119 lines
4.0 KiB
JavaScript
119 lines
4.0 KiB
JavaScript
// Setup a monitor rule and trigger it to test
|
|
const http = require('http');
|
|
|
|
const MONITOR_URL = 'http://localhost:8082';
|
|
|
|
function post(path, data) {
|
|
return new Promise((resolve, reject) => {
|
|
const payload = JSON.stringify(data);
|
|
const url = new URL(path, MONITOR_URL);
|
|
const req = http.request({
|
|
hostname: url.hostname, port: url.port, path: url.pathname,
|
|
method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
|
|
}, (res) => {
|
|
let body = '';
|
|
res.on('data', c => body += c);
|
|
res.on('end', () => { try { resolve(JSON.parse(body)); } catch { resolve(body); } });
|
|
});
|
|
req.on('error', reject);
|
|
req.write(payload);
|
|
req.end();
|
|
});
|
|
}
|
|
|
|
function get(path) {
|
|
return new Promise((resolve, reject) => {
|
|
http.get(MONITOR_URL + path, (res) => {
|
|
let body = '';
|
|
res.on('data', c => body += c);
|
|
res.on('end', () => { try { resolve(JSON.parse(body)); } catch { resolve(body); } });
|
|
}).on('error', reject);
|
|
});
|
|
}
|
|
|
|
async function main() {
|
|
console.log('\n === Monitor Test Setup ===\n');
|
|
|
|
// 1. Create rule
|
|
console.log(' 1. Creating rule "Root DB Access Detection"...');
|
|
const rule = await post('/api/monitor/rules', {
|
|
id: 'root-access',
|
|
name: 'Root DB Access Detection',
|
|
enabled: true,
|
|
sources: ['sample-logs/security-audit.log'],
|
|
patterns: ['root.*login', 'root.*executed', 'GRANT.*PRIVILEGES', 'DROP TABLE'],
|
|
patternLogic: 'any',
|
|
timeRange: { type: 'all' },
|
|
notifications: [{ type: 'webhook', url: 'http://localhost:8082/api/monitor/results' }],
|
|
maxLinesInMessage: 20,
|
|
cooldownMs: 10000,
|
|
matchCount: 0,
|
|
lastTriggered: null,
|
|
schedule: { mode: 'interval' },
|
|
});
|
|
console.log(' Result:', rule.ok ? 'OK' : 'FAILED');
|
|
|
|
// 2. Create second rule
|
|
console.log(' 2. Creating rule "Failed Login Attempts"...');
|
|
const rule2 = await post('/api/monitor/rules', {
|
|
id: 'failed-logins',
|
|
name: 'Failed Login Attempts',
|
|
enabled: true,
|
|
sources: ['sample-logs/security-audit.log'],
|
|
patterns: ['Failed login', 'Account locked'],
|
|
patternLogic: 'any',
|
|
timeRange: { type: 'all' },
|
|
notifications: [{ type: 'webhook', url: 'http://localhost:8082/api/monitor/results' }],
|
|
maxLinesInMessage: 10,
|
|
cooldownMs: 10000,
|
|
matchCount: 0,
|
|
lastTriggered: null,
|
|
schedule: { mode: 'interval' },
|
|
});
|
|
console.log(' Result:', rule2.ok ? 'OK' : 'FAILED');
|
|
|
|
// 3. List rules
|
|
console.log('\n 3. Current rules:');
|
|
const rules = await get('/api/monitor/rules');
|
|
for (const r of rules) {
|
|
console.log(` - ${r.name} (${r.patterns.length} patterns, enabled: ${r.enabled})`);
|
|
}
|
|
|
|
// 4. Trigger the first rule manually
|
|
console.log('\n 4. Triggering "Root DB Access Detection" manually...');
|
|
const result = await post('/api/monitor/trigger/root-access', {});
|
|
if (result && result.totalMatches) {
|
|
console.log(` ✅ Found ${result.totalMatches} matches!`);
|
|
console.log(' Sample matches:');
|
|
for (const line of result.matchedLines.slice(0, 5)) {
|
|
console.log(` | ${line}`);
|
|
}
|
|
if (result.totalMatches > 5) {
|
|
console.log(` ... and ${result.totalMatches - 5} more`);
|
|
}
|
|
} else {
|
|
console.log(' No matches found.');
|
|
}
|
|
|
|
// 5. Trigger second rule
|
|
console.log('\n 5. Triggering "Failed Login Attempts"...');
|
|
const result2 = await post('/api/monitor/trigger/failed-logins', {});
|
|
if (result2 && result2.totalMatches) {
|
|
console.log(` ✅ Found ${result2.totalMatches} matches!`);
|
|
for (const line of result2.matchedLines.slice(0, 3)) {
|
|
console.log(` | ${line}`);
|
|
}
|
|
}
|
|
|
|
// 6. Check results
|
|
console.log('\n 6. Alert history:');
|
|
const results = await get('/api/monitor/results');
|
|
for (const r of results) {
|
|
console.log(` - [${r.timestamp}] ${r.ruleName}: ${r.totalMatches} matches`);
|
|
}
|
|
|
|
console.log('\n === Done! Open http://localhost:8082 to see the GUI ===\n');
|
|
}
|
|
|
|
main().catch(e => console.error('Error:', e.message));
|