Skip to content
This repository has been archived by the owner on Oct 20, 2023. It is now read-only.

Commit

Permalink
Landing page (#151)
Browse files Browse the repository at this point in the history
* initial landing setup done

* rename User Guide to UserGuide for convenience

* file name case...

* file name case...

* img width/css update

* use github images for landing

* minor update

* remove env

* astro build update for gh-pages setup

* astro config outdir update

* readme update

* remove userGuide
  • Loading branch information
sharplessHQ authored Jun 20, 2023
1 parent a6fd429 commit d9f8343
Show file tree
Hide file tree
Showing 24 changed files with 4,002 additions and 706 deletions.
3 changes: 3 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -41,3 +41,6 @@ tmp
.moon/cache
.moon/docker
*.tsbuildinfo

# generated types
.astro/
2 changes: 1 addition & 1 deletion .moon/tasks.yml
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ tasks:
format:
command:
- prettier
- '**/*.{ts,tsx,js,jsx,json,yml,yaml}'
- '**/*.{ts,tsx,js,jsx,json,yml,yaml,astro}'
- '!**/*.graphql'
- --write
- --config
Expand Down
113 changes: 76 additions & 37 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,15 @@
# RedEye

Red Team C2 Log Visualization

![RedEye Screenshot](docs/images/RedEye-Hero-Screenshot.png)
<p align="center">
<img alt="RedEye Screenshot" src="https://github.com/cisagov/RedEye/blob/develop/docs/images/RedEye-Hero-Screenshot.png?raw=true" width="100%"/>
</p>

RedEye is an open-source analytic tool developed by [CISA](https://www.cisa.gov/) and [DOE](https://www.energy.gov/)’s [Pacific Northwest National Laboratory](https://www.pnnl.gov/) to assist [Red Teams](https://en.wikipedia.org/wiki/Red_team) with visualizing and reporting command and control activities. This tool allows an operator to assess and display complex data, evaluate mitigation strategies, and enable effective decision making in response to a Red Team assessment. The tool parses logs, such as those from [Cobalt Strike](https://www.cobaltstrike.com/), and presents the data in an easily digestible format. The users can then tag and add comments to activities displayed within the tool. The operators can use the RedEye’s presentation mode to present findings and workflow to stakeholders.

RedEye can assist an operator to efficiently:

- Replay and demonstrate Red Team’s assessment activities as they occurred rather than manually pouring through thousands of lines of log text.
- Display and evaluate complex assessment data to enable effective decision making.
- Gain a clearer understanding of the attack path taken and the hosts compromised during a Red Team assessment or penetration test.
Expand All @@ -14,74 +18,87 @@ Red Team: [![Red Team](https://img.shields.io/endpoint?url=https://cloud.cypress

Blue Team: [![Blue Team](https://img.shields.io/endpoint?url=https://cloud.cypress.io/badge/simple/46ahz3&style=flat&logo=cypress)](https://cloud.cypress.io/projects/46ahz3/runs)

## [User Guide](<docs/User Guide.md>)
Follow along with the [User Guide](<docs/User Guide.md>) to learn about RedEye's feature set.
## [User Guide](docs/UserGuide.md)

Follow along with the [User Guide](docs/UserGuide.md) to learn about RedEye's feature set.

## Quick start
1. **Download** the latest RedEye binaries for your OS[*](#platform-support) from the [Releases](https://github.com/cisagov/RedEye/releases) page.

1. **Download** the latest RedEye binaries for your OS[\*](#platform-support) from the [Releases](https://github.com/cisagov/RedEye/releases) page.
2. **Pick a mode** and **Run the server**
- [ **Red Team mode**](#red-team) enables the full feature set: upload C2 logs, explore data, and create presentations. To start the server in Red Team mode, run the following in a terminal. _You must provide a password to run in RedTeam mode._
```
AUTHENTICATION_PASSWORD=<your_password> ./RedEye --redTeam
```
- [**Blue Team mode**](#blue-team) (default) enables a simplified, read-only UI for reviewing campaigns exported by a Red Team. To start the server in Blue Team mode. Double-click on the 'RedEye' executable or run `./RedEye` from the command line.
- [ **Red Team mode**](#red-team) enables the full feature set: upload C2 logs, explore data, and create presentations. To start the server in Red Team mode, run the following in a terminal. _You must provide a password to run in RedTeam mode._
```
AUTHENTICATION_PASSWORD=<your_password> ./RedEye --redTeam
```
- [**Blue Team mode**](#blue-team) (default) enables a simplified, read-only UI for reviewing campaigns exported by a Red Team. To start the server in Blue Team mode. Double-click on the 'RedEye' executable or run `./RedEye` from the command line.
3. **Use the web app** in a browser at http://127.0.0.1:4000. The RedEye binary runs as a server in a terminal window and will automatically open the web app UI your default browser. You must close the terminal window to quit the RedEye server.
_**MacOS Issue** - When running RedEye for the first time, you may get a "not verified" error. You must go to "System Preferences" > "Security & Privacy" > "General" and click "Open Anyway." More info on the [apple support page](https://support.apple.com/guide/mac-help/open-a-mac-app-from-an-unidentified-developer-mh40616/)._
_**MacOS Issue** - When running RedEye for the first time, you may get a "not verified" error. You must go to "System Preferences" > "Security & Privacy" > "General" and click "Open Anyway." More info on the [Apple support page](https://support.apple.com/guide/mac-help/open-a-mac-app-from-an-unidentified-developer-mh40616/)._
## Red Team & Blue Team Modes
RedEye has two modes that cover two stages of the Red Teaming process. [Red Team mode](#red-team) allows importing C2 data, editing imported data, and making comments and presentations. After curating and annotating campaign data, Red Teams can export their campaign as a standalone `.redeye` file and [hand it off to a Blue Team](#blue-team-presentation-handoff) for reporting and remediation. [Blue Team mode](#blue-team) runs RedEye in a simplified read-only mode for viewing curated data exported by a Red Team.
_Note: Both Red and Blue Team modes can be started from the same RedEye application binary._
### Red Team
The downloaded binary comes in two parts:
- The `RedEye` application binary
- The `parsers` folder containing the `cs-parser` Cobalt Strike log parser binary
There are three options to run RedEye in Red Team mode:
1. Run the downloaded binary, passing in the `--redTeam` and password options:
```
AUTHENTICATION_PASSWORD=<your_password> ./RedEye --redTeam
```
```
AUTHENTICATION_PASSWORD=<your_password> ./RedEye --redTeam
```
2. Clone, install, and run the project directly (covered in the [Local Build](#local-build) section).
3. Docker Compose
1. Clone the repo
2. Update the environment variables in `docker-compose.yml`.
3. Run:
```
docker-compose -f docker-compose.yml up -d redeye-core
```
1. Clone the repo
2. Update the environment variables in `docker-compose.yml`.
3. Run:
```
docker-compose -f docker-compose.yml up -d redeye-core
```
### Blue Team
The Blue Team mode is a simplified, read-only UI for displaying data that has been curated, annotated, and exported by a Red Team. This mode runs by default to make startup more simple for the Blue Team.
The Blue Team version can be run by double-clicking the 'RedEye' application binary. RedEye runs at http://127.0.0.1:4000 (by default) and will automatically open your default browser.
### Blue Team Presentation Handoff
If a `campaigns` folder is located in the same directory as the `RedEye` application, RedEye will attempt to import any `.redeye` campaign files within. Campaign files can be exported in the Red Team mode.
To prepare a version for the Blue Team, follow these two steps:
1. Copy the `RedEye` application binary to an empty folder.
2. Create a `campaigns` folder in the same directory and place the `.redeye` campaign files you want to send inside.
```
Folder/
RedEye
campaigns/
Campaign-01.redeye
Campaign-02.redeye
```
`.redeye` files can also be uploaded in Blue Team mode via the "+ Add Campaign" dialog.
<!--
<!--
## RedEye Server Settings
RedEye runs as a server and can be setup to serve the UI on a network..
***{instructions}***
***{instructions}***
-->
### RedEye Server parameters
Type `./Redeye -h` to view the options
```
-d, --developmentMode [boolean]  put the database and server in development mode
-r, --redTeam [boolean]          run the server in red team mode
Expand All @@ -91,7 +108,9 @@ Type `./Redeye -h` to view the options
```
you can also configure the sever parameters in an `.env` file that sits next to the `RedEye` binary
<!-- ***{is this true?}*** -->
```env
AUTHENTICATION_PASSWORD=937038570
AUTHENTICATION_SECRET=supertopsecretdonttellanyone
Expand All @@ -101,71 +120,91 @@ SERVER_PRODUCTION=false
```

## Local Build

### Required Packages

- [Node.js](https://nodejs.org/en/) >= v16
- Install yarn: `npm install -g yarn`
- Run: `yarn install` // Installs all packages
- Run either:
1. `yarn release:all` to build a binary for Linux, macOS, and Windows
2. `yarn release:(mac|windows|linux)` .
1. `yarn release:all` to build a binary for Linux, macOS, and Windows
2. `yarn release:(mac|windows|linux)` .
- platform options:
- mac
- windows
- linux
- mac
- windows
- linux

## Development

### Setup

Install [Node.js](https://nodejs.org/en/) >= v16
Install [yarn](https://yarnpkg.com/) globally via [npm](https://www.npmjs.com/package/yarn)

```
npm install -g yarn
```

Install package dependencies

```
yarn install
```

#### Quick Start Development

Runs the project in development mode

```sh
yarn start
```

#### Advanced Development

It is recommended to run the server and client in two separate terminals

```sh
yarn start:client
```

...in another terminal

```sh
yarn start:server
```

#### Build

to build a binary for Linux, macOS, and Windows

```shell
yarn release:all
```

to build for a specific platform, replace `all` with the platform name

```shell
yarn release:(mac|windows|linux)
```

## Platform support

- Linux
- Ubuntu 18 and newer
- Kali Linux 2020.1 and newer
- Others may be supported but are untested
- Ubuntu 18 and newer
- Kali Linux 2020.1 and newer
- Others may be supported but are untested
- macOS
- El Capitan and newer
- El Capitan and newer
- Windows
- Windows 7 and newer
ARM support is experimental

- Windows 7 and newer
- ARM support is experimental

---


<div align="center">

<img alt="CISA Logo" src="docs/images/CISA Logo.png" height="35%" width="35%"/>
<img alt="CISA Logo" src="https://github.com/cisagov/RedEye/blob/develop/docs/images/CISA Logo.png?raw=true" height="35%" width="35%"/>

<img alt="RedEye Logo" src="applications/client/public/logos/Logo-Dark.svg" height="35%" width="35%"/>
<img alt="RedEye Logo" src="https://raw.githubusercontent.com/cisagov/RedEye/2e0279ad4bdc798eb2ee6aa018bcd6ad66079d0e/applications/client/public/logos/Logo-Dark.svg" height="35%" width="35%"/>

</div>
</div>
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ export const Commands = observer<CommandsProps>(({ sort, showPath = true }) => {
const commandIndex = commandIds.findIndex((id) => commandId === id);
this.scrollTargetIndex = commandIndex;
if (commandIndex > -1) {
// @ts-ignore
listRef?.current?.scrollToIndex({ index: commandIndex, align: 'start', behavior });
setTimeout(() => (this.scrollTargetIndex = -1), UtilityStyles.SCROLL_TARGET_DURATION + 500);
}
Expand Down
30 changes: 30 additions & 0 deletions applications/landing-page/.eslintrc.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
{
"env": {
"browser": true,
"node": true,
"es6": true
},
"extends": ["eslint:recommended", "plugin:@typescript-eslint/recommended", "plugin:astro/recommended"],
"parser": "@typescript-eslint/parser",
"parserOptions": {
"tsconfigRootDir": "__dirname",
"ecmaVersion": "latest",
"sourceType": "module"
},
"plugins": ["@typescript-eslint"],
"rules": {},
"overrides": [
{
"files": ["*.astro"],
"parser": "astro-eslint-parser",
"parserOptions": {
"parser": "@typescript-eslint/parser",
"extraFileExtensions": [".astro"]
},
"rules": {
// override/add rules settings here, such as:
// "astro/no-set-html-directive": "error"
}
}
]
}
16 changes: 16 additions & 0 deletions applications/landing-page/astro.config.mjs
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
import { defineConfig } from 'astro/config';

// https://astro.build/config
export default defineConfig({
// base: '/RedEye', /* use for gh-pages build */
outDir: './dist-landing',
vite: {
build: {
rollupOptions: {
output: {
assetFileNames: 'assets/style[extname]',
},
},
},
},
});
1 change: 1 addition & 0 deletions applications/landing-page/dist-landing/assets/style.css

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

0 comments on commit d9f8343

Please sign in to comment.