Repository navigation
SOC
EN | FR | 🟡 WALL | one page, every security view
The SOC (/soc/, package secubox-soc) gathers on one page the security
information that used to be scattered over several admin pages: the Guardian
dashboard, live network figures, the firewall (WAF), traffic (DPI-Vivant),
intelligence (Actor-Intelligence) and the box's own watch screens. It is a
read-only consumer: it owns no data and changes nothing.
Tabs are grouped; the default tab is Guardian.
| Group | Tab | Content | Source |
|---|---|---|---|
| (none) | Guardian | Seven tiles (threats seen, devices, connections, protocols, countries, critical, dropped), attack map, trend, categories, last events, usages, main devices, decoys, and the Guardian mode | SOC page guardian.html
|
| (none) | Live network | Throughput per interface and packets dropped by the firewall | SOC page reseau.html
|
| Firewall | Threats · Attackers · Campaigns · Surfaces · Visits · History | The WAF views |
/waf/ pages |
| Network & actors | Traffic (DPI) | The DPI overview | /dpi/vue.html |
| Network & actors | Intelligence | Actor Intelligence | /actor-intelligence/ |
| Station | Vigie | WAF, metrics, profiles, GSM sentinel on one screen | live sources |
| Station | Meta-metrics | The box looking at itself: modules, sleepers, vhosts, certificates | live sources |
| Station | Alerts centre | Network and radio alerts on one shared timeline | live sources |
The Guardian mode tiles (observe, simulation, mitigate, block) show the mode read
from the WAF (/api/v1/waf/enforcement/mode), never an assumed one. The mode is
changed in the admin console, never from the SOC.
The firewall, traffic and intelligence tabs are not copies: each one frames the
real page in a same-origin iframe (?embed=1). A fix to the WAF page therefore
shows in the SOC at once, and the page announces its own height to the frame. This
is why the SOC depends on the packages that own those pages.
secubox-soc depends on |
For |
|---|---|
secubox-waf-ng (>= 1.29.0) |
the six firewall tabs (/waf) and the Actor service |
secubox-dpi (>= 1.11.2) |
the traffic tab (/dpi) |
secubox-webos (>= 1.9.7) |
the Intelligence page (/actor-intelligence) |
Without them a tab would be empty (#2358), so the lite profile (Profils)
carries all three through the SOC with their own dependencies.
Right after Guardian, Live network shows two things on a 24 h window.
- Throughput in and out of every interface, curves on a common scale grouped Interfaces / Tunnels / Containers; interfaces idle for 24 h are folded away.
- Packets dropped by the firewall (nftables), by category.
Four tiles sum it up: incoming now, outgoing now, active interfaces, packets dropped (with the main category). Data comes from the hub, in session:
| Route | Content |
|---|---|
GET /api/v1/hub/netstats/summary |
latest snapshot: categories, interfaces, network_drops, stale flag |
GET /api/v1/hub/netstats/series?window=86400&step=300 |
throughput and drops series (window 5 min to 7 days) |
The figures are collected by a root collector run by the secubox-netstats timer
(about every two minutes) into a snapshot and a small SQLite base; drops come from
named nftables counters (blacklist, quarantine, WAF rate limit, input policy; DoH
detection is counted but not as a drop). A banner appears if the collector stopped.
A missing measure is "—", never zero.
All pages follow the Aurora style: ?embed=1 for a framed single column, ?demo=1
for demonstration data announced by a banner, "—" without a measure, a stale or
unreadable source said out loud instead of a calm zero.
secubox-threats (the Threat Dashboard, /threats/) is the intelligence
page for indicators: alerts over 24 h, active IOCs, open incidents, sources, risk
score, a 24 h timeline by severity, intelligence feeds and reports. Its web UI was
redone in the Aurora style (read-only, ?embed=1, ?demo=1). It also hosts the
former AI-insights component. It is a module of its own, beside the SOC.
Ban for 30 days (secubox-threats 1.5.0): the page shows one button per public address of the alerts and of the IP indicators, with an in-page confirmation (never confirm()). It calls the existing POST /api/v1/waf/ban (duration 30d), validated by wafctl, which still refuses private and local addresses; a server refusal or a missing session is reported as is and the button stays usable. No private address is ever offered. This is the only write of the page.
The Interceptor page complements it with maps of where traffic goes out to and where visitors come from.
WAF · Interceptor · Actor-Intelligence · DPI-Vivant · Profils · Cartes-du-Hall · SOC-FR