Dashboard
The / page is the operator landing screen — at-a-glance health, scanner inventory, and EDR-fleet status. Everything is async-loaded by the page's JS so the initial render is instant and the live data fills in.
┌──────────────────────────────────────────────────────────────────────┐
│ LitterBox v5.0.0 [Cleanup] │
│ Sandbox status / fleet posture / quick links │
├──────────────────────────────────────────────────────────────────────┤
│ ┌─ Sandbox health ──────────┐ ┌─ Local scanners ────────────┐ │
│ │ Upload folder OK │ │ Static yara, checkplz, │ │
│ │ Result folder OK │ │ stringnalyzer │ │
│ │ Doppelganger DB OK │ │ Dynamic yara, pe-sieve, │ │
│ │ HolyGrail tool OK │ │ moneta, patriot, │ │
│ │ │ │ hsb, rededr, │ │
│ │ Issues: 0 │ │ hollows-hunter │ │
│ └───────────────────────────┘ │ HolyGrail enabled, found │ │
│ └─────────────────────────────┘ │
│ │
│ ┌─ EDR fleet ──────────────────────────────────────────────────┐ │
│ │ elastic ✓ agent reachable · ✓ Elastic stack · DESKTOP-... │ │
│ │ fibratus ✓ agent reachable · ✓ Fibratus installed · ... │ │
│ └───────────────────────────────────────────────────────────────┘ │
│ │
│ ┌─ Recent samples (last 10) ──────────────────────────────────┐ │
│ │ hash · filename · type · detection score · profiles │ │
│ └─────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────────┘
The dashboard makes two async fetches:
| Endpoint | Drives | Refresh |
|---|---|---|
GET /health |
Sandbox health + Local scanners + EDR fleet (one unified payload) | every 60s |
GET /files |
Recent samples | every 60s |
/health covers all three top cards in a single request — it returns scanner inventory under scanners.rows/counts, EDR reachability under edr_agents.agents, and boot-validation issues at the top level.
Polling pauses when the tab is hidden (document.visibilityState === 'hidden') and resumes — with one immediate refresh — when it becomes visible again.
Backed by /health's top-level status + issues. Status is ok (no issues) or degraded (one or more configuration problems — missing tool path, unwritable upload folder, etc.). The sandbox block reports upload_folder_accessible. The scanners and edr_agents blocks drive the other two cards on this page.
Issues are listed verbatim. The most common ones:
-
Tool path is missing for X— config hasenabled: truebut notool_path. Either point it at the binary or setenabled: false. -
Configured tool not found: <path>— path is set but file doesn't exist. Often a path-with-backslashes-on-different-machines issue. -
Upload folder does not exist— usually means LitterBox booted butUploads/wasn't created. Restart should fix.
Backed by /health's scanners.rows array. Per-scanner row with:
| Field | Meaning |
|---|---|
enabled |
enabled: true in config? |
tool_path |
Absolute path from config |
exists |
Does the file actually exist? |
status |
ok (enabled + exists), missing (enabled + no file), disabled (not enabled) |
The dashboard groups by static / dynamic / holygrail and color-codes:
- green dot →
ok - red dot →
missing(enabled but binary not on disk — needs attention) - gray dot →
disabled(deliberately off)
Backed by /health's edr_agents.agents array (which delegates to the same TTL-cached probe /api/edr/agents/status exposes). For each registered profile (one YAML under Config/edr_profiles/) it shows:
- Profile name + display name (from the YAML)
-
Kind —
elasticorfibratus -
Whiskers reachable —
GET /api/infosucceeded -
Backend reachable — for
kind: elastic, the Elastic cluster_cluster/health; forkind: fibratus, Fibratus presence flag from/api/info'stelemetry_sources -
Hostname / agent version — self-reported by
/api/info -
Lock state —
free/in_use(from/api/lock/status)
The probe is server-side cached with a 30s TTL and continuously pre-warmed by a background poller in app/services/edr_health.py. Steady-state fetches return instantly from cache. First request after boot waits one probe cycle.
?refresh=1 on /api/edr/agents/status forces a synchronous re-probe (debug aid).
Backed by /files. Lists every analysis result on disk: hash, original filename, file type, detection score, and which EDR profiles ran against it.
The _summary_cache.json (mtime-validated, written by app/services/summary_cache.py) keeps this card under 100 ms even with hundreds of saved samples. The cache regenerates per-sample only when its result-folder mtime changes; otherwise it's served from the JSON cache without re-walking the analyzer outputs.
- Application Architecture — full backend / frontend layout
- HTTP API Reference — every endpoint the dashboard calls
-
All in One Pipeline — the
/analyze/all/<target>page that runs everything in parallel
