Redesign the /api/v1/stats route to make it useful for a "State of SSH" style reporting output

mozilla / ssh_scan_api

An API for ssh_scan (https://github.com/mozilla/ssh_scan) and the backend API service for the Mozilla SSH Observatory (https://observatory.mozilla.org/)

31 stars 12 forks source link

Redesign the /api/v1/stats route to make it useful for a "State of SSH" style reporting output #118

Closed claudijd closed 6 years ago

claudijd commented 6 years ago

We have lots and lots of data about SSH endpoints and I'm feeling like the stats API is a little lean on useful information that helps people understand what's going on with SSH.

I would love to do a brainstorming session where we get together and discuss the particulars of what the stats route should expose.

I made a recent add to allow reporting to auth_method_reporting, but it feels, well... underwhelming and I really want it to be better.

https://sshscan.rubidus.com/api/v1/stats

claudijd commented 6 years ago

/cc @april (for opportunistic IRL London discussion), but others are welcome to contribute by adding notes to this.

claudijd commented 6 years ago

Thoughts...

Increase grade precision
Do something like this (https://http-observatory.security.mozilla.org/api/v1/__stats__?verbose=true)
Cache results every 5 mins or so (so these in a separate collection)
Scan Top 1M sites (Alexa) on the regular
Rapid7 sonar data set
OpenDNS set (https://umbrella.cisco.com/blog/2016/12/14/cisco-umbrella-1-million/)

claudijd commented 6 years ago

I've decided to skip this as core functionality of the API and plan to gather "State of SSH" type info direct from DB and potentially post it somewhere statically that this service can simply grab and present to avoid run-time stress on the API node.