| { |
| "cells": [ |
| { |
| "cell_type": "markdown", |
| "metadata": {}, |
| "source": [ |
| "Initialize workflow." |
| ] |
| }, |
| { |
| "cell_type": "code", |
| "execution_count": null, |
| "metadata": { |
| "collapsed": false |
| }, |
| "outputs": [], |
| "source": [ |
| "import datetime\n", |
| "import struct, socket\n", |
| "import shutil\n", |
| "import numpy as np\n", |
| "import pandas as pd\n", |
| "import linecache, bisect\n", |
| "import csv, json\n", |
| "import operator\n", |
| "import os, time, subprocess \n", |
| "from collections import OrderedDict\n", |
| "\n", |
| "try:\n", |
| " import ipywidgets as widgets # For jupyter/ipython >= 1.4\n", |
| "except ImportError:\n", |
| " from IPython.html import widgets\n", |
| "\n", |
| "from IPython.display import display, Javascript, clear_output\n", |
| "\n", |
| "path = os.getcwd().split(\"/\") \n", |
| "date = path[len(path)-1] \n", |
| "dsource = path[len(path)-2] \n", |
| "cpath = '/'.join(['context' if var == 'ipynb' else var for var in path][:len(path)-2]) + '/'\n", |
| "\n", |
| "coff = 250;\n", |
| "nwloc = cpath + 'networkcontext.csv' \n", |
| "srcdict,srclist = {},[]\n", |
| "dstdict,dstlist = {},[]\n", |
| "sportdict,sportlist = {},[]\n", |
| "dportdict,dportlist = {},[]\n", |
| "global svals\n", |
| "svals = [] " |
| ] |
| }, |
| { |
| "cell_type": "code", |
| "execution_count": null, |
| "metadata": { |
| "collapsed": false |
| }, |
| "outputs": [], |
| "source": [ |
| "def apply_css_to_select(select):\n", |
| " select._css = (\n", |
| " (None, 'height', '90%'),\n", |
| " (None, 'width', '90%'),\n", |
| " ('select', 'overflow-x', 'auto'),\n", |
| " ('select', 'width', '100%'),\n", |
| " ('select', 'margin', 0)\n", |
| " )\n", |
| "\n", |
| "# Source IP box\n", |
| "scrIpLalbel = widgets.HTML(value=\"Source IP:\", height='10%', width='100%')\n", |
| "# srcselect = widgets.Select(options=srclist, height='90%')\n", |
| "srcselect = widgets.Select(height='100%')\n", |
| "apply_css_to_select(srcselect)\n", |
| "srcIpBox = widgets.Box(width='25%', height='100%')\n", |
| "srcIpBox.children = (scrIpLalbel, srcselect)\n", |
| "\n", |
| "# Destination IP box\n", |
| "dstIpLalbel = widgets.HTML(value=\"Dest IP:\", height='10%', width='100%')\n", |
| "dstselect = widgets.Select(height='100%')\n", |
| "# dstselect = widgets.Select(options=dstlist, height='90%')\n", |
| "apply_css_to_select(dstselect)\n", |
| "dstIpBox = widgets.Box(width='25%', height='100%')\n", |
| "dstIpBox.children = (dstIpLalbel, dstselect)\n", |
| "\n", |
| "# Source Port box\n", |
| "scrPortLalbel = widgets.HTML(value=\"Src Port:\", height='10%', width='100%')\n", |
| "sportselect = widgets.Select(height='100%')\n", |
| "# sportselect = widgets.Select(options=sportlist, height='90%')\n", |
| "apply_css_to_select(sportselect)\n", |
| "srcPortBox = widgets.Box(width='20%', height='100%')\n", |
| "srcPortBox.children = (scrPortLalbel, sportselect)\n", |
| "\n", |
| "# Destionation Port box\n", |
| "dstPortLalbel = widgets.HTML(value=\"Dst Port:\", height='10%', width='100%')\n", |
| "dportselect = widgets.Select(height='100%')\n", |
| "# dportselect = widgets.Select(options=dportlist,height='90%')\n", |
| "apply_css_to_select(dportselect)\n", |
| "dstPortBox = widgets.Box(width='20%', height='100%')\n", |
| "dstPortBox.children = (dstPortLalbel, dportselect)\n", |
| "\n", |
| "# Quick Search and Actions Box\n", |
| "emptyLalbel = widgets.HTML(value=\" \")\n", |
| "srctext = widgets.Text(value='', width='100%', placeholder='Quick IP scoring')\n", |
| "srctext._css = (\n", |
| " (None, 'width', '100%'),\n", |
| ")\n", |
| "ratingbut = widgets.RadioButtons(description='Rating:',options=['1', '2', '3'], width='100%')\n", |
| "assignbut = widgets.Button(description='Score', width='45%')\n", |
| "assignbut.button_style = 'primary'\n", |
| "updatebut = widgets.Button(description='Save', width='45%')\n", |
| "updatebut.button_style = 'primary'\n", |
| "updatebut._css = (\n", |
| " (None, 'margin-left', '10%'),\n", |
| ")\n", |
| "actionsBox = widgets.Box(width='20%', height='100%')\n", |
| "actionsBox.children = (emptyLalbel, srctext,ratingbut,assignbut,updatebut)\n", |
| "\n", |
| "# Container Box\n", |
| "bigBox = widgets.HBox(width='90%', height=250)\n", |
| "bigBox.children = (srcIpBox, dstIpBox, srcPortBox, dstPortBox, actionsBox)\n", |
| "\n", |
| "rest_msg_box = widgets.HTML()\n", |
| "\n", |
| "def fill_list(list_control,source):\n", |
| " options_list = ['- Select -'] \n", |
| " options_list.extend([s for s in source])\n", |
| " list_control.options = options_list\n", |
| "\n", |
| "\n", |
| "def data_loader():\n", |
| " # build dict of IP addresses\n", |
| " #sev,score, tstart,srcIP,dstIP,sport,dport,proto,ipkt,ibyt\n", |
| " srcdict,srclist = {},[]\n", |
| " dstdict,dstlist = {},[]\n", |
| " sportdict,sportlist = {},[]\n", |
| " dportdict,dportlist = {},[] \n", |
| " global svals \n", |
| " srcips,srcports = [],[]\n", |
| " dstips,dstports = [],[]\n", |
| " response = GraphQLClient.request(\n", |
| " query=\"\"\"query($date:SpotDateType!) {\n", |
| " flow{\n", |
| " suspicious(date:$date){\n", |
| " srcIP: srcIp\n", |
| " sport: srcPort\n", |
| " dstIP: dstIp\n", |
| " dport: dstPort\n", |
| " }\n", |
| " }\n", |
| " }\"\"\",\n", |
| " variables={\n", |
| " 'date': datetime.datetime.strptime(date, '%Y%m%d').strftime('%Y-%m-%d')\n", |
| " }\n", |
| " )\n", |
| " \n", |
| " \n", |
| " for item in svals:\n", |
| " srcips.append(item[0])\n", |
| " srcports.append(item[2]) \n", |
| " dstips.append(item[1]) \n", |
| " dstports.append(item[3])\n", |
| " \n", |
| " rowct = 1\n", |
| " \n", |
| " \n", |
| " if not 'errors' in response:\n", |
| " for row in response['data']['flow']['suspicious']:\n", |
| " if row['srcIP'] not in srcdict and row['srcIP'] not in srcips:\n", |
| " srclist.append(row['srcIP'])\n", |
| " srcdict[row['srcIP']] = struct.unpack(\"!L\", socket.inet_aton(row['srcIP']))[0]\n", |
| " if row['dstIP'] not in dstdict and row['dstIP'] not in dstips:\n", |
| " dstlist.append(row['dstIP'])\n", |
| " dstdict[row['dstIP']] = struct.unpack(\"!L\", socket.inet_aton(row['dstIP']))[0]\n", |
| " if row['sport'] not in sportdict and str(row['sport']) not in srcports:\n", |
| " sportlist.append(str(row['sport']))\n", |
| " sportdict[row['sport']] = row['sport']\n", |
| " if row['dport'] not in dportdict and str(row['dport']) not in dstports:\n", |
| " dportlist.append(str(row['dport']))\n", |
| " dportdict[row['dport']] = row['dport'] \n", |
| " if rowct == coff:\n", |
| " break;\n", |
| " rowct += 1\n", |
| " \n", |
| " fill_list(srcselect,srclist)\n", |
| " fill_list(dstselect,dstlist)\n", |
| " fill_list(sportselect,sportlist)\n", |
| " fill_list(dportselect,dportlist)\n", |
| " \n", |
| " srcselect.value = \"- Select -\"\n", |
| " dstselect.value = \"- Select -\" \n", |
| " sportselect.value = \"- Select -\" \n", |
| " dportselect.value = \"- Select -\"" |
| ] |
| }, |
| { |
| "cell_type": "code", |
| "execution_count": null, |
| "metadata": { |
| "collapsed": false |
| }, |
| "outputs": [], |
| "source": [ |
| "display(Javascript(\"$('.widget-area > .widget-subarea > *').remove();\"))\n", |
| "data_loader() \n", |
| "display(bigBox)" |
| ] |
| }, |
| { |
| "cell_type": "code", |
| "execution_count": null, |
| "metadata": { |
| "collapsed": true |
| }, |
| "outputs": [], |
| "source": [ |
| "def assign_score(b):\n", |
| " clear_output()\n", |
| " #Gets input values\n", |
| " global svals\n", |
| " if srctext.value != '':\n", |
| " svals.append([srctext.value,dstselect.value,sportselect.value,dportselect.value, ratingbut.value])\n", |
| " svals.append([srcselect.value,srctext.value,sportselect.value,dportselect.value, ratingbut.value])\n", |
| " display(Javascript(\"$(\\\"option[data-value='\" + srctext.value +\"']\\\").remove();\"))\n", |
| " dstselect.value = \"- Select -\" \n", |
| " srcselect.value = \"- Select -\" \n", |
| " else:\n", |
| " svals.append([srcselect.value,dstselect.value,sportselect.value,dportselect.value, ratingbut.value])\n", |
| " \n", |
| " if srcselect.value != \"- Select -\": \n", |
| " display(Javascript(\"$(\\\"select.widget-listbox:eq(0) option[data-value='\" + srcselect.value +\"']\\\").remove();\")) \n", |
| " srcselect.value = \"- Select -\"\n", |
| " if dstselect.value != \"- Select -\":\n", |
| " display(Javascript(\"$(\\\"select.widget-listbox:eq(1) option[data-value='\" + dstselect.value +\"']\\\").remove();\")) \n", |
| " dstselect.value = \"- Select -\"\n", |
| " if sportselect.value != \"- Select -\": \n", |
| " display(Javascript(\"$(\\\"select.widget-listbox:eq(2) option[data-value='\" + sportselect.value +\"']\\\").remove();\")) \n", |
| " sportselect.value = \"- Select -\"\n", |
| " if dportselect.value != \"- Select -\": \n", |
| " display(Javascript(\"$(\\\"select.widget-listbox:eq(3) option[data-value='\" + dportselect.value +\"']\\\").remove();\")) \n", |
| " dportselect.value = \"- Select -\"\n", |
| " srctext.value = \"\"\n", |
| " \n", |
| " rest_msg_box.visible = False\n", |
| " data_loader()\n", |
| " \n", |
| " print \"Click the 'Save' button when you're finished scoring\" \n", |
| "\n", |
| " \n", |
| "def reset_scoring():\n", |
| " response = GraphQLClient.request(\n", |
| " query=\"\"\"mutation($date:SpotDateType!) {\n", |
| " flow{\n", |
| " resetScoredConnections(date:$date){\n", |
| " success\n", |
| " }\n", |
| " }\n", |
| " }\"\"\",\n", |
| " variables={\n", |
| " 'date': datetime.datetime.strptime(date, '%Y%m%d').strftime('%Y-%m-%d')\n", |
| " }\n", |
| " ) \n", |
| " \n", |
| " if not 'errors' in response :\n", |
| " rest_msg_box.value=\"Suspicious connects successfully reset\"\n", |
| " data_loader()\n", |
| " rest_msg_box.visible = True\n", |
| " display(rest_msg_box)\n", |
| " else:\n", |
| " print \"An error ocurred: \" + response['errors'][0]['message']\n", |
| " \n", |
| " \n", |
| " \n", |
| "def savesort(b):\n", |
| " global svals\n", |
| " clear_output() \n", |
| "\n", |
| " variables = []\n", |
| " mutation=\"\"\"mutation($input:[NetflowScoreInputType!]!)\n", |
| " {\n", |
| " flow{\n", |
| " score(input:$input)\n", |
| " {success}\n", |
| " }\n", |
| " }\"\"\"\n", |
| "\n", |
| " for row in svals:\n", |
| " variables.append({\n", |
| " 'date': datetime.datetime.strptime(date, '%Y%m%d').strftime('%Y-%m-%d'),\n", |
| " 'score': row[4],\n", |
| " 'srcIp': row[0] if row[0] != '- Select -' else None,\n", |
| " 'dstIp': row[1] if row[1] != '- Select -' else None,\n", |
| " 'srcPort': row[2] if row[2] != '- Select -' else None,\n", |
| " 'dstPort': row[3] if row[3] != '- Select -' else None\n", |
| " })\n", |
| "\n", |
| " var = {'input':variables}\n", |
| " response = GraphQLClient.request(mutation,var)\n", |
| "\n", |
| " svals = []\n", |
| " if not 'errors' in response :\n", |
| " display(Javascript(\"$('.widget-area > .widget-subarea > *').remove();\"))\n", |
| " data_loader() \n", |
| " display(bigBox)\n", |
| " display(Javascript('reloadParentData();')) \n", |
| " print \"Suspicious connects successfully updated\" \n", |
| " else:\n", |
| " print \"An error ocurred: \" + response['errors'][0]['message']\n", |
| "\n", |
| "assignbut.on_click(assign_score)\n", |
| "updatebut.on_click(savesort)" |
| ] |
| }, |
| { |
| "cell_type": "code", |
| "execution_count": null, |
| "metadata": { |
| "collapsed": false |
| }, |
| "outputs": [], |
| "source": [ |
| "# reset_scoring()" |
| ] |
| } |
| ], |
| "metadata": { |
| "kernelspec": { |
| "display_name": "Python 2", |
| "language": "python", |
| "name": "python2" |
| }, |
| "language_info": { |
| "codemirror_mode": { |
| "name": "ipython", |
| "version": 2 |
| }, |
| "file_extension": ".py", |
| "mimetype": "text/x-python", |
| "name": "python", |
| "nbconvert_exporter": "python", |
| "pygments_lexer": "ipython2", |
| "version": "2.7.10" |
| } |
| }, |
| "nbformat": 4, |
| "nbformat_minor": 0 |
| } |
