zwitschi
9f8ab0f61c
- Implemented a new utility for querying WHOIS information and consolidating IP addresses by subnet. - Added caching mechanism for WHOIS responses to improve performance. - Introduced functions for loading and saving the WHOIS cache, querying subnets, and consolidating IPs based on a threshold. feat: create Flask web UI for intrusion detection system - Developed a Flask web application to manage the intrusion detection system. - Implemented routes for scanning, reports, blocklist management, and firewall configuration. - Added helper functions for reading files and handling requests. feat: define routes for web UI - Registered routes for various web pages and API endpoints in the Flask application. - Implemented functionality for scanning, reporting, blocklist management, and firewall state retrieval. feat: implement background scan runner for web UI - Created a background scan runner to handle scan jobs in a separate thread. - Managed an in-memory job store for tracking scan jobs and their statuses. - Added persistence for scan jobs to maintain state across application restarts. chore: update start script for Flask application - Enhanced the PowerShell start script to check for the existence of the virtual environment. - Added comments and structured the script for better readability and usability.
Data directory for allucanget-ids
This directory contains data files used by the allucanget-ids Intrusion Detection System application, including whitelists, blocklists, and other configuration files. The data files are organized into subdirectories for easier management and maintenance.
Data files
- whois cache: Local cache of WHOIS queries to reduce network requests and improve performance. The cache is automatically updated when new IP addresses are queried.
- Cloudflare IPv4 list: Contains a list of Cloudflare IPv4 addresses from
https://www.cloudflare.com/ips-v4, used for whitelisting traffic from Cloudflare services. - Cloudflare IPv6 list: Contains a list of Cloudflare IPv6 addresses from
https://www.cloudflare.com/ips-v6, used for whitelisting traffic from Cloudflare services. - MikroTik RouterOS IPv4 Firewall rules: Current MikroTik RouterOS IPv4 firewall rules.
- MikroTik RouterOS IPv6 Firewall rules: Current MikroTik RouterOS IPv6 firewall rules.
- MikroTik RouterOS IPv4 address list: Current MikroTik RouterOS IPv4 address list.
- MikroTik RouterOS IPv6 address list: Current MikroTik RouterOS IPv6 address list.
- Openfactory Geofeed: Contains Openfactory IP addresses and associated geolocation data from
https://openfactory.net/geofeed.csv. Used for identifying and whitelisting traffic from known Openfactory sources. - PaloAlto Scanner IP list: List of known PaloAlto scanner IP addresses from
https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity, used for whitelisting traffic from PaloAlto scanners. !NOTE: This list can not be scraped easily (Javascript-based), so it is maintained manually and may be outdated. Please verify the list against the official source if needed.