Implement reversible Sentinel beta foundation

infra/debug-dashboard/app.py

@@ -113,6 +113,44 @@ def overview():
         )
         alerts = cursor.fetchall()
 
+        cursor.execute(
+            """
+            WITH latest AS (
+                SELECT DISTINCT ON (d.machine_name_key, date_trunc('day', r.received_at))
+                       date_trunc('day', r.received_at)::date AS day,
+                       r.alert_state,
+                       r.total_events
+                FROM ocsentinel.scan_report AS r
+                JOIN ocsentinel.device AS d ON d.id = r.device_id
+                WHERE r.received_at >= now() - interval '14 days'
+                ORDER BY d.machine_name_key, date_trunc('day', r.received_at), r.received_at DESC
+            )
+            SELECT day,
+                   count(*) FILTER (WHERE alert_state = 'warning') AS warning_count,
+                   count(*) FILTER (WHERE alert_state = 'critical') AS critical_count,
+                   coalesce(sum(total_events), 0) AS event_count
+            FROM latest
+            GROUP BY day
+            ORDER BY day
+            """
+        )
+        trend = cursor.fetchall()
+
+        cursor.execute(
+            """
+            SELECT coalesce(payload #>> '{NinjaOne,OrganizationId}', 'unknown') AS organization_id,
+                   coalesce(nullif(payload #>> '{NinjaOne,OrganizationName}', ''), 'Organisation unbekannt') AS organization_name,
+                   count(*) AS device_count,
+                   count(*) FILTER (WHERE alert_state = 'warning') AS warning_count,
+                   count(*) FILTER (WHERE alert_state = 'critical') AS critical_count,
+                   max(received_at) AS last_received_at
+            FROM ocsentinel.current_device_status
+            GROUP BY 1, 2
+            ORDER BY critical_count DESC, warning_count DESC, organization_name
+            """
+        )
+        organizations = cursor.fetchall()
+
     report_rows = []
     for row in reports:
         event = event_metadata(row[8])
@@ -142,6 +180,28 @@ def overview():
             }
         )
 
+    trend_rows = [
+        {
+            "day": row[0],
+            "warning_count": row[1],
+            "critical_count": row[2],
+            "event_count": row[3],
+        }
+        for row in trend
+    ]
+    trend_max = max([row["event_count"] for row in trend_rows] or [1])
+    organization_rows = [
+        {
+            "id": row[0],
+            "name": row[1],
+            "device_count": row[2],
+            "warning_count": row[3],
+            "critical_count": row[4],
+            "last_received_at": row[5],
+        }
+        for row in organizations
+    ]
+
     return render_template(
         "overview.html",
         summary=summary,
@@ -149,6 +209,39 @@ def overview():
         reports=report_rows,
         alerts=alert_rows,
         current_alert_count=sum(alert["event"]["is_current"] for alert in alert_rows),
+        trend=trend_rows,
+        trend_max=trend_max,
+        organizations=organization_rows,
+    )
+
+
+@app.get("/organizations/<organization_id>")
+def organization(organization_id):
+    with db_connection() as connection, connection.cursor() as cursor:
+        cursor.execute(
+            """
+            SELECT machine_name, received_at, alert_state, total_events, unique_ip_count,
+                   cve_critical, payload
+            FROM ocsentinel.current_device_status
+            WHERE coalesce(payload #>> '{NinjaOne,OrganizationId}', 'unknown') = %s
+            ORDER BY CASE alert_state WHEN 'critical' THEN 0 WHEN 'warning' THEN 1 ELSE 2 END,
+                     machine_name
+            """,
+            (organization_id,),
+        )
+        devices = cursor.fetchall()
+
+    if not devices:
+        abort(404)
+
+    organization_name = (devices[0][6] or {}).get("NinjaOne", {}).get("OrganizationName") or "Organisation unbekannt"
+    return render_template(
+        "organization.html",
+        organization_id=organization_id,
+        organization_name=organization_name,
+        devices=devices,
+        critical_count=sum(row[2] == "critical" for row in devices),
+        warning_count=sum(row[2] == "warning" for row in devices),
     )
 
 
@@ -197,6 +290,7 @@ def device(machine_name):
         event=event_metadata(payload),
         payload=payload,
         security_events=security_events,
+        ransomware_beta=payload.get("RansomwareBeta") or payload.get("ransomwareBeta") or {},
         payload_pretty=json.dumps(payload, indent=2, ensure_ascii=False),
     )