Security Tab

Relevant source files

The following files were used as context for generating this wiki page:

• src/tabs/security.rs
• src/app.rs
• src/main.rs
• src/file_settings.rs
• README.md
• src/tabs/mod.rs

The Security Tab is a specialized module within LogUtil designed for advanced threat detection and analysis of Nginx access logs. Its primary purpose is to identify suspicious IP addresses, detect common web attack patterns, and provide real-time visual indicators of security risks. Sources: README.md:144-152, src/tabs/security.rs:16-25

This module integrates with the global memory database to pull real-time statistics on suspicious activities and provides an interactive interface for deeper investigation, including log highlighting and threat level assessment. Sources: src/tabs/security.rs:27-46, src/app.rs:37-77

Architecture and Components

The Security Tab is implemented as a stateful component that interacts with the GLOBAL_DB to retrieve and categorize log data. It adheres to the Tab trait and is managed by the central App structure. Sources: src/tabs/security.rs:16-25, src/app.rs:71-74

Data Structure

The SecurityTab struct maintains the state for the TUI, including table selections, search filters, and cached threat data.

Field	Type	Description
table_state	TableState	Manages selection in the suspicious IP list.
log_detail_state	ListState	Manages selection in the detailed log view.
show_log_detail	bool	Toggles between the summary view and detailed log view.
active_panel	usize	0 for the IP panel, 1 for the log panel.
suspicious_ips	Vec<(String, usize)>	Cached list of suspicious IPs and their hit counts.
ip_patterns	HashMap<String, Vec<String>>	Mapping of IPs to specific detected attack signatures.

Sources: src/tabs/security.rs:16-25

Component Interaction Flow

The following diagram illustrates how the Security Tab retrieves and processes security data from the system.

Threat Detection Logic

The system utilizes several internal detection methods to identify specific classes of web attacks based on patterns found in the log lines. Sources: src/tabs/security.rs:188-197

Supported Detection Types

The SecurityTab performs specific pattern matching for the following threats:

• SQL Injection: Searches for keywords like union, select, drop, and xp_.
• XSS (Cross-Site Scripting): Detects <script>, javascript:, and various event handlers like onload=.
• Path Traversal: Identifies sequences like ../, /etc/, and /proc/.
• Command Injection: Looks for shell metacharacters such as ;, |, &, and $(.
• Brute Force: Tracks high-frequency requests (over 10) to authentication endpoints like /login or /wp-admin.

Sources: src/tabs/security.rs:222-263

Threat Level Categorization

Threat levels are assigned based on the frequency of requests and the number of unique patterns detected for a specific IP. Sources: src/tabs/security.rs:286-293

Level	Condition	Icon
HIGH	> 100 requests OR > 3 patterns	🔴
MEDIUM	> 50 requests OR > 1 pattern	🟡
LOW	All other detected suspicious activity	🟢

Sources: src/tabs/security.rs:104-114, src/tabs/security.rs:286-293

User Interface and Interaction

The Security Tab provides a split-pane interface for monitoring and investigating threats. Sources: src/tabs/security.rs:85-91

View Modes

1. Main Security View: Displays a "Security Overview" summary at the top, a list of suspicious IPs on the left, and a log detail panel on the right. Sources: src/tabs/security.rs:68-100
2. Log Detail View: Activated by the d key, this view provides an expanded list of logs for the selected IP with highlighted malicious patterns. Sources: src/tabs/security.rs:164-186

Input Handling

The tab responds to specific keyboard events to facilitate navigation and actions:

• Tab / t: Cycle through application tabs. Sources: src/app.rs:166-180
• Left / Right: Switch focus between the IP list and the Log details panel. Sources: src/tabs/security.rs:388-397
• Up / Down: Navigate through the selected list. Sources: src/tabs/security.rs:347-386
• d: Open the full Log Detail View for the selected IP. Sources: src/tabs/security.rs:412-418
• Enter: Copy the selected IP or log line to the system clipboard. Sources: src/tabs/security.rs:403-407, src/app.rs:136-150
• Esc / q: Return from Log Detail View to Main View. Sources: src/tabs/security.rs:408-411, src/tabs/security.rs:419-423

Log Highlighting

Malicious patterns are visually emphasized in the UI using icons and bracketed text. Sources: src/tabs/security.rs:310-330

fn highlight_suspicious_patterns(&self, log_line: &str) -> String {
    let suspicious_patterns = [
        ("'", "🔴"), ("union", "🔴"), ("select", "🔴"),
        ("<script>", "🟡"), ("javascript:", "🟡"), ("../", "🟡"),
    ];
    // ... logic replaces pattern with icon[pattern]icon
}

Sources: src/tabs/security.rs:310-330

Configuration

The Security Tab is optional and must be enabled via CLI arguments or the interactive settings menu. Sources: src/main.rs:114-115, src/file_settings.rs:119-123

CLI Option	Interactive Setting	Default	Description
--enable-security	Enable Security	false	Activates the Security Tab and background threat detection.

Sources: src/main.rs:114-115, src/file_settings.rs:119-123

The security module contributes significantly to the real-time monitoring capabilities of LogUtil by providing immediate visibility into potential attacks and suspicious traffic patterns, allowing administrators to take proactive measures such as IP blocking. Sources: README.md:144-152