Flood Resiliency: Attack logging and alerting

globaleaks / whistleblowing-software

GlobaLeaks is free, open-source whistleblowing software enabling anyone to easily set up and maintain a secure reporting platform.

https://www.globaleaks.org

Other

1.23k stars 269 forks source link

Flood Resiliency: Attack logging and alerting #802

Open fpietrosanti opened 10 years ago

fpietrosanti commented 10 years ago

In relation to the GlobaLeaks Submission Flood Resiliency Project documented at https://docs.google.com/document/d/1P-uHM5K3Hhe_KD6YvARbRTuqjVOVj0VkI7qPO9aWFQw/edit?usp=sharing this ticket is to implement Attack logging and alerting

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

vecna commented 9 years ago

I've started implementing this ticket, along the others related, and I started to:

send email notification when the alarm threshold is received. Every time there is a switch in the Alarm, an email is triggered. 0 => 1, 1 => 2.
There are a time limit (10 minutes hardcoded, at the moment) so admin do not get flooded by email. The alarm email is intended to wake the admin to check the situation.

The stats interface now are three:

statistics: long term collection of activities, based on the 9 elements below
anomalies: every time the alarm has raises, (which one, with details), limited to a certain number (20 event ?)
activities: real time update of what is going on in the node.

fpietrosanti commented 9 years ago

FYI be careful not to implement an excessive amount of code/functionalities at ones as those flood resiliency need real life testing on-field with user experiences/debugging/fixing/improving in an iterative way

fpietrosanti commented 9 years ago

Btw regarding logging be sure that is self-rotated based on size/amount/time to avoid filling the DB/disk

vecna commented 9 years ago

Visualization of timeline:

option 1, timelinejs

This is the backend format expected: https://github.com/globaleaks/GLBackend/commit/644dabc05f491676474cf0279bd12f7e27d71987 This is the client dummy implementation: https://github.com/globaleaks/GLClient/commit/4f90f597c7557ca1b7d806b2d5d07c0617051193 Based on this technology: http://timeline.knightlab.com/# With this repository in github: https://github.com/NUKnightLab/TimelineJS

PRO: supercool standard timeline, easy to be deployed CON: git remote ? copy of the .js/.css ?

option 2, d3.js

I'm gonna to expend some time of research, for example using a graph like this: http://bl.ocks.org/mbostock/6618724 but with a line for every kind of event collected. or something other, like: http://bl.ocks.org/mbostock/4062844 http://bl.ocks.org/mbostock/4061961 http://bl.ocks.org/mbostock/3970883 I don't know there are so many...

hellais commented 9 years ago

Regarding the git remote/copy of the .js and .css. I would suggest simply adding whatever library we use via bower and if it does not exist in the bower repo's to upload it there.

evilaliv3 commented 9 years ago

Correct Hellais. I would preferito having d3