dgisolfi/lcars_api

By dgisolfi

•Updated over 7 years ago

The primary point of interaction between the LCARS Dashboard the rest of the LCARS System.

Image

1.2K

Overview Tags

dgisolfi/lcars_api repository overview

⁠API

⁠Authors

Daniel Gisolfi - All current work - dgisolfi⁠

Michael Gutierrez - All current work - maristmichael⁠

⁠Purpose

The purpose of the LCARS API is to enable interaction between the firewall, Database with the frontend. The frontend uses this API to render data and information about the LCARS infastructure. This API was rewritten from its original state after the dashboard was redesigned. Information pertaining to the legacy API can be found here: Legacy LCARS API⁠

⁠Running the API

Docker Compose will luanch this service when run, otherwise to run the API individually, on a machine where Docker is installed run the following commands:

docker pull dgisolfi/lcars_api
docker run --rm --name lcars_api_prod -p 5525:5525 dgisolfi/lcars_api

⁠Usage

⁠HoneyNet Routes

Routes	Description
`/`	Retrieve API Help Page
`/attack_logs/<honeypot>`	Retrieve the log entries for the specified active honeypot
`/attack_logs/<honeypot>/<start_date>/<end_date>`	Retrieve the log entries for the specified active honeypot within a given date range
`/attack_count`	Retrieve the total attack count received today by all honeypots
`/active_pots`	Retrieve the count of currently active honeypots
`/active_pots_info`	Retrieve the attack count, name, and time when last attacked of each honeypot
`/country_data`	Retrieve the count of all attacks, grouped by countries for today
`/exceptions`	Retrieve all exception entries for todays

⁠Reconfigurator Routes

Routes	Description
`/profiles/<pid>`	Show, Create or Delete Profiles
`/responserecipes/<pid>`	Show, Create or Delete Response Recipes
`/responsedetails/<rdid>`	Show, Create or Delete Response Details
`/orchestration`	Show, Create or Delete Orchestrations

⁠OS Query Routes

Routes	Description
`/osversion`	Returns the OS version of the server
`/interfacedetails`	Returns detailed information and stats of network interfaces for the server
`/uptime`	Returns tracked time passed since last boot of the server
`/systeminfo`	Returns System information for identification of the server
`/cputime`	Returns displays information from /proc/stat file about the time the cpu cores spent in different parts of the system

⁠Response Information

All responses will have the form

[
    {
        "key":"value"
    }
]

`/`

Request Methods: GET

Renders the README for the API in HTML

Response

200 OK on success

⁠/attack_logs/honeypot

Request Methods: GET

Retrieve the log entries for either the specified honeypot or all recorded pots

Note: to get all honeypot logs, pass "all" as the honeypot parameter

Response

200 OK on success

[
  {
    "id": "THA01", 
    "timestamp": "2018-08-21 09:21:16.155", 
    "pot_name": "thanatos", 
    "host_ip": "0.0.0.0/32", 
    "host_name": "d1796dfb2f14", 
    "host_PID": 6, 
    "HPID": "jw84f4wnf", 
    "method": "GET", 
    "requested_text": "/", 
    "source_ip": "92.242.236.223/32", 
    "source_port": 4400, 
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTMLCOMMA like Gecko) Version/9.1.2 Safari/601.7.7", 
    "post_text": "nu", 
    "source_country": "Croatia", 
    "country_code": "hr"
  }
]

⁠`/attack_logs/<honeypot>/<start_date>/<end_date>`

Request Methods: GET

Retrieve the log entries for the specified active honeypot within a given date range.

Note: The date format must be YYYY-MM-DD

A more specific range can be given using the format YYYY-MM-DD_HH:MM:SS, for example:

GET /attack_logs/<honeypot>/2018-09-20_00:00:00/2018-09-20_06:00:00

Response

200 OK on success

[
  {
    "id": "THA01", 
    "timestamp": "2018-08-14 07:30:44.901", 
    "pot_name": "thanatos", 
    "host_ip": "148.100.116.135/32", 
    "host_name": "923810b0412c", 
    "host_PID": 1, 
    "HPID": "4f355343276525f67ade27d8d5b5635c5", 
    "method": "GET", 
    "requested_text": "/", 
    "source_ip": "174.220.14.144/32", 
    "source_port": 4400, 
    "user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4 like Mac OS X) AppleWebKit/605.1.15 (KHTMLCOMMA like Gecko) Version/11.0 Mobile/15E148 Safari/604.1", 
    "post_text": "null", 
    "source_country": "United States", 
    "country_code": "us"
  }, 
  {
    "id": "THA01", 
    "timestamp": "2018-08-17 13:05:35.828", 
    "pot_name": "thanatos", 
    "host_ip": "148.100.116.135/32", 
    "host_name": "938eb4fa46ad", 
    "host_PID": 1, 
    "HPID": "4f355343276525f67ade27d8d5b5635c5", 
    "method": "GET", 
    "requested_text": "/", 
    "source_ip": "174.220.9.78/32", 
    "source_port": 4400, 
    "user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4 like Mac OS X) AppleWebKit/605.1.15 (KHTMLCOMMA like Gecko) Version/11.0 Mobile/15E148 Safari/604.1", 
    "post_text": "null", 
    "source_country": "United States", 
    "country_code": "us"
  }, 
]

⁠`/attack_count`

Request Methods: GET

Retrieve the total attack count received today by all honeypots

Response

200 OK on success

[
    {
      "attacks": 300
    }
]

⁠`active_pots_info/active_pots`

Request Methods: GET

Retrieve the count of currently active honeypots

Response

200 OK on success

[
    {
      "active_honeypots": 2
    }
]

⁠`/active_pots_info`

Request Methods: GET

Retrieve the attack count, name, and time when last attacked of each honeypot

Response

200 OK on success

[
  {
    "attack_count": 23, 
    "honeypot_name": "thanatos", 
    "last_attack": "2018-08-13 13:40:19.442349"
  },
  {
    "attack_count": 45, 
    "honeypot_name": "peitho", 
    "last_attack": "2018-08-013 14:55:35.856204"
  }
]

⁠`/country_data`

Request Methods: GET

Retrieve the count of all attacks, grouped by countries for today

Response

200 OK on success

[
  {
    "US": 1
  }, 
  {
    "BD": 1
  }
]

####/exceptions

Request Methods: GET

Retrieve all exception entries for todays

Response

200 OK on success

[
  {
    "id": "THA01", 
    "timestamp": "2018-08-14 07:30:44.901", 
    "pot_name": "thanatos", 
    "host_ip": "148.100.116.135/32", 
    "host_name": "923810b0412c", 
    "host_PID": 1, 
    "HPID": "4f355343276525f67ade27d8d5b5635c5", 
    "method": "GET", 
    "requested_text": "/", 
    "source_ip": "174.220.14.144/32", 
    "source_port": 4400, 
    "user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4 like Mac OS X) AppleWebKit/605.1.15 (KHTMLCOMMA like Gecko) Version/11.0 Mobile/15E148 Safari/604.1", 
    "post_text": "null", 
    "source_country": "United States", 
    "country_code": "us"
  } 
]

⁠`/profiles/<pid>`

Request Methods: GET POST DELETE

Show, Create or Delete Profiles

Methods:

GET using this method and passing a pid the details stored in the database about a profile can be retreived EX: /profiles/1

Note: to view all profiles do not include a rdid
POST sending a post request with the required data posted in JSON format will result in a new profile being created. Post the JSON data at the following route /profiles

Required Data:
```
{
    "name":"profile_name",
    "detials": "profile_detials"
}
```
Note: To update an existing profile post the updated json but when calling the route specify a pid to update EX: /profiles/1
DELETE sending a delete request with the PID of the profile to be removed will delete the profile from the table EX: /profiles/1

Response

200 OK on success for retrieving profile

404 Not Found on profile not found

201 Created on success for new profile

204 No Content on success for deleted profile

⁠`/responserecipes/<pid>`

Request Methods: GET POST DELETE

Show, Create or Delete Response Recipes

Methods:

GET using this method and passing a rrid the details stored in the database about a recipe can be retreived EX: /responserecipes/1

Note: to view all recipes do not include a rrid
POST sending a post request with the required data posted in JSON format will result in a new recipe being created. Post the JSON data at the following route /responserecipes

Required Data:
```
{
    "name":"profile_name",
}
```
Note: To update an existing recipe post the updated json but when calling the route specify a rrid to update EX: /responserecipes/1
DELETE sending a delete request with the PID of the recipe to be removed will delete the recipe from the table EX: /responserecipes/1

Response

200 OK on success for retrieving recipe

404 Not Found on recipe not found

201 Created on success for new recipe

204 No Content on success for deleted recipe

⁠`/responsedetails/<rdid>`

Request Methods: GET POST DELETE

Show, Create or Delete Response Details

Methods:

GET using this method and passing a rdid the details stored in the database about a response can be retreived EX: /responsedetails/1

Note: to view all responses do not include a rdid
POST sending a post request with the required data posted in JSON format will result in a new response being created. Post the JSON data at the following route /responsedetails

Required Data:
```
{
  "rrid": 1, 
  "rule_order": 1, 
  "target": "DROP", 
  "chain": "INPUT", 
  "protocol": "tcp", 
  "source": "1.2.3.4", 
  "destination": "49.0.0.0"
}
```
Note: To update an existing response post the updated json but when calling the route specify a rdid to update EX: /responsedetails/1
DELETE sending a delete request with the PID of the response to be removed will delete the response from the table EX: /responsedetails/1

Response

200 OK on success for retrieving response

404 Not Found on response not found

201 Created on success for new response

204 No Content on success for deleted response

⁠`/orchestration`

Request Methods: GET POST DELETE

Show, Create or Delete Orchestrations

Methods:

GET using this method and passing a pid all orchestrations pertaining to that pid will be returned

EX: /orchestration/1

Note: to view all orchestrations do not include a pid

Note: to retrieve an exact orchestration pass as pid and a rrid EX: /orchestration/1/4
POST sending a post request with a pid and rrid will result in a new orchestration being created. EX: /orchestration/1/4
DELETE sending a delete request with the PID and RRID of the orchestration to be removed will delete the response from the table EX: /orchestration/1/4. To delete all orchestrations that pertain to a pid send a delete request and only provide a PID

Response

200 OK on success for retrieving orchestrations

404 Not Found on orchestration not found

201 Created on success for new orchestration

204 No Content on success for deleted orchestration

⁠`/osversion`

Request Methods: GET

Returns the OS version of the server

Response

200 OK on success for OS version stats