Allow some insights about the contribution

[BinaryCoder87]

It would be nice to somehow be able to see some statistics, like how many attempts have been logged from how many different IPs, for example. But it's a nice-to-have, of course.

[eliphaslevy]

This needs latest code that outputs log evidence converted to JSON. Latest official docker image is outdated as of now.

cname=netwatch_ssh-attackpod
# 2025-01-01 00:11:42,333 Reported the following JSON to the NetWatch collector: {"source_ip": 
msg_match='^[0-9 :,.A-z-]\+ collector: '

# stats:
{
echo -e "Count\tIP\tTime"
docker logs --since ${SINCE} "${cname}" 2>&1 |
        sed -n "s/${msg_match}//p" |
        jq -r '.attack_timestamp |= split("T")[0] | [.source_ip, .attack_timestamp] | @tsv ' |
        sort -V |
        uniq -c
} | column -t

# list last attempts:
{
echo -e "Timestamp\tIP\tuser\tpass"
docker logs --since ${SINCE} "${cname}" 2>&1 |
        sed -n "s/${msg_match}//p" |
        jq -r '[.attack_timestamp, .source_ip, .username, .password] | @tsv'
} | column -t

# sample:
root@hopper:~/netwatch# ./stats.sh 30s
Count  IP               Time
1      xxx.yyy.zzz.aaa  2025-01-22
root@hopper:~/netwatch# ./list.sh 30s
Timestamp                   IP          user       pass
2025-01-22T19:23:23.079327  a.b.c.d     validator  validator
2025-01-22T19:23:26.869703  z.z.z.z     root       tiep0410
2025-01-22T19:23:27.256699  z.z.z.z     root       sanja13
2025-01-22T19:23:27.600203  z.z.z.z     root       tennis

[KingUdo]

Hey @BinaryCoder87
I just pushed the first version of the Community AttackPod insights here: https://community.netwatch.team/insight/
By adding your API key you can now get a few insights about the attacks you AttackPod submitted, the number of cases the AttackPod supported in creating as well as the last attacks seen.
Would there be anything else you would like to see there?

[BinaryCoder87]

Thanks a lot! Any chance it would run on an iPhone over Chrome?

[KingUdo]

It does run on mobile as well, but is for sure not designed for this =>
Let me see how I can make the whole web page more mobile friendly!

[BinaryCoder87]

I tried it on different machines and browsers but I was only one time able to load the summary. All other times I got "Failed to retrieve data. Status code: 504".