SOC — the Security Operations Center 🛡️

EN | FR | 🟡 WALL | one page, every security view

What it is for

The SOC (/soc/, package secubox-soc) gathers on one page the security information that used to be scattered over several admin pages: the Guardian dashboard, live network figures, the firewall (WAF), traffic (DPI-Vivant), intelligence (Actor-Intelligence) and the box's own watch screens. It is a read-only consumer: it owns no data and changes nothing.

The tabs

Tabs are grouped; the default tab is Guardian.

Group	Tab	Content	Source
(none)	Guardian	Seven tiles (threats seen, devices, connections, protocols, countries, critical, dropped), attack map, trend, categories, last events, usages, main devices, decoys, and the Guardian mode	SOC page guardian.html
(none)	Live network	Throughput per interface and packets dropped by the firewall	SOC page reseau.html
Firewall	Threats · Attackers · Campaigns · Surfaces · Visits · History	The WAF views	/waf/ pages
Network & actors	Traffic (DPI)	The DPI overview	/dpi/vue.html
Network & actors	Intelligence	Actor Intelligence	/actor-intelligence/
Station	Vigie	WAF, metrics, profiles, GSM sentinel on one screen	live sources
Station	Meta-metrics	The box looking at itself: modules, sleepers, vhosts, certificates	live sources
Station	Alerts centre	Network and radio alerts on one shared timeline	live sources

The Guardian mode tiles (observe, simulation, mitigate, block) show the mode read from the WAF (/api/v1/waf/enforcement/mode), never an assumed one. The mode is changed in the admin console, never from the SOC.

One source, framed

The firewall, traffic and intelligence tabs are not copies: each one frames the real page in a same-origin iframe (?embed=1). A fix to the WAF page therefore shows in the SOC at once, and the page announces its own height to the frame. This is why the SOC depends on the packages that own those pages.

secubox-soc depends on	For
secubox-waf-ng (>= 1.29.0)	the six firewall tabs (/waf) and the Actor service
secubox-dpi (>= 1.11.2)	the traffic tab (/dpi)
secubox-webos (>= 1.9.7)	the Intelligence page (/actor-intelligence)

Without them a tab would be empty (#2358), so the lite profile (Profils) carries all three through the SOC with their own dependencies.

Live network

Right after Guardian, Live network shows two things on a 24 h window.

• Throughput in and out of every interface, curves on a common scale grouped Interfaces / Tunnels / Containers; interfaces idle for 24 h are folded away.
• Packets dropped by the firewall (nftables), by category.

Four tiles sum it up: incoming now, outgoing now, active interfaces, packets dropped (with the main category). Data comes from the hub, in session:

Route	Content
GET /api/v1/hub/netstats/summary	latest snapshot: categories, interfaces, network_drops, stale flag
GET /api/v1/hub/netstats/series?window=86400&step=300	throughput and drops series (window 5 min to 7 days)

The figures are collected by a root collector run by the secubox-netstats timer (about every two minutes) into a snapshot and a small SQLite base; drops come from named nftables counters (blacklist, quarantine, WAF rate limit, input policy; DoH detection is counted but not as a drop). A banner appears if the collector stopped. A missing measure is "—", never zero.

The page style

All pages follow the Aurora style: ?embed=1 for a framed single column, ?demo=1 for demonstration data announced by a banner, "—" without a measure, a stale or unreadable source said out loud instead of a calm zero.

Threats module

secubox-threats (the Threat Dashboard, /threats/) is the intelligence page for indicators: alerts over 24 h, active IOCs, open incidents, sources, risk score, a 24 h timeline by severity, intelligence feeds and reports. Its web UI was redone in the Aurora style (read-only, ?embed=1, ?demo=1). It also hosts the former AI-insights component. It is a module of its own, beside the SOC.

Ban for 30 days (secubox-threats 1.5.0): the page shows one button per public address of the alerts and of the IP indicators, with an in-page confirmation (never confirm()). It calls the existing POST /api/v1/waf/ban (duration 30d), validated by wafctl, which still refuses private and local addresses; a server refusal or a missing session is reported as is and the button stays usable. No private address is ever offered. This is the only write of the page.

The Interceptor page complements it with maps of where traffic goes out to and where visitors come from.

See also

WAF · Interceptor · Actor-Intelligence · DPI-Vivant · Profils · Cartes-du-Hall · SOC-FR