You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1263 lines
34 KiB
1263 lines
34 KiB
import { MockStatusError } from '@delon/mock';
|
|
|
|
export const EVENTDATA = {
|
|
|
|
// 运维事件新增数量
|
|
'GET /ops_events/statistics/summary': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
operation_type: {
|
|
threat: 12,
|
|
fall: 12
|
|
},
|
|
priority: {
|
|
level1: 5
|
|
},
|
|
total_count: 23
|
|
}
|
|
},
|
|
// 运维状态图表
|
|
'GET /ops_events/statistics/state': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
state: {
|
|
new: 120,
|
|
judging: 102,
|
|
disposing: 121,
|
|
fixed: 112,
|
|
ignore: 12,
|
|
misreport: 12
|
|
}
|
|
}
|
|
},
|
|
// 运维类型图表
|
|
'GET /ops_events/statistics/operation_type': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
event_type: {
|
|
数据安全: 8,
|
|
账号安全: 16
|
|
}
|
|
}
|
|
},
|
|
// 运维等级图表
|
|
'GET /ops_events/statistics/threat_level': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
threat_level: {
|
|
middle: 3,
|
|
severe: 7,
|
|
normal: 8,
|
|
deadly: 6
|
|
}
|
|
}
|
|
},
|
|
// 运维事件操作
|
|
'PUT /judgeOperation/event/handle': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {}
|
|
},
|
|
// 运维等级图表
|
|
'GET /judgeOperation/ops_events/list': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
count: 24,
|
|
info: [
|
|
{
|
|
victim: {},
|
|
origin_event_type_path: [
|
|
'/事件类型/账号安全'
|
|
],
|
|
op_disposal_suggestion: '我也不知道建议什么',
|
|
repair_time: 1563694331,
|
|
op_type: 2,
|
|
id: 185,
|
|
is_processed: 0,
|
|
sip: [
|
|
'1.17.65.6',
|
|
'14.255.21.111',
|
|
'202.76.158.73'
|
|
],
|
|
op_source: [
|
|
'HrjD-fyJM-X8sC-NYdw'
|
|
],
|
|
op_state: 0,
|
|
releated_loophole: [],
|
|
destination: null,
|
|
dispose: [],
|
|
is_key_event: 1,
|
|
releated_nti: [],
|
|
source: null,
|
|
start_time: 1563694331,
|
|
update_time: 1563694331,
|
|
event_name: '我是假的运维事件38724',
|
|
event_suggestion_id: [
|
|
1,
|
|
2,
|
|
3
|
|
],
|
|
attacker: {},
|
|
op_liable_person: null,
|
|
judge: [],
|
|
op_object: [
|
|
{
|
|
uuid: '91bab600ab8911e9b3ba002590f24140',
|
|
name: '琚渲2 '
|
|
},
|
|
{
|
|
uuid: '03c49340ab8711e99b1b002590f24140',
|
|
name: '琚渲的网站 '
|
|
},
|
|
{
|
|
uuid: 'f8c6e4b6ab8611e99b2f002590f24140',
|
|
name: '刘阿敏的网站 '
|
|
}
|
|
],
|
|
count: 8,
|
|
releated_event: [],
|
|
op_result: null,
|
|
group_id: 1,
|
|
op_response_level: 2,
|
|
op_disposal_type: 1,
|
|
op_close_time: 1563694331,
|
|
origin_event_name: '我是假的原始运维事件38724 ',
|
|
op_threat_level: 4,
|
|
end_time: 1563694331,
|
|
op_priority_level: 1,
|
|
event_type: '账号安全',
|
|
prejudge_rule_id: 800,
|
|
dip: [
|
|
'50.123.15.48',
|
|
'24.44.121.11',
|
|
'85.248.235.195'
|
|
]
|
|
}
|
|
]
|
|
}
|
|
|
|
},
|
|
// 运维事件操作
|
|
'GET /judgeOperation/event/get/info': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
event_name: '事件名称',
|
|
operation_object: '事件名称dsfaf阿萨德撒发aaaaaaaaaaaaaaaxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
|
|
event_type: '事件名称',
|
|
event_category: '事件名称',
|
|
threat_level: 1,
|
|
priority: '事件名称',
|
|
status: 3,
|
|
source: '事件名称',
|
|
start_time: '事件名称',
|
|
end_time: '事件名称',
|
|
update_time: '事件名称',
|
|
dispose_suggestion: '事件名称xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
|
|
information: '事件名称',
|
|
op_object_map: ['1.1.1.1', '2.2.2.2'],
|
|
source_ip: '1.1.1.1',
|
|
source_port: '2323',
|
|
dst_ip: '2.2.2.2',
|
|
dst_port: '811',
|
|
result: '失败',
|
|
attack_direction: '内部攻击',
|
|
}
|
|
/**
|
|
* 源Ip，源端口，目的Ip，目的端口，攻击状态，攻击方向，情报命中。
|
|
*/
|
|
},
|
|
// 处置
|
|
'PUT /judgeOperation/event/detail/handle': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: []
|
|
},
|
|
// 获取追溯事件列表
|
|
'GET /judgeOperation/event/related_events': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
total: 2,
|
|
page: 21,
|
|
page_index: 1,
|
|
data: [
|
|
{
|
|
event_id: '3aa308a4-830e-4352-8ccc-f7fceb68db42',
|
|
event_name: ' 网页篡改攻击',
|
|
event_type_path: '/事件类型/数据安全/数据破坏',
|
|
start_time: 1563244143,
|
|
end_time: 1563244144,
|
|
attacker: '119.98.200.100',
|
|
victim: '10.67.1.4',
|
|
event_rule_id: 1,
|
|
result: ' \u6210\u529f',
|
|
threat_level: 2,
|
|
reliability_level: 3,
|
|
priority_level: 1,
|
|
occur_count: 123,
|
|
log_id: ['dad7211e-73a1-4faf-a556-936b26fe457e'],
|
|
product_hash: ['4.4.4.4_D9C3-3E74-CA8B-ABCD']
|
|
},
|
|
{
|
|
event_id: '3aa308a4-830e-4352-8ccc-f7fceb68db42',
|
|
event_name: ' 网页篡改攻击222',
|
|
event_type_path: '/事件类型/数据安全/数据破坏',
|
|
start_time: 1563244143,
|
|
end_time: 1563244144,
|
|
attacker: '119.98.200.100',
|
|
victim: '10.67.1.4',
|
|
event_rule_id: 1,
|
|
result: ' \u6210\u529f',
|
|
threat_level: 2,
|
|
reliability_level: 3,
|
|
priority_level: 1,
|
|
occur_count: 123,
|
|
log_id: ['dad7211e-73a1-4faf-a556-936b26fe457e'],
|
|
product_hash: ['4.4.4.4_D9C3-3E74-CA8B-ABCD']
|
|
}
|
|
]
|
|
}
|
|
},
|
|
// 关联日志列表
|
|
'POST /judgeOperation/event/related_logs_byid': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
'page_index': 1,
|
|
'total': 1,
|
|
'data': [{
|
|
'content': {
|
|
'dst_asset_id': '733460d2b98511e98691002590f24140',
|
|
'attacker_port': 9812,
|
|
'ti_hit_fields': '',
|
|
'kill_chain_stage': 6,
|
|
'dst_district': '',
|
|
'src_district': '',
|
|
'service_name': '',
|
|
'dev_asset_name': '',
|
|
'src_geo_location': '0.0,0.0',
|
|
'dst_asset_admin': '',
|
|
'victim_port': 80,
|
|
'sample_file_name': '',
|
|
'dev_ip': '4.4.4.4',
|
|
'victim': '10.67.1.47',
|
|
'log_message': '\u540e\u95e8\u7a0b\u5e8fDoublepulsar\u901a\u4fe1',
|
|
'acted_action': 1,
|
|
'src_asset_name': '10.67.1.86',
|
|
'sport': 9812,
|
|
'src_asset_type': '7',
|
|
'payload': '\u8bb0\u5f55\u539f\u59cb\u7684\u5305\u4fe1\u606f',
|
|
'sample_file_md5': '',
|
|
'sip': '10.67.1.86',
|
|
'av_name': '',
|
|
'sample_file_sha1': '',
|
|
'src_province': '',
|
|
'pversion': 'V2.0R00F00/F01',
|
|
'log_type_path': '/\u5f52\u4e00\u5316\u65e5\u5fd7\u7c7b\u578b/\u6076\u610f\u6837\u672c/\u6076\u610f\u540e\u95e8',
|
|
'dst_country': '',
|
|
'service_type': '',
|
|
'vender': '\u7eff\u76df',
|
|
'dst_asset_name': '10.67.1.47',
|
|
'dev_asset_type': '',
|
|
'direction': 1,
|
|
'src_city': '',
|
|
'cve_id': '',
|
|
'timestamp': 1566022461000,
|
|
'attacker': '10.67.1.86',
|
|
'hash_device': 'D9C3-3E74-CA8B-ABCD',
|
|
'policy_desc': '',
|
|
'src_asset_admin': '',
|
|
'dst_city': '',
|
|
'src_country': '',
|
|
'policy_name': '',
|
|
'log_type': '\u6076\u610f\u540e\u95e8',
|
|
'alertlevel': 0,
|
|
'av_type': '',
|
|
'log_result': 0,
|
|
'product_type': 'uts',
|
|
'src_asset_id': '73357828b98511e98691002590f24140',
|
|
'occur_count': '123',
|
|
'log_id': 'fa8bbe8e-623f-4a20-a812-58a132c0ff98',
|
|
'policy_action': 1,
|
|
'dst_geo_location': '0.0,0.0',
|
|
'dev_asset_id': '',
|
|
'rule_id': 41489,
|
|
'dst_province': '',
|
|
'sample_file_size': -1,
|
|
'dport': 80,
|
|
'dip': '10.67.1.47',
|
|
'dst_asset_type': '7',
|
|
'policy_id': ''
|
|
},
|
|
'log_type': '\u5173\u8054\u65e5\u5fd7',
|
|
'record_time': 1566022461000
|
|
}],
|
|
'page_size': 1
|
|
}
|
|
},
|
|
// 处置历史
|
|
'GET /judgeOperation/event/history': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: [
|
|
{
|
|
handle_time: 1563244143,
|
|
status: 2,
|
|
handle_content: '处置结论',
|
|
handle_user: '处置人',
|
|
responsibility_user: '指派人或者责任人',
|
|
used_time: '处置耗时',
|
|
filename: '附件文件名，有附件会传，没有附件不会传此参数'
|
|
},
|
|
{
|
|
handle_time: 1563244146,
|
|
status: 1,
|
|
handle_content: '处置结论',
|
|
handle_user: '处置人',
|
|
responsibility_user: '指派人或者责任人',
|
|
used_time: '处置耗时',
|
|
filename: '附件文件名，有附件会传，没有附件不会传此参数'
|
|
},
|
|
{
|
|
handle_time: 1563245143,
|
|
status: 2,
|
|
// tslint:disable-next-line:max-line-length
|
|
handle_content: '处置结论惺惺惜惺xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx惺想寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻惺惺惜惺惺想寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻寻嘻嘻嘻嘻嘻嘻嘻嘻寻寻寻寻寻寻寻寻寻寻寻寻寻寻',
|
|
handle_user: '处置人',
|
|
responsibility_user: '指派人或者责任人',
|
|
used_time: '处置耗时',
|
|
filename: '附件文件名，有附件会传，没有附件不会传此参数'
|
|
}
|
|
]
|
|
},
|
|
|
|
// 攻击过程
|
|
'GET /judgeOperation/ops_events/attack/sequence': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
data: [
|
|
{
|
|
ti_hits: '未命中',
|
|
attacker_ip: '10.67.3.100',
|
|
event_type: 'web漏洞攻击',
|
|
occur_count: 1,
|
|
start_time: '1565764245000',
|
|
result: 0,
|
|
victim_ip_list: ['10.67.147.137 '],
|
|
origin_event: {
|
|
analysis_technology: 'CEP',
|
|
kill_chain_stage: 4,
|
|
result: 0,
|
|
victim: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: ' 10.67.147.137',
|
|
ip_location: ' 0.0,0.0 ',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
threat_level: 3,
|
|
reliability_level: 3,
|
|
event_type: 'web漏洞攻击',
|
|
event_id: '5b303e20-dabd-4926-9beb-0f0e9717b004',
|
|
destination: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.147.137',
|
|
ip_location: '0.0,0.0',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
source: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.3.100 ',
|
|
ip_location: '0.0,0.0',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
attack_dir: 1,
|
|
start_time: '1565764245000',
|
|
event_type_path: '/事件类型/网络攻击/漏洞攻击/web漏洞攻击',
|
|
event_name: '通用_类型_目录遍历攻击',
|
|
event_suggestion_id: 1,
|
|
event_rule_id: 22,
|
|
attacker: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.3.100',
|
|
ip_location: ' 0.0,0.0 ',
|
|
asset_type: '',
|
|
port: -1
|
|
}
|
|
],
|
|
device: [
|
|
{
|
|
hash_device: 'D9C3-3E74-CA8B-ABCD',
|
|
dev_ip: ' 4.4.4.4 '
|
|
}
|
|
],
|
|
priority_level: 3,
|
|
record_time: '1565764500001',
|
|
occur_count: 1,
|
|
log_id: [
|
|
'b792f754-bdb0-4d2a-aa54-353ef4c4d646'
|
|
],
|
|
rule_mode: 1,
|
|
end_time: '1565764245000',
|
|
action: 0
|
|
}
|
|
},
|
|
{
|
|
ti_hits: '未命中',
|
|
attacker_ip: '10.67.3.100',
|
|
event_type: 'web漏洞攻击',
|
|
occur_count: 1,
|
|
start_time: '1565764245000',
|
|
result: 0,
|
|
victim_ip_list: ['10.67.147.137 '],
|
|
origin_event: {
|
|
analysis_technology: 'CEP',
|
|
kill_chain_stage: 4,
|
|
result: 0,
|
|
victim: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: ' 10.67.147.137',
|
|
ip_location: ' 0.0,0.0 ',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
threat_level: 3,
|
|
reliability_level: 3,
|
|
event_type: 'web漏洞攻击',
|
|
event_id: '5b303e20-dabd-4926-9beb-0f0e9717b004',
|
|
destination: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.147.137',
|
|
ip_location: '0.0,0.0',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
source: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.3.100 ',
|
|
ip_location: '0.0,0.0',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
attack_dir: 1,
|
|
start_time: '1565764245000',
|
|
event_type_path: '/事件类型/网络攻击/漏洞攻击/web漏洞攻击',
|
|
event_name: '通用_类型_目录遍历攻击',
|
|
event_suggestion_id: 1,
|
|
event_rule_id: 22,
|
|
attacker: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.3.100',
|
|
ip_location: ' 0.0,0.0 ',
|
|
asset_type: '',
|
|
port: -1
|
|
}
|
|
],
|
|
device: [
|
|
{
|
|
hash_device: 'D9C3-3E74-CA8B-ABCD',
|
|
dev_ip: ' 4.4.4.4 '
|
|
}
|
|
],
|
|
priority_level: 3,
|
|
record_time: '1565764500001',
|
|
occur_count: 1,
|
|
log_id: [
|
|
'b792f754-bdb0-4d2a-aa54-353ef4c4d646'
|
|
],
|
|
rule_mode: 1,
|
|
end_time: '1565764245000',
|
|
action: 0
|
|
}
|
|
},
|
|
{
|
|
ti_hits: '未命中',
|
|
attacker_ip: '10.67.3.100',
|
|
event_type: 'web漏洞攻击',
|
|
occur_count: 1,
|
|
start_time: '1565764245000',
|
|
result: 0,
|
|
victim_ip_list: ['10.67.147.137 '],
|
|
origin_event: {
|
|
analysis_technology: 'CEP',
|
|
kill_chain_stage: 4,
|
|
result: 0,
|
|
victim: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: ' 10.67.147.137',
|
|
ip_location: ' 0.0,0.0 ',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
threat_level: 3,
|
|
reliability_level: 3,
|
|
event_type: 'web漏洞攻击',
|
|
event_id: '5b303e20-dabd-4926-9beb-0f0e9717b004',
|
|
destination: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.147.137',
|
|
ip_location: '0.0,0.0',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
source: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.3.100 ',
|
|
ip_location: '0.0,0.0',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
attack_dir: 1,
|
|
start_time: '1565764245000',
|
|
event_type_path: '/事件类型/网络攻击/漏洞攻击/web漏洞攻击',
|
|
event_name: '通用_类型_目录遍历攻击',
|
|
event_suggestion_id: 1,
|
|
event_rule_id: 22,
|
|
attacker: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.3.100',
|
|
ip_location: ' 0.0,0.0 ',
|
|
asset_type: '',
|
|
port: -1
|
|
}
|
|
],
|
|
device: [
|
|
{
|
|
hash_device: 'D9C3-3E74-CA8B-ABCD',
|
|
dev_ip: ' 4.4.4.4 '
|
|
}
|
|
],
|
|
priority_level: 3,
|
|
record_time: '1565764500001',
|
|
occur_count: 1,
|
|
log_id: [
|
|
'b792f754-bdb0-4d2a-aa54-353ef4c4d646'
|
|
],
|
|
rule_mode: 1,
|
|
end_time: '1565764245000',
|
|
action: 0
|
|
}
|
|
},
|
|
{
|
|
ti_hits: '未命中',
|
|
attacker_ip: '10.67.3.100',
|
|
event_type: 'web漏洞攻击',
|
|
occur_count: 1,
|
|
start_time: '1565764245000',
|
|
result: 0,
|
|
victim_ip_list: ['10.67.147.137 '],
|
|
origin_event: {
|
|
analysis_technology: 'CEP',
|
|
kill_chain_stage: 4,
|
|
result: 0,
|
|
victim: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: ' 10.67.147.137',
|
|
ip_location: ' 0.0,0.0 ',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
threat_level: 3,
|
|
reliability_level: 3,
|
|
event_type: 'web漏洞攻击',
|
|
event_id: '5b303e20-dabd-4926-9beb-0f0e9717b004',
|
|
destination: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.147.137',
|
|
ip_location: '0.0,0.0',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
source: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.3.100 ',
|
|
ip_location: '0.0,0.0',
|
|
asset_type: '',
|
|
port: '-1'
|
|
}
|
|
],
|
|
attack_dir: 1,
|
|
start_time: '1565764245000',
|
|
event_type_path: '/事件类型/网络攻击/漏洞攻击/web漏洞攻击',
|
|
event_name: '通用_类型_目录遍历攻击',
|
|
event_suggestion_id: 1,
|
|
event_rule_id: 22,
|
|
attacker: [
|
|
{
|
|
province: '',
|
|
city: '',
|
|
ti_hit_fields: '',
|
|
district: '',
|
|
country: '',
|
|
asset_id: '',
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
ip: '10.67.3.100',
|
|
ip_location: ' 0.0,0.0 ',
|
|
asset_type: '',
|
|
port: -1
|
|
}
|
|
],
|
|
device: [
|
|
{
|
|
hash_device: 'D9C3-3E74-CA8B-ABCD',
|
|
dev_ip: ' 4.4.4.4 '
|
|
}
|
|
],
|
|
priority_level: 3,
|
|
record_time: '1565764500001',
|
|
occur_count: 1,
|
|
log_id: [
|
|
'b792f754-bdb0-4d2a-aa54-353ef4c4d646'
|
|
],
|
|
rule_mode: 1,
|
|
end_time: '1565764245000',
|
|
action: 0
|
|
}
|
|
}
|
|
],
|
|
description: {
|
|
total_count: 1,
|
|
trick: '目录遍历攻击',
|
|
attacker: [
|
|
{
|
|
asset_id: '',
|
|
city: '',
|
|
province: '',
|
|
district: '',
|
|
ip: '10.67.3.100',
|
|
port: -1,
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
country: '',
|
|
ip_location: '0.0,0.0 ',
|
|
ti_hit_fields: '',
|
|
asset_type: ''
|
|
}
|
|
],
|
|
success_count: 0,
|
|
victim: [
|
|
{
|
|
asset_id: '',
|
|
city: '',
|
|
province: '',
|
|
district: '',
|
|
ip: '10.67.147.137',
|
|
port: -1,
|
|
asset_admin: '',
|
|
asset_name: '',
|
|
country: '',
|
|
ip_location: '0.0,0.0',
|
|
ti_hit_fields: '',
|
|
asset_type: ''
|
|
}
|
|
],
|
|
time: 0
|
|
}
|
|
}
|
|
},
|
|
// 处置历史
|
|
'GET /judgeOperation/event/attach/download': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: []
|
|
},
|
|
'POST /judgeOperation/event/dispose/handle': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {}
|
|
},
|
|
'GET /judgeOperation/event/attack/topology': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: [
|
|
{
|
|
op_object: '1.1.1.1',
|
|
attacks: [
|
|
{
|
|
ip: 'A.A.A.A',
|
|
event_type: '威胁类型',
|
|
result: '-1'
|
|
},
|
|
{
|
|
ip: 'B.B.B.B',
|
|
event_type: '威胁类型',
|
|
result: '0'
|
|
},
|
|
{
|
|
ip: 'C.C.C.C',
|
|
event_type: '威胁类型',
|
|
result: '1'
|
|
}
|
|
],
|
|
victims: [
|
|
{
|
|
ip: 'a.a.a.a',
|
|
event_type: '威胁类型',
|
|
result: '-1'
|
|
},
|
|
{
|
|
ip: 'b.b.b.b',
|
|
event_type: '威胁类型',
|
|
result: '0'
|
|
},
|
|
{
|
|
ip: 'c.c.c.c',
|
|
event_type: '威胁类型',
|
|
result: '1'
|
|
}
|
|
]
|
|
},
|
|
{
|
|
op_object: '2.2.2.2',
|
|
attacks: [
|
|
{
|
|
ip: 'M.M.M.M',
|
|
event_type: '威胁类型',
|
|
result: '-1'
|
|
},
|
|
{
|
|
ip: 'N.N.N.N',
|
|
event_type: '威胁类型',
|
|
result: '0'
|
|
},
|
|
{
|
|
ip: 'K.K.K.K',
|
|
event_type: '威胁类型',
|
|
result: '1'
|
|
}
|
|
],
|
|
victims: [
|
|
{
|
|
ip: 'm.m.m.m',
|
|
event_type: '威胁类型',
|
|
result: '-1'
|
|
},
|
|
{
|
|
ip: 'n.n.n.n',
|
|
event_type: '威胁类型',
|
|
result: '0'
|
|
},
|
|
{
|
|
ip: 'j.j.j.j',
|
|
event_type: '威胁类型',
|
|
result: '1'
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
'GET /judgeOperation/ops_events/attack/flowsurvey': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
file_send: [
|
|
{
|
|
ip: '10.67.2.37',
|
|
file_names: 'locky.exe12，locky.exe222，locky.exe2222，locky.exe222',
|
|
country: '阿富汗'
|
|
}
|
|
],
|
|
port_outconnect: {
|
|
42809: 2,
|
|
1687: 1,
|
|
30301: 1
|
|
},
|
|
file_receive: [
|
|
{
|
|
ip: '10.67.1.188',
|
|
file_names: 'locky.exe12，locky.exe222，locky.exe2222，locky.exe222',
|
|
country: '中国'
|
|
},
|
|
{
|
|
ip: '10.67.1.188',
|
|
file_names: 'locky.exe12，locky.exe222，locky.exe2222，locky.exe222',
|
|
country: '中国'
|
|
},
|
|
{
|
|
ip: '10.67.1.188',
|
|
file_names: 'locky.exe12，locky.exe222，locky.exe2222，locky.exe222',
|
|
country: '中国'
|
|
},
|
|
{
|
|
ip: '10.67.1.188',
|
|
file_names: 'locky.exe12，locky.exe222，locky.exe2222，locky.exe222',
|
|
country: '中国'
|
|
},
|
|
{
|
|
ip: '10.67.1.188',
|
|
file_names: 'locky.exe12，locky.exe222，locky.exe2222，locky.exe222',
|
|
country: '中国'
|
|
}
|
|
],
|
|
port_listen: {
|
|
42809: 2,
|
|
1687: 1,
|
|
30301: 1,
|
|
30331: 45
|
|
},
|
|
attack_outreach: [
|
|
{
|
|
count: 81,
|
|
country: '中国'
|
|
},
|
|
{
|
|
count: 90,
|
|
country: '中国'
|
|
},
|
|
{
|
|
count: 10,
|
|
country: '中国'
|
|
},
|
|
{
|
|
count: 60,
|
|
country: '中国'
|
|
},
|
|
{
|
|
count: 60,
|
|
country: '中国'
|
|
}
|
|
],
|
|
attack_return: [
|
|
{
|
|
count: 3,
|
|
ip: '10.67.1.93',
|
|
country: ''
|
|
},
|
|
{
|
|
count: 3,
|
|
ip: '10.67.1.115',
|
|
country: ''
|
|
},
|
|
{
|
|
count: 1,
|
|
ip: '10.67.1.84',
|
|
country: '阿富汗'
|
|
},
|
|
{
|
|
count: 3,
|
|
ip: '10.67.1.93',
|
|
country: '中国'
|
|
},
|
|
]
|
|
}
|
|
},
|
|
'GET /vulnerabilityApp/workflow/allAsset/statistic': {
|
|
errCode: 0,
|
|
errMsg: {
|
|
sys: {
|
|
totalAssetCount: 100,
|
|
assetLevel: {
|
|
safeMore: 12,
|
|
safe: 34,
|
|
dangerMore: 34,
|
|
danger: 33
|
|
},
|
|
vulnLevel: {
|
|
high: 12,
|
|
mid: 234,
|
|
low: 122
|
|
}
|
|
},
|
|
web: {
|
|
totalAssetCount: 100,
|
|
assetLevel: {
|
|
safeMore: 12,
|
|
safe: 34,
|
|
dangerMore: 34,
|
|
danger: 33
|
|
},
|
|
vulnLevel: {
|
|
high: 12,
|
|
mid: 234,
|
|
low: 122
|
|
}
|
|
}
|
|
}
|
|
},
|
|
'GET /judgeOperation/asset/attackChain': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
1: { type: '侦查类型', value: 12 },
|
|
2: { type: '类型XXX', value: 12 },
|
|
3: { type: '类型XXX', value: 122 },
|
|
4: { type: '类型XXX', value: 112 },
|
|
5: { type: '类型XXX', value: 122 },
|
|
6: { type: '类型XXX', value: 312 },
|
|
7: { type: '类型XXXxxxxxx, xxxxxxxxxxxxxx', value: 512 },
|
|
}
|
|
},
|
|
'GET /judgeOperation/asset/infoList': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: [
|
|
{
|
|
asset_id: 'usadfsakfsdaf',
|
|
asset_name: '资产 2.2.2.2',
|
|
view: 'XXXX业务',
|
|
name: '责任人',
|
|
phone: '134xxxxxxxxxxx',
|
|
email: 'ssss@foxmail.com',
|
|
fall_reason: '信仰是沙漠的绿洲，思想的骆驼是走不到的'
|
|
},
|
|
{
|
|
asset_id: 'usadfsakfsdaf',
|
|
asset_name: '资产 2.2.2.2',
|
|
view: 'XXXX业务',
|
|
name: '责任人',
|
|
phone: '134xxxxxxxxxxx',
|
|
email: 'ssss@foxmail.com',
|
|
fall_reason: '信仰是沙漠的绿洲，思想的骆驼是走不到的'
|
|
},
|
|
{
|
|
asset_id: 'usadfsakfsdaf',
|
|
asset_name: '资产 2.2.2.2',
|
|
view: 'XXXX业务',
|
|
name: '责任人',
|
|
phone: '134xxxxxxxxxxx',
|
|
email: 'ssss@foxmail.com',
|
|
fall_reason: '信仰是沙漠的绿洲，思想的骆驼是走不到的'
|
|
}
|
|
]
|
|
},
|
|
'GET /vulnerabilityApp/external/assetVulView': {
|
|
vpoint: '-94966613.50191377',
|
|
vrange: [
|
|
'56658948.88403243',
|
|
'-78183271.13154107',
|
|
'35316828.04807499'
|
|
],
|
|
vtop: [
|
|
{
|
|
status: '65298887.205860466',
|
|
update_time: 'elitinaddoloreoccaecat',
|
|
vendor: 'pariatur',
|
|
vul_name: 'cillum',
|
|
vpoint: '42464869.60838199',
|
|
vul_id: 'reprehenderit',
|
|
priority: 'ullamcofugiatcommodovelitin'
|
|
},
|
|
{
|
|
status: '-89066674.64450137',
|
|
update_time: 'irureamet',
|
|
vendor: 'aute',
|
|
vul_name: 'et',
|
|
vpoint: '-5464009.96503143',
|
|
vul_id: 'nostrudeuofficiatempor',
|
|
priority: 'utmollit'
|
|
}
|
|
]
|
|
},
|
|
'GET /isoc/api/v1/threat_monitor/return_log':
|
|
{
|
|
totalCount: 100,
|
|
list: [
|
|
{
|
|
time: 1563244143,
|
|
content: [
|
|
{ key: 'bababaKey', value: 'xxxxxxx' },
|
|
{ key: 'bababaKey', value: 'xxxxxxx' },
|
|
{ key: 'bababaKey', value: 'xxxxxxx' },
|
|
{ key: 'bababaKey', value: 'xxxxxxx' }
|
|
]
|
|
},
|
|
{
|
|
time: 1563244143,
|
|
content: [
|
|
{ key: 'bababaKey2', value: 'xxxxxxx' },
|
|
{ key: 'bababaKey3', value: 'xxxxxxx' },
|
|
{ key: 'bababaKey', value: 'xxxxxxx' },
|
|
{ key: 'bababaKey', value: 'xxxxxxx' }
|
|
]
|
|
}, {
|
|
time: 1563244143,
|
|
content: [
|
|
{ key: 'bababaKey44', value: 'xxxxxxx' },
|
|
{ key: 'bababaKey44', value: 'xxxxxxx' },
|
|
{ key: 'bababaKey44', value: 'xxxxxxx' },
|
|
{ key: 'bababaKey', value: 'xxxxxxx' }
|
|
]
|
|
}
|
|
]
|
|
},
|
|
'GET /judgeOperation/ops_events/websafe/detail': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: [
|
|
{
|
|
'event_id': '16751144',
|
|
'priority': 2,
|
|
'name': '网页篡改',
|
|
'uri': 'http://us.gnpes.org/index.html/http://us.gnpes.org/index.html/http://us.gnpes.org/index.html/http://us.gnpes.org/index.html/',
|
|
description: {
|
|
'dst_asset_id': '733460d2b98511e98691002590f24140',
|
|
'attacker_port': 9812,
|
|
'ti_hit_fields': '',
|
|
'kill_chain_stage': 6,
|
|
'dst_district': '',
|
|
'src_district': '',
|
|
'service_name': '',
|
|
'dev_asset_name': '',
|
|
'src_geo_location': '0.0,0.0',
|
|
'dst_asset_admin': '',
|
|
'victim_port': 80,
|
|
'sample_file_name': '',
|
|
'dev_ip': '4.4.4.4',
|
|
'victim': '10.67.1.47',
|
|
'log_message': '\u540e\u95e8\u7a0b\u5e8fDoublepulsar\u901a\u4fe1',
|
|
'acted_action': 1
|
|
}
|
|
},
|
|
{
|
|
'event_id': '16751144',
|
|
'priority': 2,
|
|
'name': '网页篡改',
|
|
'uri': 'http://us.gnpes.org/index.html/',
|
|
description: 'asdfsafsadfsaf'
|
|
},
|
|
{
|
|
'event_id': '16751144',
|
|
'priority': 2,
|
|
'name': '网页篡改',
|
|
'uri': 'http://us.gnpes.org/index.html/'
|
|
}
|
|
]
|
|
},
|
|
'GET /judgeOperation/event/user': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
1: 'admin',
|
|
2: 'admin2',
|
|
3: 'admin3',
|
|
4: 'admin4',
|
|
5: 'admin5',
|
|
6: 'admin6',
|
|
7: 'admin7',
|
|
}
|
|
},
|
|
'GET /judgeOperation/event/judger_user': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
1: 'admin',
|
|
2: 'admin2',
|
|
3: 'admin3',
|
|
4: 'admin4',
|
|
5: 'admin5',
|
|
6: 'admin6',
|
|
7: 'admin7',
|
|
}
|
|
},
|
|
'DELETE /judgeOperation/event/delete/tab': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {}
|
|
},
|
|
'POST /judgeOperation/event/add_tab': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {}
|
|
},
|
|
'GET /judgeOperation/event/get_tab': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: {
|
|
count: 3,
|
|
data: [
|
|
{
|
|
tab_id: 132,
|
|
tab_name: '轮胎梨花',
|
|
op_type: [1],
|
|
event_type: [2],
|
|
event_name: '事件名称1',
|
|
object: '1.1.1.2',
|
|
threat_level: [2],
|
|
attDirection: 1,
|
|
status: [2],
|
|
source_ip: '2.2.2.2',
|
|
source_port: 8777,
|
|
dst_ip: '3.3.3.3',
|
|
begin_time: 1565924901,
|
|
end_time: 1566529701,
|
|
op_source: 'asdfsafsadfsa',
|
|
judge_user: [12],
|
|
judge_person: 'admin',
|
|
count: 2
|
|
},
|
|
{
|
|
tab_id: 132,
|
|
tab_name: '轮胎梨花',
|
|
op_type: [1],
|
|
event_type: [2],
|
|
event_name: '事件名称1',
|
|
object: '1.1.1.2',
|
|
threat_level: [2],
|
|
attDirection: 1,
|
|
status: [2],
|
|
source_ip: '2.2.2.2',
|
|
source_port: 8777,
|
|
dst_ip: '3.3.3.3',
|
|
begin_time: 1565924901,
|
|
end_time: 1566529701,
|
|
op_source: 'asdfsafsadfsa',
|
|
judge_user: [12],
|
|
judge_person: 'admin',
|
|
count: 2
|
|
}
|
|
]
|
|
}
|
|
},
|
|
'PUT /judgeOperation/event/set_tab': {
|
|
retDesc: 'success',
|
|
retCode: '000000',
|
|
rspBody: []
|
|
},
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
// op_type :1 威胁 2 失陷资产。
|
|
|