repsheet_visualizer 0.1.0 → 0.1.1

data/lib/repsheet_visualizer/application/app.rb

@@ -10,8 +10,11 @@ class RepsheetVisualizer < Sinatra::Base
   end
 
   helpers do
-    def action(data)
-      if data[:blacklist].nil? || data[:blacklist] == "false"
+    def action(ip, blacklist=nil)
+      puts ip.inspect
+      puts blacklist.inspect
+      blacklist = redis_connection.get("#{ip}:repsheet:blacklist") if blacklist.nil?
+      if blacklist.nil? || blacklist == "false"
         "blacklist"
       else
         "allow"
@@ -39,17 +42,31 @@ class RepsheetVisualizer < Sinatra::Base
 
   # TODO: These methods should get moved out to another place
   def summary(connection)
-    actors = {}
+    suspects = {}
+    blacklisted = {}
+
     connection.keys("*:requests").map {|d| d.split(":").first}.reject {|ip| ip.empty?}.each do |actor|
-      actors[actor] = Hash.new 0
-      actors[actor][:repsheet] = connection.get("#{actor}:repsheet")
-      actors[actor][:blacklist] = connection.get("#{actor}:repsheet:blacklist")
-      actors[actor][:detected] = connection.smembers("#{actor}:detected").join(", ")
-      connection.smembers("#{actor}:detected").each do |rule|
-        actors[actor][:total] += connection.get("#{actor}:#{rule}:count").to_i
+      detected = connection.smembers("#{actor}:detected").join(", ")
+      blacklist = connection.get("#{actor}:repsheet:blacklist")
+
+      if !detected.empty? && blacklist != "true"
+        suspects[actor] = Hash.new 0
+        suspects[actor][:detected] = detected
+        connection.smembers("#{actor}:detected").each do |rule|
+          suspects[actor][:total] += connection.get("#{actor}:#{rule}:count").to_i
+        end
+      end
+
+      if blacklist == "true"
+        blacklisted[actor] = Hash.new 0
+        blacklisted[actor][:detected] = detected
+        connection.smembers("#{actor}:detected").each do |rule|
+          blacklisted[actor][:total] += connection.get("#{actor}:#{rule}:count").to_i
+        end
       end
     end
-    actors
+
+    [suspects.sort_by{|k,v| -v[:total]}.take(10), blacklisted]
   end
 
   def breakdown(connection)
@@ -83,7 +100,7 @@ class RepsheetVisualizer < Sinatra::Base
 
   # This is the actual application
   get '/' do
-    @data = summary(redis_connection)
+    @suspects, @blacklisted = summary(redis_connection)
     erb :actors
   end
 

data/lib/repsheet_visualizer/application/public/javascripts/application.js

@@ -1,8 +1,12 @@
 $(document).ready(function() {
-    // Bring up tablesorter and sort by people who have committed the
-    // most number of ModSecurity violations and who are not yet on
-    // the blacklist
-    $("#actors").tablesorter({sortList: [[2,0], [4,1]],widgets: ['zebra']});
+    $("#suspects").tablesorter({sortList: [[2,1]],widgets: ['zebra']});
+    $("#blacklisted").tablesorter({sortList: [[2,1]],widgets: ['zebra']});
+
+    $("#search-button").click(function() {
+	ip = $("#ip").val();
+	if (ip === "") return;
+	window.location = "activity/" + ip;
+    });
 });
 
 function angle(d) {

data/lib/repsheet_visualizer/application/views/activity.erb

@@ -10,19 +10,20 @@
     <link href="<%= @mount %>css/bootstrap.css" rel="stylesheet">
     <style>
       body {
-        padding-top: 60px; /* 60px to make the container go all the way to the bottom of the topbar */
+      padding-top: 60px; /* 60px to make the container go all the way to the bottom of the topbar */
       }
     </style>
     <link href="<%= @mount %>css/bootstrap-responsive.css" rel="stylesheet">
-    
+
     <!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
     <!--[if lt IE 9]>
-      <script src="<%= @mount %>javascripts/html5shiv.js"></script>
-    <![endif]-->
+        <script src="<%= @mount %>javascripts/html5shiv.js"></script>
+        <![endif]-->
 
     <link rel="shortcut icon" href="/<%= @mount %>/images/favicon.ico">
 
-    <script src="<%= @mount %>javascripts/d3.v3.min.js" type="text/javascript"></script>
+    <script src="<%= @mount %>javascripts/jquery-latest.js" type="text/javascript"></script>
+    <script src="<%= @mount %>javascripts/jquery.tablesorter.min.js" type="text/javascript"></script>
     <script src="<%= @mount %>javascripts/application.js" type="text/javascript"></script>
   </head>
 
@@ -31,24 +32,35 @@
       <div class="navbar-inner">
         <div class="container">
           <a class="brand" href="<%= @mount %>">Repsheet</a>
-	  <div class="nav-collapse collapse">
-	    <ul class="nav">
-	      <li><a href="<%= @mount %>">Actors</a></li>
-	      <li><a href="<%= @mount %>breakdown">Breakdown</a></li>
-	      <li><a href="<%= @mount %>worldview">Worldview</a></li>
-	    </ul>
-	  </div>
+          <div class="nav-collapse collapse">
+            <ul class="nav">
+              <li><a href="<%= @mount %>">Actors</a></li>
+              <li><a href="<%= @mount %>breakdown">Breakdown</a></li>
+              <li><a href="<%= @mount %>worldview">Worldview</a></li>
+            </ul>
+          </div>
         </div>
       </div>
     </div>
 
     <div class="container">
       <h2>Activity for <%= @ip %></h2>
-      <div><a href="<%= @mount %>">Back</a></div>
+      <form method="post" action="<%= @mount %>action" class="button_to">
+        <div>
+          <input value="<%= action(@ip) %>" type="submit" />
+          <input type="hidden" name="ip" value="<%= @ip %>"/>
+          <input type="hidden" name="action" value="<%= action(@ip) %>"/>
+        </div>
+      </form>
+
+      <div>
+        <a href="<%= @mount %>">Back</a>
+      </div>
+
       <ul>
-	<% @data.each do |action| %>
-	  <li><%= action %></li>
-	<% end %>
+        <% @data.each do |action| %>
+        <li><%= action %></li>
+        <% end %>
       </ul>
     </div>
   </body>

data/lib/repsheet_visualizer/application/views/actors.erb

@@ -15,9 +15,45 @@
         padding-top: 60px; /* 60px to make the container go all the way to the bottom of the topbar */
       }
 
+      #search {
+        padding-bottom: 20px;
+      }
+
       .actors {
         border-color: #FFF;
       }
+
+      #suspects-wrapper {
+        float: left;
+      }
+
+      #suspects-table-wrapper {
+        overflow: auto;
+        max-height: 800px;
+
+      }
+
+      #suspects {
+        width: 550px;
+      }
+
+      #blacklisted-wrapper {
+        float: right;
+      }
+
+      #blacklisted-table-wrapper {
+        overflow: auto;
+        max-height: 570px;
+      }
+
+      #blacklisted {
+        width: 550px;
+      }
+
+      .clearfix {
+        display: inline-block;
+        clear: both;
+      }
     </style>
     
     <!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
@@ -49,40 +85,85 @@
     </div>
 
     <div class="container">
-      <table id="actors" class="tablesorter actors">
-        <thead>
-	  <tr>
-	    <th>IP</th>
-	    <th>Repsheet?</th>
-	    <th>Blacklist?</th>
-      	    <th>Triggered Rules</th>
-	    <th>Offenses</th>
-	    <th>Activity</th>
-	    <th>Action</th>
-	  </tr>
-	</thead>
-	<tbody>
-	  <% @data.each do |actor,details| %>
-	    <tr>
-	      <td><%= actor %></td>
-	      <td><%= details[:repsheet] %></td>
-	      <td><%= details[:blacklist] %></td>
-	      <td><%= details[:detected] %></td>
-	      <td><%= details[:total] %></td>
-	      <td><a href="<%= @mount %>activity/<%= actor %>">Click to see activity</a>
-	      <td>
-		<form method="post" action="<%= @mount %>action" class="button_to">
-		  <div>
-		    <input value="<%= action(details) %>" type="submit" />
-		    <input type="hidden" name="ip" value="<%= actor %>"/>
-		    <input type="hidden" name="action" value="<%= action(details) %>"/>
-		  </div>
-		</form>
-	      </td>
-	    </tr>
-	  <% end %>
-	</tbody>
-      </table>
+      <div id="search">
+	<label-for="ip"><b>Find Activity For an IP</b> </label>
+	<input name="ip" id="ip" type="text-field"/>
+	<input type="submit" id="search-button" value="Search"/>
+      </div>
+
+      <div id="suspects-wrapper">
+	<h2>Top 10 Suspect Actors</h2>
+	<div id="suspects-table-wrapper">
+	  <table id="suspects" class="tablesorter actors">
+            <thead>
+	      <tr>
+		<th>IP</th>
+                <th>Triggered Rules</th>
+		<th>Offenses</th>
+		<th>Activity</th>
+		<th>Action</th>
+	      </tr>
+	    </thead>
+	    <tbody>
+	      <% @suspects.each do |actor,details| %>
+	      <tr>
+		<td><%= actor %></td>
+		<td><%= details[:detected] %></td>
+		<td><%= details[:total] %></td>
+		<td width=100><a href="<%= @mount %>activity/<%= actor %>">Click to see activity</a>
+		<td width=90>
+		  <form method="post" action="<%= @mount %>action" class="button_to">
+		    <div>
+		      <input value="<%= action(actor) %>" type="submit" />
+		      <input type="hidden" name="ip" value="<%= actor %>"/>
+		      <input type="hidden" name="action" value="<%= action(actor) %>"/>
+		    </div>
+		  </form>
+		</td>
+	      </tr>
+	      <% end %>
+	    </tbody>
+	  </table>
+	</div>
+      </div>
+
+      <div class="clearfix"></div>
+
+      <div id="blacklisted-wrapper">
+	<h2>Blacklisted Actors</h2>
+	<div id="blacklisted-table-wrapper">
+	  <table id="blacklisted" class="tablesorter actors">
+            <thead>
+	      <tr>
+		<th>IP</th>
+                <th>Triggered Rules</th>
+		<th>Offenses</th>
+		<th>Activity</th>
+		<th>Action</th>
+	      </tr>
+	    </thead>
+	    <tbody>
+	      <% @blacklisted.each do |actor,details| %>
+	      <tr>
+		<td><%= actor %></td>
+		<td><%= details[:detected] %></td>
+		<td><%= details[:total] %></td>
+		<td width=100><a href="<%= @mount %>activity/<%= actor %>">Click to see activity</a>
+		<td width=70>
+		  <form method="post" action="<%= @mount %>action" class="button_to">
+		    <div>
+		      <input value="<%= action(actor, details[:blacklist]) %>" type="submit" />
+		      <input type="hidden" name="ip" value="<%= actor %>"/>
+		      <input type="hidden" name="action" value="<%= action(actor, details[:blacklist]) %>"/>
+		    </div>
+		  </form>
+		</td>
+	      </tr>
+	      <% end %>
+	    </tbody>
+	  </table>
+	</div>
+      </div>
     </div>
   </body>
 </html>

data/lib/repsheet_visualizer/version.rb

@@ -1,3 +1,3 @@
 module RepsheetVisualizer
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

data/script/fill

@@ -0,0 +1,26 @@
+#!/usr/bin/env ruby
+
+require 'redis'
+
+r = Redis.new
+r.flushdb
+
+255.times do |i|
+  r.set("1.1.1.#{i}:950001:count", rand(1000))
+  r.lpush("1.1.1.#{i}:requests", "request")
+  r.sadd("1.1.1.#{i}:detected", "950001")
+  if i > 220
+    r.set("1.1.1.#{i}:repsheet:blacklist", "true")
+  end
+end
+
+255.times do |i|
+  r.lpush("2.2.2.#{i}:requests", "request")
+end
+
+
+20.times do |i|
+  r.sadd("1.1.1.1:detected", "9900#{i + 10}")
+  r.set("1.1.1.1:9900#{i + 10}:count", 1000)
+end
+

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: repsheet_visualizer
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-06-11 00:00:00.000000000 Z
+date: 2013-06-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: geoip
@@ -161,6 +161,7 @@ files:
 - lib/repsheet_visualizer/application/views/worldview.erb
 - lib/repsheet_visualizer/version.rb
 - repsheet_visualizer.gemspec
+- script/fill
 homepage: https://github.com/Repsheet/visualizer
 licenses:
 - MIT