Porawit/gravity
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Porawit Dongwang
2026-09-16 23:20:08 +07:00
commit 0041668dbb
32577 changed files with 3687927 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ระบบ SOAR integration ร่วมกับ Wazuh/views/sysmon.php
+126
View File
@@ -0,0 +1,126 @@
<?php
$pageTitle = "Sysmon / EDR Dashboard";
ob_start();
?>
<div class="mb-6 flex flex-col md:flex-row justify-between items-start md:items-center gap-4">
<div>
<h1 class="text-2xl font-bold text-slate-800"><i class="fas fa-desktop text-indigo-600 mr-2"></i> Sysmon / EDR Dashboard</h1>
<p class="text-slate-500 mt-1">Endpoint Detection and Response data collected via Sysmon</p>
</div>
</div>
<div class="grid grid-cols-1 md:grid-cols-3 gap-6 mb-6">
<div class="bg-white rounded-xl shadow-sm border border-slate-200 p-6 flex items-center">
<div class="rounded-full bg-indigo-100 p-3 mr-4">
<i class="fas fa-microchip text-indigo-600 text-2xl"></i>
</div>
<div>
<div class="text-slate-500 text-sm font-semibold uppercase tracking-wider mb-1">Sysmon Alerts Today</div>
<div class="text-3xl font-bold text-slate-800"><?= number_format($totalSysmonToday) ?></div>
</div>
</div>
<div class="bg-white rounded-xl shadow-sm border border-slate-200 p-6 md:col-span-2">
<h3 class="text-slate-700 font-semibold mb-3 border-b border-slate-100 pb-2"><i class="fas fa-exclamation-triangle text-amber-500 mr-2"></i> Top 5 Triggered Rules (Sysmon)</h3>
<?php if (empty($topRules)): ?>
<div class="text-slate-400 text-sm py-2">No sysmon alerts detected yet.</div>
<?php else: ?>
<div class="space-y-3">
<?php foreach ($topRules as $r): ?>
<div class="flex justify-between items-center text-sm">
<span class="text-slate-600 truncate mr-4"><span class="font-mono text-xs text-slate-400 mr-2"><?= htmlspecialchars($r['rule_id']) ?></span> <?= htmlspecialchars($r['description']) ?></span>
<span class="bg-amber-100 text-amber-700 py-0.5 px-2.5 rounded-full font-bold text-xs"><?= number_format($r['cnt']) ?></span>
</div>
<?php endforeach; ?>
</div>
<?php endif; ?>
</div>
</div>
<div class="bg-white rounded-xl shadow-sm border border-slate-200 overflow-hidden">
<div class="p-5 border-b border-slate-100 bg-slate-50 flex justify-between items-center">
<h3 class="font-semibold text-slate-800"><i class="fas fa-list-ul mr-2 text-slate-400"></i> Recent Sysmon Events</h3>
</div>
<div class="overflow-x-auto">
<table id="sysmonTable" class="w-full text-left border-collapse">
<thead>
<tr class="bg-slate-50 text-slate-600 border-b border-slate-200 text-sm">
<th class="px-5 py-4 font-semibold w-40 text-center">Timestamp</th>
<th class="px-5 py-4 font-semibold text-center">Level</th>
<th class="px-5 py-4 font-semibold">Agent</th>
<th class="px-5 py-4 font-semibold">Rule / Description</th>
<th class="px-5 py-4 font-semibold text-center w-24">Details</th>
</tr>
</thead>
<tbody class="divide-y divide-slate-100 text-sm">
<?php foreach ($recentAlerts as $a): ?>
<tr class="hover:bg-slate-50 transition-colors">
<td class="px-5 py-4 text-center text-slate-500 whitespace-nowrap text-xs"><?= date('Y-m-d H:i:s', strtotime($a['created_at'])) ?></td>
<td class="px-5 py-4 text-center">
<?php
$lvl = (int)$a['rule_level'];
$color = 'bg-slate-100 text-slate-600';
if ($lvl >= 12) $color = 'bg-red-100 text-red-700';
elseif ($lvl >= 7) $color = 'bg-amber-100 text-amber-700';
elseif ($lvl >= 5) $color = 'bg-blue-100 text-blue-700';
?>
<span class="px-2 py-1 rounded text-xs font-bold <?= $color ?>">L<?= $lvl ?></span>
</td>
<td class="px-5 py-4 font-semibold text-slate-700">
<?= htmlspecialchars($a['agent_name']) ?>
</td>
<td class="px-5 py-4">
<div class="font-mono text-xs text-slate-400 mb-0.5">ID: <?= htmlspecialchars($a['rule_id']) ?></div>
<div class="text-slate-700 font-medium"><?= htmlspecialchars($a['description']) ?></div>
</td>
<td class="px-5 py-4 text-center">
<button onclick="viewSysmonDetails(<?= $a['id'] ?>)" class="text-indigo-600 hover:text-indigo-900 bg-indigo-50 hover:bg-indigo-100 px-3 py-1.5 rounded transition">
<i class="fas fa-search"></i>
</button>
<template id="raw-<?= $a['id'] ?>">
<?= htmlspecialchars($a['raw_data']) ?>
</template>
</td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
</div>
</div>
<script>
window.viewSysmonDetails = function(id) {
let raw = document.getElementById('raw-' + id).innerHTML;
try {
let jsonObj = JSON.parse(raw);
raw = JSON.stringify(jsonObj, null, 2);
} catch(e) {}
Swal.fire({
title: 'Sysmon Event Details',
html: `<pre class="text-left bg-slate-900 text-green-400 p-4 rounded-lg overflow-x-auto text-xs font-mono whitespace-pre-wrap">${raw}</pre>`,
width: '900px',
showCloseButton: true,
showConfirmButton: false
});
};
$(document).ready(function() {
$('#sysmonTable').DataTable({
responsive: true,
order: [[0, 'desc']],
pageLength: 25,
language: {
search: "",
searchPlaceholder: "Search Sysmon events..."
},
dom: '<"flex flex-col md:flex-row justify-between items-center mb-4 px-5 pt-4"lf>rt<"flex flex-col md:flex-row justify-between items-center mt-4 px-5 pb-4"ip>'
});
});
</script>
<?php
$content = ob_get_clean();
require 'layout.php';
?>