skipped 3 lines 4 4 <head> 5 5 <meta charset="utf-8"> 6 6 <title>LogonTracer</title> 7 - <link rel="stylesheet" href="https://stackpath .bootstrapcdn .com /bootstrap/ 4 . 5.0/css/bootstrap.min.css" integrity="sha384-9aIt2nRpC12Uk9gS9baDl411NQApFmC26EwAOH8WgZl5MYYxFfc +NcPb1dKGj7Sk " crossorigin="anonymous"> 7 + <link rel="stylesheet" href="https://cdn .jsdelivr .net / npm /bootstrap@ 5.0. 1 / dist /css/bootstrap.min.css" integrity="sha384-+ 0n0xVW2eSR5OomGNYDnhzAbDsOXxcvSN1TPprVMTNDbiYZCxYbOOl7 +AMvyTG2x " crossorigin="anonymous"> 8 8 <link rel="stylesheet" href="http://cdnjs.cloudflare.com/ajax/libs/qtip2/2.2.1/jquery.qtip.css" integrity="sha384-EG4MkHYaMXjB6f2q1t0Jfs+W6DpGsGZls4D6PYHr9yhXwZf27Z10ReappeV2ZXcU" crossorigin="anonymous"> 9 9 <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/gitbrent/[email protected] /css/bootstrap4-toggle.min.css" integrity="sha384-yakM86Cz9KJ6CeFVbopALOEQGGvyBFdmA4oHMiYuHcd9L59pLkCEFSlr6M9m434E" crossorigin="anonymous"> 10 10 <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css" integrity="sha384-CmLV3WR+cw/TcN50vJSYAs2EAzhDD77tQvGcmoZ1KEzxtpl2K5xkrpFz9N2H9ClN" crossorigin="anonymous"> skipped 4 lines 15 15 <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js" integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4=" crossorigin="anonymous"></script> 16 16 <script src="https://cdnjs.cloudflare.com/ajax/libs/qtip2/2.2.1/jquery.qtip.js" integrity="sha384-6pAYkjo39N26cI9QEzy7zTD9xr9XzSnaWywG02LeFyoJnBEyYvWvqomLU+uGAlaw" crossorigin="anonymous"></script> 17 17 <script src="https://cdn.jsdelivr.net/gh/gitbrent/[email protected] /js/bootstrap4-toggle.min.js" integrity="sha384-Q9RsZ4GMzjlu4FFkJw4No9Hvvm958HqHmXI9nqo5Np2dA/uOVBvKVxAvlBQrDhk4" crossorigin="anonymous"></script> 18 - <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.15.0/umd/popper.min.js" integrity="sha384-L2pyEeut/H3mtgCBaUNw7KWzp5n9+4pDQiExs933/5QfaTh8YStYFFkOzSoXjlTb" crossorigin="anonymous"></script> 19 - <script src="https://stackpath .bootstrapcdn .com /bootstrap /4 . 5.0/js/bootstrap.min.js" integrity="sha384-OgVRvuATP1z7JjHLkuOU7Xw704 + h835Lr +6QL9UvYjZE3Ipu6Tp75j7Bh / kR0JKI " crossorigin="anonymous"></script> 20 - <script src="https://cdn.jsdelivr.net/npm/cytoscape@3.17 .1 /dist/cytoscape.min.js" integrity="sha384-Yb1Z72xvvDj90lZyt11T289pCDIO1IkHKVtYsiqJ + UHg0RBcYrjEwyuN6CANr + P + " crossorigin="anonymous"></script> 18 + <script src="https://cdn.jsdelivr.net/npm/@popperjs/[email protected] /dist/umd/popper.min.js" integrity="sha384-IQsoLXl5PILFhosVNubq5LC7Qb9DXgDA9i+tQ8Zj3iwWAwPtgFTxbJ8NT4GN1R8p" crossorigin="anonymous"></script> 19 + <script src="https://cdn .jsdelivr .net /npm /bootstrap @ 5.0. 1 / dist /js/bootstrap.min.js" integrity="sha384-Atwg2Pkwv9vp0ygtn1JAojH0nYbwNJLPhwyoVbhoPwBhjQPR5VtM2 +xf0Uwh9KtT " crossorigin="anonymous"></script> 20 + <script src="https://cdn.jsdelivr.net/npm/cytoscape@3.19 .0 /dist/cytoscape.min.js" integrity="sha384-PrL5I4ZOM0AxHqZI8Mnw6Bf6d5DkQXlneKuzQ99QeR58lFMAZBmCI7C4Wn3rjEe7 " crossorigin="anonymous"></script> 21 21 <script src="https://cdn.jsdelivr.net/npm/[email protected] /cytoscape-qtip.min.js" integrity="sha384-jJ6MCpnkaa5gDX4/qEUeKZ6SOfPAa+hfjLifoOrfDehIF0VTqdPA6sqrkWRYJIGi" crossorigin="anonymous"></script> 22 22 <script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.22.2/moment.min.js" integrity="sha384-sIzeKWIAHvT0Vm8QbfLCqZwBG0WMCkWVAOYd/330YSNeeQ1Y57N3T9lQz5Ry/EHH" crossorigin="anonymous"></script> 23 23 <script src="https://cdnjs.cloudflare.com/ajax/libs/tempusdominus-bootstrap-4/5.0.1/js/tempusdominus-bootstrap-4.min.js" integrity="sha384-hzexvprs0k2Q/IHSJOfegsjdg6kTcTTVxQdgHiB4+I/915hcvse9v42LLVVM5K4e" crossorigin="anonymous"></script> 24 24 <script src="https://cdn.jsdelivr.net/npm/[email protected] /desvg.min.js" integrity="sha384-J1rV4940pYhBtFhx6SqDEMJP35rgSVSVx+44+TPf67jyXL8dsBtYMZeBCNLf/2zk" crossorigin="anonymous"></script> 25 25 <!-- Neo4j JavaScript Driver --> 26 - <script src="https://cdn.jsdelivr.net/npm/[email protected] .1 /lib/browser/neo4j-web.min.js" integrity="sha384-r0SOtzrxnyTN0w02zPv1PxxkQYtJzqmeE936zA0aiNJ6DVAiFFip1dpAYSFqfO5s " crossorigin="anonymous"></script> 26 + <script src="https://cdn.jsdelivr.net/npm/[email protected] .3 /lib/browser/neo4j-web.min.js" integrity="sha384-1D5NgvaN05AW2uC9b49MURqg8 / grsmT + Rmq97UTE8 + hnwhArsP2FPrtkz71Ga3Gu " crossorigin="anonymous"></script> 27 27 <script src="static/js/script.js"></script> 28 28 </head> 29 29 30 30 <body> 31 31 <nav class="navbar navbar-expand-lg navbar-light bg-light p-1 shadow"> 32 - <a class="navbar-brand" href="#"><img class="my_svg" src="static/images/logo_top.svg" alt="top" width="190"></a> 33 - <div class="collapse navbar-collapse"> 34 - <form class="navbar-nav" role="search"> 35 - <div class = " form - group mt - 3 " id="itemForm"> 36 - <div class="form-inline"> 37 - <label class="sr-only" for="InputSelect">select</label> 38 - <select class="custom -select" id="InputSelect"> 39 - <option>Username</option> 40 - <option>Hostname</option> 41 - <option>IPAddress</option> 32 + <a class="navbar-brand" href="#"><img class="my_svg" src="static/images/logo_top.svg" alt="top" width="190"></a> 33 + <div class="collapse navbar-collapse"> 34 + <form class="navbar-nav" role="search"> 35 + <div id="itemForm"> 36 + <div class="row mt-2" style="--bs-gutter-x: 0.5rem;"> 37 + <div class="col-auto"> 38 + <select class="form -select" id="InputSelect"> 39 + <option value = " Username " >Username</option> 40 + <option value = " Hostname " >Hostname</option> 41 + <option value = " IPAddress " >IPAddress</option> 42 42 </select> 43 - <input class="form-control my-2 my-lg-0 ml-1" type="text" value="administrator" id="query-input"> 44 43 </div> 45 - </div> 46 - <input type="button" class="btn btn-primary ml-1 mt-3 h-25" value="+" onclick="ItemField.add();" /> 47 - <input type="button" class="btn btn-primary ml-1 mt-3 h-25" value="-" onclick="ItemField.del();" /> 48 - <input type="button" class="btn btn-secondary ml-1 mt-3 h-25" data-toggle="modal" value="Filter" data-target="#Filters"> 49 - <button type="button" class="btn btn-outline-primary ml-1 mt-3 h-25" data-toggle="tooltip" data-placement="bottom" data-original-title="Username/IPAddress/Hostname search" onclick="createQuery()">search</button> 50 - <button type="button" class="btn btn-outline-primary ml-1 mt-3 h-25" data-toggle="tooltip" data-placement="bottom" data-original-title="Search for how exploit the administrator account from the account. (only one Username)" onclick="searchPath()">search path</button> 51 - <div class="btn-group ml-1 mt-3 h-25"> 52 - <button class="btn btn-outline-secondary" type="button">Export</button> 53 - <button class="btn btn-outline-secondary dropdown-toggle dropdown-toggle-split" type="button" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> 54 - <span class="sr-only"></span> 55 - </button> 56 - <div class="dropdown-menu" aria-labelledby="navbarDropdown"> 57 - <a class="dropdown-item" onclick="exportCSV()" href="#">CSV</a> 58 - <a class="dropdown-item" download="image.json" id="export-json" onclick="exportJSON()" href="#">JSON</a> 59 - <a class="dropdown-item" download="image.png" id="export-png" onclick="exportPNG()" href="#">PNG</a> 60 - <a class="dropdown-item" download="image.jpeg" id="export-jpeg" onclick="exportJPEG()" href="#">JPEG</a> 44 + <div class="col-auto"> 45 + <input class="form-control" type="text" value="administrator" id="query-input"> 61 46 </div> 62 47 </div> 63 - <div class="custom-control custom-switch ml-4 mt-4"> 64 - <input type="checkbox" class="custom-control-input" id="darkSwitch"> 65 - <label class="custom-control-label" for="darkSwitch">Dark Mode</label> 48 + </div> 49 + <input type="button" class="btn btn-primary ms-1 mt-2 h-25" value="+" onclick="ItemField.add();" /> 50 + <input type="button" class="btn btn-primary ms-1 mt-2 h-25" value="-" onclick="ItemField.del();" /> 51 + <input type="button" class="btn btn-secondary ms-1 mt-2 h-25" data-bs-toggle="modal" value="Filter" data-bs-target="#Filters"> 52 + <button type="button" class="btn btn-outline-primary ms-1 mt-2 h-25" data-bs-toggle="tooltip" data-bs-placement="bottom" title="Username/IPAddress/Hostname search" onclick="createQuery()">search</button> 53 + <button type="button" class="btn btn-outline-primary ms-1 mt-2 h-25" data-bs-toggle="tooltip" data-bs-placement="bottom" title="Search for how exploit the administrator account from the account. (only one Username)" onclick="searchPath()">search 54 + path</button> 55 + <div class="btn-group ms-1 mt-2 h-25"> 56 + <button class="btn btn-outline-secondary" type="button">Export</button> 57 + <button class="btn btn-outline-secondary dropdown-toggle dropdown-toggle-split" type="button" id="navbarDropdown" role="button" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> 58 + <span class="sr-only"></span> 59 + </button> 60 + <div class="dropdown-menu" aria-labelledby="navbarDropdown"> 61 + <a class="dropdown-item" onclick="exportCSV()" href="#">CSV</a> 62 + <a class="dropdown-item" download="image.json" id="export-json" onclick="exportJSON()" href="#">JSON</a> 63 + <a class="dropdown-item" download="image.png" id="export-png" onclick="exportPNG()" href="#">PNG</a> 64 + <a class="dropdown-item" download="image.jpeg" id="export-jpeg" onclick="exportJPEG()" href="#">JPEG</a> 66 65 </div> 66 + </div> 67 + <div class="form-check form-switch ms-4 mt-3"> 68 + <input class="form-check-input" type="checkbox" id="darkSwitch"> 69 + <label class="form-check-label" for="darkSwitch">Dark Mode</label> 70 + </div> 67 71 68 - <script src="static/js/dark-mode-switch.min.js"></script> 69 - </form> 70 - </div> 72 + <script src="static/js/dark-mode-switch.min.js"></script> 73 + </form> 74 + </div> 71 75 </nav> 72 76 73 77 <div class="container-fluid"> 74 78 <div class="row"> 75 79 <div class="col-sm-2 col-md-2 sidebar"> 76 80 <div class="list-group mt-3"> 77 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing all users and hosts." onclick="createAllQuery()">All Users</button> 78 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing users with system privileges." onclick="createSystemQuery()">SYSTEM Privileges</button> 79 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing remote logon users and hosts using NTLM authentication. If not using NTLM authentication, it may be pass-the-hash." onclick="createNTLMQuery()">NTLM Remote Logon</button> 80 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing RDP logon users and hosts (Logon type: 10)." onclick="createRDPQuery()">RDP Logon</button> 81 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing logon users and hosts from remote network (Logon type: 3)." onclick="createNetQuery()">Network Logon</button> 82 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing batch server logon (Logon type: 4)." onclick="createBatchQuery()">Batch Logon</button> 83 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing Services Control Manager logon (Logon type: 5)." onclick="createServiceQuery()">Service Logon</button> 84 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing the error log that the ms14-068 exploit failed." onclick="create14068Query()">MS14-068 Exploit Failure</button> 85 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing failed logon." onclick="createFailQuery()">Logon Failure</button> 86 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing DCSync and DCShadow log." onclick="dcsQuery()">Detect DCSync/DCShadow</button> 87 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing deleted or added users." onclick="adddelUsersQuery()">Add/Delete Users</button> 88 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing all domain names. If an attacker is intrude into a network, there may be a malicious domain name." onclick="createDomainQuery()">Domain Check</button> 89 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Visualizing changed audit policy." onclick="policyQuery()">Audit Policy Change</button> 90 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="modal" data-target="#Diff">Diff Graph</button> 91 - <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-toggle="tooltip" data-placement="bottom" data - original - title="Displays hourly event log counts in time series." onclick="window.open('timeline')">Create Timeline</button> 81 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing all users and hosts." onclick="createAllQuery()">All Users</button> 82 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing users with system privileges." onclick="createSystemQuery()">SYSTEM Privileges</button> 83 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing remote logon users and hosts using NTLM authentication. If not using NTLM authentication, it may be pass-the-hash." onclick="createNTLMQuery()">NTLM Remote Logon</button> 84 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing RDP logon users and hosts (Logon type: 10)." onclick="createRDPQuery()">RDP Logon</button> 85 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing logon users and hosts from remote network (Logon type: 3)." onclick="createNetQuery()">Network Logon</button> 86 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing batch server logon (Logon type: 4)." onclick="createBatchQuery()">Batch Logon</button> 87 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing Services Control Manager logon (Logon type: 5)." onclick="createServiceQuery()">Service Logon</button> 88 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing the error log that the ms14-068 exploit failed." onclick="create14068Query()">MS14-068 Exploit Failure</button> 89 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing failed logon." onclick="createFailQuery()">Logon Failure</button> 90 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing DCSync and DCShadow log." onclick="dcsQuery()">Detect DCSync/DCShadow</button> 91 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing deleted or added users." onclick="adddelUsersQuery()">Add/Delete Users</button> 92 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing all domain names. If an attacker is intrude into a network, there may be a malicious domain name." onclick="createDomainQuery()">Domain Check</button> 93 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Visualizing changed audit policy." onclick="policyQuery()">Audit Policy Change</button> 94 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="modal" data- bs -target="#Diff">Diff Graph</button> 95 + <button type="button" class="list-group-item list-group-item-action list-group-item-light" data-bs - toggle="tooltip" data- bs -placement="bottom" title="Displays hourly event log counts in time series." onclick="window.open('timeline')">Create Timeline</button> 92 96 </div> 93 97 <hr> 94 - <a data-toggle="tooltip" data-placement="bottom" data - original - title="Add value to edges of visualization graph.">Add event value</a><br> 95 - <div class="btn-group btn - group - toggle " data - toggle ="buttons "> 96 - <label class="btn btn-outline-secondary"> 97 - <input type="checkbox" name="options" id="label-count" autocomplete="off">Count</label> 98 - <label class="btn btn-outline-secondary"> 99 - <input type="checkbox" name="options" id="label-type" autocomplete="off">Type</label> 100 - <label class="btn btn-outline-secondary"> 101 - <input type="checkbox" name="options" id="label-authname" autocomplete="off">Auth</label> 98 + <a data-bs - toggle="tooltip" data- bs -placement="bottom" title="Add value to edges of visualization graph.">Add event value</a><br> 99 + <div class="btn-group" role ="group "> 100 + <input type="checkbox" class="btn-check" id="label-count" autocomplete="off"> 101 + <label class="btn btn-outline-secondary" for="label-count">Count</label> 102 + <input type="checkbox" class="btn-check" id="label-type" autocomplete="off"> 103 + <label class="btn btn-outline-secondary" for="label-type">Type</label> 104 + <input type="checkbox" class="btn-check" id="label-authname" autocomplete="off"> 105 + <label class="btn btn-outline-secondary" for="label-authname">Auth</label> 102 106 </div> 103 107 <hr> 104 - <a data-toggle="tooltip" data-placement="bottom" data - original - title="Select visualization graph mode.">Graph mode</a><br> 105 - <div class="btn-group btn - group - toggle " data - toggle ="buttons "> 106 - <label class="btn btn-outline-secondary active"> 107 - <input type="radio" id="modeGrid" name="graphmode" checked="checked">grid</label> 108 - <label class="btn btn-outline-secondary"> 109 - <input type="radio" id="modeCose" name="graphmode">cose</label> 110 - <label class="btn btn-outline-secondary"> 111 - <input type="radio" id="modeCircle" name="graphmode">circle</label> 112 - <label class="btn btn-outline-secondary"> 113 - <input type="radio" id="modeTree" name="graphmode">tree</label> 108 + <a data-bs - toggle="tooltip" data- bs -placement="bottom" title="Select visualization graph mode.">Graph mode</a><br> 109 + <div class="btn-group" role ="group "> 110 + <input type="radio" class="btn-check" id="modeGrid" name="btnradio" autocomplete="off" checked="checked"> 111 + <label class="btn btn-outline-secondary" for="modeGrid">grid</label> 112 + <input type="radio" class="btn-check" id="modeCose" name="btnradio" autocomplete="off"> 113 + <label class="btn btn-outline-secondary" for="modeCose">cose</label> 114 + <input type="radio" class="btn-check" id="modeCircle" name="btnradio" autocomplete="off"> 115 + <label class="btn btn-outline-secondary" for="modeCircle">circle</label> 116 + <input type="radio" class="btn-check" id="modeTree" name="btnradio" autocomplete="off"> 117 + <label class="btn btn-outline-secondary" for="modeTree">tree</label> 114 118 </div> 115 119 <hr> 116 - <a data-toggle="tooltip" data-placement="bottom" data - original - title="Enable visualization of malicious account ranking.">Rank visualize mode</a><br> 120 + <a data-bs - toggle="tooltip" data- bs -placement="bottom" title="Enable visualization of malicious account ranking.">Rank visualize mode</a><br> 117 121 <input type="checkbox" data-toggle="toggle" data-on="Enabled" data-onstyle="secondary" data-height="35" data-off="Disabled" data-offstyle="outline-secondary" id="rankMode"> 118 122 <hr> 119 - <a data-toggle="tooltip" data-placement="bottom" data - original - title="Import event logs in EVTX or XML format.">Upload</a><br> 120 - <button class="btn btn-secondary" data-toggle="modal" data-target="#UploadEVTX">Upload Event Log</button> 123 + <a data-bs - toggle="tooltip" data- bs -placement="bottom" title="Import event logs in EVTX or XML format.">Upload</a><br> 124 + <button class="btn btn-secondary" data-bs - toggle="modal" data- bs -target="#UploadEVTX">Upload Event Log</button> 121 125 <hr> 122 - <a data-toggle="tooltip" data-placement="bottom" data - original - title="Import event logs from Elasticsearch.">Elasticsearch</a><br> 123 - <button class="btn btn-secondary" data-toggle="modal" data-target="#Elasticsearch">Load from <img src="static/images/elastic-logo.png" width="24"></button> 126 + <a data-bs - toggle="tooltip" data- bs -placement="bottom" title="Import event logs from Elasticsearch.">Elasticsearch</a><br> 127 + <button class="btn btn-secondary" data-bs - toggle="modal" data- bs -target="#Elasticsearch">Load from <img src="static/images/elastic-logo.png" width="24"></button> 124 128 <hr> 125 129 </div> 126 130 <div class="col-sm-8 col-md-8 main"> skipped 7 lines 134 138 <div class="container" id="rankUser"></div> 135 139 <ul class="pagination justify-content-center"> 136 140 <li><a class="btn page-link rounded-pill" onclick="pruserBack()">Back</a></li> 137 - <li><a class="btn page-link rounded-pill ml -2" onclick="pruserNext()">Next</a></li> 141 + <li><a class="btn page-link rounded-pill ms -2" onclick="pruserNext()">Next</a></li> 138 142 </ul> 139 143 <div class="container" id="rankHost"></div> 140 144 <ul class="pagination justify-content-center"> 141 145 <li><a class="btn page-link rounded-pill" onclick="prhostBack()">Back</a></li> 142 - <li><a class="btn page-link rounded-pill ml -2" onclick="prhostNext()">Next</a></li> 146 + <li><a class="btn page-link rounded-pill ms -2" onclick="prhostNext()">Next</a></li> 143 147 </ul> 144 148 </div> 145 149 </div> skipped 4 lines 150 154 <div class="modal-content"> 151 155 <div class="modal-header"> 152 156 <h4 class="modal-title">Upload Event Log File</h4> 153 - <button type="button" class="close" data-dismiss="modal"> < i class ="fas fa - times "> < / i ></button> 157 + <button type="button" class="btn - close" data-bs - dismiss="modal" aria - label ="Close "></button> 154 158 </div> 155 159 <div class="modal-body"> 156 160 <p>Import the event log. Supported file format is EVTX or XML (exported Event Viewer or PowerShell).</p> 157 - <div class="form - inline "> 158 - <div class="w -auto " id="zoneTime"></div> 159 - <div class="w - auto ml -2"> 160 - <select class="custom -select" id="logType"> 161 - <option>EVTX</option> 162 - <option>XML</option> 163 - </select> 164 - </div> 165 - <div class="input - group w -75 ml - 2 "> 166 - <input multiple id="lefile" type="file" style="display:none"> 167 - <input type="text" id="evtx_name" class="form-control" placeholder="select file (multi files) ..."> 168 - <span class="input-group-btn"><button type="button" class="btn btn-info" onclick="$('input[id=lefile]').click();">Browse</button></span> 169 - </div> 161 + <div class="row "> 162 + <div class="col -2 " id="zoneTime"></div> 163 + <div class="col -2"> 164 + <select class="form -select" id="logType"> 165 + <option>EVTX</option> 166 + <option>XML</option> 167 + </select> 168 + </div> 169 + <div class="col -8 "> 170 + <div class="input-group"> 171 + <input multiple id="lefile" type="file" style="display:none"> 172 + <input type="text" id="evtx_name" class="form-control" placeholder="select file (multi files) ..."> 173 + <span class="input-group-btn"><button type="button" class="btn btn-info" onclick="$('input[id=lefile]').click();">Browse</button></span> 174 + </div> 175 + </div> 170 176 </div> 171 - <div class="custom-control custom-checkbox mt-3"> 172 - <label data-toggle="tooltip" data-placement="bottom" data-original-title="If you want to add more logs, please enable the checkbox."> 173 - <input type="checkbox" class="custom-control-input" id="add_log"> 174 - <label class="custom-control-label" for="add_log">Add additional EVTX or XML files</label> 177 + <div class="form-check mt-3"> 178 + <input class="form-check-input" type="checkbox" value="" id="add_log"> 179 + <label class="form-check-label" for="add_log" data-bs-toggle="tooltip" data-bs-placement="bottom" title="If you want to add more logs, please enable the checkbox."> 180 + Add additional EVTX or XML files 175 181 </label> 176 182 </div> 177 183 <div id="uploadBar"></div> skipped 1 lines 179 185 </div> 180 186 <div class="modal-footer"> 181 187 <button type="submit" class="btn btn-primary" onclick="file_upload()">Upload</button> 182 - <button type="button" class="btn btn-secondary" data-dismiss="modal">Close</button> 188 + <button type="button" class="btn btn-secondary" data-bs - dismiss="modal">Close</button> 183 189 <a href="log" target="_blank"><button type="button" class="btn btn-secondary">Log</button></a> 184 190 </div> 185 191 </div> skipped 1 lines 187 193 </div> 188 194 <!-- Elasticsearch --> 189 195 <div class="modal fade" id="Elasticsearch" tabindex="-1"> 190 - <div class="modal-dialog"> 196 + <div class="modal-dialog modal - lg "> 191 197 <div class="modal-content"> 192 198 <div class="modal-header"> 193 199 <h4 class="modal-title">Load Event Log from Elasticsearch</h4> 194 - <button type="button" class="close" data-dismiss="modal"> < i class ="fas fa - times "> < / i ></button> 200 + <button type="button" class="btn - close" data-bs - dismiss="modal" aria - label ="Close "></button> 195 201 </div> 196 202 <div class="modal-body"> 197 203 <div class="container-fluid"> 204 + <h4 class="col-md-3">Date</h4> 198 205 <div class="row"> 199 - <h4 class="col-md-3">Date<h4> 200 - <div class="form-group"> 201 - <div class="input-group fromdatetime" id="datetimepicker5" data-target-input="nearest"> 202 - <input type="text" placeholder="From" id="from-date-time" class="form-control datetimepicker-input" data-target="#datetimepicker5"/> 203 - <div class="input-group-append" data-target="#datetimepicker5" data-toggle="datetimepicker"> 204 - <div class="input-group-text"><i class="far fa-calendar-alt"></i></div> 205 - </div> 206 - </div> 207 - </div> 208 - <div class="form-group"> 209 - <div class="input-group todatetime" id="datetimepicker6" data-target-input="nearest"> 210 - <input type="text" placeholder="To" id="to-date-time" class="form-control datetimepicker-input" data-target="#datetimepicker6"/> 211 - <div class="input-group-append" data-target="#datetimepicker6" data-toggle="datetimepicker"> 212 - <div class="input-group-text"><i class="far fa-calendar-alt"></i></div> 213 - </div> 214 - </div> 206 + <div class="form-group col-auto"> 207 + <div class="input-group fromdatetime" id="datetimepicker5" data-target-input="nearest"> 208 + <input type="text" placeholder="From" id="from-date-time" class="form-control datetimepicker-input" data-target="#datetimepicker5" /> 209 + <div class="input-group-text" data-target="#datetimepicker5" data-toggle="datetimepicker"><i class="far fa-calendar-alt"></i></div> 215 210 </div> 216 211 </div> 217 - <div class="row "> 218 - <div class="custom-control custom-checkbox custom-control-inline"> 219 - <label data-toggle="tooltip" data-placement="bottom" data-original-title="If you want to add more logs, please enable the checkbox."> 220 - <input type="checkbox" id="add_logES" class="custom-control-input"> 221 - <label class="custom-control-label" for="add_logES">Add additional event log from Elasticsearch</label> 222 - </label> 223 - </div> 212 + <div class="col - auto mt - 2 "> 213 + <h5>to</h5> 224 214 </div> 225 - <div class="row "> 226 - <div class="custom-control custom-checkbox custom-control-inline"> 227 - <label data-toggle="tooltip" data-placement="bottom" data-original-title="If you want to add results analyzed by LononTracer, please enable the checkbox."> 228 - <input type="checkbox" id="add_es" class="custom-control-input"> 229 - <label class="custom-control-label" for="add_es">Add results analyzed by LononTracer to Elasticsearch</label> 230 - </label> 215 + <div class="form - group col - auto "> 216 + <div class="input-group todatetime" id="datetimepicker6" data-target-input="nearest"> 217 + <input type="text" placeholder="To" id="to-date-time" class="form-control datetimepicker-input" data-target="#datetimepicker6" /> 218 + <div class="input-group-text" data-target="#datetimepicker6" data-toggle="datetimepicker"><i class="far fa-calendar-alt"></i></div> 231 219 </div> 232 220 </div> 233 - <hr> 234 - <div class="row "> 235 - <h4 class="col-md-3">Zone<h4> 236 - <div id="zoneTimeES"></div> 237 - </div> 238 - <hr> 239 - <div class="row"> 240 - <h4 class="col-md-3">Server<h4> 241 - <div class="form-group"> 242 - <input class="form-control" type="text" value="localhost:9200" id="es-ip-input" data-toggle="tooltip" data-placement="bottom" data-original-title="Set the Elasticsearch server IP address."> 243 - </div> 221 + </div> 222 + <div class="form - check mt - 3 "> 223 + <input class="form-check-input" type="checkbox" value="" id="add_logES"> 224 + <label class="form-check-label" for="add_logES" data-bs-toggle="tooltip" data-bs-placement="bottom" title="If you want to add more logs, please enable the checkbox."> 225 + Add additional event log from Elasticsearch 226 + </label> 227 + </div> 228 + <div class="form-check mt-3"> 229 + <input class="form-check-input" type="checkbox" value="" id="add_es"> 230 + <label class="form-check-label" for="add_es" data-bs-toggle="tooltip" data-bs-placement="bottom" title="If you want to add results analyzed by LononTracer, please enable the checkbox."> 231 + Add results analyzed by LononTracer to Elasticsearch 232 + </label> 233 + </div> 234 + <hr> 235 + <h4>Zone</h4> 236 + <div class="row"> 237 + <div id="zoneTimeES"></div> 238 + </div> 239 + <hr> 240 + <h4>Server</h4> 241 + <div class="row"> 242 + <div class="col-auto"> 243 + <input class="form-control" type="text" value="localhost:9200" id="es-ip-input" data-bs-toggle="tooltip" data-bs-placement="bottom" title="Set the Elasticsearch server IP address."> 244 244 </div> 245 245 </div> 246 + </div> 246 247 <div id="uploadBarES"></div> 247 248 <div id="statusES"></div> 248 249 </div> 249 250 <div class="modal-footer"> 250 251 <button type="submit" class="btn btn-primary" onclick="load_eventlog()">Load</button> 251 - <button type="button" class="btn btn-secondary" data-dismiss="modal">Close</button> 252 + <button type="button" class="btn btn-secondary" data-bs - dismiss="modal">Close</button> 252 253 <a href="log" target="_blank"><button type="button" class="btn btn-secondary">Log</button></a> 253 254 </div> 254 255 </div> skipped 5 lines 260 261 <div class="modal-content"> 261 262 <div class="modal-header"> 262 263 <h4 class="modal-title">Event Log Filter</h4> 263 - <button type="button" class="close" data-dismiss="modal"> < i class ="fas fa - times "> < / i ></button> 264 + <button type="button" class="btn - close" data-bs - dismiss="modal" aria - label ="Close "></button> 264 265 </div> 265 266 <div class="modal-body"> 266 267 <p>Filter event log by date, count and event id.</p> 267 268 <div class="container-fluid"> 268 - <div class="row"> 269 - <h4 class="col-md-3">Date<h4> 270 - <div class="form-group"> 271 - <div class="input-group fromdate" id="datetimepicker1" data-target-input="nearest"> 272 - <input type="text" placeholder="From" id="from-date" class="form-control datetimepicker-input" data-target="#datetimepicker1"/> 273 - <div class="input-group-append " data-target="#datetimepicker1" data-toggle="datetimepicker"> 274 - <div class="input-group-text"><i class="far fa-calendar-alt"></i></div> 269 + <h4>Date<h4> 270 + <div class="row"> 271 + <div class="form-group col - auto "> 272 + <div class="input-group fromdate" id="datetimepicker1" data-target-input="nearest"> 273 + <input type="text" placeholder="From" id="from-date" class="form-control datetimepicker-input" data-target="#datetimepicker1" /> 274 + <div class="input-group-text " data-target="#datetimepicker1" data-toggle="datetimepicker">< i class = " far fa - calendar - alt " > < / i > < / div > 275 275 </div> 276 276 </div> 277 - </div> 278 - <div class="form-group"> 279 - <div class="input-group todate" id="datetimepicker2" data-target-input="nearest"> 280 - <input type="text" placeholder="To" id="to-date" class="form-control datetimepicker-input" data-target="#datetimepicker2"/> 281 - <div class="input-group- append " data - target ="# datetimepicker2" data-toggle ="datetimepicker "> 282 - <div class="input-group-text"><i class="far fa-calendar-alt"></i></div> 277 + <div class="col-auto mt-2"> 278 + <h5>to</h5> 279 + </div> 280 + <div class="form-group col-auto"> 281 + <div class="input-group todate " id ="datetimepicker2" data-target - input ="nearest "> 282 + <input type="text" placeholder="To" id="to-date" class="form-control datetimepicker-input" data-target="#datetimepicker2" /> 283 + <div class="input-group-text" data-target="#datetimepicker2" data-toggle="datetimepicker"><i class="far fa-calendar-alt"></i></div> 283 284 </div> 284 285 </div> 285 286 </div> 286 - </div> 287 - <hr> 288 - <div class="row"> 289 - <h4 class="col-md-3">Event ID</h4> 290 - <div class="custom-control custom-checkbox custom-control-inline"> 291 - <label data-toggle="tooltip" data-placement="bottom" data-original-title="Successful logon"> 292 - <input type="checkbox" id="id4624" class="custom-control-input" checked="checked"> 293 - <label class="custom-control-label" for="id4624">4624</label> 287 + <hr> 288 + <h4>Event ID</h4> 289 + <div class="form-check form-check-inline"> 290 + <label data-bs-toggle="tooltip" data-bs-placement="bottom" title="Successful logon"> 291 + <input type="checkbox" id="id4624" class="form-check-input" checked="checked"> 292 + <label class="form-check-label" for="id4624">4624</label> 294 293 </label> 295 294 </div> 296 - <div class="custom-control custom-checkbox custom-control-inline"> 297 - <label data-toggle="tooltip" data-placement="bottom" data - original - title="Logon failure"> 298 - <input type="checkbox" id="id4625" class="custom -control -input" checked="checked"> 299 - <label class="custom -control -label" for="id4625">4625</label> 295 + <div class="form-check form-check-inline"> 296 + <label data-bs - toggle="tooltip" data- bs -placement="bottom" title="Logon failure"> 297 + <input type="checkbox" id="id4625" class="form -check -input" checked="checked"> 298 + <label class="form -check -label" for="id4625">4625</label> 300 299 </label> 301 300 </div> 302 - <div class="custom-control custom-checkbox custom-control-inline"> 303 - <label data-toggle="tooltip" data-placement="bottom" data - original - title="Kerberos Authentication (TGT Request)"> 304 - <input type="checkbox" id="id4768" class="custom -control -input" checked="checked"> 305 - <label class="custom -control -label" for="id4768">4768</label> 301 + <div class="form-check form-check-inline"> 302 + <label data-bs - toggle="tooltip" data- bs -placement="bottom" title="Kerberos Authentication (TGT Request)"> 303 + <input type="checkbox" id="id4768" class="form -check -input" checked="checked"> 304 + <label class="form -check -label" for="id4768">4768</label> 306 305 </label> 307 306 </div> 308 - <div class="custom-control custom-checkbox custom-control-inline"> 309 - <label data-toggle="tooltip" data-placement="bottom" data - original - title="Kerberos Service Ticket (ST Request)"> 310 - <input type="checkbox" id="id4769" class="custom -control -input" checked="checked"> 311 - <label class="custom -control -label" for="id4769">4769</label> 307 + <div class="form-check form-check-inline"> 308 + <label data-bs - toggle="tooltip" data- bs -placement="bottom" title="Kerberos Service Ticket (ST Request)"> 309 + <input type="checkbox" id="id4769" class="form -check -input" checked="checked"> 310 + <label class="form -check -label" for="id4769">4769</label> 312 311 </label> 313 312 </div> 314 - <div class="custom-control custom-checkbox custom-control-inline"> 315 - <label data-toggle="tooltip" data-placement="bottom" data - original - title="NTLM Authentication"> 316 - <input type="checkbox" id="id4776" class="custom -control -input" checked="checked"> 317 - <label class="custom -control -label" for="id4776">4776</label> 313 + <div class="form-check form-check-inline"> 314 + <label data-bs - toggle="tooltip" data- bs -placement="bottom" title="NTLM Authentication"> 315 + <input type="checkbox" id="id4776" class="form -check -input" checked="checked"> 316 + <label class="form -check -label" for="id4776">4776</label> 318 317 </label> 319 318 </div> 320 - </div> 321 - <hr> 322 - <div class="row "> 323 - <h4 class = " col - md - 3 " >Count<h4> 324 - <div class="form-group"> 325 - <input class="form-control" type="text" value=0 id="count-input" data-toggle="tooltip" data-placement="bottom" data-original-title="Set the lower limit of Event ID to visualize."> 319 + <hr> 320 + <div class="row g-3 align-items-center"> 321 + <div class="col - auto "> 322 + <h4>Count<h4> 323 + </div> 324 + <div class="col-auto"> 325 + <input class="form-control" type="text" value=0 id="count-input" data-bs-toggle="tooltip" data-bs-placement="bottom" title="Set the lower limit of Event ID to visualize."> 326 + </div> 326 327 </div> 327 - </div> 328 - </div> 329 - </div> 330 - <div class="modal-footer"> 331 - <button type="button" class="btn btn-secondary" data-dismiss="modal">Close</button> 332 328 </div> 333 329 </div> 330 + <div class="modal-footer"> 331 + <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button> 332 + </div> 334 333 </div> 335 334 </div> 335 + </div> 336 336 </div> 337 337 <!-- Diff Graph --> 338 338 <div class="modal fade" id="Diff" tabindex="-1"> 339 - <div class="modal-dialog"> 339 + <div class="modal-dialog modal - lg "> 340 340 <div class="modal-content"> 341 341 <div class="modal-header"> 342 342 <h4 class="modal-title">Diff Graph</h4> 343 - <button type="button" class="close" data-dismiss="modal"> < i class ="fas fa - times "> < / i ></button> 343 + <button type="button" class="btn - close" data-bs - dismiss="modal" aria - label ="Close "></button> 344 344 </div> 345 345 <div class="modal-body"> 346 346 <p>Compare two days and view unique events.</p> 347 347 <div class="container-fluid"> 348 348 <div class="row"> 349 - <div class="form-group"> 349 + <div class="form-group col - auto "> 350 350 <div class="input-group fromday" id="datetimepicker3" data-target-input="nearest"> 351 - <input type="text" placeholder="From" id="from-day" class="form-control datetimepicker-input" data-target="#datetimepicker3"/> 352 - <div class="input-group-append " data-target="#datetimepicker3" data-toggle="datetimepicker"> 353 - <div class="input-group-text"><i class="far fa-calendar-alt"></i></div> 354 - </div> 351 + <input type="text" placeholder="From" id="from-day" class="form-control datetimepicker-input" data-target="#datetimepicker3" /> 352 + <div class="input-group-text " data-target="#datetimepicker3" data-toggle="datetimepicker">< i class = " far fa - calendar - alt " > < / i > < / div > 355 353 </div> 356 354 </div> 357 - <div class="form -group "> 355 + <div class="col -auto mt - 2 "> 356 + <h5>and</h5> 357 + </div> 358 + <div class="form-group col-auto"> 358 359 <div class="input-group today" id="datetimepicker4" data-target-input="nearest"> 359 - <input type="text" placeholder="To" id="to-day" class="form-control datetimepicker-input" data-target="#datetimepicker4"/> 360 - <div class="input-group-append " data-target="#datetimepicker4" data-toggle="datetimepicker"> 361 - <div class="input-group-text"><i class="far fa-calendar-alt"></i></div> 362 - </div> 360 + <input type="text" placeholder="To" id="to-day" class="form-control datetimepicker-input" data-target="#datetimepicker4" /> 361 + <div class="input-group-text " data-target="#datetimepicker4" data-toggle="datetimepicker">< i class = " far fa - calendar - alt " > < / i > < / div > 363 362 </div> 364 363 </div> 365 364 </div> 366 365 </div> 367 366 </div> 368 367 <div class="modal-footer"> 369 - <button type="submit" class="btn btn-primary" data-dismiss="modal" onclick="diffQuery()">Compare</button> 370 - <button type="button" class="btn btn-secondary" data-dismiss="modal">Close</button> 368 + <button type="submit" class="btn btn-primary" data-bs - dismiss="modal" onclick="diffQuery()">Compare</button> 369 + <button type="button" class="btn btn-secondary" data-bs - dismiss="modal">Close</button> 371 370 </div> 372 371 </div> 373 372 </div> skipped 9 lines 383 382 <p>Web page loading slow due to large graph. Do you want to continue searching?</p> 384 383 </div> 385 384 <div class="modal-footer"> 386 - <button type="button" class="btn btn-secondary" onclick="contQuery()" data-dismiss="modal">Yes</button> 387 - <button type="button" class="btn btn-primary" data-dismiss="modal">No</button> 385 + <button type="button" class="btn btn-secondary" onclick="contQuery()" data-bs - dismiss="modal">Yes</button> 386 + <button type="button" class="btn btn-primary" data-bs - dismiss="modal">No</button> 388 387 </div> 389 388 </div> 390 389 </div> skipped 20 lines 411 410 var currentNumber = 0; 412 411 var ItemField = { 413 412 currentNumber: 0, 414 - itemTemplate: '<div class="form-inline my-5 my-lg-0"><label class="sr-only" for="InputSelect">select</label>\ 415 - <select class="custom-select" id="InputSelect_count_">\ 416 - <option>Username</option><option>Hostname</option><option>IPAddress</option></select>\ 417 - <input class="form-control my-2 my-lg-0 ml-1" type="text" id="query-input_count_">\ 418 - <label class="sr-only" for="InputSelect">select</label>\ 419 - <select class="custom-select ml-1" id="InputRule_count_">\ 420 - <option>OR</option><option>AND</option></select></div>', 413 + itemTemplate: '<div class="row mt-1" style="--bs-gutter-x: 0.5rem;">\ 414 + <div class="col-auto">\ 415 + <select class="form-select" id="InputSelect_count_">\ 416 + <option value="Username">Username</option>\ 417 + <option value="Hostname">Hostname</option>\ 418 + <option value="IPAddress">IPAddress</option>\ 419 + </select>\ 420 + </div>\ 421 + <div class="col-auto">\ 422 + <input class="form-control" type="text" id="query-input_count_">\ 423 + </div>\ 424 + <div class="col-auto">\ 425 + <select class="form-select" id="InputRule_count_">\ 426 + <option>OR</option>\ 427 + <option>AND</option>\ 428 + </select>\ 429 + </div>', 421 430 add: function() { 422 431 currentNumber++; 423 432 if (currentNumber <= 10) { skipped 15 lines 439 448 } 440 449 } 441 450 442 - var downMenu = '<div class = " col - xs - 2 " > < select class="custom -select" id="utcTime"><option>Time Zone</option>'; 451 + var downMenu = '<select class="form -select" id="utcTime"><option value = " Username " >Time Zone</option>'; 443 452 for (i = +14; i >= -12; i--) { 444 453 downMenu += '<option>' + i + '</option>'; 445 454 } 446 - downMenu += '</select>< / div > '; 455 + downMenu += '</select>'; 447 456 document.getElementById("zoneTime").innerHTML = downMenu; 448 457 449 - var downMenuES = '<div class="col-xs - 2 "><select class="custom -select" id="utcTimeES"><option>Time Zone</option>'; 458 + var downMenuES = '<div class="col-3 "><select class="form -select" id="utcTimeES"><option value = " Username " >Time Zone</option>'; 450 459 for (i = +14; i >= -12; i--) { 451 460 downMenuES += '<option>' + i + '</option>'; 452 461 } skipped 11 lines 464 473 $('#evtx_name').val(inFile.replace("C:\\fakepath\\", "")); 465 474 }); 466 475 467 - $(function () { 468 - $('[data-toggle="tooltip"]').tooltip(); 476 + $(function() { 477 + $('[data-bs - toggle="tooltip"]').tooltip(); 469 478 }) 470 479 471 - $(function(){ 480 + $(function() { 472 481 deSVG('.my_svg', true); 473 482 }); 474 483 </script> skipped 4 lines