repsheet_visualizer 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 71b5fb40592b28d1fd6c5eb61869ab76f56c1746
-  data.tar.gz: 1a52994411c949ea058ff88f43d0a4cd2ac9c3e1
+  metadata.gz: f98f7e61dc56515d36646dd74b76486a069ad677
+  data.tar.gz: 6fdb7a815f6ae92361d9a5628eb20445619787ad
 SHA512:
-  metadata.gz: 4353c9cc413a856243f114c7b18f8c29fa4fee5adca1b980a46ed73b6723294d0d519700758dfd4f61a324b51cbb2d1cb0c06c7b5e04162f5b6666b495c1eec4
-  data.tar.gz: e0233520e1473d115fb3a3c0092f976c45cd9c97a927f1f8095b8606991959aec8b0d1fa8631778408694ec97fed622c8a683b7bd63e321e85d5a5336570b3b4
+  metadata.gz: 030d9e94c181dc2c948eed48415322379537ba7a44e708732b9e3955fcba4f0ac66dafd416e17d7d6281f1fef314d0674d537ba8d62a992f65c6073b77d42fcc
+  data.tar.gz: 9516b4fb6cb68e5ada5df76f0d7420c35f675cc1036e304f08065ffc098aed7df9e7e86641e3c04b641f2cc48c0ac96186ea0e186f7d9050dc6d1de5101a75b8

data/.travis.yml

@@ -0,0 +1,4 @@
+language: ruby
+rvm:
+  - 2.0.0
+  - 1.9.3

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    repsheet_visualizer (0.2.0)
+    repsheet_visualizer (0.2.1)
       geoip
       json
       redis

data/README.md

@@ -1,12 +1,14 @@
-# Mod Repsheet Vizualizer
+#Repsheet Visualizer [![Build Status](https://secure.travis-ci.org/repsheet/visualizer.png)](http://travis-ci.org/repsheet/visualizer?branch=master)
+
+This is the visualization component for Repsheet. It displays information on offending actors and allows for manual blacklisting. It provides a world map that displays the location of offending actors which allows for identification of global attack patterns. It is still under active development and will undergo some pretty major changes over the next several months.
 
 ## Setup
 
-You will need to have Ruby/RubyGems installed. This app has been tested on Ruby 1.9.3. To setup and run do the following from the example folder:
+You will need to have Ruby/RubyGems installed. If you would like to use the world map feature, you will need a copy of the [GeoLiteCity Database](http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz). This app has been tested on Ruby 1.9.3 Ruby 2.0.0. You will also need access to the Repsheet Redis database. There are several ways of running the Visualizer application, but the simplest is to just run the command line program:
 
 ``` sh
 bundle install
-shotgun
+bin/repsheet_visualizer <redis_host> <redis_port> <path_to_geolite_database>
 ```
 
-Visit [http://localhost:4567](http://localhost:9393) to see the details.
+Visit [http://localhost:4567](http://localhost:4567) to view the application

data/lib/repsheet_visualizer/application/app.rb

@@ -51,7 +51,7 @@ class RepsheetVisualizer < Sinatra::Base
   end
 
   get '/breakdown' do
-    @data, @aggregate = Backend.breakdown(redis_connection)
+    @data = Backend.breakdown(redis_connection)
     erb :breakdown
   end
 
@@ -72,8 +72,9 @@ class RepsheetVisualizer < Sinatra::Base
     if params["action"] == "allow"
       connection.del("#{params[:ip]}:repsheet:blacklist")
     else
+      ttl = connection.ttl("#{params[:ip]}:requests")
       connection.set("#{params[:ip]}:repsheet:blacklist", "true")
-      connection.expire("#{params[:ip]}:repsheet:blacklist", redis_expiry)
+      connection.expire("#{params[:ip]}:repsheet:blacklist", ttl)
     end
     redirect back
   end

data/lib/repsheet_visualizer/application/backend.rb

@@ -10,18 +10,14 @@ class Backend
   end
 
   def self.breakdown(connection)
-    # data = {}
-    # offenders = connection.keys("*:repsheet").map {|o| o.split(":").first}
-    # offenders.each do |offender|
-    #   data[offender] = {"totals" => {}}
-    #   connection.smembers("#{offender}:detected").each do |rule|
-    #     data[offender]["totals"][rule] = connection.get "#{offender}:#{rule}:count"
-    #   end
-    # end
-    # aggregate = Hash.new 0
-    # data.each {|ip,data| data["totals"].each {|rule,count| aggregate[rule] += count.to_i}}
-    # [data, aggregate]
-    [{},{}]
+    data = Hash.new(0)
+    offenders = connection.keys("*:repsheet").map {|o| o.split(":").first}
+    offenders.each do |offender|
+      connection.zrange("#{offender}:detected", 0, -1).each do |rule|
+        data[rule] += connection.zscore("#{offender}:detected", rule).to_i
+      end
+    end
+    data.take(10)
   end
 
   def self.activity(connection, actor)

data/lib/repsheet_visualizer/application/public/javascripts/application.js

@@ -9,9 +9,9 @@ function angle(d) {
 }
 
 function pie(dataSet) {
-  var canvasWidth = 500,
-  canvasHeight = 500,
-  outerRadius = 150,
+  var canvasWidth = 700,
+  canvasHeight = 700,
+  outerRadius = 250,
   color = d3.scale.category20();
 
   var vis = d3.select("#total").append("svg:svg")

data/lib/repsheet_visualizer/application/views/activity.erb

@@ -35,7 +35,7 @@
           <div class="nav-collapse collapse">
             <ul class="nav">
               <li><a href="<%= @mount %>">Actors</a></li>
-              <!-- <li><a href="<%= @mount %>breakdown">Breakdown</a></li> -->
+              <li><a href="<%= @mount %>breakdown">Breakdown</a></li>
               <li><a href="<%= @mount %>worldview">Worldview</a></li>
             </ul>
           </div>

data/lib/repsheet_visualizer/application/views/actors.erb

@@ -90,7 +90,7 @@
 	  <div class="nav-collapse collapse">
 	    <ul class="nav">
 	      <li class="active"><a href="<%= @mount %>">Actors</a></li>
-	      <!-- <li><a href="<%= @mount %>breakdown">Breakdown</a></li> -->
+	      <li><a href="<%= @mount %>breakdown">Breakdown</a></li>
 	      <li><a href="<%= @mount %>worldview">Worldview</a></li>
 	    </ul>
 	  </div>

data/lib/repsheet_visualizer/application/views/breakdown.erb

@@ -27,9 +27,14 @@
         font-size: 20px;
         font-weight: bold;
       }
+
+     svg {
+       display: block;
+       margin: auto;
+     }
     </style>
     <link href="<%= @mount %>css/bootstrap-responsive.css" rel="stylesheet">
-    
+
     <!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
     <!--[if lt IE 9]>
       <script src="<%= @mount %>javascripts/html5shiv.js"></script>
@@ -59,15 +64,10 @@
 
     <div class="container">
       <div id="total">
-        <p class="announce">Mod Security Rule Breakdown</p>
-	<script>pie(<%= @aggregate.collect {|k,v| {"legendLabel" => k, "magnitude" => v}}.to_json %>);</script>
-      </div>
-
-      <div id="individual">
-        <p class="announce">Breakdown by IP</p>
-	<% @data.each do |ip, data| %>
-	  <script>donut(<%= data["totals"].keys.to_json %>, <%= {:label => ip, :pct => data["totals"].values}.to_json %>);</script>
-        <% end %>
+        <p class="announce">Top 10 Mod Security Rules Triggered</p>
+	<div id="chart" class="offset3 span6">
+	  <script>pie(<%= @data.collect {|k,v| {"legendLabel" => k, "magnitude" => v}}.to_json %>);</script>
+	</div>
       </div>
     </div>
   </body>

data/lib/repsheet_visualizer/application/views/worldview.erb

@@ -38,7 +38,7 @@
 	  <div class="nav-collapse collapse">
 	    <ul class="nav">
 	      <li><a href="<%= @mount %>">Actors</a></li>
-	      <!-- <li><a href="<%= @mount %>breakdown">Breakdown</a></li> -->
+	      <li><a href="<%= @mount %>breakdown">Breakdown</a></li>
 	      <li class="active"><a href="<%= @mount %>worldview">Worldview</a></li>
 	    </ul>
 	  </div>

data/lib/repsheet_visualizer/version.rb

@@ -1,3 +1,3 @@
 module RepsheetVisualizer
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

data/script/fill

@@ -6,8 +6,9 @@ r = Redis.new
 r.flushdb
 
 255.times do |i|
-  r.zincrby("1.1.1.#{i}:detected", rand(1000), "950001")
+  r.zincrby("1.1.1.#{i}:detected", rand(100), "950001")
   r.lpush("1.1.1.#{i}:requests", "123, Chrome, GET, foo, bar")
+  r.set("1.1.1.#{i}:repsheet", true)
 
   if i > 220
     r.set("1.1.1.#{i}:repsheet:blacklist", "true")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: repsheet_visualizer
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Aaron Bedra
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-08-16 00:00:00.000000000 Z
+date: 2013-11-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: geoip
@@ -133,6 +133,7 @@ files:
 - .gitignore
 - .rspec
 - .rvmrc
+- .travis.yml
 - Gemfile
 - Gemfile.lock
 - LICENSE.txt