127 lines
6.0 KiB
PHP
127 lines
6.0 KiB
PHP
<?php
|
|
$pageTitle = "Sysmon / EDR Dashboard";
|
|
ob_start();
|
|
?>
|
|
|
|
<div class="mb-6 flex flex-col md:flex-row justify-between items-start md:items-center gap-4">
|
|
<div>
|
|
<h1 class="text-2xl font-bold text-slate-800"><i class="fas fa-desktop text-indigo-600 mr-2"></i> Sysmon / EDR Dashboard</h1>
|
|
<p class="text-slate-500 mt-1">Endpoint Detection and Response data collected via Sysmon</p>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="grid grid-cols-1 md:grid-cols-3 gap-6 mb-6">
|
|
<div class="bg-white rounded-xl shadow-sm border border-slate-200 p-6 flex items-center">
|
|
<div class="rounded-full bg-indigo-100 p-3 mr-4">
|
|
<i class="fas fa-microchip text-indigo-600 text-2xl"></i>
|
|
</div>
|
|
<div>
|
|
<div class="text-slate-500 text-sm font-semibold uppercase tracking-wider mb-1">Sysmon Alerts Today</div>
|
|
<div class="text-3xl font-bold text-slate-800"><?= number_format($totalSysmonToday) ?></div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="bg-white rounded-xl shadow-sm border border-slate-200 p-6 md:col-span-2">
|
|
<h3 class="text-slate-700 font-semibold mb-3 border-b border-slate-100 pb-2"><i class="fas fa-exclamation-triangle text-amber-500 mr-2"></i> Top 5 Triggered Rules (Sysmon)</h3>
|
|
<?php if (empty($topRules)): ?>
|
|
<div class="text-slate-400 text-sm py-2">No sysmon alerts detected yet.</div>
|
|
<?php else: ?>
|
|
<div class="space-y-3">
|
|
<?php foreach ($topRules as $r): ?>
|
|
<div class="flex justify-between items-center text-sm">
|
|
<span class="text-slate-600 truncate mr-4"><span class="font-mono text-xs text-slate-400 mr-2"><?= htmlspecialchars($r['rule_id']) ?></span> <?= htmlspecialchars($r['description']) ?></span>
|
|
<span class="bg-amber-100 text-amber-700 py-0.5 px-2.5 rounded-full font-bold text-xs"><?= number_format($r['cnt']) ?></span>
|
|
</div>
|
|
<?php endforeach; ?>
|
|
</div>
|
|
<?php endif; ?>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="bg-white rounded-xl shadow-sm border border-slate-200 overflow-hidden">
|
|
<div class="p-5 border-b border-slate-100 bg-slate-50 flex justify-between items-center">
|
|
<h3 class="font-semibold text-slate-800"><i class="fas fa-list-ul mr-2 text-slate-400"></i> Recent Sysmon Events</h3>
|
|
</div>
|
|
<div class="overflow-x-auto">
|
|
<table id="sysmonTable" class="w-full text-left border-collapse">
|
|
<thead>
|
|
<tr class="bg-slate-50 text-slate-600 border-b border-slate-200 text-sm">
|
|
<th class="px-5 py-4 font-semibold w-40 text-center">Timestamp</th>
|
|
<th class="px-5 py-4 font-semibold text-center">Level</th>
|
|
<th class="px-5 py-4 font-semibold">Agent</th>
|
|
<th class="px-5 py-4 font-semibold">Rule / Description</th>
|
|
<th class="px-5 py-4 font-semibold text-center w-24">Details</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody class="divide-y divide-slate-100 text-sm">
|
|
<?php foreach ($recentAlerts as $a): ?>
|
|
<tr class="hover:bg-slate-50 transition-colors">
|
|
<td class="px-5 py-4 text-center text-slate-500 whitespace-nowrap text-xs"><?= date('Y-m-d H:i:s', strtotime($a['created_at'])) ?></td>
|
|
<td class="px-5 py-4 text-center">
|
|
<?php
|
|
$lvl = (int)$a['rule_level'];
|
|
$color = 'bg-slate-100 text-slate-600';
|
|
if ($lvl >= 12) $color = 'bg-red-100 text-red-700';
|
|
elseif ($lvl >= 7) $color = 'bg-amber-100 text-amber-700';
|
|
elseif ($lvl >= 5) $color = 'bg-blue-100 text-blue-700';
|
|
?>
|
|
<span class="px-2 py-1 rounded text-xs font-bold <?= $color ?>">L<?= $lvl ?></span>
|
|
</td>
|
|
<td class="px-5 py-4 font-semibold text-slate-700">
|
|
<?= htmlspecialchars($a['agent_name']) ?>
|
|
</td>
|
|
<td class="px-5 py-4">
|
|
<div class="font-mono text-xs text-slate-400 mb-0.5">ID: <?= htmlspecialchars($a['rule_id']) ?></div>
|
|
<div class="text-slate-700 font-medium"><?= htmlspecialchars($a['description']) ?></div>
|
|
</td>
|
|
<td class="px-5 py-4 text-center">
|
|
<button onclick="viewSysmonDetails(<?= $a['id'] ?>)" class="text-indigo-600 hover:text-indigo-900 bg-indigo-50 hover:bg-indigo-100 px-3 py-1.5 rounded transition">
|
|
<i class="fas fa-search"></i>
|
|
</button>
|
|
<template id="raw-<?= $a['id'] ?>">
|
|
<?= htmlspecialchars($a['raw_data']) ?>
|
|
</template>
|
|
</td>
|
|
</tr>
|
|
<?php endforeach; ?>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
window.viewSysmonDetails = function(id) {
|
|
let raw = document.getElementById('raw-' + id).innerHTML;
|
|
try {
|
|
let jsonObj = JSON.parse(raw);
|
|
raw = JSON.stringify(jsonObj, null, 2);
|
|
} catch(e) {}
|
|
|
|
Swal.fire({
|
|
title: 'Sysmon Event Details',
|
|
html: `<pre class="text-left bg-slate-900 text-green-400 p-4 rounded-lg overflow-x-auto text-xs font-mono whitespace-pre-wrap">${raw}</pre>`,
|
|
width: '900px',
|
|
showCloseButton: true,
|
|
showConfirmButton: false
|
|
});
|
|
};
|
|
|
|
$(document).ready(function() {
|
|
$('#sysmonTable').DataTable({
|
|
responsive: true,
|
|
order: [[0, 'desc']],
|
|
pageLength: 25,
|
|
language: {
|
|
search: "",
|
|
searchPlaceholder: "Search Sysmon events..."
|
|
},
|
|
dom: '<"flex flex-col md:flex-row justify-between items-center mb-4 px-5 pt-4"lf>rt<"flex flex-col md:flex-row justify-between items-center mt-4 px-5 pb-4"ip>'
|
|
});
|
|
});
|
|
</script>
|
|
|
|
<?php
|
|
$content = ob_get_clean();
|
|
require 'layout.php';
|
|
?>
|