@@ -2190,23 +2190,29 @@ def _set_nodes_query(self, data):
2190
2190
"count(c.process) as {2}, " \
2191
2191
"c.uid as {3}, " \
2192
2192
"c.protocol as {4}, " \
2193
- "c.dst_ip as {5}, " \
2194
- "c.dst_host as {6}, " \
2195
- "c.dst_port as {7}, " \
2196
- "c.process || ' (' || c.pid || ')' as {8}, " \
2197
- "c.process_args as {9}, " \
2193
+ "c.src_port as {5}, " \
2194
+ "c.src_ip as {6}, " \
2195
+ "c.dst_ip as {7}, " \
2196
+ "c.dst_host as {8}, " \
2197
+ "c.dst_port as {9}, " \
2198
+ "c.pid as {10}, " \
2199
+ "c.process as {11}, " \
2200
+ "c.process_args as {12}, " \
2198
2201
"c.process_cwd as CWD, " \
2199
- "c.rule as {10 } " \
2202
+ "c.rule as {13 } " \
2200
2203
"FROM connections as c " \
2201
- "WHERE c.node = '{11 }' GROUP BY {12 }, c.process_args, c.uid, c.src_ip, c.dst_ip, c.dst_host, c.dst_port, c.protocol {13 }" .format (
2204
+ "WHERE c.node = '{14 }' GROUP BY {15 }, c.process_args, c.uid, c.src_ip, c.dst_ip, c.dst_host, c.dst_port, c.protocol {16 }" .format (
2202
2205
self .COL_STR_TIME ,
2203
2206
self .COL_STR_ACTION ,
2204
2207
self .COL_STR_HITS ,
2205
2208
self .COL_STR_UID ,
2206
2209
self .COL_STR_PROTOCOL ,
2210
+ self .COL_STR_SRC_PORT ,
2211
+ self .COL_STR_SRC_IP ,
2207
2212
self .COL_STR_DST_IP ,
2208
2213
self .COL_STR_DST_HOST ,
2209
2214
self .COL_STR_DST_PORT ,
2215
+ self .COL_STR_PID ,
2210
2216
self .COL_STR_PROCESS ,
2211
2217
self .COL_STR_PROC_CMDLINE ,
2212
2218
self .COL_STR_RULE ,
@@ -2338,22 +2344,28 @@ def _set_rules_query(self, rule_name="", node=""):
2338
2344
"count(c.process) as {2}, " \
2339
2345
"c.uid as {3}, " \
2340
2346
"c.protocol as {4}, " \
2341
- "c.dst_port as {5}, " \
2342
- "c.dst_ip as {6}, " \
2343
- "c.dst_host as {7}, " \
2344
- "c.process as {8}, " \
2345
- "c.process_args as {9}, " \
2347
+ "c.src_port as {5}, " \
2348
+ "c.src_ip as {6}, " \
2349
+ "c.dst_ip as {7}, " \
2350
+ "c.dst_host as {8}, " \
2351
+ "c.dst_port as {9}, " \
2352
+ "c.pid as {10}, " \
2353
+ "c.process as {11}, " \
2354
+ "c.process_args as {12}, " \
2346
2355
"c.process_cwd as CWD " \
2347
2356
"FROM connections as c " \
2348
- "WHERE {10 } GROUP BY c.process, c.process_args, c.uid, c.dst_ip, c.dst_host, c.dst_port {11 }" .format (
2357
+ "WHERE {13 } GROUP BY c.process, c.process_args, c.uid, c.dst_ip, c.dst_host, c.dst_port {14 }" .format (
2349
2358
self .COL_STR_TIME ,
2350
2359
self .COL_STR_NODE ,
2351
2360
self .COL_STR_HITS ,
2352
2361
self .COL_STR_UID ,
2353
2362
self .COL_STR_PROTOCOL ,
2354
- self .COL_STR_DST_PORT ,
2363
+ self .COL_STR_SRC_PORT ,
2364
+ self .COL_STR_SRC_IP ,
2355
2365
self .COL_STR_DST_IP ,
2356
2366
self .COL_STR_DST_HOST ,
2367
+ self .COL_STR_DST_PORT ,
2368
+ self .COL_STR_PID ,
2357
2369
self .COL_STR_PROCESS ,
2358
2370
self .COL_STR_PROC_CMDLINE ,
2359
2371
condition ,
@@ -2369,22 +2381,28 @@ def _set_hosts_query(self, data):
2369
2381
"c.action as {3}, " \
2370
2382
"c.uid as {4}, " \
2371
2383
"c.protocol as {5}, " \
2372
- "c.dst_port as {6}, " \
2373
- "c.dst_ip as {7}, " \
2374
- "c.process || ' (' || c.pid || ')' as {8}, " \
2375
- "c.process_args as {9}, " \
2384
+ "c.src_port as {6}, " \
2385
+ "c.src_ip as {7}, " \
2386
+ "c.dst_ip as {9}, " \
2387
+ "c.dst_port as {8}, " \
2388
+ "c.pid as {10}, " \
2389
+ "c.process as {11}, " \
2390
+ "c.process_args as {12}, " \
2376
2391
"c.process_cwd as CWD, " \
2377
- "c.rule as {10 } " \
2392
+ "c.rule as {13 } " \
2378
2393
"FROM connections as c " \
2379
- "WHERE c.dst_host = '{11 }' GROUP BY c.pid, {12 }, c.process_args, c.src_ip, c.dst_ip, c.dst_port, c.protocol, c.action, c.node {13 }" .format (
2394
+ "WHERE c.dst_host = '{14 }' GROUP BY c.pid, {15 }, c.process_args, c.src_ip, c.dst_ip, c.dst_port, c.protocol, c.action, c.node {16 }" .format (
2380
2395
self .COL_STR_TIME ,
2381
2396
self .COL_STR_NODE ,
2382
2397
self .COL_STR_HITS ,
2383
2398
self .COL_STR_ACTION ,
2384
2399
self .COL_STR_UID ,
2385
2400
self .COL_STR_PROTOCOL ,
2386
- self .COL_STR_DST_PORT ,
2401
+ self .COL_STR_SRC_PORT ,
2402
+ self .COL_STR_SRC_IP ,
2387
2403
self .COL_STR_DST_IP ,
2404
+ self .COL_STR_DST_PORT ,
2405
+ self .COL_STR_PID ,
2388
2406
self .COL_STR_PROCESS ,
2389
2407
self .COL_STR_PROC_CMDLINE ,
2390
2408
self .COL_STR_RULE ,
@@ -2401,24 +2419,28 @@ def _set_process_query(self, data):
2401
2419
"c.action as {3}, " \
2402
2420
"c.uid as {4}, " \
2403
2421
"c.protocol as {5}, " \
2404
- "c.dst_ip as {6}, " \
2405
- "c.dst_host as {7}, " \
2406
- "c.dst_port as {8}, " \
2422
+ "c.src_port as {6}, " \
2423
+ "c.src_ip as {7}, " \
2424
+ "c.dst_ip as {8}, " \
2425
+ "c.dst_host as {9}, " \
2426
+ "c.dst_port as {10}, " \
2407
2427
"c.pid as PID, " \
2408
- "c.process_args as {9 }, " \
2428
+ "c.process_args as {11 }, " \
2409
2429
"c.process_cwd as CWD, " \
2410
- "c.rule as {10 } " \
2430
+ "c.rule as {12 } " \
2411
2431
"FROM connections as c " \
2412
- "WHERE c.process = '{11 }' " \
2413
- "GROUP BY c.src_ip, c.dst_ip, c.dst_host, c.dst_port, c.uid, c.action, c.node, c.pid, c.process_args {12 }" .format (
2432
+ "WHERE c.process = '{13 }' " \
2433
+ "GROUP BY c.src_ip, c.dst_ip, c.dst_host, c.dst_port, c.uid, c.action, c.node, c.pid, c.process_args {14 }" .format (
2414
2434
self .COL_STR_TIME ,
2415
2435
self .COL_STR_NODE ,
2416
2436
self .COL_STR_HITS ,
2417
2437
self .COL_STR_ACTION ,
2418
2438
self .COL_STR_UID ,
2419
2439
self .COL_STR_PROTOCOL ,
2440
+ self .COL_STR_SRC_PORT ,
2441
+ self .COL_STR_SRC_IP ,
2420
2442
self .COL_STR_DST_IP ,
2421
- self .COL_STR_DESTINATION ,
2443
+ self .COL_STR_DST_HOST ,
2422
2444
self .COL_STR_DST_PORT ,
2423
2445
self .COL_STR_PROC_CMDLINE ,
2424
2446
self .COL_STR_RULE ,
@@ -2437,31 +2459,34 @@ def _set_addrs_query(self, data):
2437
2459
"c.action as {3}, " \
2438
2460
"c.uid as {4}, " \
2439
2461
"c.protocol as {5}, " \
2440
- "CASE c.dst_host WHEN '' " \
2441
- " THEN c.dst_ip " \
2442
- " ELSE c.dst_host " \
2443
- "END {6 }, " \
2444
- "c.dst_port as {7 }, " \
2445
- "c.process || ' (' || c.pid || ')' as {8 }, " \
2446
- "c.process_args as {9 }, " \
2462
+ "c.src_port as {6}, " \
2463
+ "c.src_ip as {7}, " \
2464
+ "c.dst_host as {8}, " \
2465
+ "c.dst_port as {9 }, " \
2466
+ "c.pid as {10 }, " \
2467
+ "c.process as {11 }, " \
2468
+ "c.process_args as {12 }, " \
2447
2469
"c.process_cwd as CWD, " \
2448
- "c.rule as {10 } " \
2470
+ "c.rule as {13 } " \
2449
2471
"FROM connections as c " \
2450
- "WHERE c.dst_ip = '{11 }' GROUP BY c.pid, {12 }, c.process_args, c.src_ip, c.dst_port, {13 }, c.protocol, c.action, c.uid, c.node {14 }" .format (
2472
+ "WHERE c.dst_ip = '{14 }' GROUP BY c.pid, {15 }, c.process_args, c.src_ip, c.dst_port, {16 }, c.protocol, c.action, c.uid, c.node {17 }" .format (
2451
2473
self .COL_STR_TIME ,
2452
2474
self .COL_STR_NODE ,
2453
2475
self .COL_STR_HITS ,
2454
2476
self .COL_STR_ACTION ,
2455
2477
self .COL_STR_UID ,
2456
2478
self .COL_STR_PROTOCOL ,
2457
- self .COL_STR_DESTINATION ,
2479
+ self .COL_STR_SRC_PORT ,
2480
+ self .COL_STR_SRC_IP ,
2481
+ self .COL_STR_DST_HOST ,
2458
2482
self .COL_STR_DST_PORT ,
2483
+ self .COL_STR_PID ,
2459
2484
self .COL_STR_PROCESS ,
2460
2485
self .COL_STR_PROC_CMDLINE ,
2461
2486
self .COL_STR_RULE ,
2462
2487
data ,
2463
2488
self .COL_STR_PROCESS ,
2464
- self .COL_STR_DESTINATION ,
2489
+ self .COL_STR_DST_HOST ,
2465
2490
self ._get_order ("1" ) + self ._get_limit ()))
2466
2491
2467
2492
def _set_ports_query (self , data ):
@@ -2473,31 +2498,34 @@ def _set_ports_query(self, data):
2473
2498
"c.action as {3}, " \
2474
2499
"c.uid as {4}, " \
2475
2500
"c.protocol as {5}, " \
2476
- "c.dst_ip as {6}, " \
2477
- "CASE c.dst_host WHEN '' " \
2478
- " THEN c.dst_ip " \
2479
- " ELSE c.dst_host " \
2480
- "END {7 }, " \
2481
- "c.process || ' (' || c.pid || ')' as {8 }, " \
2482
- "c.process_args as {9 }, " \
2501
+ "c.src_port as {6}, " \
2502
+ "c.src_ip as {7}, " \
2503
+ "c.dst_ip as {8}, " \
2504
+ "c.dst_host as {9}, " \
2505
+ "c.pid as {10 }, " \
2506
+ "c.process as {11 }, " \
2507
+ "c.process_args as {12 }, " \
2483
2508
"c.process_cwd as CWD, " \
2484
- "c.rule as {10 } " \
2509
+ "c.rule as {13 } " \
2485
2510
"FROM connections as c " \
2486
- "WHERE c.dst_port = '{11 }' GROUP BY c.pid, {12 }, c.process_args, {13 }, c.src_ip, c.dst_ip, c.protocol, c.action, c.uid, c.node {14 }" .format (
2511
+ "WHERE c.dst_port = '{14 }' GROUP BY c.pid, {15 }, c.process_args, {16 }, c.src_ip, c.dst_ip, c.protocol, c.action, c.uid, c.node {17 }" .format (
2487
2512
self .COL_STR_TIME ,
2488
2513
self .COL_STR_NODE ,
2489
2514
self .COL_STR_HITS ,
2490
2515
self .COL_STR_ACTION ,
2491
2516
self .COL_STR_UID ,
2492
2517
self .COL_STR_PROTOCOL ,
2518
+ self .COL_STR_SRC_PORT ,
2519
+ self .COL_STR_SRC_IP ,
2493
2520
self .COL_STR_DST_IP ,
2494
- self .COL_STR_DESTINATION ,
2521
+ self .COL_STR_DST_HOST ,
2522
+ self .COL_STR_PID ,
2495
2523
self .COL_STR_PROCESS ,
2496
2524
self .COL_STR_PROC_CMDLINE ,
2497
2525
self .COL_STR_RULE ,
2498
2526
data ,
2499
2527
self .COL_STR_PROCESS ,
2500
- self .COL_STR_DESTINATION ,
2528
+ self .COL_STR_DST_HOST ,
2501
2529
self ._get_order ("1" ) + self ._get_limit ()))
2502
2530
2503
2531
def _set_users_query (self , data ):
@@ -2509,28 +2537,33 @@ def _set_users_query(self, data):
2509
2537
model = self ._get_active_table ().model ()
2510
2538
self .setQuery (model , "SELECT " \
2511
2539
"MAX(c.time) as {0}, " \
2512
- "c.uid, " \
2513
2540
"c.node as {1}, " \
2514
2541
"count(c.dst_ip) as {2}, " \
2515
2542
"c.action as {3}, " \
2516
2543
"c.protocol as {4}, " \
2517
- "c.dst_ip as {5}, " \
2518
- "c.dst_host as {6}, " \
2519
- "c.dst_port as {7}, " \
2520
- "c.process || ' (' || c.pid || ')' as {8}, " \
2521
- "c.process_args as {9}, " \
2544
+ "c.src_port as {5}, " \
2545
+ "c.src_ip as {6}, " \
2546
+ "c.dst_ip as {7}, " \
2547
+ "c.dst_host as {8}, " \
2548
+ "c.dst_port as {9}, " \
2549
+ "c.pid as {10}, " \
2550
+ "c.process as {11}, " \
2551
+ "c.process_args as {12}, " \
2522
2552
"c.process_cwd as CWD, " \
2523
- "c.rule as {10 } " \
2553
+ "c.rule as {13 } " \
2524
2554
"FROM connections as c " \
2525
- "WHERE c.uid = '{11 }' GROUP BY c.pid, {12 }, c.process_args, c.src_ip, c.dst_ip, c.dst_host, c.dst_port, c.protocol, c.action, c.node {13 }" .format (
2555
+ "WHERE c.uid = '{14 }' GROUP BY c.pid, {15 }, c.process_args, c.src_ip, c.dst_ip, c.dst_host, c.dst_port, c.protocol, c.action, c.node {16 }" .format (
2526
2556
self .COL_STR_TIME ,
2527
2557
self .COL_STR_NODE ,
2528
2558
self .COL_STR_HITS ,
2529
2559
self .COL_STR_ACTION ,
2530
2560
self .COL_STR_PROTOCOL ,
2561
+ self .COL_STR_SRC_PORT ,
2562
+ self .COL_STR_SRC_IP ,
2531
2563
self .COL_STR_DST_IP ,
2532
- self .COL_STR_DESTINATION ,
2564
+ self .COL_STR_DST_HOST ,
2533
2565
self .COL_STR_DST_PORT ,
2566
+ self .COL_STR_PID ,
2534
2567
self .COL_STR_PROCESS ,
2535
2568
self .COL_STR_PROC_CMDLINE ,
2536
2569
self .COL_STR_RULE ,
0 commit comments