ShadowTrackr

Log in >
RSS feed

Port change notifications

01 July 2019
Last month has seen lost of small changes in existing notifications. The goal is to cleanup the timeline and make it more useful. Some messages are more concise, some are grouped, and some contain more context so you don't have to look things up manually (what was on that ip?).

The biggest one of these changes is in the way port notifications are handled. Each port was a separate event and only showed the port number and ip. Only when showing the timeline where these event grouped, which unnecessarily slowed down the page buildup. And this didn't really work well when scrolling. Port events are now grouped when the event is generated and nicely formatted with proper context. Much better than it was, except for ports that are actively checked (like those with STARTTLS). Active checks produce a lot more information than just checking if a port is open. I still have to figure out a way to integrate those without messing up a nice timeline.

Another problem solved is the different lists of bad ports and advice on what to do. These where different lists on the nodes where the events are generated and on the webservers. Multiple lists are cumbersome to maintain and error prone. If some attacks are spotted more often you want to change the message of the corresponding notification on the bad port list, and maybe the level too. The list is now centrally maintained on the server and automatically pushed to all nodes. From now on you'll get consistent advice on port changes.
Older posts >

Resources
API
Blog
Documentation
Integrations
Shodan
OpenCTI