鍒嗘瀽鐨勫浘琛?#xff0c;浣滀负鏅€氳繍缁翠汉鍛樻垨鑰呯洃鎺т汉鍛?#xff0c;缁濆ぇ澶氭暟鎿嶄綔閮芥槸閫氳繃Web UI 鏉ュ畬鎴愩€?/p>

Web UI 鐣岄潰浠ュ強鍚勯儴鍒嗘墍瀵瑰簲鐨勫姛鑳?#xff0c;宸插湪鍓嶉潰鐨勫崥鏂囦腑杩涜浜嗚缁嗙殑闃愯堪璁茶В，鏈瘒鍗氭枃渚夸笉鍐嶈禈杩?/p>

2銆乄eb UI瀵瑰簲婧愪唬鐮佺洰褰曠粨鏋?/h2>Web UI 浠?php 涓轰富瑕佺紪绋嬭瑷€，鍚勯儴鍒嗗姛鑳藉搴旂殑婧愪唬鐮佺洰褰曞涓嬭〃鎵€绀?#xff1a;

涓€绾ц彍鍗?/th>浜岀骇鑿滃崟璋冪敤鐣岄潰

DASHBOARDSOverview./dashboard/index.php

Deployment status./deployment/index.php

Risk Maps./risk maps/view.php

OTX./reputation/index.php

AnalysisAlarms Group View./alarm/alarm_console.php ./alarm/alarm_group_console.php

Security Events (SIEM) Real Time./forensics/base_ary_main.php ./control_ panel/event_panel.php

Raw Logs./sem/index.php

Tickets./incidents/index.php

ENVIRONMENTAssets Asset Discovery./assets/index.php ./netscan/index.php

Groups&Networks Network Groups./assets/list_view.php ./netgroup/netgroup.php

VulnerabilitiesOverview : ./vulnmeter/index.php ScanJobs : ./vulnmeter/manage_jobs.php Settings : ./vulnmeter/webconfig.php Threat Database : ./vulnmeter/threats-db.php

Profiles./ntop/index.php

NetFlow./nfsen/nfsen.php

Traffic capture./pcap/index.php

Availability./nagios/index.php

Detection./ossec/status.php Agents : ./ossec/agent.php Agentless : ./ossec/agentless.php Edit Rules : ./ossec/index.php Config : ./ossec/config.php Ossec control : ./ossec/ossec_control.php Wireles IDS : ./wireless/index.php

REPORTS

Alarms Report 鐢熸垚鏂囦欢 : ./report/os_reports/Alarms/generaL.php Business&Compliance ISO PCI Report鐢熸垚鏂囦欢 : ./report/os_reports/BussinessAndComplianceISOPCI/general.php Tickets Status Report鐢熸垚鏂囦欢 : ./report/os_reports/Tickets/general.php SIEM Events 鐢熸垚鏂囦欢 : ./reports/os_reports/Siem/general.php Vulnerabilities Report 鐢熸垚鏂囦欢 : ./vulnmeter/lr_respdf.php

CONFIGURATIONAdministrationUSERS ./session/users.php Activity : ./conf/userlog.php

MAIN ./conf/index.php

BACKUP ./backup/index.php

DeploymentAlienvault Center : ./av_center/index.php Sensors : ./server/sensor.php Servers : ./server/server.php Scheduler : ./av_inventory/index.php Locations : ./sensor/locations.php

Threat IntelligencePolicy : ./policy/policy.php Edit pPolicy Groups : ./policy/policygroup.php

Actions : ./action/action.php

Ports : ./porUport.php Port Groups : ./port/portgroup.php

Directives : ./directives/index.php

ComplianceMapping : ./compliance/iso27001.php PCIDSS2.0 : ./compliance/pci-dss.php Run Scripts : ./compliance/mod scripts.php

Cross Correlation : ./conf/pluginref.php

Data Source : ./conf/plugin.php Data Source Groups : ./policy/plugingroups.php

Taxonomy : ./conficategory.php

Knowledge Base : ./repository/index.php

SETTINGSMy Profile./session/user_form.php

Current Sessions./userlogopened_sessions.php

User Activity./userlog/user_ action _log.php

SupportHelp./help/index.php

Downloads./downloads/index.php

3銆乻ecurity.php婧愮爜鍒嗘瀽

鏈儴鍒嗗皢瀵逛华琛ㄧ洏瀛愭ā鍧椾腑 event妯″潡涓殑涓€涓瘮杈冮噸瑕佺殑浠ｇ爜鏂囦欢security.php鐨勬簮浠ｇ爜杩涜鍒濇鍒嗘瀽銆?/p>

婧愮爜鍦板潃：alienvault-ossim\os-sim\www\dashboard\sections\widgets\data\security.php

//棣栧厛鍦ㄦ枃浠跺ご閮ㄨ繘琛岀浉鍏虫枃浠剁殑寮曠敤，鍒濆鍖栧嚱鏁板簱

require_once 'av_init.php';require_once 'sensor_filter.php';require_once '../widget_common.php';require_once 'common.php';寮曞叆鐩稿叧鏂囦欢鐨勪富瑕佸姛鑳?#xff1a;

av_init.php：AlienVault 鍒濆鍖栨枃浠?#xff0c;閫氳繃寮曠敤鍏朵粬鏂囦欢，瀹屾垚涓€浜涘垵濮嬪寲鎿嶄綔，渚嬪鍒涘缓session銆佽缃甤lass path銆丏B 绠＄悊銆佽幏鍙栧叏灞€閰嶇疆銆佽缃瑷€绛夌瓑銆?/p>

sensor_filter.php：涓昏瀹炵幇鐩稿叧杩囨护鐨勫姛鑳姐€傚寘鍚祫浜ц繃婊ゃ€佷紶鎰熷櫒杩囨护銆佸垎绫昏繃婊ょ瓑銆?/p>

widget_common.php：鎺т欢鐩稿叧鎿嶄綔銆備富瑕佷笌鏁版嵁搴撲腑 dashboard_widget_config 琛ㄨ繘琛屼氦浜?#xff0c;杩涜鎺т欢閲嶆柊鎺掑垪銆佽幏鍙栨搴忋€佽幏鍙栨暟鎹瓑鎿嶄綔銆?/p>

common.php：鑾峰彇涓€浜涙暟鎹殑瓒嬪娍，浠ュ皬鏃跺拰鍛ㄤ负鍗曚綅鑾峰彇 SIEM 瓒嬪娍

//閫氳繃Session妫€鏌ュ綋鍓嶇櫥褰曠敤鎴锋槸鍚︽湁璁块棶璇ヨ彍鍗曠殑鏉冮檺

Session::logcheck("dashboard-menu", "ControlPanelExecutive");Session::logcheck("analysis-menu", "EventsForensics");//鎺ヤ笅鏉ヨ繛鎺ユ暟鎹簱

$db    = new ossim_db(TRUE);$conn  = $db->connect();//鑾峰彇褰撳墠鐢ㄦ埛淇℃伅

$user = Session::get_session_user();

//get鏂瑰紡鑾峰彇鎺т欢绫诲瀷，璁剧疆瀹夊叏鎺т欢鐨勭被鍨?/p>

$type = GET("type");

//get鏂瑰紡鑾峰彇鎺т欢ID

$id = GET("id");

//瀵规帶浠剁被鍨嬨€両D杩涜鏈夋晥鎬ч獙璇?/p>

ossim_valid($type, OSS_TEXT,  'illegal:' . _("type"));ossim_valid($id,  OSS_DIGIT, OSS_NULLABLE,  'illegal:' . _("Widget ID"));if (ossim_error()) {    die(ossim_error());}//鎺т欢鐨勬暟缁勪俊鎭?#xff0c;鍥捐〃淇℃伅鍜屾爣绛句簯淇℃伅绛?/p>

$winfo = array();$chart_info = array();鎺ヤ笅鏉ュ垽鏂璉D

//濡傛灉ID涓虹┖，浠ｈ〃鐫€鐩墠鍦ㄥ悜瀵肩殑棰勫彲瑙嗗寲涓€傜郴缁熷彲浠ヤ粠get鍙傛暟涓幏鍙栨墍鏈変俊鎭€?/p>

if (!isset($id) || empty($id)){    //瀹氫箟鎺т欢楂樺害    $winfo['height'] = GET("height");    //瀹氫箟绫诲瀷:鍥捐〃鏍囩浜戠瓑    $winfo['wtype'] = GET("wtype");     //瀹氫箟璧勪骇    $winfo['asset'] = GET("asset");     //鍥捐〃绫诲瀷，鍥句緥鍙傛暟绛?/span>    $chart_info = json_decode(GET("value"),true); }//濡傛灉ID涓嶄负绌?#xff0c;姝ｅ父鎯呭喌涓?#xff0c;浠庝华琛ㄦ澘鍔犺浇鎺т欢，鍦ㄨ繖绉嶆儏鍐典笅，绯荤粺浠庢暟鎹簱鑾峰彇鐩稿叧淇℃伅銆?/p>

else {    $winfo = get_widget_data($conn, $id);     //鍥捐〃绫诲瀷，鍥句緥鍙傛暟    $chart_info = $winfo['params']; }// 鏈夋晥鎬ф楠?/p>

ossim_valid($winfo['wtype'],  OSS_TEXT,  'illegal:' . _("Type"));ossim_valid($winfo['height'], OSS_DIGIT,  'illegal:' . _("Widget ID"));ossim_valid($winfo['asset'],  OSS_HEX,OSS_SCORE,OSS_ALPHA,OSS_USER,  'illegal:' . _("Asset/User/Entity"));if (is_array($chart_info) && !empty($chart_info)){ $validation = get_array_validation(); foreach($chart_info as $key=>$val) {     if ($validation[$key] == '')     {         continue;     }     eval("ossim_valid(\"\$val\", ".$validation[$key].", 'illegal:" . _($key)."');"); } }if (ossim_error()) { die(ossim_error());}//瀛樺偍鍥捐〃淇℃伅鐨勫彉閲?/p>

//瀹氫箟涓€涓帶浠惰嚜韬暟缁?/span>$data  = array(); //鎺т欢鐨勬爣绛?#xff0c;渚嬪鍥捐〃涓殑鍥句緥銆佹爣绛句簯涓殑鏍囬绛?..$label = array(); //瀹氫箟姣忎釜鍏冪礌鐨勯摼鎺ユ暟缁?/span>$links = array(); //switch case鏍规嵁鎺т欢鐨勭被鍨嬪鎺т欢鐨勬暟鎹繘琛岃绠?br /> //type=鈥渢cp鈥?/p>

switch($type){ case "tcp"://璧勪骇杩囨护鍣?/p>

$query_where = Security_report::make_where($conn, gmdate("Y-m-d 00:00:00",gmdate("U")-7200), gmdate("Y-m-d 23:59:59"), array(), $assets_filters);//鍦ㄦ帶浠朵腑鏄剧ず鐨勬渶澶ф敾鍑绘鏁般€?$limit = ($chart_info['top'] != '')? $chart_info['top'] : 30; //SQL鏌ヨ //鍦ㄦ煡璇腑浣跨敤鍙傛暟 $sql   = "select layer4_dport as port, count(id) as num from alienvault_siem.acid_event where layer4_dport != 0 and ip_proto=6 $query_where group by port order by num desc limit $limit"; //鍥炴樉 $sql; $rs = $conn->CacheExecute($sql); if (!$rs) {     print $conn->ErrorMsg(); } else  { $array_aux = array();     while (!$rs->EOF)      { $array_aux[$rs->fields["port"]] = $rs->fields["num"]; $link = Menu::get_menu_url('/ossim/forensics/base_qry_main.php?tcp_port[0][0]=&tcp_port[0][1]=layer4_dport&tcp_port[0][2]==&tcp_port[0][3]='.$rs->fields["port"].'&tcp_port[0][4]=&tcp_port[0][5]=&tcp_flags[0]=&layer4=TCP&num_result_rows=-1¤t_view=-1&new=1&submit=QUERYDBP&sort_order=sig_a&clear_allcriteria=1&clear_criteria=time&time_range=all', 'analysis', 'security_events'); $links[$rs->fields["port"]] = $link;  $rs->MoveNext();     } //鎸夌収绔彛鐨勫悕绉版帓搴忓缁撴灉杩涜鎺掑簭，鑰屼笉鏄敾鍑荤殑鏁伴噺銆?/span> ksort($array_aux); $data   = array_values($array_aux); $label  = array_keys($array_aux); //serie鍚嶇О $serie  = 'Amount of Attacks'; //棰滆壊璁剧疆 $colors = "#333333"; } break;//type=鈥減romiscuous鈥?/p>

case "promiscuous":      //鏃ユ湡鑼冨洿 $range          = ($chart_info['range']  > 0)? ($chart_info['range'] * 86400) : 432000; //璧勪骇杩囨护 $query_where    = Security_report::make_where($conn, gmdate("Y-m-d 00:00:00",gmdate("U")-$range), gmdate("Y-m-d 23:59:59"), array(), $assets_filters); //璁剧疆涓绘満鍦ㄦ帶浠朵腑鏄剧ず鐨勯檺鍒躲€?/span> $limit          = ($chart_info['top'] != '')? $chart_info['top'] : 10; //杩炴帴鍒癝IEM鎺у埗鍙伴〉闈?/span> $forensic_link  = Menu::get_menu_url("/ossim/forensics/base_qry_main.php?clear_allcriteria=1&time_range=range&time_cnt=2&time[0][0]=+&time[0][1]=%3E%3D&time[0][8]=+&time[0][9]=AND&time[1][1]=%3C%3D&time[0][2]=".gmdate("m",$timetz-$range)."&time[0][3]=".gmdate("d",$timetz-$range)."&time[0][4]=".gmdate("Y",$timetz-$range)."&time[0][5]=00&time[0][6]=00&time[0][7]=00&time[1][2]=".gmdate("m",$timetz)."&time[1][3]=".gmdate("d",$timetz)."&time[1][4]=".gmdate("Y",$timetz)."&time[1][5]=23&time[1][6]=59&time[1][7]=59&submit=Query+DB&num_result_rows=-1&time_cnt=1&sort_order=time_d&hmenu=Forensics&smenu=Forensics", 'analysis', 'security_events'); //SQL鏌ヨ //鍦ㄦ煡璇腑浣跨敤鍙傛暟，鐢ㄦ埛鍙傛暟鏌ヨ $sqlgraph       = "select count(distinct(ip_dst)) as num_events,ip_src as name from alienvault_siem.po_acid_event AS acid_event WHERE 1=1 $query_where group by ip_src having ip_src>0x00000000000000000000000000000000 order by num_events desc limit $limit";        $rg = $conn->CacheExecute($sqlgraph); if (!$rg) {     print $conn->ErrorMsg(); } else {     while (!$rg->EOF)      {         $data[]  = $rg->fields["num_events"]; $label[] = inet_ntop($rg->fields["name"]); $links[] = $forensic_link . '&ip_addr[0][0]=+&ip_addr[0][1]=ip_src&ip_addr[0][2]=%3D&ip_addr[0][3]=' . inet_ntop($rg->fields["name"]) . '&ip_addr[0][8]=+&ip_addr[0][9]=+&ip_addr_cnt=1';         $rg->MoveNext();     } } $colors = get_widget_colors(count($data)); break;//type=鈥渟iemhours鈥?/p>

case 'siemhours': //鍦ㄦ帶浠朵腑鏄剧ず鐨勫皬鏃舵暟銆?/span> $max = ($chart_info['range'] == '')? 16 : $chart_info['range']; //妫€绱㈠皬閮ㄤ欢鐨勬暟鎹?/span> $js     = "analytics"; $fdate  = gmdate("Y-m-d H",$timetz-(3600*($max-1))); $values = SIEM_trends($max, $assets_filters, $fdate); //灏嗕俊鎭牸寮忓寲涓哄澶勭悊绋嬪簭鏈夋晥鐨勬牸寮忋€?/span> for ($i=$max-1; $i>=0; $i--)  { $tref    = $timetz-(3600*$i); $h       = gmdate("j G",$tref)."h"; $label[] = preg_replace("/\d+ /","",$h); $data[]  = ($values[$h]!="") ? $values[$h] : 0; $link    = Menu::get_menu_url("/ossim/forensics/base_qry_main.php?clear_allcriteria=1&time_range=range&time[0][0]=+&time[0][1]=>%3D&time[0][2]=".gmdate("m",$tref)."&time[0][3]=".gmdate("d",$tref)."&time[0][4]=".gmdate("Y",$tref)."&time[0][5]=".gmdate("H",$tref)."&time[0][6]=00&time[0][7]=00&time[0][8]=+&time[0][9]=AND&time[1][0]=+&time[1][1]=<%3D&time[1][2]=".gmdate("m",$tref)."&time[1][3]=".gmdate("d",$tref)."&time[1][4]=".gmdate("Y",$tref)."&time[1][5]=".gmdate("H",$tref)."&time[1][6]=59&time[1][7]=59&time[1][8]=+&time[1][9]=+&submit=Query+DB&num_result_rows=-1&time_cnt=2&sort_order=time_d&hmenu=Forensics&smenu=Forensics", 'analysis', 'security_events'); $key = preg_replace('/^0/', '', gmdate("H",$tref) . 'h'); $links[$key] = $link; }     $siem_url    = $links; $colors      = "'#444444'"; //閮ㄤ欢涓虹┖鏃剁殑娑堟伅銆?/span> $nodata_text = "No data available yet"; break;//鏈€鍚庤皟鐢ㄥ鐞嗙▼搴忔潵缁樺埗閫傚綋鐨勫皬閮ㄤ欢，鍗?#xff1a;浠讳綍绫诲瀷鐨勫浘琛ㄣ€乼ag_cloud 绛夆€?/p>

require 'handler.php';4銆丱verview婧愮爜鍒嗘瀽

index.php 涓昏涓?php 浠ｇ爜，甯︽湁灏戦儴鍒?HTML 浠ｇ爜，涓昏瀹炵幇褰撳墠鑿滃崟鐨勫熀鏈唴瀹圭殑鑾峰彇銆佹潈闄愬垽鏂瓑鍔熻兘銆?/p>

//寮曠敤鏂囦欢

require_once 'av_init.php';//妫€鏌ユ槸鍚︽湁鏉冮檺鑾峰彇褰撳墠鑿滃崟

Session::logcheck("dashboard-menu", "ControlPanelExecutive");//鑾峰彇褰撳墠鐢ㄦ埛淇℃伅

$login = Session::get_session_user();$pro   = Session::is_pro();//鑾峰彇榛樿閫夐」鍗?/p>

/*濡傛灉鐢ㄦ埛session閲岄潰瀛樺偍浜嗛粯璁ら€夐」鍗?#xff0c;鐩存帴璧嬪€肩粰default_tab*/if (!empty($_SESSION['default_tab'])){    $default_tab = $_SESSION['default_tab'];}/*濡傛灉娌℃湁璁剧疆榛樿閫夐」鍗?#xff0c;鏂板缓鐢ㄦ埛閰嶇疆，瀛樺偍榛樿閰嶇疆*/else{    $config_aux  = new User_config($conn);    $default_tab = $config_aux->get($login, 'panel_default', 'simple', "main");    $default_tab = ($default_tab > 0) ? $default_tab : 1;    //鎶婇€夐」鍗′繚瀛樺湪session涓?/span>    $_SESSION['default_tab'] = $default_tab;}//鑾峰彇褰撳墠 panel

$panel_id = $default_tab;//鍒ゆ柇鏄惁涓虹┖if (GET('panel_id') != ""){    $panel_id = GET('panel_id');}elseif ($_SESSION['_db_panel_selected'] != ""){    $panel_id = $_SESSION['_db_panel_selected'];}//鑾峰彇閫夐」鍗″垪琛?/p>

$tab_list = Dashboard_tab::get_tabs_by_user($login, $edit);//鍒ゆ柇閫夐」鍗″垪琛ㄦ槸鍚︿负绌?/p>

if (empty($tab_list)){    //tab_list涓虹┖    $config_nt = array(        'content' => _('No tabs have been found').".",        'options' => array (            'type'          => 'nf_warning',            'cancel_button' => ''        ),        //鍓嶇css浠ｇ爜        'style'   => ' margin:25px auto 0 auto;text-align:center;padding:3px 30px;'    );         $nt = new Notification('nt_panel', $config_nt);    $nt->show();    die(); }tabs.php 涓?HTML+php 浠ｇ爜，涓昏瀹炵幇閫夐」鍗＄殑澧炲姞銆佸垹闄ゃ€佹帓搴忕瓑閫夐」鍗＄浉鍏虫搷浣滅殑鍓嶇浠ｇ爜

+涓婁竴绡?#xff08;鏋舵瀯鍒嗘瀽）：OSSIM寮€婧愬畨鍏ㄤ俊鎭鐞嗙郴缁?#xff08;涓?#xff09;

涓嬩竴绡?#xff08;浠ｇ爜鍒嗘瀽）：

Tags：web瀹夊叏 瀹夊叏 缃戠粶 杩愮淮 OSSIM

转载：感谢您对网站平台的认可，以及对我们原创作品以及文章的青睐，非常欢迎各位朋友分享到个人站长或者朋友圈，但转载请说明文章出处“来源搜码吧-程序员大本营，技术文章内容聚合第一站”。https://www.somanba.cn/xitong/457962.html

很赞哦！ (0)