date script
+// WWW: http://www.mattkruse.com/
+// Only the used part is left
+
+// ------------------------------------------------------------------
+// Utility functions for parsing in getDateFromFormat()
+// ------------------------------------------------------------------
+function _isInteger(val) {
+ var digits="1234567890";
+ for (var i=0; i < val.length; i++) {
+ if (digits.indexOf(val.charAt(i))==-1) { return false; }
+ }
+ return true;
+}
+function _getInt(str,i,minlength,maxlength) {
+ for (var x=maxlength; x>=minlength; x--) {
+ var token=str.substring(i,i+x);
+ if (token.length < minlength) { return null; }
+ if (_isInteger(token)) { return token; }
+ }
+ return null;
+}
+// ------------------------------------------------------------------
+// getDateFromFormat( date_string , format_string )
+//
+// This function takes a date string and a format string.
+// If the date string matches the format string, it returns the
+// getTime() of the date. If it does not match, it returns 0.
+// ------------------------------------------------------------------
+// Field | Full Form | Short Form
+// -------------+--------------------+-----------------------
+// Year | yyyy (4 digits) | yy (2 digits), y (2 or 4 digits)
+// Month | MMM (name or abbr.)| MM (2 digits), M (1 or 2 digits)
+// | NNN (abbr.) |
+// Day of Month | dd (2 digits) | d (1 or 2 digits)
+// Day of Week | EE (name) | E (abbr)
+// Hour (1-12) | hh (2 digits) | h (1 or 2 digits)
+// Hour (0-23) | HH (2 digits) | H (1 or 2 digits)
+// Hour (0-11) | KK (2 digits) | K (1 or 2 digits)
+// Hour (1-24) | kk (2 digits) | k (1 or 2 digits)
+// Minute | mm (2 digits) | m (1 or 2 digits)
+// Second | ss (2 digits) | s (1 or 2 digits)
+// AM/PM | a |
+function getDateFromFormat(val, format) {
+ val = val + "";
+ format = format + "";
+ var i_val = 0;
+ var i_format = 0;
+ var c = "";
+ var token = "";
+ //var token2 = "";
+ var x, y;
+ var now = new Date();
+ var year = now.getYear();
+ var month = now.getMonth() + 1;
+ var date = 1;
+ var hh = now.getHours();
+ var mm = now.getMinutes();
+ var ss = now.getSeconds();
+ var ampm = "";
+
+ while (i_format < format.length) {
+ // Get next token from format string
+ c = format.charAt(i_format);
+ token = "";
+ while (format.charAt(i_format) == c && i_format < format.length) {
+ token += format.charAt(i_format++);
+ }
+ // Extract contents of value based on format token
+ if (token == "yyyy" || token == "yy" || token == "y") {
+ if (token == "yyyy") {
+ x = 4;
+ y = 4;
+ }
+ if (token == "yy") {
+ x = 2;
+ y = 2;
+ }
+ if (token == "y") {
+ x = 2;
+ y = 4;
+ }
+ year = _getInt(val, i_val, x, y);
+ if (year == null) {
+ return 0;
+ }
+ i_val += year.length;
+ if (year.length == 2) {
+ if (year > 70) {
+ year = 1900 + (year - 0);
+ } else {
+ year = 2000 + (year - 0);
+ }
+ }
+ } else if (token == "MMM" || token == "NNN") {
+ month = 0;
+ for (var i = 0; i < MONTH_NAMES.length; i++) {
+ var month_name = MONTH_NAMES[i];
+ if (val.substring(i_val, i_val + month_name.length).toLowerCase() == month_name.toLowerCase()) {
+ if (token == "MMM" || (token == "NNN" && i > 11)) {
+ month = i + 1;
+ if (month > 12) {
+ month -= 12;
+ }
+ i_val += month_name.length;
+ break;
+ }
+ }
+ }
+ if (month < 1 || month > 12) {
+ return 0;
+ }
+ } else if (token == "EE" || token == "E") {
+ for (var i = 0; i < DAY_NAMES.length; i++) {
+ var day_name = DAY_NAMES[i];
+ if (val.substring(i_val, i_val + day_name.length).toLowerCase() == day_name.toLowerCase()) {
+ i_val += day_name.length;
+ break;
+ }
+ }
+ } else if (token == "MM" || token == "M") {
+ month = _getInt(val, i_val, token.length, 2);
+ if (month == null || month < 1 || month > 12) {
+ return 0;
+ }
+ i_val += month.length;
+ } else if (token == "dd" || token == "d") {
+ date = _getInt(val, i_val, token.length, 2);
+ if (date == null || date < 1 || date > 31) {
+ return 0;
+ }
+ i_val += date.length;
+ } else if (token == "hh" || token == "h") {
+ hh = _getInt(val, i_val, token.length, 2);
+ if (hh == null || hh < 1 || hh > 12) {
+ return 0;
+ }
+ i_val += hh.length;
+ } else if (token == "HH" || token == "H") {
+ hh = _getInt(val, i_val, token.length, 2);
+ if (hh == null || hh < 0 || hh > 23) {
+ return 0;
+ }
+ i_val += hh.length;
+ } else if (token == "KK" || token == "K") {
+ hh = _getInt(val, i_val, token.length, 2);
+ if (hh == null || hh < 0 || hh > 11) {
+ return 0;
+ }
+ i_val += hh.length;
+ } else if (token == "kk" || token == "k") {
+ hh = _getInt(val, i_val, token.length, 2);
+ if (hh == null || hh < 1 || hh > 24) {
+ return 0;
+ }
+ i_val += hh.length;
+ hh--;
+ } else if (token == "mm" || token == "m") {
+ mm = _getInt(val, i_val, token.length, 2);
+ if (mm == null || mm < 0 || mm > 59) {
+ return 0;
+ }
+ i_val += mm.length;
+ } else if (token == "ss" || token == "s") {
+ ss = _getInt(val, i_val, token.length, 2);
+ if (ss == null || ss < 0 || ss > 59) {
+ return 0;
+ }
+ i_val += ss.length;
+ } else if (token == "a") {
+ if (val.substring(i_val, i_val + 2).toLowerCase() == "am") {
+ ampm = "AM";
+ } else if (val.substring(i_val, i_val + 2).toLowerCase() == "pm") {
+ ampm = "PM";
+ } else {
+ return 0;
+ }
+ i_val += 2;
+ } else {
+ if (val.substring(i_val, i_val + token.length) != token) {
+ return 0;
+ } else {
+ i_val += token.length;
+ }
+ }
+ }
+ // If there are any trailing characters left in the value, it doesn't match
+ if (i_val != val.length) {
+ return 0;
+ }
+ // Is date valid for month?
+ if (month == 2) {
+ // Check for leap year
+ if ((year % 4 == 0 && year % 100 != 0) || year % 400 == 0) {
+ // leap year
+ if (date > 29) {
+ return 0;
+ }
+ } else {
+ if (date > 28) {
+ return 0;
+ }
+ }
+ }
+ if (month == 4 || month == 6 || month == 9 || month == 11) {
+ if (date > 30) {
+ return 0;
+ }
+ }
+ // Correct hours value
+ if (hh < 12 && ampm == "PM") {
+ hh = hh - 0 + 12;
+ } else if (hh > 11 && ampm == "AM") {
+ hh -= 12;
+ }
+ var newdate = new Date(year, month - 1, date, hh, mm, ss);
+ return newdate.getTime();
+}
+
diff --git a/manifest.json b/manifest.json
index 66b685a..44d79f0 100644
--- a/manifest.json
+++ b/manifest.json
@@ -26,14 +26,13 @@
"libs/jquery/jquery-3.5.1.min.js",
"libs/jquery-ui-1.12.1/jquery-ui.min.js",
"libs/d3.js/d3.v4.min.js",
- "libs/moment.js/moment-with-locales.js",
+ "libs/monkey_date.js",
"libs/underscore.js/underscore-min.js",
"libs/textarea-helper.js/textarea-helper.js",
"libs/ipaddr.js/ipaddr.min.js",
"update.popup.js",
"processTree.popup.js",
"script.js"],
- "css": ["siemMonkey.css","libs/jquery-ui-1.12.1/jquery-ui.min.monkey.css"],
"all_frames": true
}
],
@@ -45,10 +44,11 @@
{
"resources": [
"img/icon128.png",
- "siemMonkey.css",
+ "siemMonkey.css",
"customfilters.json",
"fieldaliases.json",
"xhr_override.js",
+ "web_accessible_resources.js",
"libs/jquery-ui-1.12.1/jquery-ui.min.monkey.css"
],
"matches": [
diff --git a/popup.css b/popup.css
index c66d19c..225086a 100644
--- a/popup.css
+++ b/popup.css
@@ -26,7 +26,10 @@ body.loading .lds-dual-ring {
display: block;
}
-* { font-family:Roboto,Helvetica Neue,sans-serif; font-size:10px; }
+:not([class^="ui-datepicker"]) {
+ font-family: Roboto,Helvetica Neue,sans-serif;
+ font-size: 10px;
+}
.parent {
color: white;
diff --git a/popup.html b/popup.html
index d5aa184..2504bf0 100644
--- a/popup.html
+++ b/popup.html
@@ -23,7 +23,7 @@
-
+
diff --git a/popup.js b/popup.js
index 1e819fc..dbf14ce 100644
--- a/popup.js
+++ b/popup.js
@@ -426,18 +426,16 @@ async function onPageDetailsReceived(details) {
if(typeof selectedEventTime === 'undefined'){
// попробуем распарсить по формату из NAD
let session_start = details.params['session_start'];
- let session_start_parsed = moment(session_start, "DD MMMM YYYY, hh:mm:ss", "ru");
- selectedEventTimeParsedTo = session_start_parsed.clone().add(15, 'm');
- selectedEventTimeParsedFrom = session_start_parsed.clone().subtract(15, 'm');
- $("#datepickerTo").datepicker().datepicker("setDate", selectedEventTimeParsedTo.toDate());
- $("#datepickerFrom").datepicker().datepicker("setDate", selectedEventTimeParsedFrom.toDate());
+ selectedEventTimeTo = session_start + 15*60;
+ selectedEventTimeFrom = session_start - 15*60
+ $("#datepickerTo").datepicker().datepicker("setDate", new Date(selectedEventTimeTo*1000));
+ $("#datepickerFrom").datepicker().datepicker("setDate", new Date(selectedEventTimeFrom*1000));
}
else{
- selectedEventTimeParsed = moment(selectedEventTime, "DD.MM.YYYY hh:mm:ss");
- selectedEventTimeParsedTo = selectedEventTimeParsed.clone().add(1, 'days');
- selectedEventTimeParsedFrom = selectedEventTimeParsed.clone().subtract(1, 'days');
- $("#datepickerTo").datepicker().datepicker("setDate", selectedEventTimeParsedTo.toDate());
- $("#datepickerFrom").datepicker().datepicker("setDate", selectedEventTimeParsedFrom.toDate());
+ selectedEventTimeTo = selectedEventTime + 86400*1000;
+ selectedEventTimeFrom = selectedEventTime - 86400*1000;
+ $("#datepickerTo").datepicker().datepicker("setDate", new Date(selectedEventTimeTo));
+ $("#datepickerFrom").datepicker().datepicker("setDate", new Date(selectedEventTimeFrom));
}
processStartMsgid = details.params['msgid'].trim("↵");
@@ -472,8 +470,8 @@ async function onPageDetailsReceived(details) {
let dst_port = details.params['dst.port'].trim("↵");
event_src_host = details.params['event_src.host'].trim("↵");
- let timestampfrom = selectedEventTimeParsed.clone().subtract(15, 'minutes').unix()*1000;
- let timestampto = selectedEventTimeParsed.clone().add(15, 'minutes').unix()*1000;
+ let timestampfrom = selectedEventTime - 15*60*1000;
+ let timestampto = selectedEventTime + 15*60*1000;
// Подготовка фильтра для поиска трафика в NAD
let nadfilter = '';
@@ -638,5 +636,3 @@ chrome.runtime.onMessage.addListener(
// console.log(message);
onPageDetailsReceived(message);
});
-
-
diff --git a/processTree.popup.js b/processTree.popup.js
index c6b57ca..8cfea87 100644
--- a/processTree.popup.js
+++ b/processTree.popup.js
@@ -22,7 +22,7 @@
{
let commandlineField = "object.process.cmdline";
let events;
- if(pre_events[0]['msgid'].includes("exec")) {
+ if(pre_events[0] && 'msgid' in pre_events[0] && pre_events[0]['msgid'] !== null && pre_events[0]['msgid'].includes("exec")) {
events = pre_events.map(x => ({
...x,
tree_id: x['object.process.id'],
@@ -30,7 +30,7 @@
}));
}
else {
- if('object.process.guid' in pre_events[0] && pre_events[0]['object.process.guid'] != null) {
+ if(pre_events[0] && 'object.process.guid' in pre_events[0] && pre_events[0]['object.process.guid'] != null) {
events = pre_events.map(x => ({
...x,
tree_id: x['object.process.guid'],
@@ -112,7 +112,7 @@ async function processTreeBranch(pre_events, outputelemsuffix="")
{
let commandlineField = "object.process.cmdline";
let events;
- if(treeBranchEvents[0]['msgid'].includes("exec")) {
+ if('msgid' in treeBranchEvents[0] && treeBranchEvents[0]['msgid'] !== null && treeBranchEvents[0]['msgid'].includes("exec")) {
events = treeBranchEvents.map(x => ({
...x,
tree_id: x['object.process.id'],
@@ -251,7 +251,7 @@ async function processTreeBranchReverse(pre_events, outputelemsuffix="")
{
let commandlineField = "object.process.cmdline";
let events;
- if(treeBranchEvents[0]['msgid'].includes("exec")) {
+ if('msgid' in treeBranchEvents[0] && treeBranchEvents[0]['msgid'] !== null && treeBranchEvents[0]['msgid'].includes("exec")) {
events = treeBranchEvents.map(x => ({
...x,
tree_id: x['object.process.id'],
@@ -450,11 +450,11 @@ function processCorrleationEventDownloadSubevents(events, outputelemsuffix="")
let event = events[0];
let time = event['time'];
//"2023-02-04T19:07:05.0000000Z"
- let timeParsed = moment.utc(time.slice(0,-9), "YYYY-MM-DDThh:mm:ss");
- let timeto = timeParsed.toDate();
- let ttimeto = timeto.getTime()/1000;
- gtfrom = ttimeto;
- gtto = ttimeto;
+ //js Date native format
+ let timeParsed = Date.parse(time)/1000;
+ ttimeto = timeParsed;
+ gtfrom = timeParsed;
+ gtto = timeParsed;
let uuids = event['subevents'];
let uuids_str = "'" + uuids.join("','") + "'";
@@ -482,4 +482,4 @@ function saveFile (name, type, data) {
a.remove();
}
-var siemUrl = window.location.origin;
\ No newline at end of file
+var siemUrl = window.location.origin;
diff --git a/script.js b/script.js
index ccae3e1..32718f3 100644
--- a/script.js
+++ b/script.js
@@ -13,6 +13,33 @@
// limitations under the License.
+oldHref = document.location.href.split("?")[0];
+// inject script in main app and get some info from there. we want window.appConfig
+// app locale is stored there
+window.appConfig = "";
+function injectScript(file_path, tag) {
+ var node = document.getElementsByTagName(tag)[0];
+ var script = document.createElement('script');
+ script.setAttribute('type', 'text/javascript');
+ script.setAttribute('src', file_path);
+ node.appendChild(script);
+}
+injectScript(chrome.runtime.getURL('web_accessible_resources.js'), 'body');
+
+window.addEventListener("message", (event) => {
+ // We only accept messages from ourselves
+ if (event.source !== window) {
+ return;
+ }
+
+ if (event.data.type && (event.data.type === "FROM_PAGE")) {
+ console.log("SIEM Monkey: main page data received: " + event.data.text);
+ if (event.data.text.length > 0) {
+ window.appConfig = JSON.parse(event.data.text);
+ }
+ }
+}, false);
+
pt_tags = ["pt-siem-app-root", "pt-nad-root"];
pt_product = false;
siem_bananas = {
@@ -22,6 +49,12 @@ siem_bananas = {
};
siem_ver = "";
prod_name = "";
+pt_locale_date_formats = {
+ "ru-RU":"d.M.y H:m:s",
+ "en-US":"M/d/y H:m:s",
+ "user":"",
+};
+date_format = "";
function get_prod_name() {
let siem_title_elem = $(
@@ -36,30 +69,34 @@ function get_prod_name() {
return "";
}
-var SearchBananas = function (selectors, callback, interval, timeout) {
+function SearchBananas (selectors, callback, interval, timeout) {
var time = 0;
// exit early if not in pt product
$.each(pt_tags, function(index, tag) {
if (document.querySelectorAll(tag).length > 0) {
pt_product = true;
+ if (tag == "pt-siem-app-root") {
+ monitorSIEMnav();
+ }
}
})
if (pt_product == false) {
- console.log("Monkey doesn't like it here");
+ console.log("SIEM Monkey: monkey doesn't like it here");
return;
}
- //
+
var poll = setInterval(function () {
let prod_name = get_prod_name();
if (prod_name === "NAD") {
- console.log("NAD is banana!");
+ console.log("SIEM Monkey: NAD is banana!");
clearInterval(poll);
callback("NAD");
return;
}
+
if (typeof timeout !== "undefined" && time >= timeout) {
clearInterval(poll);
- console.log("monkey wants BANANAS");
+ console.log("SIEM Monkey: monkey wants BANANAS");
return;
} else {
$.each(siem_bananas, function (banana, ver) {
@@ -76,7 +113,7 @@ var SearchBananas = function (selectors, callback, interval, timeout) {
}
}
if (bananas_found > 0) {
- console.log("SIEM is banana!");
+ console.log("SIEM Monkey: SIEM is banana!");
siem_ver = ver;
clearInterval(poll);
callback("SIEM");
@@ -88,93 +125,107 @@ var SearchBananas = function (selectors, callback, interval, timeout) {
}, interval);
};
-SearchBananas(
- siem_bananas,
- function () {
- insertMonkeyIntoUI();
- // Если есть элементы "legacy-overlay" и "legacy-events-page", то мы очутились в 26.1
- // Загружать CSS и вешать обработчик мутаций страницы нужно внутри shadowRoot
- let legacy_overlay = $("legacy-overlay");
- if (legacy_overlay.length === 1) {
- let shadowRoot = legacy_overlay[0].shadowRoot;
- observer.observe(shadowRoot, {
- childList: true,
- subtree: true,
- characterData: true,
- attributes: true,
- });
- let jquery_ui_css;
- try {
- let css_url = chrome.runtime.getURL(
- "libs/jquery-ui-1.12.1/jquery-ui.min.monkey.css" // using jquery-ui css just with embedded images
- );
- let xhr = new XMLHttpRequest();
- xhr.onload = function () {
- jquery_ui_css = this.response;
- };
- xhr.open("GET", css_url, false);
- xhr.send();
- } catch (err) {
- console.log(
- "Не удалось прочитать файл libs/jquery-ui-1.12.1/jquery-ui.min.monkey.css"
- );
- return;
- }
+/**
+ * Adopting a constructed stylesheet to be used by the document or ShadowRoots
+ * @param {*} doc document or ShadowRoot to adopt
+ * @param {*} path CSS file path
+ */
+function adoptCSS(doc, path) {
+ let MonkeyCSS;
+ try {
+ let css_url = chrome.runtime.getURL(path);
+ let xhr = new XMLHttpRequest();
+ xhr.onload = function () {
+ MonkeyCSS = this.response;
+ };
+ xhr.open("GET", css_url, false);
+ xhr.send();
+ } catch (err) {
+ console.log("Не удалось прочитать файл " + path);
+ return;
+ }
+ const sheet = new CSSStyleSheet();
+ sheet.replaceSync(MonkeyCSS);
+ doc.adoptedStyleSheets = [sheet];
+}
- const sheet = new CSSStyleSheet();
- sheet.replaceSync(jquery_ui_css);
- shadowRoot.adoptedStyleSheets = [sheet];
- }
+function siemMonkeyBind(product) {
+ // Let's set locale and string formats for date/time conversions
+ // TODO: add custom locale format to options
+ let pt_locale;
+ if (window.appConfig) {
+ pt_locale = window.appConfig.locale;
+ }
+ if (pt_locale_date_formats["user"].length > 0) {
+ date_format = pt_locale_date_formats["user"];
+ console.log("SIEM Monkey: using custom date format. " + date_format);
+ } else if (pt_locale && pt_locale_date_formats[pt_locale]) {
+ date_format = pt_locale_date_formats[pt_locale];
+ console.log("SIEM Monkey: " + pt_locale + " locale is set by App. Date format is " + date_format);
+ } else {
+ date_format = pt_locale_date_formats["ru-RU"];
+ console.log("SIEM Monkey: Локаль не найдена и не установлена пользователем. Ну и пожалуйста. Ну и будет ru-RU.");
+ }
+ if (!$("img.monkeydropbtn").length) {
+ insertMonkeyIntoUI(product);
+ }
- let legacy_events_page = $("legacy-events-page");
- if (legacy_events_page.length === 1) {
- let shadowRoot = legacy_events_page[0].shadowRoot;
- observer.observe(shadowRoot, {
- childList: true,
- subtree: true,
- characterData: true,
- attributes: true,
- });
- let siemMonkeyCSS;
- try {
- let css_url = chrome.runtime.getURL("siemMonkey.css");
- let xhr = new XMLHttpRequest();
- xhr.onload = function () {
- siemMonkeyCSS = this.response;
- };
- xhr.open("GET", css_url, false);
- xhr.send();
- } catch (err) {
- console.log("Не удалось прочитать файл siemMonkey.css");
- return;
- }
+ // load CSS in main tree
+ let ui_css_path = chrome.runtime.getURL("libs/jquery-ui-1.12.1/jquery-ui.min.monkey.css");
+ let ui_css_path2 = chrome.runtime.getURL("siemMonkey.css");
+ $('head').append($('')
+ .attr("rel","stylesheet")
+ .attr("type","text/css")
+ .attr("href", ui_css_path));
+ $('head').append($('')
+ .attr("rel","stylesheet")
+ .attr("type","text/css")
+ .attr("href", ui_css_path2));
+
+ // Если есть элементы "legacy-overlay" и "legacy-events-page", то мы очутились в 26.1
+ // Загружать CSS и вешать обработчик мутаций страницы нужно внутри shadowRoot
+ let legacy_overlay = $("legacy-overlay");
+ if (legacy_overlay.length === 1) {
+ let shadowRoot = legacy_overlay[0].shadowRoot;
+ observer.observe(shadowRoot, {
+ childList: true,
+ subtree: true,
+ characterData: true,
+ attributes: true,
+ });
+ adoptCSS(shadowRoot, "libs/jquery-ui-1.12.1/jquery-ui.min.monkey.css"); // using jquery-ui css just with embedded images
+ }
- const sheet = new CSSStyleSheet();
- sheet.replaceSync(siemMonkeyCSS);
- shadowRoot.adoptedStyleSheets = [sheet];
- } else {
- // Старый добрый UI до 26.0 включительно - вешаем обработчик мутаций прямо на весь document,
- // а CSSы уже и так загружены расширением
- observer.observe(document, {
- childList: true,
- subtree: true,
- characterData: true,
- attributes: true,
- });
- }
- },
- 500,
- 6000
-);
+ let legacy_events_page = $("legacy-events-page");
+ if (legacy_events_page.length === 1) {
+ let shadowRoot = legacy_events_page[0].shadowRoot;
+ observer.observe(shadowRoot, {
+ childList: true,
+ subtree: true,
+ characterData: true,
+ attributes: true,
+ });
+ adoptCSS(shadowRoot, "siemMonkey.css");
+ } else {
+ // Старый добрый UI до 26.0 включительно - вешаем обработчик мутаций прямо на весь document,
+ // CSS уже подгружен
+ observer.observe(document, {
+ childList: true,
+ subtree: true,
+ characterData: true,
+ attributes: true,
+ });
+ }
+}
-function insertMonkeyIntoUI() {
+function insertMonkeyIntoUI(product) {
let siem_title_elem = $("body > pt-siem-app-root > pt-siem-header > header > mc-navbar > mc-navbar-container:nth-child(1) > pt-siem-navbar-brand > a > mc-navbar-title");
let siem_title = siem_title_elem.text();
let nad_title_elem = $(".mc-navbar-title:first");
let nad_title_elem_text = nad_title_elem.text();
- if (siem_title === "MaxPatrol 10") {
+ if (product === "SIEM") {
makeSideBarGreatAgain();
let navbaritem = $(".mc-navbar-logo");
navbaritem.append(`
`);
@@ -195,8 +246,7 @@ function insertMonkeyIntoUI() {
}
}
);
- }
- else if (nad_title_elem_text === "NAD") {
+ } else if (product === "NAD") {
var navbaritem = $(".mc-navbar-logo");
navbaritem.after(`
`);
$(".monkeydropbtn")
@@ -231,10 +281,20 @@ function makeSideBarGreatAgain()
{
iframe = $('#legacyApplicationFrame');
sidebar = $('.mc-sidebar_right', iframe.contents()); //new ui R25
+ if (sidebar.length == 0) {
+ // shadowRoot
+ let legacy_events = $("legacy-events-page");
+ if (legacy_events.length === 1) {
+ let shadowRoot = legacy_events[0].shadowRoot;
+ if (shadowRoot) {
+ sidebar = $(shadowRoot).find('.mc-sidebar_right');
+ }
+ }
+ }
}
}
icons = sidebar.find(".pt-icons").first();
- icons.before(`
`)
+ icons.before(`
`)
sidebar.attr('style', function(i, style){
return style && style.replace(/(max-width: )(\d+)(px)/, '$131337$3');
});
@@ -244,7 +304,7 @@ function makeSideBarGreatAgain()
.delay(100).fadeTo(100,0.5)
.delay(100).fadeTo(100,1)
.delay(100).fadeTo(100,0.5)
- .delay(100).fadeTo(100,1, function(){$(this).remove();});
+ .delay(100).fadeTo(100,1, function(){$(this).hide();});
}
function extractLast( term ) {
@@ -427,6 +487,13 @@ let observer = new MutationObserver(async mutations => {
});
+SearchBananas(
+ siem_bananas,
+ siemMonkeyBind,
+ 500,
+ 6000
+);
+
async function GetOptionsFromStorage(){
options = await getStorageData('options');
}
@@ -616,9 +683,7 @@ function ProcessHandler(addedNode) {
count = 1;
let time = getTimeValueFromSidebar();
- let timeParsed = moment(time, "DD.MM.YYYY hh:mm::ss");
- let timeto = timeParsed.toDate();
- let ttimeto = timeto.getTime()/1000 + 3600; // на 1 час вперёд
+ let ttimeto = time + 3600; // на 1 час вперёд
gtfrom = ttimeto - 86400; // и на сутки назад
gtto = ttimeto;
@@ -692,10 +757,7 @@ function ProcessHandler(addedNode) {
// TODO: придумать способ задавать этот параметр при необходимости
count = 1000;
- let timeParsed = moment(time, "DD.MM.YYYY hh:mm::ss");
- let timeto = timeParsed.toDate();
- let ttimeto = timeto.getTime()/1000;
-
+ let ttimeto = time;
gtfrom = ttimeto - 86400;
gtto = ttimeto;
if(msgid === '1' || msgid === '4688') {
@@ -755,11 +817,8 @@ function ProcessHandler(addedNode) {
let time = getTimeValueFromSidebar();
- let timeParsed = moment(time, "DD.MM.YYYY hh:mm::ss");
- let timeto = timeParsed.toDate();
- let ttimeto = timeto.getTime()/1000 + 86400; // на сутки вперед
-
- gtfrom = ttimeto - 86400 - 600; // и на 10 минут назад на всякий случай
+ let ttimeto = time + 86400; // на сутки вперед
+ gtfrom = time - 600; // и на 10 минут назад на всякий случай
gtto = ttimeto;
@@ -817,7 +876,9 @@ function getTimeValueFromSidebar() {
let shadowRoot = legacy_events_page[0].shadowRoot;
// class="layout-padding_no-left mc-sidebar-header__title flex ng-binding"
let time = $("mc-sidebar-opened > header > div.layout-row.flex > div > div", shadowRoot).text().trim("↵");
- return time;
+ // SIEM don't want milliseconds, microseconds and nanoseconds
+ return_time = getDateFromFormat(time, date_format)/1000;
+ return return_time;
}
let time = $("body > section > div > div > events-page > div > section > mc-sidebar.mc-sidebar_wide.mc-sidebar_right.ng-scope.ng-isolate-scope > mc-sidebar-opened > header > div.layout-row.flex > div > div").text().trim("↵");
@@ -828,7 +889,9 @@ function getTimeValueFromSidebar() {
time = $("mc-sidebar-opened > header > div.layout-row.flex > div > div", iframe.contents()).text().trim("↵");
}
}
- return time;
+ // SIEM don't want milliseconds, microseconds and nanoseconds
+ return_time = getDateFromFormat(time, date_format)/1000;
+ return return_timetime;
}
function ExternalLink(addedNode) {
@@ -1189,7 +1252,7 @@ async function ipfieldChangeObserver(addedNode, fieldname){
src_ip = $(changedElement).text();
let addr = ipaddr.parse(src_ip);
let range = addr.range();
-
+
if('options' in options && 'iplinks' in options.options){
let services = [...options.options.iplinks].reverse();
services.forEach(e => {
@@ -1203,7 +1266,6 @@ async function ipfieldChangeObserver(addedNode, fieldname){
500,
src_ip_span)
);
-
span_to_observe = addedNode.querySelector(`div[title=\"${fieldname}\"] + div span.pt-preserve-white-space`);
if (span_to_observe) {
ip_span_observer.observe(span_to_observe,{childList: true, subtree: true, characterDataOldValue: true,});
@@ -1319,13 +1381,9 @@ function AddDownloadNormalizedSubeventsIcon(addedNode) {
let siemUrl = window.location.origin;
let uuid = getFieldValueFromSidebar('uuid');
let time = getTimeValueFromSidebar();
-
- timeParsed = moment(time, "DD.MM.YYYY hh:mm::ss");
- timeto = timeParsed.toDate();
- ttimeto = timeto.getTime()/1000;
- gtfrom = ttimeto;
- gtto = ttimeto;
- getdata(siemUrl, `uuid = '${uuid}'`, 1, processCorrleationEventDownloadSubevents, "", ttimeto, ttimeto); //TODO: со временем путаница и не удобно, надо распутаться
+ gtfrom = time;
+ gtto = time;
+ getdata(siemUrl, `uuid = '${uuid}'`, 1, processCorrleationEventDownloadSubevents, "", gtfrom, gtto); //TODO: со временем путаница и не удобно, надо распутаться
})
}
@@ -1349,12 +1407,9 @@ function AddDownloadNormalizedIcon(addedNode) {
let siemUrl = window.location.origin;
let uuid = getFieldValueFromSidebar('uuid');
let time = getTimeValueFromSidebar();
- timeParsed = moment(time, "DD.MM.YYYY hh:mm::ss");
- timeto = timeParsed.toDate();
- ttimeto = timeto.getTime()/1000;
- gtfrom = ttimeto;
- gtto = ttimeto;
- getdata(siemUrl, `uuid = '${uuid}'`, 1, processCorrleationEventDownload, "", ttimeto, ttimeto);
+ gtfrom = time;
+ gtto = time;
+ getdata(siemUrl, `uuid = '${uuid}'`, 1, processCorrleationEventDownload, "", gtfrom, gtto);
})
copy_normalized_icon.click(function ()
@@ -1362,12 +1417,9 @@ function AddDownloadNormalizedIcon(addedNode) {
let siemUrl = window.location.origin;
let uuid = getFieldValueFromSidebar('uuid');
let time = getTimeValueFromSidebar();
- timeParsed = moment(time, "DD.MM.YYYY hh:mm::ss");
- timeto = timeParsed.toDate();
- ttimeto = timeto.getTime()/1000;
- gtfrom = ttimeto;
- gtto = ttimeto;
- getdata(siemUrl, `uuid = '${uuid}'`, 1, processEventCopyToClipboard, "", ttimeto, ttimeto);
+ gtfrom = time;
+ gtto = time;
+ getdata(siemUrl, `uuid = '${uuid}'`, 1, processEventCopyToClipboard, "", gtfrom, gtto);
})
}
@@ -1389,10 +1441,8 @@ function AddGetShareableEventLinkIcon(addedNode) {
}
let uuid = getFieldValueFromSidebar('uuid');
let time = getTimeValueFromSidebar();
- timeParsed = moment(time, "DD.MM.YYYY hh:mm::ss");
- timeto = timeParsed.toDate();
- ttimeto = timeto.getTime();
- let link = `${siemUrl}/#/events/view?where=uuid=%22${uuid}%22&period=range&start=${ttimeto}&end=${ttimeto}`;
+ time = time*1000;
+ let link = `${siemUrl}/#/events/view?where=uuid=%22${uuid}%22&period=range&start=${time}&end=${time}`;
console.log(link);
navigator.clipboard.writeText(link);
let legacy_events_page = $("legacy-events-page");
@@ -1404,7 +1454,7 @@ function AddGetShareableEventLinkIcon(addedNode) {
searchNode = document;
}
let icon = $(".shareableeventlink", searchNode);
- $('Ссылка в буфере обмена...
').insertAfter(icon).show().delay(500).fadeOut();
+ $('Ссылка в буфере обмена...
').insertAfter(icon).show().delay(500).fadeOut(500, function() { $(this).remove(); })
})
}
@@ -1426,7 +1476,8 @@ async function popup_event_handler() {
fields.forEach( x => {
params[x.name] = $(`div[title=\"${x.name}\"] + div > div > div:first`, applicationNode).text().trim('↵');
});
- params['time'] = getTimeValueFromSidebar();
+ let time = getTimeValueFromSidebar();
+ params['time'] = time*1000;
}
catch(err)
{
@@ -1570,3 +1621,49 @@ GetOptionsFromStorage().then(() => {
(document.head || document.documentElement).appendChild(s);
}
});
+
+// catch if SIEM menu is changed and there is a place for Monkey
+// should help if we switching between assets, events and other tabs
+function monitorSIEMnav() {
+ let config = {
+ attributes: false,
+ subtree: true,
+ childList: true,
+ };
+
+ let callback = function(mutationList, monkeyObserver) {
+ // if MP href changed, is monkey on sidebar?
+ // attach if needed
+ let href_main = document.location.href.split("?")[0];
+ if (oldHref !== href_main) {
+ oldHref = href_main;
+
+ let target_class = ".sidebarWithMonkey";
+ let monkey_binded = 0;
+ monkey_binded = document.querySelectorAll(target_class).length;
+ if (monkey_binded == 0) {
+ // search in shadowRoot too
+ let legacy_events = $("legacy-events-page");
+ if (legacy_events.length === 1) {
+ let shadowRoot = legacy_events[0].shadowRoot;
+ if (shadowRoot) {
+ monkey_binded = $(shadowRoot).find(target_class).length;
+ }
+ }
+ }
+ //console.log("Monkey binded: " + monkey_binded);
+ if (monkey_binded == 0) {
+ //console.log("no Monkeys here. We want Monkey!");
+ SearchBananas(
+ siem_bananas,
+ siemMonkeyBind,
+ 500,
+ 6000
+ );
+ }
+ }
+ }
+ let targetNode = document.getElementsByTagName("pt-siem-app-root")[0];
+ monkeyObserver = new MutationObserver(callback);
+ monkeyObserver.observe(targetNode, config);
+}
diff --git a/web_accessible_resources.js b/web_accessible_resources.js
new file mode 100644
index 0000000..8aa2204
--- /dev/null
+++ b/web_accessible_resources.js
@@ -0,0 +1,4 @@
+//console.log(window.appConfig);
+if (window.appConfig){
+ window.postMessage({type : "FROM_PAGE", text : JSON.stringify(window.appConfig)}, "*");
+}