EagleEye - host-based IDS and network monitoring system
This is project needs a lot of work to be ready to use as it's my graduation project so it's not user-friendly, only for experienced users, beta version, and I published/made it only for educational purposes!
- EagleEye consists of two parts:
- Client (Written in Golang)
- Purpose: Capture every packet on device and extract important details in famous protocols then finally send all the collected data to the master if online!
- Usage: It should be installed on each device you want to monitor (ex: employee devices for companies).
- Master: (Written in Python and Bootstrap)
- Purpose: Receive every packet sent from the clients, display it organized in the GUI monitoring table, display connected devices information like current system user/system info, compare the captured data to the threats models already written before, and then finally alert the master user for possible security threats in the network as what a typical IDS system would do!
- Usage: It should be running on a server on the same network as the clients (ex: a server managed by the IT department or blue hacking team for the company maybe).
For more info, you will need to read about (I)ntrusion (D)etection (S)ystems and its types. I recommend the NIST guide.
Screenshots
Main GUI
Monitoring table
Notice the buttons in the table gives you the ability to export table as (CSV, Excel, PDF), copy table data to clipboard, and print the table data if you want.
Monitoring table search
Simple search
Detailed search
As you can see the search here gives you the ability to search for any thing represented in the table.
Connected devices table
When a new client connected to the client
Notice table refreshed automatically every 5s or on page refresh!
Threats table
When a threats detected
Details about any possible threats detected + reference on click
Desktop notification for threats
Notice table refreshed automatically every 5s or on page refresh!
Installation instructions
The Client
Requirements
- Supports Windows system only currently (Because of the data grabbed from the registry, need to change that).
- The following instructions
Installation instructions
- Make sure you have Golang installed.
- Install gopacket library by using this command:
go get github.com/google/gopacket
- Download and install npcap from here.
- Change the following variables in the code according to your needs:
- Line57: Change variable url to your current Master url
- Line59: Change variable device to the network interface you would listen to, for windows you will need this article!
- Line66: Change variable filter to the filter you want in capturing network packets or leave it empty as it is (if you want to capture all packets). The filter syntax is bpf which is the same used in Wireshark search, you can learn it from this guide. I left some examples in the comments too, if anyone wants to use it.
- In CMD navigate to the client directory, of course.
- Now you can run the client as a script with this command:
go run main.go
- To compile/build it, you can use the following command:
go build -o client.exe main.go, maybe you could need this guide.
- If you did all of these, go have a life dude 😆 (Joking)
The Master
Requirements
- Any OS.
- The following instructions, it's a lot easier than the client don't worry LOL!
Installation instructions
- Make sure you have Python 3 installed (Version 3.5 and above) and pip.
- In CMD navigate to the master folder then install the requirements by using this command:
pip install -r requirements.txt or python -m pip install -r requirements.txt
- If you are on windows and colored print in CMD matters to you, run this command:
pip install -r coloring-requirements.txt or python -m pip install -r coloring-requirements.txt
- Now a few variables to change according to your needs 😆
- Line21: Change variable host_port to the port you want to serve on (Default:8000)
- Line23: Change variable serve_localhost change to True if you want to run master on local host only (Default:True)
- Line24: Change variable view_browser change to True if you want the master to open the serving url on the browser automatically (Default:True)
- Now you can run the master by
python interface.py
- Have fun :)
TODO list
d4vinci/eagleeye
