RedEye is a visual analytic tool supporting Red & Blue Team operations

Overview

RedEye

Red Team C2 Log Visualization

RedEye Screenshot

RedEye is an open-source analytic tool developed by CISA and DOE’s Pacific Northwest National Laboratory to assist Red Teams with visualizing and reporting command and control activities. This tool, released in October 2022 on GitHub, allows an operator to assess and display complex data, evaluate mitigation strategies, and enable effective decision making in response to a Red Team assessment. The tool parses logs, such as those from Cobalt Strike, and presents the data in an easily digestible format. The users can then tag and add comments to activities displayed within the tool. The operators can use the RedEye’s presentation mode to present findings and workflow to stakeholders.

RedEye can assist an operator to efficiently:

  • Replay and demonstrate Red Team’s assessment activities as they occurred rather than manually pouring through thousands of lines of log text.
  • Display and evaluate complex assessment data to enable effective decision making.
  • Gain a clearer understanding of the attack path taken and the hosts compromised during a Red Team assessment or penetration test.

User Guide

Quick start

The fastest way to get up and running is by downloading the latest RedEye binaries for your operating system in the Releases section on GitHub.

RedEye currently supports uploading Cobalt Strike logs and offers both Red Team and Blue Team modes.

  • The Red Team mode offers the ability to upload campaign logs, explore, and create presentations. This mode is started by running RedEye with the SERVER_BLUE_TEAM=false environment variable or the --redTeam argument.
  • The Blue Team mode enables the ability to review a read-only campaign exported by a Red Team. This mode runs by default.

Note: Both Red and Blue Team modes can be started from the same RedEye application binary.

Blue Team

The Blue Team version can be run by double-clicking the RedEye application binary.

RedEye runs by default at http://127.0.0.1:4000 and will automatically open your default browser.

If a campaigns folder is located in the same directory as the RedEye application, RedEye will attempt to import any .redeye campaign files within. Campaign files can be exported in the "Red Team" version.

To prepare a version for the Blue Team, follow these two steps:

  1. Copy the RedEye application binary to an empty folder.
  2. Create a campaigns folder in the same directory and place the .redeye campaign files you want to send inside.

Red Team

The Red Team version comes in two parts:

  • The RedEye application binary and
  • The parsers folder containing the cs-parser Cobalt Strike log parser binary.

There are two options to run RedEye:

  1. Run the downloaded binary: AUTHENTICATION_PASSWORD=<your_password> ./RedEye --redTeam.
  2. Clone this repository and either:
    1. Docker Compose:
      1. Update the environment variables in `docker-compose.yml`.
      2. Run: `docker-compose -f docker-compose.yml up -d redeye-core`.
    2. Install and run the project directly (covered in the Local Build section).

The application runs by default at http://127.0.0.1:4000.

Platform support

  • Linux
    • Ubuntu 18 and newer
    • Kali Linux 2020.1 and newer
    • Others may be supported but are untested
  • macOS
    • El Capitan and newer
  • Windows
    • Windows 7 and newer

ARM support is experimental

Note: For Mac users, when first running the RedEye application (and cs-parser if using the Red Team version), you must go to "System Preferences" then "Security & Privacy" and click "Open Anyway".

Local Build

Required Packages

  • Node.js >= v16

  • Install yarn: npm install -g yarn

  • Run: yarn install // Installs all packages

  • Run either:

    1. yarn release:all to build a binary for Linux, macOS, and Windows
    2. yarn release --platform (mac|win|linux) to build for a specific platform.
    • platform options:
      • mac
      • win
      • linux

Development

Setup

  • Install yarn: npm install -g yarn
  • Run: yarn install // Installs all packages

Quick Start Development

Runs the project in development mode

yarn run start

Advanced Development

It is recommended to run the server and client in two separate terminals

yarn run start:client
yarn run start:server

Build

yarn build:all to build all applications and their dependent libraries

Server .env example

AUTHENTICATION_PASSWORD=937038570
AUTHENTICATION_SECRET=supertopsecretdonttellanyone
DATABASE_MODE=DEV_PERSIST
SERVER_BLUE_TEAM=false
SERVER_PRODUCTION=false

CISA Logo RedEye Logo
Comments
  • Tips for building on mac? No luck with binary or docker thus far

    Tips for building on mac? No luck with binary or docker thus far

    Currently using:

    macos montery
    node v18.11.0
    rancher desktop 1.6.1 for container build
    

    When I run yarn run release with mac or linux, I fail with varying errors.

    > yarn run release --platform linux
      ✔  nx run models:build  [existing outputs match the cache, left as is]
      ✔  nx run graph:build  [existing outputs match the cache, left as is]
      ✔  nx run parser:build  [existing outputs match the cache, left as is]
      ✔  nx run client:build:production  [existing outputs match the cache, left as is]
      ✔  nx run server:build  [existing outputs match the cache, left as is]
    
      ✖  nx run server:release
           > [email protected]
           /Users/[REDACTED]/.pkg-cache/v3.4/fetched-v16.16.0-macos-x64-signed: No such file or directory
           > Error! Cannot generate bytecode
             pkg fails to run "codesign" utility. Due to the mandatory signing
             requirement of macOS, executables must be signed. Please ensure the
             utility is installed and properly configured.
    
    

    Same issue when building --platform mac

    It's worth noting that I do have codesign in my PATH

    Docker gets farther, and appears to build my version, but fails when running it.

    >docker compose build
    ...
    ...
     => ERROR [redeye-core:latest redeye-linux-builder 5/5] RUN yarn run release --platform=linux                                                       39.6s
    ------
     > [redeye-core:latest redeye-linux-builder 5/5] RUN yarn run release --platform=linux:
    #0 4.290
    #0 4.292  >  NX   Running target release for 2 project(s) and 5 task(s) they depend on:
    #0 4.292
    #0 4.292     - parser
    #0 4.292     - server
    #0 4.292
    #0 4.292    With additional flags:
    #0 4.292      --platform=linux
    #0 4.292
    #0 4.293
    #0 4.983
    #0 4.984 > nx run models:build  [remote cache]
    #0 4.984
    #0 4.984 Compiling with SWC for models...
    #0 4.984 Successfully compiled: 27 files with swc (67.66ms)
    #0 5.008
    #0 5.008 > nx run graph:build  [remote cache]
    #0 5.008
    #0 5.008 vite v3.1.3 building for production...
    #0 5.008 transforming...
    #0 5.008 ✓ 28 modules transformed.
    #0 5.008 rendering chunks...
    #0 5.008 ../../dist/packages/graph/graph.es.js                 69.13 KiB / gzip: 17.36 KiB
    #0 5.008 ../../dist/packages/graph/assets/index.7f7ce887.css   973.22 KiB / gzip: 736.92 KiB
    #0 5.008 ../../dist/packages/graph/graph.umd.js   57.00 KiB / gzip: 16.07 KiB
    #0 5.008 Copying asset files...
    #0 5.008 Done copying asset files.
    #0 5.008 Bundle complete.
    #0 5.409
    #0 5.409 > nx run parser:build  [remote cache]
    #0 5.409
    #0 5.409 Compiling with SWC for parser...
    #0 5.409 Successfully compiled: 41 files with swc (47.54ms)
    #0 5.609
    #0 5.609 > nx run client:build:production  [remote cache]
    #0 5.609
    #0 5.609 vite v3.1.3 building for production...
    #0 5.609 transforming...
    #0 5.609 transforming...
    #0 5.609 ✓ 9 modules transformed.
    #0 5.609 rendering chunks...
    #0 5.609 ✓ 3790 modules transformed.
    #0 5.609 rendering chunks...
    #0 5.609 ../../dist/applications/client/assets/Logo-Dark.cca6b38e.svg                        7.72 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-sans-all-400.205b5e5a.woff2          51.82 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-sans-all-400-italic.f8bbd0e3.woff2   56.15 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-sans-all-500.1212e7ab.woff2          55.14 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-sans-all-500-italic.c62c7ee9.woff2   59.40 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-sans-all-600.d8b4efc9.woff2          55.66 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-sans-all-600-italic.3778adf3.woff2   58.68 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-sans-all-700.36fc9410.woff2          51.78 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-sans-all-700-italic.ac0eed09.woff2   55.39 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-mono-all-400.0581085d.woff2          32.63 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-mono-all-400-italic.738db8c6.woff2   36.53 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-mono-all-500.10aef5a3.woff2          33.51 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-mono-all-500-italic.91e97a3c.woff2   37.52 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-mono-all-600.01f3197a.woff2          34.47 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-mono-all-600-italic.36e707a0.woff2   38.11 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-mono-all-700.25a2510f.woff2          33.80 KiB
    #0 5.609 ../../dist/applications/client/assets/ibm-plex-mono-all-700-italic.88c19110.woff2   36.98 KiB
    #0 5.609 ../../dist/applications/client/assets/file-worker.348138a2.js                       1.90 KiB
    #0 5.609 ../../dist/applications/client/index.html                                           0.87 KiB
    #0 5.609 ../../dist/applications/client/assets/index.cbda0dd0.css                            303.86 KiB / gzip: 35.74 KiB
    #0 5.609 ../../dist/applications/client/assets/vendor.00901628.js                            306.09 KiB / gzip: 96.90 KiB
    #0 5.609 ../../dist/applications/client/assets/index.05ec905a.js                             3691.92 KiB / gzip: 797.72 KiB
    #0 5.609 Bundle complete.
    #0 6.194
    #0 6.195 > nx run server:build  [remote cache]
    #0 6.196
    #0 6.196 Compiling with SWC for server...
    #0 6.196 Successfully compiled: 56 files with swc (66.29ms)
    #0 14.02
    #0 14.02 > nx run server:release --platform=linux
    #0 14.02
    #0 14.02 > [email protected]
    #0 14.02 > Fetching base Node.js binaries to PKG_CACHE_PATH
    #0 14.02
    #0 14.02
    #0 14.02 node:internal/fs/utils:347
    #0 14.02     throw err;
    #0 14.02     ^
    #0 14.02
    #0 14.02 Error: ENOENT: no such file or directory, stat '/root/.pkg-cache/v3.4/fetched-v16.16.0-linux-x64.downloading'
    #0 14.02     at Object.statSync (node:fs:1583:3)
    #0 14.02     at Object.statSync (/app/node_modules/graceful-fs/polyfills.js:318:34)
    #0 14.02     at statSync (/app/node_modules/fs-extra/lib/util/stat.js:10:52)
    #0 14.02     at getStatsSync (/app/node_modules/fs-extra/lib/util/stat.js:24:19)
    #0 14.02     at Object.checkPathsSync (/app/node_modules/fs-extra/lib/util/stat.js:49:33)
    #0 14.02     at Object.moveSync (/app/node_modules/fs-extra/lib/move-sync/move-sync.js:14:28)
    #0 14.02     at WriteStream.<anonymous> (/app/node_modules/pkg-fetch/lib-es5/utils.js:90:56)
    #0 14.02     at WriteStream.<anonymous> (node:internal/util:453:5)
    #0 14.02     at WriteStream.onclose (node:internal/streams/end-of-stream:147:14)
    #0 14.02     at WriteStream.emit (node:events:513:28) {
    #0 14.02   errno: -2,
    #0 14.02   syscall: 'stat',
    #0 14.02   code: 'ENOENT',
    #0 14.02   path: '/root/.pkg-cache/v3.4/fetched-v16.16.0-linux-x64.downloading'
    #0 14.02 }
    #0 14.02
    #0 14.02  >  NX   ERROR: Something went wrong in run-commands - Command failed: pkg dist/applications/server/package.json -t node16-linux -o release/linux/RedEye
    #0 14.02
    #0 14.02    Pass --verbose to see the stacktrace.
    #0 14.02
    #0 39.23
    #0 39.23 > nx run parser:release --platform=linux
    #0 39.23
    #0 39.24 > [email protected]
    #0 39.24 > Fetching base Node.js binaries to PKG_CACHE_PATH
    #0 39.24
    #0 39.24
    #0 39.24 > Warning Failed to make bytecode node16-x64 for file /snapshot/app/node_modules/supports-color/index.js
    #0 39.24
    #0 39.24
    #0 39.24
    #0 39.24  >  NX   Running target "release" failed
    #0 39.25
    #0 39.25    Failed tasks:
    #0 39.25
    #0 39.25    - server:release
    #0 39.25
    #0 39.41    Nx Cloud made it possible to reuse 5 tasks: https://nx.app/runs/CjpHlyxcIr
    #0 39.41
    ------
    failed to solve: executor failed running [/bin/sh -c yarn run release --platform=linux]: exit code: 1
    

    I think my current plan is try to build the mac binaries in the a container build step and copy them out.

    need info 
    opened by Yablargo 21
  • Excessive identical job parallelism in workflow

    Excessive identical job parallelism in workflow

    RedEye folk,

    Could you take a look at your testing workflow. When it kicks off it is occupying over half of our organization's available runners, and has starved out some of the other projects.

    • Please document the purpose of 12 identical jobs running in parallel in the workflow. e.g., the parallel tests are non-deterministic.
    • Please consider using max-parallel to limit the matrix to a couple of jobs at a time if this parallelism isn't necessary.

    Thank, @felddy

    https://github.com/cisagov/RedEye/blob/336919c97d620f40aaf403131ee922b7b169221d/.github/workflows/test.yml#L47-L51

    https://github.com/cisagov/RedEye/blob/336919c97d620f40aaf403131ee922b7b169221d/.github/workflows/test.yml#L90-L94

    bug documentation 
    opened by felddy 7
  • run problem : yarn run start:server

    run problem : yarn run start:server

    environment: ubuntu:20.04 nodejs:16.17.1 npm:8.19.2 yarn:3.2.3

    The following error occurs when I run the yarn install command:

    root:~/RedEye# yarn install
    ➤ YN0000: ┌ Resolution step
    ➤ YN0002: │ @nrwl/cypress@npm:14.6.5 [63507] doesn't provide nx (p10390), requested by @nrwl/devkit
    ➤ YN0002: │ @nrwl/cypress@npm:14.6.5 [63507] doesn't provide typescript (p12f21), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/cypress@npm:14.6.5 [63507] doesn't provide typescript (p6345b), requested by fork-ts-checker-webpack-plugin
    ➤ YN0002: │ @nrwl/cypress@npm:14.6.5 [63507] doesn't provide typescript (pfc203), requested by ts-loader
    ➤ YN0002: │ @nrwl/cypress@npm:14.6.5 [7a45f] doesn't provide nx (p1f374), requested by @nrwl/devkit
    ➤ YN0002: │ @nrwl/cypress@npm:14.6.5 [7a45f] doesn't provide typescript (p1ce2c), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/cypress@npm:14.6.5 [7a45f] doesn't provide typescript (p88b83), requested by fork-ts-checker-webpack-plugin
    ➤ YN0002: │ @nrwl/cypress@npm:14.6.5 [7a45f] doesn't provide typescript (p52358), requested by ts-loader
    ➤ YN0002: │ @nrwl/devkit@npm:14.6.3 [7d709] doesn't provide typescript (p4b372), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/devkit@npm:14.6.3 [f7f79] doesn't provide typescript (pd13ca), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/devkit@npm:14.6.5 [466ed] doesn't provide typescript (p952f2), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/devkit@npm:14.6.5 [7a45f] doesn't provide typescript (p88aeb), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/devkit@npm:14.6.5 [e712c] doesn't provide typescript (p121bf), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/eslint-plugin-nx@npm:14.6.3 [7a45f] doesn't provide eslint (pcdd36), requested by @typescript-eslint/utils
    ➤ YN0002: │ @nrwl/eslint-plugin-nx@npm:14.6.3 [7a45f] doesn't provide nx (p3f0ed), requested by @nrwl/devkit
    ➤ YN0002: │ @nrwl/jest@npm:14.6.3 doesn't provide nx (p7bd51), requested by @nrwl/devkit
    ➤ YN0002: │ @nrwl/jest@npm:14.6.3 doesn't provide typescript (paa32c), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/jest@npm:14.6.5 doesn't provide nx (p51599), requested by @nrwl/devkit
    ➤ YN0002: │ @nrwl/jest@npm:14.6.5 doesn't provide typescript (p68cd3), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/js@npm:14.6.3 doesn't provide nx (p2cb88), requested by @nrwl/devkit
    ➤ YN0002: │ @nrwl/js@npm:14.6.5 doesn't provide nx (p8ee91), requested by @nrwl/devkit
    ➤ YN0002: │ @nrwl/linter@npm:14.6.3 [7a45f] doesn't provide typescript (pe0811), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/linter@npm:14.6.3 [89c3e] doesn't provide typescript (pbe7e7), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/linter@npm:14.6.5 [ecbee] doesn't provide typescript (pf9585), requested by @phenomnomnominal/tsquery
    ➤ YN0002: │ @nrwl/node@npm:14.6.5 doesn't provide @types/node (pf093b), requested by ts-node
    ➤ YN0002: │ @nrwl/node@npm:14.6.5 doesn't provide nx (p3e1ba), requested by @nrwl/devkit
    ➤ YN0002: │ @nrwl/node@npm:14.6.5 doesn't provide typescript (p931a2), requested by fork-ts-checker-webpack-plugin
    ➤ YN0002: │ @nrwl/node@npm:14.6.5 doesn't provide typescript (p42906), requested by ts-loader
    ➤ YN0002: │ @nrwl/node@npm:14.6.5 doesn't provide typescript (p3b16b), requested by ts-node
    ➤ YN0002: │ @nrwl/web@npm:14.6.5 doesn't provide @types/node (pbf886), requested by ts-node
    ➤ YN0002: │ @nrwl/web@npm:14.6.5 doesn't provide nx (p66ace), requested by @nrwl/devkit
    ➤ YN0002: │ @nrwl/web@npm:14.6.5 doesn't provide typescript (pd976f), requested by fork-ts-checker-webpack-plugin
    ➤ YN0002: │ @nrwl/web@npm:14.6.5 doesn't provide typescript (p796a9), requested by ts-loader
    ➤ YN0002: │ @nrwl/web@npm:14.6.5 doesn't provide typescript (p032d9), requested by ts-node
    ➤ YN0002: │ @nrwl/web@npm:14.6.5 doesn't provide typescript (p7ef8a), requested by rollup-plugin-typescript2
    ➤ YN0002: │ @nxext/vite@npm:14.0.0 [7a45f] doesn't provide nx (p23fe6), requested by @nrwl/devkit
    ➤ YN0002: │ @types/testing-library__react@npm:10.2.0 doesn't provide react (p31675), requested by @testing-library/react
    ➤ YN0002: │ @types/testing-library__react@npm:10.2.0 doesn't provide react-dom (p45428), requested by @testing-library/react
    ➤ YN0002: │ redeye@workspace:. doesn't provide @babel/core (p5e601), requested by @emotion/babel-plugin
    ➤ YN0002: │ redeye@workspace:. doesn't provide @babel/plugin-syntax-flow (p48cba), requested by eslint-plugin-flowtype
    ➤ YN0002: │ redeye@workspace:. doesn't provide @babel/plugin-transform-react-jsx (pbf514), requested by eslint-plugin-flowtype
    ➤ YN0002: │ redeye@workspace:. doesn't provide @blueprintjs/docs-theme (p9d6a0), requested by blueprint-styler
    ➤ YN0002: │ redeye@workspace:. doesn't provide @blueprintjs/icons (p9e3bc), requested by blueprint-styler
    ➤ YN0002: │ redeye@workspace:. doesn't provide @blueprintjs/table (p457d2), requested by blueprint-styler
    ➤ YN0002: │ redeye@workspace:. doesn't provide @blueprintjs/timezone (pcdff1), requested by blueprint-styler
    ➤ YN0002: │ redeye@workspace:. doesn't provide @testing-library/dom (p4b37a), requested by @testing-library/user-event
    ➤ YN0002: │ redeye@workspace:. doesn't provide eslint-plugin-n (p61d4a), requested by eslint-config-standard
    ➤ YN0060: │ redeye@workspace:. provides mobx-keystone (p05af7) with version 1.0.0, which doesn't satisfy what mk-gql requests
    ➤ YN0060: │ redeye@workspace:. provides prettier (p92f8b) with version 2.5.1, which doesn't satisfy what @nrwl/workspace requests
    ➤ YN0060: │ redeye@workspace:. provides react (pca4bc) with version 18.2.0, which doesn't satisfy what @blueprintjs/core and some of its descendants request
    ➤ YN0060: │ redeye@workspace:. provides react (p15ae2) with version 18.2.0, which doesn't satisfy what @blueprintjs/datetime and some of its descendants request
    ➤ YN0060: │ redeye@workspace:. provides react (pe4698) with version 18.2.0, which doesn't satisfy what @blueprintjs/popover2 and some of its descendants request
    ➤ YN0060: │ redeye@workspace:. provides react (p81fea) with version 18.2.0, which doesn't satisfy what react-resize-detector requests
    ➤ YN0060: │ redeye@workspace:. provides react-dom (p22dbf) with version 18.2.0, which doesn't satisfy what react-resize-detector requests
    ➤ YN0002: │ redeye@workspace:. doesn't provide rollup (p85155), requested by rollup-plugin-auto-external
    ➤ YN0060: │ redeye@workspace:. provides vite (pacda5) with version 3.1.3, which doesn't satisfy what @nxext/vite requests
    ➤ YN0000: │ Some peer dependencies are incorrectly met; run yarn explain peer-requirements <hash> for details, where <hash> is the six-letter p-prefixed code
    ➤ YN0000: └ Completed in 1s 377ms
    ➤ YN0000: ┌ Fetch step
    ➤ YN0000: └ Completed in 3m 25s
    ➤ YN0000: ┌ Link step
    ➤ YN0007: │ cypress@npm:10.9.0 must be built because it never has been before or the last one failed
    ➤ YN0007: │ nodemon@npm:2.0.15 must be built because it never has been before or the last one failed
    ➤ YN0007: │ playwright-webkit@npm:1.25.2 must be built because it never has been before or the last one failed
    ➤ YN0007: │ @carbon/icons-react@npm:10.44.0 [7a45f] must be built because it never has been before or the last one failed
    ➤ YN0007: │ type-graphql@npm:1.1.1 [7a45f] must be built because it never has been before or the last one failed
    ➤ YN0007: │ @parcel/watcher@npm:2.0.4 must be built because it never has been before or the last one failed
    ➤ YN0007: │ core-js@npm:3.22.7 must be built because it never has been before or the last one failed
    ➤ YN0007: │ better-sqlite3@npm:7.6.2 must be built because it never has been before or the last one failed
    ➤ YN0007: │ esbuild@npm:0.15.9 must be built because it never has been before or the last one failed
    ➤ YN0007: │ core-js-pure@npm:3.22.7 must be built because it never has been before or the last one failed
    ➤ YN0007: │ @apollo/protobufjs@npm:1.2.4 must be built because it never has been before or the last one failed
    ➤ YN0007: │ redeye@workspace:. must be built because it never has been before or the last one failed
    ➤ YN0007: │ nx@npm:14.6.3 [f7f79] must be built because it never has been before or the last one failed
    ➤ YN0007: │ nx@npm:14.6.5 [4a848] must be built because it never has been before or the last one failed
    ➤ YN0000: └ Completed in 1m 53s
    ➤ YN0000: Done with warnings in 5m 20s
    

    run yarn release:all

    ✔  nx run models:build  [remote cache]
        ✔  nx run graph:build  [remote cache]
        ✔  nx run parser:build  [remote cache]
        ✔  nx run client:build:production  [remote cache]
        ✔  nx run server:build  [remote cache]
    
        ✖  nx run parser:release-all
           >  NX   Running target release for project parser and 2 task(s) it depends on
           
            
           
           > nx run parser:build  [existing outputs match the cache, left as is]
           
           Compiling with SWC for parser...
           Successfully compiled: 41 files with swc (58.2ms)
           
           > nx run parser:release --platform=mac
           
           > [email protected]
           > Fetching base Node.js binaries to PKG_CACHE_PATH
           
           
           > Error! Binary hash does NOT match.
           
            >  NX   ERROR: Something went wrong in run-commands - Command failed: pkg dist/packages/cs-parser/package.json -t node16-mac -o release/mac/parsers/cs-parser
           
              Pass --verbose to see the stacktrace.
           
           
            
           
            >  NX   Running target "parser:release" failed
           
              Failed tasks:
              
              - parser:release
              
              Hint: run the command with --verbose for more details.
           
           
            >  NX   ERROR: Something went wrong in run-commands - Command failed: yarn nx release parser --platform mac
           
              Pass --verbose to see the stacktrace.
           
    
        ✖  nx run server:release-all
           >  NX   Running target release for project server and 5 task(s) it depends on
           
            
           
           > nx run server:build  [existing outputs match the cache, left as is]
           
           Compiling with SWC for server...
           Successfully compiled: 56 files with swc (63.79ms)
           
           > nx run server:release --platform=mac
           
           > [email protected]
           > Fetching base Node.js binaries to PKG_CACHE_PATH
           
           
           node:internal/fs/utils:347
               throw err;
               ^
           
           Error: ENOENT: no such file or directory, stat '/root/.pkg-cache/v3.4/fetched-v16.16.0-macos-x64.downloading'
               at Object.statSync (node:fs:1588:3)
               at Object.statSync (/root/RedEye-cisa/node_modules/graceful-fs/polyfills.js:318:34)
               at statSync (/root/RedEye-cisa/node_modules/fs-extra/lib/util/stat.js:10:52)
               at getStatsSync (/root/RedEye-cisa/node_modules/fs-extra/lib/util/stat.js:24:19)
               at Object.checkPathsSync (/root/RedEye-cisa/node_modules/fs-extra/lib/util/stat.js:49:33)
               at Object.moveSync (/root/RedEye-cisa/node_modules/fs-extra/lib/move-sync/move-sync.js:14:28)
               at WriteStream.<anonymous> (/root/RedEye-cisa/node_modules/pkg-fetch/lib-es5/utils.js:90:56)
               at WriteStream.<anonymous> (node:internal/util:445:5)
               at WriteStream.onclose (node:internal/streams/end-of-stream:147:14)
               at WriteStream.emit (node:events:513:28) {
             errno: -2,
             syscall: 'stat',
             code: 'ENOENT',
             path: '/root/.pkg-cache/v3.4/fetched-v16.16.0-macos-x64.downloading'
           }
           
            >  NX   ERROR: Something went wrong in run-commands - Command failed: pkg dist/applications/server/package.json -t node16-mac -o release/mac/RedEye
           
              Pass --verbose to see the stacktrace.
           
           
            
           
            >  NX   Running target "server:release" failed
           
              Failed tasks:
              
              - server:release
              
              Hint: run the command with --verbose for more details.
           
           
            >  NX   ERROR: Something went wrong in run-commands - Command failed: yarn nx release server --platform mac
           
              Pass --verbose to see the stacktrace.
           
    
     —————————————————————————————————————————————————————————————————————————————————————————————————————————
    
     >  NX   Ran target release-all for 2 projects and 5 task(s) they depend on (12s)
     
        ✔    5/7 succeeded [5 read from cache]
     
        ✖    2/7 targets failed, including the following:
             - nx run parser:release-all
             - nx run server:release-all
     
       Nx Cloud made it possible to reuse 5 tasks: https://nx.app/runs/mXmOCfDmj8
    

    run yarn run start:server

    root:~/RedEye# yarn run start:server
    
    > nx run server:serve
    
    Compiling with SWC for models...
    Successfully compiled: 27 files with swc (134.79ms)
    Compiling with SWC for parser...
    Successfully compiled: 41 files with swc (92.14ms)
    
     >  NX   inotify_add_watch on '/root/RedEye-cisa/node_modules/@faker-js/faker/dist/types/locales/hy/color' failed: No space left on device
    
       Pass --verbose to see the stacktrace.
    
    
     —————————————————————————————————————————————————————————————————————————————————————————————————————————
    
     >  NX   Running target "server:serve" failed
    
       Failed tasks:
       
       - server:serve
       
       Hint: run the command with --verbose for more details.
    
       See Nx Cloud run details at https://nx.app/runs/Ck14JFu42J
    
    need info 
    opened by KamiSec 5
  • Clicking in the

    Clicking in the "bar graph area" of the timeline should move the time slider.

    Is your feature request related to a problem? Please describe.

    When I first used RedEye, I attempted to navigate the time slider by clicking into the upper 'canvas' area with the activity bar graph as (poorly) circled here. image

    Since this UI doesn't do anything else, it might be a nice improvement to jump the timeline to the area clicked.

    Tt might just be, but that was the first thing I tried to do when I inspected the timeline, and it did not work as expected.

    Describe the solution you'd like Clicking in the area above the draggable dot jumps the dot to the horizontal spot you clicked on.

    Describe alternatives you've considered I guess the current implementation is the most obvious alternative.

    opened by Yablargo 3
  • closes User setting displaying incorrect data

    closes User setting displaying incorrect data

    🗣 Description

    💭 Motivation and context

    User setting text is in dot notation

    🧪 Testing

    View #18 for testing steps Check that the User Setting user.name is now Username

    ✅ Pre-approval checklist

    • [x] This PR has an informative and human-readable title.
    • [x] Changes are limited to a single goal - eschew scope creep!
    • [ ] All future TODOs are captured in issues, which are referenced in code comments.
    • [ ] All relevant type-of-change labels have been added.
    • [x] I have read the CONTRIBUTING document.
    • [x] These code changes follow cisagov code standards.
    • [x] All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
    • [ ] Tests have been added and/or modified to cover the changes in this PR.
    • [ ] All new and existing tests pass.

    ✅ Pre-merge checklist

    • [x] Revert dependencies to default branches.
    • [x] Finalize version.

    ✅ Post-merge checklist

    • [ ] Add a tag or create a release.
    opened by MarkisK 3
  • Our security product uses the name RedEye

    Our security product uses the name RedEye

    Our threat hunting product has been using the RedEye name for the past 3 years.

    • https://rtfs.pl/pl/threat-hunting.html / https://rtfs.pl/en/threat-hunting.html
    • https://redteam.pl/pl/threat-hunting-intelligence.html / https://redteam.pl/en/threat-hunting-intelligence.html
    • https://redteam.pl/pl/soc-security-operations-center.html / https://redteam.pl/en/soc-security-operations-center.html
    • https://forsec.pl/wp-content/uploads/2021/08/SOC_opis.pdf - there's even a logo depicting a red eye on the 10th page
    • https://redteam.pl/images/04.svg - logo of our product RedEye etc

    Is it possible for you to change the name to avoid confusion? Our product is commercial and also intended for an identical purpose.

    Our RED TEAM company is also well-known in the foreign market, including the United States:

    • https://www.forbes.com/sites/leemathews/2020/08/25/apple-safari-bug-steal-files/
    • https://isc.sans.edu/podcastdetail.html?id=7138
    • https://isc.sans.edu/podcastdetail.html?id=6484
    • https://www.zdnet.com/article/security-researcher-discloses-safari-bug-after-apples-delays-patch/
    • https://www.bleepingcomputer.com/news/security/black-kingdom-ransomware-hacks-networks-with-pulse-vpn-flaws/
    • https://clutch.co/profile/redteampl#reviews etc
    opened by adamziaja 3
  • Explicit pkg fetch

    Explicit pkg fetch

    🗣 Description

    💭 Motivation and context

    🧪 Testing

    ✅ Pre-approval checklist

    • [ ] This PR has an informative and human-readable title.
    • [ ] Changes are limited to a single goal - eschew scope creep!
    • [ ] All future TODOs are captured in issues, which are referenced in code comments.
    • [ ] All relevant type-of-change labels have been added.
    • [ ] I have read the CONTRIBUTING document.
    • [ ] These code changes follow cisagov code standards.
    • [ ] All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
    • [ ] Tests have been added and/or modified to cover the changes in this PR.
    • [ ] All new and existing tests pass.

    ✅ Pre-merge checklist

    • [ ] Revert dependencies to default branches.
    • [ ] Finalize version.

    ✅ Post-merge checklist

    • [ ] Add a tag or create a release.
    opened by Yablargo 2
  • Stuck when importing C/S logs

    Stuck when importing C/S logs

    After selecting C/S logs for import, the page stays at Importing... Status image The error message reported on the server is as follows PARSING ERROR: error in exec callback { error: Error: spawn /home/test/linux/test/parsers/cs-parser ENOENT at Process.ChildProcess._handle.onexit (node:internal/child_process:283:19) at onErrorNT (node:internal/child_process:478:16) at processTicksAndRejections (node:internal/process/task_queues:83:21) { errno: -2, code: 'ENOENT', syscall: 'spawn /home/test/linux/test/parsers/cs-parser', path: '/home/test/linux/test/parsers/cs-parser', spawnargs: [ 'campaign', '-d', '/home/test/linux/test/campaign/13aafb0c-ecb4-43c8-827a-542c7a3c5ac6/db.redeye', '-p', '/home/test/linux/test/campaign/13aafb0c-ecb4-43c8-827a-542c7a3c5ac6', '-t', '7' ], cmd: '/home/test/linux/test/parsers/cs-parser campaign -d /home/test/linux/test/campaign/13aafb0c-ecb4-43c8-827a-542c7a3c5ac6/db.redeye -p /home/test/linux/test/campaign/13aafb0c-ecb4-43c8-827a-542c7a3c5ac6 -t 7' }, stdout: '', stderror: '' } image

    opened by mxlgg 2
  • User setting displaying incorrect data

    User setting displaying incorrect data

    Describe the bug The user setting is displaying incorrect data

    To Reproduce Steps to reproduce the behavior:

    1. Log into the application
    2. Click the user setting button at the top of the screen
    3. The Change user.name did not render correctly as shown

    Expected behavior Should show as change name or the actual name of the user

    Screenshots Screen Shot 2022-10-18 at 4 44 31 PM

    Desktop (please complete the following information):

    • OS: [Mac]
    • Browser [Firefox]
    • Version [105]

    Additional context Add any other context about the problem here.

    ux 
    opened by MarkisK 2
  • Updates to parsed campaigns

    Updates to parsed campaigns

    Is your feature request related to a problem? Please describe. We are planning on using RedEye as a visualization tool during our red team assessments. As of now, it seems like RedEye is unable to add data to a campaign once it has been parsed initially.

    Describe the solution you'd like A solution to allow upload of additional/updated log files would allow RedEye to be used as a live-view of a running campaign.

    Describe alternatives you've considered I attempted to create a wrapper script that parses new log files and uploads them to the API with the corresponding campaign ID, but it seems like this is currently not supported. As of now, I don't see an alternative way.

    Additional context None

    improvement 
    opened by lengers 2
  • Export fails on campaign with hidden hosts

    Export fails on campaign with hidden hosts

    Describe the bug Export of campaign fails if campaign contains hidden hosts.

    To Reproduce Steps to reproduce the behavior:

    1. Create a campaign by importing logs
    2. Hide a host
    3. Export the campaign with option 'Remove all hidden Beacons, Hosts, and Servers' checked
    4. See error

    Expected behavior Campaign to successfully export and the exported campaign does not contain the host(s) that were hidden.

    Screenshots Screen Shot 2022-11-10 at 11 29 41 PM Screen Shot 2022-11-10 at 11 30 42 PM

    Desktop (please complete the following information):

    • OS: macOS Monterey
    • Browser: Chrome
    • Version: 107.0.5304.110

    Additional context I created a campaign, and then hid two hosts (SA-WIN10-21H1-1 and SA-DC01-2019). I then attempted to export the campaign with the option 'Remove all hidden Beacons, Hosts, and Servers' checked, and received the errors in the above screenshots.

    bug 
    opened by simplysean 1
  • OperatorResolvers missing @Authorized decorator

    OperatorResolvers missing @Authorized decorator

    Describe the bug The OperatorResolvers are missing @Authorized() decorators, which allows anybody to query operator names without authentication.

    To Reproduce Send this POST request to the /graphql endpoint of RedEye:

    POST /api/graphql HTTP/1.1
    Host: localhost:4000
    content-type: application/json
    Content-Length: 67
    
    {"query":"query test { globalOperators { __typename id name } }"
    
    }
    

    The response will leak the registered operator names. Example response:

    {"data":{"globalOperators":[{"__typename":"GlobalOperator","id":"dev","name":"dev"},{"__typename":"GlobalOperator","id":"analyst01","name":"analyst01"},{"__typename":"GlobalOperator","id":"john.doe","name":"john.doe"},{"__typename":"GlobalOperator","id":"dev2","name":"dev2"}]}}
    

    The mutation also is lacking the @Authorized decorator, thus allows creating global operators without authentication:

    {
    
      "query": "mutation createGlobalOperator($username: String!) { createGlobalOperator(username: $username) { id name } }",
      "variables": {
        "username": "john.doe"
      }
    }
    

    To fix, simply add the @Authorized decorator to all queries.

    Background Info

    We created this CodeQL query live on stream to find the resolvers without the authorized decorator:

    import javascript
    
    from Decorator d1
    where 
        d1.getAChildExpr().(CallExpr).getCalleeName() 
                in ["Mutation", "Query"]
        and 
        not d1.getParent().getAChild().(Decorator).getAChildExpr().(CallExpr).getCalleeName() in ["Authorized"]
    select d1, "is not authorized"
    

    We only found these affected files, the progress resolver is uninteresting. And the issue with the operator resolver is mentioned above.

    • RedEye/applications/server/src/store/progress-resolvers.ts
    • RedEye/applications/server/src/store/operator-resolvers.ts
    improvement 
    opened by LiveOverflow 1
  • Feature/ambiguous data

    Feature/ambiguous data

    🗣 Description

    💭 Motivation and context

    🧪 Testing

    ✅ Pre-approval checklist

    • [ ] This PR has an informative and human-readable title.
    • [ ] Changes are limited to a single goal - eschew scope creep!
    • [ ] All future TODOs are captured in issues, which are referenced in code comments.
    • [ ] All relevant type-of-change labels have been added.
    • [ ] I have read the CONTRIBUTING document.
    • [ ] These code changes follow cisagov code standards.
    • [ ] All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
    • [ ] Tests have been added and/or modified to cover the changes in this PR.
    • [ ] All new and existing tests pass.

    ✅ Pre-merge checklist

    • [ ] Revert dependencies to default branches.
    • [ ] Finalize version.

    ✅ Post-merge checklist

    • [ ] Add a tag or create a release.
    opened by aguamentiPatronum 0
  • Parsers for additional C2 frameworks

    Parsers for additional C2 frameworks

    We're planning on integrating up to three additional C2 framework parsers this year into RedEye. The list of parsers is still being finalized, so please comment below with any framework parser you'd like to see in RedEye!

    opened by GoldingAustin 2
  • Missing ability to create new campaign

    Missing ability to create new campaign

    Describe the bug Trying to create a new initial campaign, but only have the ability to import a campaign and DB files.

    To Reproduce Steps to reproduce the behavior:

    1. Login
    2. Click on 'Add a Campaign +'
    3. See error

    Expected behavior Screen shots on User Guide show "Create Campaign" but not in my run.

    Screenshots image

    Desktop (please complete the following information):

    • OS: Windows
    • Browser Firefox
    • Version 102.3.0esr (64-bit)

    Additional context Running Windows: RedEye Server v0.8.0-beta w/no additional parameters in originally "empty" directory.

    Am I missing a config to allow new campaigns? Is there a sample or an empty campaign that I can import for now to "create"?

    opened by jharbin 3
  • Blue Team or Red Team Mode Indication

    Blue Team or Red Team Mode Indication

    Is your feature request related to a problem? Please describe. When using the application there is really no way to distinguish if a user is in blue team(review) mode or red team

    Describe the solution you'd like There should be an indication somewhere within the main view or once a user logs in letting them know what mode they are in

    Describe alternatives you've considered N/A

    Additional context Add any other context or screenshots about the feature request here.

    improvement 
    opened by MarkisK 1
Releases(v0.8.1)
  • v0.8.1(Nov 11, 2022)

    What's Changed

    • Fix add campaign dialog description spacing closes #10 by @GoldingAustin in https://github.com/cisagov/RedEye/pull/20
    • closes User setting displaying incorrect data by @MarkisK in https://github.com/cisagov/RedEye/pull/21
    • Bugfix/528 turning on show hidden beacons button causes search to crash by @sharplessHQ in https://github.com/cisagov/RedEye/pull/26
    • Update Server Terminal Ascii Art by @arniebradfo in https://github.com/cisagov/RedEye/pull/28
    • Bugfix - beacon meta timezone by @sharplessHQ in https://github.com/cisagov/RedEye/pull/29
    • PKG No such file or directory error by @GoldingAustin in https://github.com/cisagov/RedEye/pull/35
    • Small fix for anonymization & export error state by @GoldingAustin in https://github.com/cisagov/RedEye/pull/36
    • Fix executable sometimes not finding export worker script by @GoldingAustin in https://github.com/cisagov/RedEye/pull/38
    • Fix hidden hosts failing to delete during anonymization by @GoldingAustin in https://github.com/cisagov/RedEye/pull/40
    • Release 0.8.1 by @GoldingAustin in https://github.com/cisagov/RedEye/pull/41

    New Contributors

    • @MarkisK made their first contribution in https://github.com/cisagov/RedEye/pull/21

    Full Changelog: https://github.com/cisagov/RedEye/commits/v0.8.1

    Source code(tar.gz)
    Source code(zip)
    linux.zip(66.17 MB)
    mac.zip(64.75 MB)
    windows.zip(62.47 MB)
Owner
Cybersecurity and Infrastructure Security Agency
Commit today, secure tomorrow.
Cybersecurity and Infrastructure Security Agency
A string of four operations of the library, can solve the js digital calculation accuracy of scientific notation and formatting problems, support for thousands of decimal point formatting output operations

A string of four operations of the library, can solve the js digital calculation accuracy of scientific notation and formatting problems, support for thousands of decimal point formatting output operations

null 10 Apr 6, 2022
Visual Studio Code extension for supporting jaksel-language

jaksel-language-support for Visual Studio Code Visual Studio Code extension for supporting jaksel-language coding experience. Features Syntax Highligh

Ngupuk 6 Oct 23, 2022
A quick and easy to use security reconnaissance webapp tool, does OSINT, analysis and red-teaming in both passive and active mode. Written in nodeJS and Electron.

ᵔᴥᵔ RedJoust A quick and easy to use security reconnaissance webapp tool, does OSINT, analysis and red-teaming in both passive and active mode. Writte

Dave 17 Oct 31, 2022
Team Empire offers an innovative and intuitive game based on puzzles solved by two players working in a team.

Team Empire offers an innovative and intuitive game based on puzzles solved by two players working in a team. The user can create an account to monitor their results and achievements. The whole idea of the product is to make the player think and develop his logical thinking.

Vocational school for computer programming and innovation 14 Aug 8, 2022
Veselin Petranchev 2 Oct 11, 2022
ECS Blue/Green Deployment with AWS CodePipeline

ECS Blue/Green Deployment with AWS CodePipeline This repository contains a set of configuration to setup a CI/CD pipeline for an AWS ECS Cluster. All

Phạm Khắc Quyền 7 Sep 20, 2022
Primeiro projeto do Módulo 1 da Blue ed Tech - Web Fullstack

Projeto1-Modulo1-BlueFullstack Módulo 1 - Blue ed Tech - Web Fullstack Projeto 1 - A Jornada do Herói A premissa é a seguinte: O nosso herói chegou ao

Vinhas93 2 Mar 9, 2022
This document introduces an early implementation of the Node-RED runtime that runs on resource-constrained microcontrollers (MCUs).

Node-RED MCU Edition Copyright 2022, Moddable Tech, Inc. All rights reserved. Peter Hoddie Updated June 25, 2022 Introduction This document introduces

Peter Hoddie 53 Jan 3, 2023
Open Horizon service container demonstrating Node-RED Object Detection

service-node-red-object-detection Open Horizon service container demonstrating Node-RED Object Detection. This is an Open Horizon configuration to dep

null 4 Dec 25, 2022
VS Code extension that adds a red error squiggle to every word in your code.

Dumbisense Dumbisense is a VS Code extension that adds a red error squiggle to every word in your code, with an interesting error message and dino ima

Maggie Liu 9 Sep 3, 2022
A calculation and tracker tool for one-person business operations

?? Taxemu This is the alpha version of Taxemu. A tracker tool for one-person business operations. The live project can be found here. Development Clon

John Raptis 7 Nov 30, 2022
Simple and configurable tool to manage daily huddles in a remote team.

Daily Huddle Simple and configurable tool to manage daily huddles in a remote team. See working version. What's this? This repo has been developed as

Origen Studio 4 Oct 2, 2022
Web-based tool to build gradient data for retro platforms using a visual editor

Gradient Blaster https://gradient-blaster.grahambates.com Gradient Blaster is a web-based tool to build gradient data for retro platforms using a visu

Graham Bates 5 Dec 13, 2022
Next-gen mobile first analytics server (think Mixpanel, Google Analytics) with built-in encryption supporting HTTP2 and gRPC. Node.js, headless, API-only, horizontally scaleable.

Introduction to Awacs Next-gen behavior analysis server (think Mixpanel, Google Analytics) with built-in encryption supporting HTTP2 and gRPC. Node.js

Socketkit 52 Dec 19, 2022
Inter Process Communication Module for node supporting Unix sockets, TCP, TLS, and UDP. Giving lightning speed on Linux, Mac, and Windows. Neural Networking in Node.JS

Inter Process Communication Module for node supporting Unix sockets, TCP, TLS, and UDP. Giving lightning speed on Linux, Mac, and Windows. Neural Networking in Node.JS

Node IPC 43 Dec 9, 2022
A guide that teach you build a custom version of chromium on macOS/Windows/Linux that supporting hardware/software HEVC decoding.

enable-chromium-hevc-hardware-decoding A guide that teach you build a custom version of chromium on macOS/Windows/Linux that supports hardware/softwar

Sta Zhu 778 Jan 1, 2023
A small library aims to improve better tagged-unions/discriminated-unions supporting for TypeScript

coproduct A small library aims to improve better tagged-unions/discriminated-unions supporting for TypeScript Benefits Small bundled size(just 1kb) Ea

工业聚 29 Aug 15, 2022
"Pizza Party!" - A Jovo V4 master template supporting a lot of features

"Pizza Party!" - Yet another Jovo V4 master template supporting a lot of features There are a lot of Jovo examples around but I did not find any proje

Frank Börncke 8 Aug 2, 2022
Syntax Highlighter supporting multiple languages, themes, fonts, highlighting from a URL, local file or post text.

Crayon Syntax Highlighter Supports multiple languages, themes, fonts, highlighting from a URL, local file or post text. Written in PHP and jQuery. Cra

Aram Kocharyan 1.1k Nov 26, 2022