787 lines
28 KiB
Python
787 lines
28 KiB
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Stdlib curses terminal UI for SSH/tmux operators."""
|
|
from __future__ import annotations
|
|
|
|
import curses
|
|
import json
|
|
import textwrap
|
|
from dataclasses import dataclass, field
|
|
from typing import Iterable
|
|
|
|
from . import __version__, incident
|
|
from .config import Config
|
|
|
|
|
|
VIEWS = (
|
|
"status",
|
|
"alerts",
|
|
"incidents",
|
|
"timeline",
|
|
"posture",
|
|
"integrity",
|
|
"rules",
|
|
"events",
|
|
"response",
|
|
"help",
|
|
)
|
|
WORKFLOW_VIEWS = ("status", "incidents", "timeline", "response", "integrity")
|
|
TUI_COMMANDS = {
|
|
"status": "show daemon health and heartbeat",
|
|
"alerts": "show recent captured alert snapshots",
|
|
"incidents": "show grouped incidents",
|
|
"timeline": "show incident timelines",
|
|
"posture": "show advisory posture findings",
|
|
"integrity": "show watchdog, FIM, package, and reconciliation state",
|
|
"rules": "show event-rule catalog",
|
|
"events": "tail local events.log",
|
|
"response": "preview read-only response plans for incidents",
|
|
"help": "show keys and commands",
|
|
"home": "return to the Status starting view",
|
|
"guide": "show beginner workflow help",
|
|
"next": "move to the next beginner workflow view",
|
|
"back": "move to the previous beginner workflow view",
|
|
"refresh": "reload data from disk",
|
|
"filter": "filter current view: filter <text>",
|
|
"clear": "clear filter and message",
|
|
"quit": "exit the TUI",
|
|
}
|
|
VIEW_INFO = {
|
|
"status": (
|
|
"Status",
|
|
"Start here. Shows whether the Sentinel sensor is running and fresh.",
|
|
),
|
|
"alerts": (
|
|
"Alerts",
|
|
"Individual findings from detectors. Use Incidents when several alerts may be related.",
|
|
),
|
|
"incidents": (
|
|
"Incidents",
|
|
"Grouped alerts that tell one story. Start investigations here.",
|
|
),
|
|
"timeline": (
|
|
"Timeline",
|
|
"Time-ordered incident activity. Use this to understand what happened first.",
|
|
),
|
|
"posture": (
|
|
"Posture",
|
|
"Hardening advice. These are risky settings, not proof of compromise by themselves.",
|
|
),
|
|
"integrity": (
|
|
"Integrity",
|
|
"Trust checks for heartbeat, FIM, package DB, signatures, and accepted drift.",
|
|
),
|
|
"rules": (
|
|
"Rules",
|
|
"Detection rule catalog. Mostly useful for tuning or understanding why an alert fired.",
|
|
),
|
|
"events": (
|
|
"Events",
|
|
"Technical event log. Useful for troubleshooting sensor startup and probes.",
|
|
),
|
|
"response": (
|
|
"Response Plans",
|
|
"Read-only containment and recovery suggestions. The TUI never executes commands.",
|
|
),
|
|
"help": (
|
|
"Help",
|
|
"Keys, commands, and a safe first investigation workflow.",
|
|
),
|
|
}
|
|
|
|
|
|
@dataclass
|
|
class TuiState:
|
|
view: str = "status"
|
|
filter_text: str = ""
|
|
message: str = ""
|
|
scroll: int = 0
|
|
command: str = ""
|
|
command_mode: bool = False
|
|
should_quit: bool = False
|
|
model: dict = field(default_factory=dict)
|
|
|
|
|
|
def complete_command(prefix: str, commands: Iterable[str] = TUI_COMMANDS) -> str:
|
|
"""Return the unique command completion or the common prefix of matches."""
|
|
if not prefix:
|
|
return prefix
|
|
matches = sorted(c for c in commands if c.startswith(prefix))
|
|
if not matches:
|
|
return prefix
|
|
if len(matches) == 1:
|
|
return matches[0]
|
|
common = matches[0]
|
|
for match in matches[1:]:
|
|
i = 0
|
|
while i < min(len(common), len(match)) and common[i] == match[i]:
|
|
i += 1
|
|
common = common[:i]
|
|
return common or prefix
|
|
|
|
|
|
def collect_model(cfg: Config) -> dict:
|
|
from .web import (
|
|
daemon_status,
|
|
integrity_report,
|
|
posture_report,
|
|
rules_catalog,
|
|
tail_events,
|
|
)
|
|
|
|
status = _safe_section("status", lambda: daemon_status(cfg), {})
|
|
incidents = _safe_section(
|
|
"incidents",
|
|
lambda: sorted(
|
|
incident.load_index(cfg).values(),
|
|
key=lambda i: i.get("last_ts", 0.0),
|
|
reverse=True,
|
|
),
|
|
[],
|
|
)
|
|
return {
|
|
"status": status,
|
|
"alerts": _recent_alerts(cfg),
|
|
"incidents": incidents,
|
|
"timeline": _incident_views(cfg, incidents),
|
|
"posture": _safe_section("posture", lambda: posture_report(cfg), {}),
|
|
"integrity": _safe_section(
|
|
"integrity", lambda: integrity_report(cfg, status), {}
|
|
),
|
|
"rules": _safe_section("rules", lambda: rules_catalog(cfg), {}),
|
|
"events": _safe_section("events", lambda: tail_events(cfg), []),
|
|
"response": _response_plans(cfg, incidents),
|
|
}
|
|
|
|
|
|
def _safe_section(name: str, fn, fallback):
|
|
try:
|
|
return fn()
|
|
except Exception as exc: # pragma: no cover - defensive TUI degradation
|
|
if isinstance(fallback, dict):
|
|
data = dict(fallback)
|
|
data["error"] = f"{name}: {exc}"
|
|
return data
|
|
return [f"{name}: {exc}"]
|
|
|
|
|
|
def run_tui_command(state: TuiState, command: str) -> TuiState:
|
|
raw = command.strip()
|
|
if not raw:
|
|
state.command_mode = False
|
|
return state
|
|
name, _, rest = raw.partition(" ")
|
|
if name in VIEWS:
|
|
state.view = name
|
|
state.scroll = 0
|
|
state.message = f"view: {_view_label(name)}"
|
|
elif name == "home":
|
|
state.view = "status"
|
|
state.scroll = 0
|
|
state.message = "view: Status"
|
|
elif name == "guide":
|
|
state.view = "help"
|
|
state.scroll = 0
|
|
state.message = "beginner guide"
|
|
elif name == "next":
|
|
state.view = _workflow_neighbor(state.view, 1)
|
|
state.scroll = 0
|
|
state.message = f"next: {_view_label(state.view)}"
|
|
elif name == "back":
|
|
state.view = _workflow_neighbor(state.view, -1)
|
|
state.scroll = 0
|
|
state.message = f"back: {_view_label(state.view)}"
|
|
elif name == "refresh":
|
|
state.message = "refreshed"
|
|
elif name == "filter":
|
|
state.filter_text = rest.strip()
|
|
state.scroll = 0
|
|
state.message = f"filter: {state.filter_text or 'none'}"
|
|
elif name == "clear":
|
|
state.filter_text = ""
|
|
state.message = ""
|
|
state.scroll = 0
|
|
elif name == "quit":
|
|
state.should_quit = True
|
|
else:
|
|
state.message = f"unknown command: {name}"
|
|
state.command = ""
|
|
state.command_mode = False
|
|
return state
|
|
|
|
|
|
def render_lines(state: TuiState, width: int = 100) -> list[str]:
|
|
model = state.model or {}
|
|
view = state.view if state.view in VIEWS else "status"
|
|
if view == "status":
|
|
lines = _render_status(model.get("status") or {}, width)
|
|
elif view == "alerts":
|
|
lines = _render_alerts(model.get("alerts") or [], width)
|
|
elif view == "incidents":
|
|
lines = _render_incidents(model.get("incidents") or [], width)
|
|
elif view == "timeline":
|
|
lines = _render_timelines(model.get("timeline") or [], width)
|
|
elif view == "posture":
|
|
lines = _render_posture(model.get("posture") or {}, width)
|
|
elif view == "integrity":
|
|
lines = _render_integrity(model.get("integrity") or {}, width)
|
|
elif view == "rules":
|
|
lines = _render_rules(model.get("rules") or {}, width)
|
|
elif view == "events":
|
|
lines = _render_events(model.get("events") or [], width)
|
|
elif view == "response":
|
|
lines = _render_response(model.get("response") or [], width)
|
|
else:
|
|
lines = _render_help(width)
|
|
if view != "help":
|
|
lines = _with_intro(view, lines, width)
|
|
if state.filter_text:
|
|
needle = state.filter_text.lower()
|
|
lines = [line for line in lines if needle in line.lower()]
|
|
if not lines:
|
|
lines = [f"No rows match filter: {state.filter_text}"]
|
|
return lines
|
|
|
|
|
|
def run(cfg: Config) -> int:
|
|
curses.wrapper(lambda stdscr: _loop(stdscr, cfg))
|
|
return 0
|
|
|
|
|
|
def main(argv=None) -> int:
|
|
import argparse
|
|
|
|
parser = argparse.ArgumentParser(
|
|
prog="enodia-sentinel-tui",
|
|
description="Terminal dashboard for Enodia Sentinel.",
|
|
)
|
|
parser.add_argument("-c", "--config", help="path to TOML config")
|
|
args = parser.parse_args(argv)
|
|
return run(Config.load(args.config))
|
|
|
|
|
|
def _loop(stdscr, cfg: Config) -> None:
|
|
curses.curs_set(0)
|
|
stdscr.nodelay(False)
|
|
state = TuiState(model=collect_model(cfg))
|
|
while not state.should_quit:
|
|
_draw(stdscr, state)
|
|
key = stdscr.getch()
|
|
if state.command_mode:
|
|
_handle_command_key(state, key)
|
|
if not state.command_mode and not state.should_quit:
|
|
if state.message == "refreshed":
|
|
state.model = collect_model(cfg)
|
|
state.command = ""
|
|
continue
|
|
if key in (ord("q"), ord("Q")):
|
|
state.should_quit = True
|
|
elif key in (ord("r"), ord("R")):
|
|
state.model = collect_model(cfg)
|
|
state.message = "refreshed"
|
|
elif key in (ord("1"),):
|
|
state.view, state.scroll = "status", 0
|
|
elif key in (ord("2"),):
|
|
state.view, state.scroll = "alerts", 0
|
|
elif key in (ord("3"),):
|
|
state.view, state.scroll = "incidents", 0
|
|
elif key in (ord("4"),):
|
|
state.view, state.scroll = "timeline", 0
|
|
elif key in (ord("5"),):
|
|
state.view, state.scroll = "posture", 0
|
|
elif key in (ord("6"),):
|
|
state.view, state.scroll = "integrity", 0
|
|
elif key in (ord("7"),):
|
|
state.view, state.scroll = "rules", 0
|
|
elif key in (ord("8"),):
|
|
state.view, state.scroll = "events", 0
|
|
elif key in (ord("9"),):
|
|
state.view, state.scroll = "response", 0
|
|
elif key in (ord("h"), ord("?")):
|
|
state.view, state.scroll = "help", 0
|
|
elif key in (ord("n"), ord("N")):
|
|
state.view, state.scroll = _workflow_neighbor(state.view, 1), 0
|
|
state.message = f"next: {_view_label(state.view)}"
|
|
elif key in (ord("b"), ord("B")):
|
|
state.view, state.scroll = _workflow_neighbor(state.view, -1), 0
|
|
state.message = f"back: {_view_label(state.view)}"
|
|
elif key == ord(":"):
|
|
state.command_mode = True
|
|
state.command = ""
|
|
curses.curs_set(1)
|
|
elif key == ord("/"):
|
|
state.command_mode = True
|
|
state.command = "filter "
|
|
curses.curs_set(1)
|
|
elif key in (curses.KEY_DOWN, ord("j")):
|
|
state.scroll += 1
|
|
elif key in (curses.KEY_UP, ord("k")):
|
|
state.scroll = max(0, state.scroll - 1)
|
|
elif key == curses.KEY_NPAGE:
|
|
state.scroll += 10
|
|
elif key == curses.KEY_PPAGE:
|
|
state.scroll = max(0, state.scroll - 10)
|
|
elif key == 12: # Ctrl-L
|
|
stdscr.clear()
|
|
|
|
|
|
def _handle_command_key(state: TuiState, key: int) -> None:
|
|
if key in (10, 13, curses.KEY_ENTER):
|
|
run_tui_command(state, state.command)
|
|
curses.curs_set(0)
|
|
elif key in (27,):
|
|
state.command_mode = False
|
|
state.command = ""
|
|
curses.curs_set(0)
|
|
elif key in (9,):
|
|
head, sep, tail = state.command.partition(" ")
|
|
if sep:
|
|
return
|
|
state.command = complete_command(head)
|
|
elif key in (curses.KEY_BACKSPACE, 127, 8):
|
|
state.command = state.command[:-1]
|
|
elif 32 <= key <= 126:
|
|
state.command += chr(key)
|
|
|
|
|
|
def _draw(stdscr, state: TuiState) -> None:
|
|
height, width = stdscr.getmaxyx()
|
|
width = max(width, 20)
|
|
stdscr.erase()
|
|
stdscr.addnstr(0, 0, _header_text(state, width), width - 1, curses.A_REVERSE)
|
|
meta = (
|
|
f"view={_view_label(state.view)} "
|
|
f"filter={state.filter_text or '-'} {state.message}"
|
|
)
|
|
stdscr.addnstr(1, 0, meta[:width - 1], width - 1)
|
|
lines = render_lines(state, width)
|
|
body_h = max(0, height - 4)
|
|
max_scroll = max(0, len(lines) - body_h)
|
|
state.scroll = min(state.scroll, max_scroll)
|
|
for row, line in enumerate(lines[state.scroll:state.scroll + body_h], start=2):
|
|
stdscr.addnstr(row, 0, line[:width - 1], width - 1)
|
|
prompt = (
|
|
":" + state.command
|
|
if state.command_mode
|
|
else "Read-only. h help, n next, b back, 1-9 views, / filter, q quit."
|
|
)
|
|
stdscr.addnstr(height - 1, 0, prompt[:width - 1], width - 1, curses.A_REVERSE)
|
|
if state.command_mode:
|
|
stdscr.move(height - 1, min(width - 1, len(prompt)))
|
|
stdscr.refresh()
|
|
|
|
|
|
def _header_text(state: TuiState, width: int) -> str:
|
|
title = f" Enodia Sentinel TUI v{__version__} "
|
|
full_tabs = (
|
|
"1 Status 2 Alerts 3 Incidents 4 Timeline 5 Posture "
|
|
"6 Integrity 7 Rules 8 Events 9 Response h Help r Refresh q Quit"
|
|
)
|
|
compact_tabs = (
|
|
"1 Status 2 Alerts 3 Inc 4 Time 5 Post 6 Int 7 Rules 8 Event 9 Resp"
|
|
)
|
|
if width >= len(title) + len(full_tabs) + 2:
|
|
text = title + full_tabs
|
|
elif width >= len(title) + len(compact_tabs) + 2:
|
|
text = title + compact_tabs
|
|
else:
|
|
text = (
|
|
f"{title}{_view_label(state.view)} "
|
|
"1-9 switch h help r refresh q quit"
|
|
)
|
|
return text[:max(0, width - 1)]
|
|
|
|
|
|
def _view_label(view: str) -> str:
|
|
return VIEW_INFO.get(view, (view.title(), ""))[0]
|
|
|
|
|
|
def _workflow_neighbor(view: str, direction: int) -> str:
|
|
try:
|
|
index = WORKFLOW_VIEWS.index(view)
|
|
except ValueError:
|
|
index = 0
|
|
index = max(0, min(len(WORKFLOW_VIEWS) - 1, index + direction))
|
|
return WORKFLOW_VIEWS[index]
|
|
|
|
|
|
def _with_intro(view: str, lines: list[str], width: int) -> list[str]:
|
|
label, hint = VIEW_INFO.get(view, (view.title(), ""))
|
|
intro = [f"{label} - {_clip(hint, max(20, width - len(label) - 3))}"]
|
|
if view in {"alerts", "incidents", "timeline", "response"}:
|
|
intro.append("Suggested flow: 3 Incidents -> 4 Timeline -> 9 Response Plans.")
|
|
elif view == "status":
|
|
intro.append("If the daemon is stopped or heartbeat is stale, start/restart the service before trusting old data.")
|
|
elif view == "integrity":
|
|
intro.append("Overall 'review' means check details; 'critical' means the watchdog or heartbeat needs attention.")
|
|
intro.append("")
|
|
return intro + lines
|
|
|
|
|
|
def _render_status(status: dict, width: int) -> list[str]:
|
|
if not status:
|
|
return [
|
|
"No status available.",
|
|
"Next step: start the daemon or check that this TUI uses the same config/log_dir.",
|
|
]
|
|
age = status.get("heartbeat_age")
|
|
heartbeat = "none" if age is None else f"{int(age)}s ago"
|
|
if status.get("heartbeat_stale"):
|
|
heartbeat += " (STALE)"
|
|
counts = status.get("counts") or {}
|
|
count_text = ", ".join(f"{k}:{v}" for k, v in sorted(counts.items())) or "none"
|
|
return [
|
|
f"Host: {status.get('host', '?')}",
|
|
f"Version: {status.get('version', '?')}",
|
|
f"Daemon: {'running' if status.get('running') else 'stopped'}",
|
|
f"Heartbeat: {heartbeat}",
|
|
f"Alerts: {status.get('total_alerts', 0)} total ({count_text})",
|
|
f"Last alert: {status.get('last_alert') or 'none'}",
|
|
f"eBPF: {status.get('ebpf', 'unknown')}",
|
|
f"Exec probe: {status.get('ebpf_exec', 'unknown')}",
|
|
f"Syscall: {status.get('ebpf_syscall', 'unknown')}",
|
|
"",
|
|
"Plain language:",
|
|
" Daemon running + fresh heartbeat = the local sensor is alive.",
|
|
" Alerts are raw findings; incidents group related findings together.",
|
|
" eBPF unknown/disabled means Sentinel falls back to polling detectors.",
|
|
"",
|
|
"Use 3 for incidents, 4 for timelines, 9 for response plans, or h for help.",
|
|
]
|
|
|
|
|
|
def _render_alerts(alerts: list[dict], width: int) -> list[str]:
|
|
if not alerts:
|
|
return [
|
|
"No alert snapshots found.",
|
|
"This is good if the daemon is running and the heartbeat is fresh.",
|
|
]
|
|
lines = [
|
|
"Severity guide: CRITICAL = urgent, HIGH = review soon, MEDIUM = investigate when practical.",
|
|
f"{'TIME':<24} {'SEV':<9} {'SID':<7} SIGNATURE / DETAIL",
|
|
]
|
|
for snap in alerts:
|
|
for alert in snap.get("alerts", []):
|
|
detail = alert.get("detail", "")
|
|
line = (
|
|
f"{snap.get('time', '?')[:24]:<24} {alert.get('severity', '?'):<9} "
|
|
f"{alert.get('sid', 0):<7} {alert.get('signature', '?')} "
|
|
f"{detail[:max(20, width - 60)]}"
|
|
)
|
|
lines.append(line)
|
|
return lines
|
|
|
|
|
|
def _render_incidents(incidents: list[dict], width: int) -> list[str]:
|
|
if not incidents:
|
|
return [
|
|
"No incidents recorded.",
|
|
"Incidents appear after alerts are grouped by process lineage or time window.",
|
|
]
|
|
lines = [
|
|
"Pick an incident id, then use 4 Timeline to see the order of events.",
|
|
f"{'INCIDENT':<28} {'LAST SEEN':<24} {'SEV':<9} {'#':>3} SIGNATURES",
|
|
]
|
|
for inc in incidents:
|
|
sigs = ", ".join(inc.get("signatures", []))
|
|
lines.append(
|
|
f"{inc.get('id', '?'):<28} {inc.get('last_seen', '?')[:24]:<24} "
|
|
f"{inc.get('severity', '?'):<9} {inc.get('alert_count', 0):>3} {sigs}"
|
|
)
|
|
return lines
|
|
|
|
|
|
def _render_timelines(views: list[dict], width: int) -> list[str]:
|
|
if not views:
|
|
return [
|
|
"No incident timelines.",
|
|
"Timelines need at least one recorded incident snapshot.",
|
|
]
|
|
lines = []
|
|
for view in views:
|
|
if view.get("error"):
|
|
lines.append(f"{view.get('incident_id', '?')}: {view['error']}")
|
|
lines.append("")
|
|
continue
|
|
inc = view.get("incident") or {}
|
|
lines.append(
|
|
f"{inc.get('id', '?')} severity={inc.get('severity', '?')} "
|
|
f"alerts={inc.get('alert_count', 0)}"
|
|
)
|
|
sigs = ", ".join(inc.get("signatures") or [])
|
|
if sigs:
|
|
lines.append(f" signatures: {_clip(sigs, max(20, width - 15))}")
|
|
timeline = view.get("timeline") or []
|
|
if not timeline:
|
|
lines.append(" No timeline rows.")
|
|
for row in timeline:
|
|
if row.get("missing"):
|
|
lines.append(
|
|
f" {row.get('time', '?'):<24} missing snapshot {row.get('snapshot', '?')}"
|
|
)
|
|
continue
|
|
sig_text = ", ".join(row.get("signatures") or [])
|
|
pid_text = ",".join(str(p) for p in row.get("pids") or [])
|
|
lines.append(
|
|
f" {row.get('time', '?')[:24]:<24} {row.get('severity', '?'):<9} "
|
|
f"{_clip(sig_text, max(20, width - 45))} pids={pid_text or '-'}"
|
|
)
|
|
lines.append("")
|
|
return lines
|
|
|
|
|
|
def _render_posture(report: dict, width: int) -> list[str]:
|
|
if report.get("error"):
|
|
return [f"Posture unavailable: {report['error']}"]
|
|
findings = report.get("findings") or []
|
|
counts = report.get("counts") or {}
|
|
count_text = ", ".join(f"{k}:{v}" for k, v in sorted(counts.items())) or "none"
|
|
lines = [
|
|
f"Posture findings: {report.get('count', len(findings))} ({count_text})",
|
|
"",
|
|
]
|
|
if not findings:
|
|
lines.append("No posture findings. SSH, sudo, PATH, file perms, and package signature policy look sound.")
|
|
return lines
|
|
lines.append("These are hardening tasks. Fixing them reduces risk even if no attack is active.")
|
|
lines.append(f"{'SEV':<9} {'SID':<7} {'SIGNATURE':<22} DETAIL")
|
|
for finding in findings:
|
|
detail = finding.get("detail", "")
|
|
lines.append(
|
|
f"{finding.get('severity', '?'):<9} {finding.get('sid', 0):<7} "
|
|
f"{finding.get('signature', '?'):<22} {_clip(detail, max(20, width - 42))}"
|
|
)
|
|
return lines
|
|
|
|
|
|
def _render_integrity(report: dict, width: int) -> list[str]:
|
|
if report.get("error"):
|
|
return [f"Integrity unavailable: {report['error']}"]
|
|
if not report:
|
|
return ["No integrity report available."]
|
|
checks = report.get("checks") or {}
|
|
watchdog = report.get("watchdog") or {}
|
|
anchors = report.get("anchors") or {}
|
|
fim = anchors.get("fim_baseline") or {}
|
|
pkgdb = anchors.get("pkgdb") or {}
|
|
pacman = anchors.get("pacman") or {}
|
|
footprint = report.get("sentinel_footprint") or {}
|
|
reconciliation = report.get("reconciliation") or {}
|
|
lines = [
|
|
f"Overall: {report.get('status', 'unknown')}",
|
|
f"Generated: {report.get('generated_at', '?')}",
|
|
"",
|
|
"Checks:",
|
|
]
|
|
for name, state in sorted(checks.items()):
|
|
lines.append(f" {name:<18} {state}")
|
|
lines.extend([
|
|
"",
|
|
"Watchdog:",
|
|
f" Status: {'ok' if watchdog.get('ok') else 'review'}",
|
|
f" Message: {_clip(watchdog.get('message', '?'), max(20, width - 17))}",
|
|
f" Heartbeat age: {_format_age(watchdog.get('heartbeat_age'))}",
|
|
f" Max age: {watchdog.get('max_age', '?')}s",
|
|
f" Daemon: {'running' if watchdog.get('daemon_running') else 'stopped'}",
|
|
"",
|
|
"Anchors:",
|
|
f" FIM baseline: {fim.get('status', 'unknown')} ({fim.get('path', '?')})",
|
|
f" Package DB: {pkgdb.get('status', 'unknown')} prefix={pkgdb.get('fingerprint_prefix', '')}",
|
|
f" Pacman keyring:{' present' if pacman.get('keyring_present') else ' missing'}",
|
|
f" SigLevel: {pacman.get('siglevel_status', 'unknown')}",
|
|
"",
|
|
"Sentinel footprint:",
|
|
f" Present: {footprint.get('present', 0)}/{footprint.get('configured', 0)}",
|
|
f" Missing: {footprint.get('missing', 0)}",
|
|
"",
|
|
"Reconciliation:",
|
|
f" Total: {reconciliation.get('total', 0)}",
|
|
f" Stale: {reconciliation.get('stale', 0)}",
|
|
])
|
|
for item in reconciliation.get("stale_items") or []:
|
|
lines.append(
|
|
f" stale {item.get('kind', '?')} {item.get('target', '?')} - "
|
|
f"{_clip(item.get('reason', ''), max(20, width - 20))}"
|
|
)
|
|
return lines
|
|
|
|
|
|
def _render_rules(catalog, width: int) -> list[str]:
|
|
if isinstance(catalog, dict) and catalog.get("error"):
|
|
return [f"Rules unavailable: {catalog['error']}"]
|
|
rules = catalog.get("rules", []) if isinstance(catalog, dict) else catalog
|
|
if not rules:
|
|
return ["No rules loaded.", "This usually means no built-in rule metadata was available."]
|
|
lines = []
|
|
if isinstance(catalog, dict):
|
|
lines.append(
|
|
"Rules: "
|
|
f"{catalog.get('count', len(rules))} total; "
|
|
f"events={_dict_counts(catalog.get('by_event') or {})}; "
|
|
f"severity={_dict_counts(catalog.get('by_severity') or {})}"
|
|
)
|
|
lines.append("")
|
|
lines.append(f"{'SID':<7} {'EVENT':<8} {'SEV':<9} {'CLASSTYPE':<24} MESSAGE")
|
|
for rule in rules:
|
|
lines.append(
|
|
f"{rule.get('sid', 0):<7} {rule.get('event', '?'):<8} "
|
|
f"{rule.get('severity', '?'):<9} {rule.get('classtype', '?'):<24} "
|
|
f"{rule.get('msg', '')[:max(20, width - 52)]}"
|
|
)
|
|
return lines
|
|
|
|
|
|
def _render_events(events: list[str], width: int) -> list[str]:
|
|
if not events:
|
|
return [
|
|
"No events.log entries found.",
|
|
"This log is mostly for troubleshooting daemon startup and probe status.",
|
|
]
|
|
return [
|
|
"Newest daemon/probe messages are shown below. These are technical logs.",
|
|
"",
|
|
*[_clip(line, width) for line in events],
|
|
]
|
|
|
|
|
|
def _render_response(plans: list[dict], width: int) -> list[str]:
|
|
if not plans:
|
|
return [
|
|
"No incidents with response plans.",
|
|
"Response plans appear after an incident exists. They are suggestions only.",
|
|
]
|
|
lines = [
|
|
"Read-only response previews. Commands are not executed from the TUI.",
|
|
"Review evidence before stopping processes, blocking IPs, or moving files.",
|
|
"",
|
|
]
|
|
for plan in plans:
|
|
if plan.get("error"):
|
|
lines.append(f"{plan.get('incident_id', '?')}: {plan['error']}")
|
|
lines.append("")
|
|
continue
|
|
summary = plan.get("summary") or {}
|
|
lines.append(
|
|
f"{plan.get('incident_id', '?')} severity={summary.get('severity', '?')} "
|
|
f"actions={summary.get('action_count', len(plan.get('actions') or []))} "
|
|
f"mode={plan.get('mode', 'dry-run')}"
|
|
)
|
|
sigs = ", ".join(summary.get("signatures") or [])
|
|
if sigs:
|
|
lines.append(f" signatures: {_clip(sigs, max(20, width - 15))}")
|
|
for action in plan.get("actions") or []:
|
|
cmd = " ".join(str(part) for part in action.get("command") or [])
|
|
lines.append(
|
|
f" {action.get('id', '?'):<4} {action.get('category', '?'):<12} "
|
|
f"{action.get('risk', '?'):<7} {_clip(action.get('title', ''), max(20, width - 31))}"
|
|
)
|
|
lines.append(f" {_clip(cmd, max(20, width - 7))}")
|
|
lines.append("")
|
|
return lines
|
|
|
|
|
|
def _render_help(width: int) -> list[str]:
|
|
lines = [
|
|
"New User Workflow:",
|
|
" 1 Status confirm the sensor is running and heartbeat is fresh",
|
|
" 3 Incidents find grouped activity instead of chasing raw alerts",
|
|
" 4 Timeline read what happened in time order",
|
|
" 9 Response review suggested commands; the TUI does not execute them",
|
|
" 6 Integrity check watchdog, file integrity, and package trust",
|
|
" Press n/b to walk this workflow forward/back.",
|
|
"",
|
|
"Safety:",
|
|
" This TUI is read-only. It displays commands and evidence, but does not change the host.",
|
|
" If you are unsure, preserve evidence first and avoid deleting or moving files.",
|
|
"",
|
|
"Keys:",
|
|
" 1-9 switch views: status, alerts, incidents, timeline, posture, integrity, rules, events, response",
|
|
" n / b next/back in the beginner workflow",
|
|
" j/k or arrows scroll",
|
|
" PgUp/PgDn page scroll",
|
|
" r refresh",
|
|
" / filter current view",
|
|
" : command mode",
|
|
" Tab complete command names in command mode",
|
|
" Ctrl-L redraw",
|
|
" q quit",
|
|
"",
|
|
"Commands:",
|
|
]
|
|
for name, help_text in TUI_COMMANDS.items():
|
|
lines.append(f" {name:<10} {help_text}")
|
|
return [wrapped for line in lines for wrapped in (textwrap.wrap(line, width) or [""])]
|
|
|
|
|
|
def _recent_alerts(cfg: Config, limit: int = 50) -> list[dict]:
|
|
rows = []
|
|
for path in sorted(cfg.log_dir.glob("alert-*.json"), reverse=True)[:limit]:
|
|
try:
|
|
data = json.loads(path.read_text())
|
|
except (OSError, ValueError):
|
|
continue
|
|
if isinstance(data, dict):
|
|
data.setdefault("snapshot", path.name)
|
|
rows.append(data)
|
|
return rows
|
|
|
|
|
|
def _response_plans(cfg: Config, incidents: list[dict], limit: int = 20) -> list[dict]:
|
|
from .web import response_plan
|
|
|
|
plans = []
|
|
for inc in incidents[:limit]:
|
|
incident_id = inc.get("id")
|
|
if not incident_id:
|
|
continue
|
|
try:
|
|
plan = response_plan(cfg, str(incident_id))
|
|
except Exception as exc: # pragma: no cover - defensive TUI degradation
|
|
plans.append({"incident_id": incident_id, "error": f"response: {exc}"})
|
|
continue
|
|
if isinstance(plan, dict):
|
|
plans.append(plan)
|
|
return plans
|
|
|
|
|
|
def _incident_views(cfg: Config, incidents: list[dict], limit: int = 20) -> list[dict]:
|
|
from .web import get_incident
|
|
|
|
views = []
|
|
for inc in incidents[:limit]:
|
|
incident_id = inc.get("id")
|
|
if not incident_id:
|
|
continue
|
|
try:
|
|
view = get_incident(cfg, str(incident_id))
|
|
except Exception as exc: # pragma: no cover - defensive TUI degradation
|
|
views.append({"incident_id": incident_id, "error": f"timeline: {exc}"})
|
|
continue
|
|
if isinstance(view, dict):
|
|
views.append(view)
|
|
return views
|
|
|
|
|
|
def _clip(text, width: int) -> str:
|
|
text = str(text)
|
|
if width <= 0 or len(text) <= width:
|
|
return text
|
|
if width <= 3:
|
|
return text[:width]
|
|
return text[:width - 3] + "..."
|
|
|
|
|
|
def _format_age(value) -> str:
|
|
if value is None:
|
|
return "none"
|
|
try:
|
|
return f"{int(value)}s"
|
|
except (TypeError, ValueError):
|
|
return str(value)
|
|
|
|
|
|
def _dict_counts(data: dict) -> str:
|
|
return ", ".join(f"{k}:{v}" for k, v in sorted(data.items())) or "none"
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|