diff --git a/README.md b/README.md
index 6f50096..3d1f25e 100644
--- a/README.md
+++ b/README.md
@@ -6,4 +6,4 @@ Installation: http://www.flowbat.com/installation.htmlToggle Dropdown ')),"\n",HTML.UL({"class":"dropdown-menu",role:"menu"},HTML.Raw('Execute each 15 minutes Execute each 60 minutes Execute periodically... Output type\n '),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-6"},Spacebars.include(e.lookupTemplate("outputField"))))),Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("output"),"is","rwstats")},function(){return[HTML.FIELDSET({"class":"rwstats-parameters"},HTML.LEGEND("Stats parameters","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"rwstats fields","data-content":"These parameters determine how the statistics are to be calculated by selecting Top-N or Bottom-N, and a value to limit the amount of output. Count sets a static limit (top 20 for instance), threshold outputs all results over/under a specific stats VALUE, and percentage prints the bins where the primary value is greater-than (or less-than) N percent of the sum of the primary values across all bins."})),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-2"},HTML.DIV({"class":["input-group"," ","direction-input-group"]},HTML.DIV({"class":"input-group-btn"},HTML.DIV({"class":"btn-group"},HTML.BUTTON({"class":function(){return["set-property"," ","btn"," ","btn-default"," ",[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("rwstatsDirection"),"is","top")},function(){return"active"})," ",Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return"btn-xs"})]]},"data-property":"rwstatsDirection","data-value":"top",type:"button"},HTML.I({"class":["fa"," ","fa-hand-o-up"]}),"\n","Top"),"\n",HTML.BUTTON({"class":function(){return["set-property"," ","btn"," ","btn-default"," ",[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("rwstatsDirection"),"is","bottom")},function(){return"active"})," ",Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return"btn-xs"})]]},"data-property":"rwstatsDirection","data-value":"bottom",type:"button"},HTML.I({"class":["fa"," ","fa-hand-o-down"]}),"\n","Bottom"))))),"\n",HTML.DIV({"class":"col-xs-2"},HTML.DIV({"class":"form-group"},HTML.DIV({"class":"input-group"},HTML.SPAN({"class":["input-group-addon"," ","equisize-input-group-addon"]},HTML.LABEL(Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),object:Spacebars.call(e.lookup(".")),property:Spacebars.call("rwstatsMode"),value:Spacebars.call("count"),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("radio"))}),"\n","Count")),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsCountModeValue"),value:Spacebars.call(e.lookup("rwstatsCountModeValue")),enabled:Spacebars.call(e.lookup("rwstatsCountModeValueIsEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))})))),"\n",HTML.DIV({"class":"col-xs-2"},HTML.DIV({"class":"form-group"},HTML.DIV({"class":"input-group"},HTML.SPAN({"class":["input-group-addon"," ","equisize-input-group-addon"]},HTML.LABEL(Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),object:Spacebars.call(e.lookup(".")),property:Spacebars.call("rwstatsMode"),value:Spacebars.call("threshold"),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("radio"))}),"\n","Threshold")),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsThresholdModeValue"),value:Spacebars.call(e.lookup("rwstatsThresholdModeValue")),enabled:Spacebars.call(e.lookup("rwstatsThresholdModeValueIsEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))})))),"\n",HTML.DIV({"class":"col-xs-2"},HTML.DIV({"class":"form-group"},HTML.DIV({"class":"input-group"},HTML.SPAN({"class":["input-group-addon"," ","equisize-input-group-addon"]},HTML.LABEL(Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),object:Spacebars.call(e.lookup(".")),property:Spacebars.call("rwstatsMode"),value:Spacebars.call("percentage"),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("radio"))}),"\n","Percentage")),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsPercentageModeValue"),value:Spacebars.call(e.lookup("rwstatsPercentageModeValue")),enabled:Spacebars.call(e.lookup("rwstatsPercentageModeValueIsEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))})))),"\n",HTML.DIV({"class":["col-xs-2"," ","col-xs-offset-2"," ","equisize-input-group-addon"]},HTML.DIV({"class":"input-group"},HTML.SPAN({"class":"input-group-addon"},HTML.LABEL(Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsBinTimeEnabled"),value:Spacebars.call(e.lookup("rwstatsBinTimeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))}),"\n","Bin time")),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsBinTime"),value:Spacebars.call(e.lookup("rwstatsBinTime")),placeholder:Spacebars.call("60"),enabled:Spacebars.call(e.lookup("rwstatsBinTimeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}))))),HTML.FIELDSET({"class":"display-fields-block"},HTML.LEGEND("Stats fields","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"rwstats fields","data-content":"To compute a Top-N or Bottom-N list, the key field(s) must be specified. These are the flow attributes (a.k.a. fields or columns) that make up the key into which flows are binned and statistics are computed from. Bin-time is unique for when time FIELDS are used, to determine the time bin top/bottom-n statistics."})),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},Blaze.Each(function(){return Spacebars.call(e.lookup("rwstatsFieldsOrder"))},function(){return HTML.DIV({"class":"checkbox"},HTML.LABEL(HTML.INPUT({"class":"field-checkbox",type:"checkbox",checked:function(){return Spacebars.mustache(e.lookup("fieldIsSelected"),e.lookup(".."),"rwstatsFields")},value:function(){return Spacebars.mustache(e.lookup("."))},"data-property":"rwstatsFields"}),"\n",Blaze.View(function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))})))})))),HTML.FIELDSET({"class":"display-fields-block"},HTML.LEGEND("Stats values","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"rwstats values","data-content":'These options determine how the statistics are calculated (such as if you are looking for top 10 dip by BYTES for example). When computing a Top-N or Bottom-N, all flows that have the same key field(s) will be binned together. For each bin, one or more aggregate values are computed as specified by VALUES, a comma separated list of names. VALUES that are not Records, Packets, or Bytes are instead "distinct" grouping values (such as how many "distinct-dcc" did a user talk to).'})),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},Blaze.Each(function(){return Spacebars.call(e.lookup("rwstatsValuesOrder"))},function(){return HTML.DIV({"class":"checkbox"},HTML.LABEL(HTML.INPUT({"class":"field-checkbox",type:"checkbox",checked:function(){return Spacebars.mustache(e.lookup("fieldIsSelected"),e.lookup(".."),"rwstatsValues")},value:function(){return Spacebars.mustache(e.lookup("."))},"data-property":"rwstatsValues"}),"\n",Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("."),"in",Spacebars.dot(e.lookup("share"),"rwstatsValues"))},function(){return HTML.STRONG(Blaze.View(function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))}))},function(){return Blaze.View(function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))})})))}))),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-4"},HTML.DIV({"class":"form-group"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsPrimaryValue"),value:Spacebars.call(e.lookup("rwstatsPrimaryValue")),options:Spacebars.call(e.lookup("rwstatsPrimaryValueOptions")),placeholder:Spacebars.call("Primary stats value"),withEmptyOption:Spacebars.call(!0),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("chosen"))})))))]}),Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("output"),"is","rwcount")},function(){return HTML.FIELDSET({"class":"rwcount-parameters"},HTML.LEGEND("Count parameters"),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-5"},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":"control-label"},"Bin size","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"bin size","data-content":"Denote the size of each time bin, in seconds; defaults to 30 seconds."})),"\n",HTML.DIV({"class":"input-group"},HTML.SPAN({"class":"input-group-addon"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwcountBinSizeEnabled"),value:Spacebars.call(e.lookup("rwcountBinSizeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwcountBinSize"),value:Spacebars.call(e.lookup("rwcountBinSize")),enabled:Spacebars.call(e.lookup("rwcountBinSizeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}),"\n",HTML.SPAN({"class":"input-group-addon"},"seconds")))),"\n",HTML.DIV({"class":"col-xs-5"},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":"control-label"},"Load scheme","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"load scheme","data-content":"Specify how a flow record that spans multiple bins allocates its bytes and packets among the bins. The default scheme is time-proportional."})),"\n",HTML.DIV({"class":"input-group"},HTML.SPAN({"class":"input-group-addon"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwcountLoadSchemeEnabled"),value:Spacebars.call(e.lookup("rwcountLoadSchemeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwcountLoadScheme"),value:Spacebars.call(e.lookup("rwcountLoadScheme")),options:Spacebars.call(e.lookup("rwcountLoadSchemeOptions")),enabled:Spacebars.call(e.lookup("rwcountLoadSchemeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("chosen"))})))),"\n",HTML.DIV({"class":"col-xs-2"},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":"control-label"},"Skip zeroes"),"\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"skip zeroes","data-content":"Disable printing of bins with no traffic. By default, all bins are printed."}),"\n",HTML.DIV({"class":["input-group"," ","fake-input-group"]},HTML.SPAN({"class":"input-group-addon"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwcountSkipZeroes"),value:Spacebars.call(e.lookup("rwcountSkipZeroes")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))})),"\n",HTML.DIV({"class":"fake-input"}))))))}),Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup("availableChartTypes"),"length"))},function(){return Spacebars.include(e.lookupTemplate("presentationFieldset"))}),HTML.FIELDSET(HTML.Raw("Final query "),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},Blaze.If(function(){return Spacebars.dataMustache(e.lookup("inputCommand"),e.lookup("currentConfig"),Spacebars.dot(e.lookup("currentUser"),"profile"),!0)},function(){return[HTML.CODE({"class":"query-display"},"$ ",Blaze.View(function(){return Spacebars.mustache(e.lookup("inputCommand"),e.lookup("currentConfig"),Spacebars.dot(e.lookup("currentUser"),"profile"),!0)})),HTML.CODE({"class":"query-display"},"$ ",Blaze.View(function(){return Spacebars.mustache(e.lookup("outputCommand"),e.lookup("currentConfig"),Spacebars.dot(e.lookup("currentUser"),"profile"),!0)}))]},function(){return HTML.CODE({"class":"query-display"},HTML.EM("Please set some options to build the query"))}))))]})}();
+},HTML.DIV({"class":"col-xs-6"},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":"control-label"},"Tuple Delimiter","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"Tuple Delimiter","data-content":"Specifies the character separating the input fields. When the switch is not provided, the default of | is used."})),"\n",HTML.DIV({"class":"input-group"},HTML.SPAN({"class":"input-group-addon"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("tupleDelimiterEnabled"),value:Spacebars.call(e.lookup("tupleDelimiterEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("tupleDelimiter"),value:Spacebars.call(e.lookup("tupleDelimiter")),enabled:Spacebars.call(e.lookup("tupleDelimiterEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))})))),"\n",HTML.DIV({"class":"col-xs-6"},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":"control-label"},"Tuple Fields","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"Tuple Fields","data-content":'These define how to interpret the list of fields (columns) in the Tuple File in the order in which they appear in the file. For instance, if you have two ip addresses, you might use "sip,dip".'})),"\n",HTML.DIV({"class":"input-group"},HTML.SPAN({"class":"input-group-addon"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("tupleFieldsEnabled"),value:Spacebars.call(e.lookup("tupleFieldsEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("tupleFields"),value:Spacebars.call(e.lookup("tupleFields")),enabled:Spacebars.call(e.lookup("tupleFieldsEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}))))),HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":"control-label"},"Additional parameters","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"Additional parameters","data-content":"Used to specify additional SiLK rwfilter command line options not made available through the FlowBAT interface. This should be used by advanced users only."})),"\n",HTML.DIV({"class":["input-group"," ","additional-parameters-form-group"]},HTML.SPAN({"class":"input-group-addon"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("additionalParametersEnabled"),value:Spacebars.call(e.lookup("additionalParametersEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("additionalParameters"),value:Spacebars.call(e.lookup("additionalParameters")),enabled:Spacebars.call(e.lookup("additionalParametersEnabled")),placeholder:Spacebars.call("Raw command-line options"),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}))))),HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":"control-label"},"Exclusions"),"\n",HTML.DIV({"class":["input-group"," ","additional-parameters-form-group"]},HTML.SPAN({"class":"input-group-addon"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("additionalExclusionsCmdEnabled"),value:Spacebars.call(e.lookup("additionalExclusionsCmdEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("additionalExclusionsCmd"),value:Spacebars.call(e.lookup("additionalExclusionsCmd")),enabled:Spacebars.call(e.lookup("additionalExclusionsCmdEnabled")),placeholder:Spacebars.call('Use "OR" to separate exclusions, for example: --type=7 OR --dport=80'),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))})))))]})),HTML.FIELDSET(HTML.Raw('Output type\n '),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-6"},Spacebars.include(e.lookupTemplate("outputField"))))),Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("output"),"is","rwstats")},function(){return[HTML.FIELDSET({"class":"rwstats-parameters"},HTML.LEGEND("Stats parameters","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"Stats Parameters","data-content":"These parameters determine how the statistics are to be calculated by selecting Top-N or Bottom-N, and a value to limit the amount of output. Count sets a static limit (top 20 for instance), threshold outputs all results over/under a specific stats VALUE, and percentage prints the bins where the primary value is greater-than (or less-than) N percent of the sum of the primary values across all bins."})),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-2"},HTML.DIV({"class":["input-group"," ","direction-input-group"]},HTML.DIV({"class":"input-group-btn"},HTML.DIV({"class":"btn-group"},HTML.BUTTON({"class":function(){return["set-property"," ","btn"," ","btn-default"," ",[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("rwstatsDirection"),"is","top")},function(){return"active"})," ",Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return"btn-xs"})]]},"data-property":"rwstatsDirection","data-value":"top",type:"button"},HTML.I({"class":["fa"," ","fa-hand-o-up"]}),"\n","Top"),"\n",HTML.BUTTON({"class":function(){return["set-property"," ","btn"," ","btn-default"," ",[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("rwstatsDirection"),"is","bottom")},function(){return"active"})," ",Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return"btn-xs"})]]},"data-property":"rwstatsDirection","data-value":"bottom",type:"button"},HTML.I({"class":["fa"," ","fa-hand-o-down"]}),"\n","Bottom"))))),"\n",HTML.DIV({"class":"col-xs-2"},HTML.DIV({"class":"form-group"},HTML.DIV({"class":"input-group"},HTML.SPAN({"class":["input-group-addon"," ","equisize-input-group-addon"]},HTML.LABEL(Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),object:Spacebars.call(e.lookup(".")),property:Spacebars.call("rwstatsMode"),value:Spacebars.call("count"),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("radio"))}),"\n","Count")),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsCountModeValue"),value:Spacebars.call(e.lookup("rwstatsCountModeValue")),enabled:Spacebars.call(e.lookup("rwstatsCountModeValueIsEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))})))),"\n",HTML.DIV({"class":"col-xs-2"},HTML.DIV({"class":"form-group"},HTML.DIV({"class":"input-group"},HTML.SPAN({"class":["input-group-addon"," ","equisize-input-group-addon"]},HTML.LABEL(Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),object:Spacebars.call(e.lookup(".")),property:Spacebars.call("rwstatsMode"),value:Spacebars.call("threshold"),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("radio"))}),"\n","Threshold")),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsThresholdModeValue"),value:Spacebars.call(e.lookup("rwstatsThresholdModeValue")),enabled:Spacebars.call(e.lookup("rwstatsThresholdModeValueIsEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))})))),"\n",HTML.DIV({"class":"col-xs-2"},HTML.DIV({"class":"form-group"},HTML.DIV({"class":"input-group"},HTML.SPAN({"class":["input-group-addon"," ","equisize-input-group-addon"]},HTML.LABEL(Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),object:Spacebars.call(e.lookup(".")),property:Spacebars.call("rwstatsMode"),value:Spacebars.call("percentage"),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("radio"))}),"\n","Percentage")),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsPercentageModeValue"),value:Spacebars.call(e.lookup("rwstatsPercentageModeValue")),enabled:Spacebars.call(e.lookup("rwstatsPercentageModeValueIsEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))})))),"\n",HTML.DIV({"class":["col-xs-2"," ","col-xs-offset-2"," ","equisize-input-group-addon"]},HTML.DIV({"class":"input-group"},HTML.SPAN({"class":"input-group-addon"},HTML.LABEL(Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsBinTimeEnabled"),value:Spacebars.call(e.lookup("rwstatsBinTimeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))}),"\n","Bin time")),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsBinTime"),value:Spacebars.call(e.lookup("rwstatsBinTime")),placeholder:Spacebars.call("60"),enabled:Spacebars.call(e.lookup("rwstatsBinTimeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}))))),HTML.FIELDSET({"class":"display-fields-block"},HTML.LEGEND("Stats fields","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"rwstats fields","data-content":"To compute a Top-N or Bottom-N list, the key field(s) must be specified. These are the flow attributes (a.k.a. fields or columns) that make up the key into which flows are binned and statistics are computed from. Bin-time is unique for when time FIELDS are used, to determine the time bin top/bottom-n statistics."})),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},Blaze.Each(function(){return Spacebars.call(e.lookup("rwstatsFieldsOrder"))},function(){return HTML.DIV({"class":"checkbox"},HTML.LABEL({"data-toggle":"popover",title:function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))},"data-content":function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldDefinitions"))}},HTML.INPUT({"class":"field-checkbox",type:"checkbox",checked:function(){return Spacebars.mustache(e.lookup("fieldIsSelected"),e.lookup(".."),"rwstatsFields")},value:function(){return Spacebars.mustache(e.lookup("."))},"data-property":"rwstatsFields"}),"\n",Blaze.View(function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))})))})))),HTML.FIELDSET({"class":"display-fields-block"},HTML.LEGEND("Stats values","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"rwstats values","data-content":'These options determine how the statistics are calculated (such as if you are looking for top 10 dip by BYTES for example). When computing a Top-N or Bottom-N, all flows that have the same key field(s) will be binned together. For each bin, one or more aggregate values are computed as specified by VALUES, a comma separated list of names. VALUES that are not Records, Packets, or Bytes are instead "distinct" grouping values (such as how many "distinct-dcc" did a user talk to).'})),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},Blaze.Each(function(){return Spacebars.call(e.lookup("rwstatsValuesOrder"))},function(){return HTML.DIV({"class":"checkbox"},HTML.LABEL({"data-toggle":"popover",title:function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))},"data-content":function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldDefinitions"))}},HTML.INPUT({"class":"field-checkbox",type:"checkbox",checked:function(){return Spacebars.mustache(e.lookup("fieldIsSelected"),e.lookup(".."),"rwstatsValues")},value:function(){return Spacebars.mustache(e.lookup("."))},"data-property":"rwstatsValues"}),"\n",Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("."),"in",Spacebars.dot(e.lookup("share"),"rwstatsValues"))},function(){return HTML.STRONG(Blaze.View(function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))}))},function(){return Blaze.View(function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))})})))}))),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-4"},HTML.DIV({"class":"form-group"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwstatsPrimaryValue"),value:Spacebars.call(e.lookup("rwstatsPrimaryValue")),options:Spacebars.call(e.lookup("rwstatsPrimaryValueOptions")),placeholder:Spacebars.call("Primary stats value"),withEmptyOption:Spacebars.call(!0),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("chosen"))})))))]}),Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("output"),"is","rwcount")},function(){return HTML.FIELDSET({"class":"rwcount-parameters"},HTML.LEGEND("Count parameters"),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-5"},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":"control-label"},"Bin size","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"bin size","data-content":"Denote the size of each time bin, in seconds; defaults to 30 seconds."})),"\n",HTML.DIV({"class":"input-group"},HTML.SPAN({"class":"input-group-addon"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwcountBinSizeEnabled"),value:Spacebars.call(e.lookup("rwcountBinSizeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwcountBinSize"),value:Spacebars.call(e.lookup("rwcountBinSize")),enabled:Spacebars.call(e.lookup("rwcountBinSizeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}),"\n",HTML.SPAN({"class":"input-group-addon"},"seconds")))),"\n",HTML.DIV({"class":"col-xs-5"},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":"control-label"},"Load scheme","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"load scheme","data-content":"Specify how a flow record that spans multiple bins allocates its bytes and packets among the bins. The default scheme is time-proportional."})),"\n",HTML.DIV({"class":"input-group"},HTML.SPAN({"class":"input-group-addon"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwcountLoadSchemeEnabled"),value:Spacebars.call(e.lookup("rwcountLoadSchemeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwcountLoadScheme"),value:Spacebars.call(e.lookup("rwcountLoadScheme")),options:Spacebars.call(e.lookup("rwcountLoadSchemeOptions")),enabled:Spacebars.call(e.lookup("rwcountLoadSchemeEnabled")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("chosen"))})))),"\n",HTML.DIV({"class":"col-xs-2"},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":"control-label"},"Skip zeroes"),"\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"skip zeroes","data-content":"Disable printing of bins with no traffic. By default, all bins are printed."}),"\n",HTML.DIV({"class":["input-group"," ","fake-input-group"]},HTML.SPAN({"class":"input-group-addon"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("rwcountSkipZeroes"),value:Spacebars.call(e.lookup("rwcountSkipZeroes")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("checkbox"))})),"\n",HTML.DIV({"class":"fake-input"}))))))}),Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup("availableChartTypes"),"length"))},function(){return Spacebars.include(e.lookupTemplate("presentationFieldset"))}),HTML.FIELDSET(HTML.Raw("Final query "),"\n",HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},Blaze.If(function(){return Spacebars.dataMustache(e.lookup("inputCommand"),e.lookup("currentConfig"),Spacebars.dot(e.lookup("currentUser"),"profile"),!0)},function(){return[HTML.CODE({"class":"query-display"},"$ ",Blaze.View(function(){return Spacebars.mustache(e.lookup("inputCommand"),e.lookup("currentConfig"),Spacebars.dot(e.lookup("currentUser"),"profile"),!0)})),HTML.CODE({"class":"query-display"},"$ ",Blaze.View(function(){return Spacebars.mustache(e.lookup("outputCommand"),e.lookup("currentConfig"),Spacebars.dot(e.lookup("currentUser"),"profile"),!0)}))]},function(){return HTML.CODE({"class":"query-display"},HTML.EM("Please set some options to build the query"))}))))]})}();
!function(){Template.__checkName("rwcountCmd"),Template.rwcountCmd=new Template("Template.rwcountCmd",function(){var a=this;return HTML.DIV({"class":"input-group"},HTML.Raw('rwcount
\n'),Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(a.lookup("_id")),property:Spacebars.call("rwcountCmd"),value:Spacebars.call(a.lookup("rwcountCmd")),isNew:Spacebars.call(a.lookup("isNew"))}},function(){return Spacebars.include(a.lookupTemplate("input"))}))})}();
@@ -226,7 +226,7 @@ Router=Package["iron:router"].Router,RouteController=Package["iron:router"].Rout
!function(){Template.__checkName("footer"),Template.footer=new Template("Template.footer",function(){var e=this;return HTML.FOOTER({"class":"footer"},HTML.DIV({"class":"container"},HTML.DIV({"class":"row"},HTML.DIV({"class":["col-xs-6"," ","col-xs-offset-3"]},HTML.H6({"class":"text-center"},Blaze.View(function(){return Spacebars.mustache(e.lookup("version"))}))))))})}();
-!function(){Template.__checkName("help"),Template.help=new Template("Template.help",function(){var e=this;return HTML.Raw('
Help \n
Documentation will be here soon.
FlowBAT \n is a graphical flow-based analysis tool. Utilizing the power and versatility of network flow records,\nFlowBAT \n can help provide visibility for network administrators and network security practitioners.
\nWhether you are a seasoned pro at using flow data or brand new to it, FlowBAT provides a user experience that should make it easy to rapidly track connections in to and out of your network. This includes
\nInvestigating intrusion detection system alerts \nTracking attacker activity through a network \nTroubleshooting network communication issues \nLearning more about the communication to/from devices on your network FlowBAT \nTech \nCount \nTech \nInstallation \nInitial Configuration
\n- SiLK Site Configuration File \n- SiLK Root Directory \n- Temporary Storage Directory
\n\n- Filters \n- Exclusions \n- Stats \n- Count \n- IP Sets \n- Tuple Files \n- PCAP Analysis \n- RWF Analysis
\n\n- Dashboard \n- Quick Query \n- Saved Queries \n- IP Sets \n- Tuple Files \n- Night Mode \n- Configuration Settings \n- User Administration \n- SiLK Server Administration \n- Help
\n\n- Standards \n- HTTPS
\n\nFlowBAT \n is written in Node.js using the Meteor framework. It is designed to work along side an existing\nSiLK \n-based NetFlow system, or to be installed in conjunction with one.\nFlowBAT \n was written with ease of installation and deployment in mind.
\nIf you’re reading this, you probably already succeeded at installing\nFlowBAT \n. However, if you are perhaps not the installer and are looking to check out what went into getting this running, check out the\ninstallation \n documentation. It was probably just two scripts and maybe some manually configuration editing of sensor.conf and silk.conf.
\nThis is the main configuration file that SiLK uses to interpret your sensor deployment. If you’ve installed using the scripts provided at\nFlowBAT \n.com then it is /data/silk.conf
\nThis is the directory where you are storing flow data on the SiLK server. If you’ve installed using the scripts provided at\nFlowBAT \n.com then it is /data/
\nThis is where temporary files, sets, rwf files, and generally anything else that FlowBAT needs to make and use later will be stored. It is easy to want to use /tmp/ as the directory but due to how the filesystem cleans it up regularly, it is not recommended. Instead, create a directory that you can manually control if needed.
\nFlowBAT \n can be used to search for flows, perform stats against user defined bins of flow data, or it can be used to count flows of a certain type and put them in timebased bins for a time based analysis. The record results are presented as a customizable table where columns can be moved around via mouse, and fields can be removed using selection boxes below the table. Single clicking a column will all data on the table in an ascending or descending order based on the column clicked. Every value in the table has a pivot capability when clicked. For instance, timestamps can be used to further customize the filter by adding a “Before/After 1 minute” to the filter simply by clicking and pivoting off of the user selected time in the table. IP addresses have lookup features in Robtex. More sources are being added via updates.\nStats \n and\nCount \n output types can be presented as either a table or a chart.\nStats \n is based on\nrwstats \n and the tables have limited pivoting available for\nStats Fields \n.\nCount \n is based on\nrwcount \n and has static table output as well as line chart output. For more details on\nStats \n and\nCount \n usage, see below.
\nThe most common usage of FlowBAT will be to use filters to search for specific flows from a SiLK datastore. The syntax for a query is implicitly “AND”, meaning that every record in a result will be a match of the combined result of all user provided options in the query. The goal is always to narrow down to smaller results via\nfilters \n, and then you can do more specific carving using\nexclusions \n. Lets say that you are looking for traffic where either address is 192.168.1.15. Your filter will be as simple as:
\n--any-address=192.168.1.15 --type=allThe\nany-address \n option says to look for 192.168.1.15 in source or destination IP address fields. The\ntype \n option is an input option that states that we want to look in all forms of traffic whether it is inbound, outbound, or internal to internal traffic. In this case the\ntype \n is redundant though due to liberties taken in FlowBAT to meet more common user use cases. We default to “all” for the\ntype \n field. See “Other Notes” at the end of this documentation for more detail.
\nExclusions \n are used to narrow a filter’s results. Think of exclusions as doing an equal and opposite feature of filtering. Assume that you have a fair amount of SSH traffic and Google Hangouts traffic that is overwhelming a specific search. Hypothetically the following exclusion would remove records from the results that have [a source IP address of 192.168.1.15 and a source address of port 22] OR [UDP records with some local source IP addresses that looks like Google Hangouts traffic on ports 19302 through 19309]. You could write an exclusion as such:
\n--saddress=192.168.1.15 --sport=22 OR --protocol=17 --scidr=192.168.0.0/16 --dcidr=173.194.0.0/16,74.125.0.0/16 --aport=19302-19309If you’re wanting to look for large groupings of IP addresses, you’ll want to generate IP sets. Please refer to the “IP Sets” section for more information. When filters alone won’t accomplish some goals of pulling very specific 5-tuple combinations, we allow the creation of 5-tuple files for use in the query builder. See “Tuple Files” for more information.
\nStats \n is based on\nrwstats \n and is used to calculate top-n/bottom-n lists based on user definied fields and stat values.\nStats \n is best explained via examples and the best practice is usually to try to put into words what you are looking for first. For instance, you are looking for the [top 10 sIP-dIP pairs by bytes]. In this case you would specify “Top”, “Count=10”, select Source IP and Dest IP as fields, and select “Bytes” as the\nStats Value \n. Multiple\nStats Values \n can be selected as long as the value does not match the field being searched for. In the event that you are pulling muliple stat values, you’ll want to select the *Primary Stats Value" that is most important to you. The other fields will be supplementary information, but will not be the main values being used to calculate against.
\nTable output allows for pivoting on certain\nstats fields \n but not on\nstats values \n. You can select between bar, column, and pie charts for the chart display. The chart uses a logarithmic scale due to the widely varying values when using multiple\nstats values
\nCount \n is based on\nrwcount \n and is used to summarize flow records over time, grouping record, byte, and packet counts into time bins of a user defined duration. Each row in the table output each data point on the line chart output represents one bin. If the user uses a 60 second bin size (the default is 30 seconds) this means that the total number of records/minute, bytes/minute, and packets/minute. Special considerations need to be taken when making charts with rwcount. If the time range specified is incredible long and the bin size is unreasonably small for that range, the chart will take a long time to create and it will be illegible if it actually appears. This is because you are loading the entire dataset onto one chart.
\nIP Sets \n are user defined lists of IP addresses that can be edited in the “IP Sets” tab in the navbar at the top of the screen. There you will create an IP set that can be IP addresses, CIDR ranges, or combinations of the two. Saving the results will allow you to specify those sets in the query builder under the “host” subheading. As before, selecting\nany IP set \n will add the\nanyset \n option to the query. That option looks for any match from the sets, regardless if they occur as the source or destination IP address.
\nTuple Files \n allow you to specify up to an entire 5-tuple to search for, and by default it will search in any direction. This means that if you choose to only look for communications between two addresses, you can specify them in the file as something like “192.168.1.15,8.8.8.8”. You can save as many tuples as you would like in the file (just as you did in IP Sets), but specifying the options in the query builder is slightly more complex to give you more power in filtering. Under the “additional options” subheading in the query builder you’ll find Tuple File, Tuple Direction, Tuple Delimiter, and Tuple Fields. After selecting the tuple file that you’ve created, the tuple direction refers to what order you wish to search in. Selecting “both” will search for any occurence of the tuple elements regardless of where they appear in the individual record. This is the most common use case as it accomplishes a task that isn’t easily specified in default options. After specifying direction, you need to tell FlowBAT how the tuple file is formatted. Provide the delimiter that you chose (in this example we are using a comma\n, \n), and tell FlowBAT what the elements are in the tuple. In this case, we can say\nsip,dip \n. If we’ve chosen the tuple direction to be both, this really just implies that both of the values are IP addresses. Had we chosen otherwise, the sip,dip would have more meaning. Also, had we provided the full 5-tuple we might have used\nsip,dip,sport,dport,protocol \n to define the tuple fields.
\nPCAP analysis can be performed in FlowBAT by specifying the full path of the file at either the command line FlowBAT interface or the "Additional Options" tab. See the examples at the end of this documentation for more details.
\n/home/jason/badguys.pcap --saddress=192.168.1.15 --aport=31337RWF files are the binary files that SiLK tools operate on. These can also be created at the command line in cases where automation might be desired. If you need to review an rwf file in FlowBAT, simply specify it prior to the rest of the filter.
\n/home/jason/IOT.rwf --type=out,outweb --packets=4- --ack-flag=1FlowBAT \n was created to be a more user-friendly frontend for the SiLK flow analysis tool suite. Seasoned professionals will notice that many tools are not immediately available to use, but instead have been packaged together in an effort to meet the most common SiLK analysis use-cases.\nFlowBAT \n allows the user to search and filter for flow data as well as run statistics based on the outputs. The main FlowBAT Interface is divided into six main sections:
\nDashboard \nQuick Query \nSaved Queries \nIP Sets \nTuple Files \nConfiguration Settings If this is your first time booting up\nFlowBAT \n you might notice that the dashboard is a plain canvas. This is a place to put the output of saved queries. Those outputs might be bandwidth graphs or tables of records with interactions with malicious IP sets, or generally just anything you want. In order to make them actionable in a dashboard, you’ll want to make sure that the outputs are updated, so make sure that the intended queries have rolling times and periodic execution. At the top of the Dashboard is a quick query command interface input. This input allows for running a search spontaneously without navigating manually to other tabs. For the query builder, you will need to go to\nquick query \n or\nsaved queries \n.
\nRunning a quick query is useful when you are just doing some regular hunting or providing situational awareness upon request. If it is something that you don’t think that you will keep, then quick query is the place to go. However, in the event that you just love something you’ve found, you can go ahead and make it a saved query on the fly from the quick query page. In the event that you cannot filter exactly how you want, or perhaps there is an outlier that you also want removed, you can also provide “exclusions” which will remove data from your results. See “Basic Usage and Best Practices”. There is also a query builder that provides individual descriptions and input fields for those not verse in SiLK syntax already. Each input contains a help bubble that can assist in understanding what fields mean. Upon adding fields in the query builder, the full SiLK query itself (in red) is populated below the input parameters. New users can take note of the syntax to ween themselves off of the query builder and opt to make use of quick query for a more streamlined experience.
\nThe\nSaved Queries \n tab shows all queries that you have saved. This tab also provides the actual SiLK queries needed to replicate from the command line on the server itself (useful for those wanting to learn SiLK syntax and run automated tasks against flow data). Query names in this list are referenced when selecting outputs to display on the dashboard.
\nHere you can create an IP set that can be IP addresses, CIDR ranges, or combinations of the two. Saving the results will allow you to specify those sets in the query builder under the “host” subheading. When creating IP sets it is recommended that you leave a note descibing the set and have a unique IP set name. The name will be referenced in the query builder. See “Basic Usage and Best Practices” for more details.
\nHere you can create a tuple file (see “Basic Usage and Best Practices” for more details on these unique files). Saving the results will allow you to specify those tuples in the query builder under the “Additional options” subheading. When creating tuple files it is recommended that you leave a note descibing the file and have a unique name. The name will be referenced in the query builder. See “Basic Usage and Best Practices” for more details.
\nNight Mode changes the visual theme of FlowBAT to make it easier on the eyes in darker environments. Simple click the sun/moon symbol to toggle. Night Mode is only available on webkit enabled browsers (Chrome, Safari, Opera).
\nThese are options available to all users.
\nAdd, remove, or edit users.
\nChange initial FlowBAT configuration options such as silk.conf location, data directory, temporary storage directory, and SSH options. See “Initial Configuration” for more details.
\nYou are here.
\nSearch for all records with IP address 192.168.1.15 as either source IP or dest IP
\nFilter: --any-address=192.168.1.15Search for 192.168.1.15 but only show outbound flows
\nFilter: --any-address=192.168.1.15 --type=out,outwebLook at the top 10 source-dest ip pairs with stats by bytes
\nFilter: --protocol=0-255\nStats: --top --count=10 --fields=sip,dip --values=bytesLook at the top 10 list of destination country codes for outbound traffic by packets, excluding the United States, Great Britain, and private IP space
\nFilter: --protocol=0-255 --type=out,outweb\nExclusion: --dcc=US,GB,--\nStats: --top --count=10 --fields=dcc --values=packetsExamine a pre-made RWF file of IoT traffic to determine how much outbound data is traversing the network.
\nFilter: /home/jason/IOT.rwf --type=out,outweb --packets=4- --ack-flag=1\nCount: --bin-size=60Examine a PCAP file to generate a list of the top talking sip-dip pairs by bytes.
\nFilter: /home/jason/badguys.pcap --protocol=0-255\nStats --top --count=10 --fields=sip,dip --values=bytesFlowBAT \n makes every attempt at keeping most of the standards set by\nSiLK \n and only deviates when it is in the analysts best interest. The most significant change is regarding the\ntype \n default values when creating a filter. If you’re a veteran of SiLK you’ll probably know that SiLK defaults to incoming traffic as per the\nrwfilter \n documentation:
\nThe default-type list is determined by the value of CLASS, and the default types generally include only incoming traffic.
In our experience analysts generally intend to start searching by looking through all flows collected and as such\nwe have made “all” the default value for\ntype \n.
\nWe have also provided a script in the support folder of the project that allows the user to quickly set up an nginx proxy for https access. This script is only meant to ensure that connections made to FlowBAT are encrypted, but as with any security measures, you should customize the proxy configuration to your own liking if you desire any more than what is described here.
\nDon’t hesitate to email\nsupport \n if you have any questions or feature requests about\nFlowBAT \n. You can also submit\nissues \n if you feel inclined to submit bugs or requests via github.
\nFor more information on\nSiLK \n please see the [SiLK documentation] and for tool specific documentation, see the following
\n\nRefer to the\nlicense \n on the project page.
'))))))})}();
!function(){Template.__checkName("ipset"),Template.ipset=new Template("Template.ipset",function(){var e=this;return HTML.DIV({"class":["container-fluid"," ","ipset-default"," ","ipset"]},HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},Spacebars.With(function(){return Spacebars.call(e.lookup("ipset"))},function(){return HTML.FORM({"class":["panel"," ","panel-default"]},HTML.DIV({"class":"panel-heading"},HTML.DIV({"class":"form-group"},HTML.LABEL("IP Set Name","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"IP Set name","data-content":"This is the name that will be referenced in the query builder."})),"\n",HTML.DIV({"class":"input-group"},Blaze._TemplateWith(function(){return{family:Spacebars.call("ipset"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("name"),value:Spacebars.call(e.lookup("name")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}),"\n",HTML.DIV({"class":"input-group-btn"},HTML.BUTTON({"class":["btn"," ","btn-default"," ","dropdown-toggle"],"data-toggle":"dropdown",type:"button"},HTML.SPAN({"class":"caret"})),"\n",HTML.UL({"class":["dropdown-menu"," ","pull-right"]},HTML.LI(HTML.A({"class":"confirm",href:function(){return["/ipset/",Spacebars.mustache(e.lookup("_id")),"/remove"]},"data-confirmation":"Are you sure you want to delete this IP Set?"},HTML.I({"class":["fa"," ","fa-trash-o"]}),"\n","Delete this IP Set"))))))),"\n",HTML.DIV({"class":"panel-body"},HTML.DIV({"class":"form-group"},HTML.LABEL("Note","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"Note","data-content":"These notes are for personal use and can be quickly referenced when examining the list in the IP Sets tab in the navbar."})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("ipset"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("note"),value:Spacebars.call(e.lookup("note")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("textarea"))})),"\n",HTML.DIV({"class":"form-group"},HTML.LABEL("IP Addresses","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"IP addresses","data-content":"List of IP addresses or CIDR ranges. When sets are specified in the query builder (via Source IP Set, Destination IP Set, or Any IP Set), records that contain matching IP addresses will be displayed."})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("ipset"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("contents"),value:Spacebars.call(e.lookup("contents")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("textarea"))})),"\n",HTML.DIV({"class":"form-group"},HTML.BUTTON({"class":["btn"," ","btn-primary"],type:"submit"},"Save"),"\n",HTML.SPAN({"class":["save-notice"," ","notice"," ","text-success"]},"Successfully saved"),"\n",HTML.SPAN({"class":["create-notice"," ","notice"," ","text-success"]},"Successfully created")),"\n",Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup("queries"),"count"))},function(){return[HTML.HR(),HTML.H4("Queries using this IP Set"),HTML.UL(Blaze.Each(function(){return Spacebars.call(e.lookup("queries"))},function(){return HTML.LI(HTML.A({href:function(){return Spacebars.mustache(e.lookup("path"))}},Blaze.View(function(){return Spacebars.mustache(e.lookup("displayName"))})))}))]})))}))))})}();
@@ -236,13 +236,13 @@ Router=Package["iron:router"].Router,RouteController=Package["iron:router"].Rout
!function(){Template.__checkName("login"),Template.login=new Template("Template.login",function(){var n=this;return[HTML.LI({"class":"dropdown"},HTML.Raw('Sign in\n '),"\n",HTML.UL({"class":"dropdown-menu"},HTML.LI(HTML.DIV({"class":"signin"},HTML.BUTTON({"class":["btn"," ","btn-primary"," ","sign-in-with-google"]},Blaze.If(function(){return Spacebars.call(n.lookup("loggingIn"))},function(){return"Signing in..."},function(){return"Sign in with Google"})),"\n",HTML.Raw("or
"),"\n",HTML.FORM({autocomplete:"off"},HTML.Raw('
'),"\n",HTML.Raw('
'),"\n",HTML.DIV({"class":["links"," ","clearfix"]},HTML.BUTTON({"class":["btn"," ","btn-default"],type:"submit"},Blaze.If(function(){return Spacebars.call(n.lookup("loggingIn"))},function(){return"Signing in..."},function(){return"Sign in"})),"\n",HTML.A({"class":["forgot-password"," ","pull-right"],href:"#"},Blaze.View(function(){return Spacebars.mustache(n.lookup("t"),"forms.login.passwordForgot.link")})))))))),HTML.LI({"class":"dropdown"},HTML.Raw('Sign up\n '),"\n",HTML.UL({"class":"dropdown-menu"},HTML.LI(HTML.DIV({"class":"signup"},HTML.BUTTON({"class":["btn"," ","btn-primary"," ","sign-in-with-google"]},Blaze.If(function(){return Spacebars.call(n.lookup("loggingIn"))},function(){return"Signing in..."},function(){return"Sign up with Google"})),"\n",HTML.Raw("or
"),"\n",HTML.FORM({autocomplete:"off"},HTML.Raw('
'),"\n",HTML.Raw('
'),"\n",HTML.Raw('
'),"\n",HTML.DIV({"class":["links"," ","clearfix"]},HTML.BUTTON({"class":["btn"," ","btn-default"," ","pull-left"],type:"submit"},Blaze.If(function(){return Spacebars.call(n.lookup("loggingIn"))},function(){return"Signing up..."},function(){return"Sign up"}))))))))]})}();
-!function(){Template.__checkName("navbar"),Template.navbar=new Template("Template.navbar",function(){var a=this;return HTML.NAV({"class":["navbar"," ","navbar-default"," ","navbar-static-top"," ","navbar-main"],role:"navigation"},HTML.DIV({"class":"container-fluid"},HTML.Raw(''),"\n",HTML.DIV({id:"top-navbar-collapse","class":["collapse"," ","navbar-collapse"]},HTML.UL({"class":["nav"," ","navbar-nav"]},Blaze.If(function(){return Spacebars.call(a.lookup("currentUser"))},function(){return[HTML.LI({"class":function(){return Blaze.If(function(){return Spacebars.dataMustache(a.lookup("condition"),a.lookup("currentTemplateName"),"is","dashboard")},function(){return"active"})}},HTML.A({href:"/"},"Dashboard")),HTML.LI({"class":function(){return Blaze.If(function(){return Spacebars.dataMustache(a.lookup("condition"),a.lookup("currentTemplateName"),"in","query")},function(){return Blaze.If(function(){return Spacebars.call(Spacebars.dot(a.lookup("queryObject"),"isQuick"))},function(){return"active"})})}},HTML.A({href:"/query/create/quick"},"Quick Query")),HTML.LI({"class":function(){return Blaze.If(function(){return Spacebars.dataMustache(a.lookup("condition"),a.lookup("currentTemplateName"),"in","queryList","query")},function(){return Blaze.If(function(){return Spacebars.dataMustache(a.lookup("not"),Spacebars.dot(a.lookup("queryObject"),"isQuick"))},function(){return"active"})})}},HTML.A({href:"/query/list"},"Saved Queries")),HTML.LI({"class":function(){return Blaze.If(function(){return Spacebars.dataMustache(a.lookup("condition"),a.lookup("currentTemplateName"),"in","ipsetList","ipset","ipsetCreate")},function(){return"active"})}},HTML.A({href:"/ipset/list"},"IP Sets")),HTML.LI({"class":function(){return Blaze.If(function(){return Spacebars.dataMustache(a.lookup("condition"),a.lookup("currentTemplateName"),"in","tupleList","tuple","tupleCreate")},function(){return"active"})}},HTML.A({href:"/tuple/list"},"Tuple Files"))]})),"\n",HTML.UL({"class":["nav"," ","navbar-nav"," ","navbar-right"]},Blaze.If(function(){return Spacebars.call(a.lookup("currentUser"))},function(){return HTML.LI({"class":"dropdown"},HTML.A({"class":"dropdown-toggle",href:"#","data-toggle":"dropdown"},Blaze.View(function(){return Spacebars.mustache(Spacebars.dot(a.lookup("currentUser"),"profile","name"))}),"\n",HTML.B({"class":"caret"})),"\n",HTML.UL({"class":"dropdown-menu"},HTML.Comment('li: a(href="/user/{{currentUser._id}}") Profile'),"\n",Blaze.If(function(){return Spacebars.dataMustache(a.lookup("currentUserHasRole"),"admin")},function(){return[HTML.LI(HTML.A({href:"/users"},"User administration")),HTML.LI(HTML.A({href:"/config"},"SiLK server configuration"))]},function(){return HTML.LI(HTML.A({href:"/profile"},"Profile"))}),"\n",HTML.LI(HTML.A({href:"/help"},"Help")),"\n",HTML.LI({"class":"divider"}),"\n",HTML.LI(HTML.A({"class":"logout",href:"#"},"Logout"))))},function(){return Spacebars.include(a.lookupTemplate("login"))})))))})}();
+!function(){Template.__checkName("navbar"),Template.navbar=new Template("Template.navbar",function(){var e=this;return HTML.NAV({"class":["navbar"," ","navbar-default"," ","navbar-static-top"," ","navbar-main"],role:"navigation"},HTML.DIV({"class":"container-fluid"},HTML.Raw(''),"\n",HTML.DIV({id:"top-navbar-collapse","class":["collapse"," ","navbar-collapse"]},HTML.UL({"class":["nav"," ","navbar-nav"]},Blaze.If(function(){return Spacebars.call(e.lookup("currentUser"))},function(){return[HTML.LI({"class":function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("currentTemplateName"),"is","dashboard")},function(){return"active"})}},HTML.A({href:"/"},"Dashboard")),HTML.LI({"class":function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("currentTemplateName"),"in","query")},function(){return Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup("queryObject"),"isQuick"))},function(){return"active"})})}},HTML.A({href:"/query/create/quick"},"Quick Query")),HTML.LI({"class":function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("currentTemplateName"),"in","queryList","query")},function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),Spacebars.dot(e.lookup("queryObject"),"isQuick"))},function(){return"active"})})}},HTML.A({href:"/query/list"},"Saved Queries")),HTML.LI({"class":function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("currentTemplateName"),"in","ipsetList","ipset","ipsetCreate")},function(){return"active"})}},HTML.A({href:"/ipset/list"},"IP Sets")),HTML.LI({"class":function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("currentTemplateName"),"in","tupleList","tuple","tupleCreate")},function(){return"active"})}},HTML.A({href:"/tuple/list"},"Tuple Files"))]})),"\n",HTML.UL({"class":["nav"," ","navbar-nav"," ","navbar-right"]},Blaze.If(function(){return Spacebars.call(e.lookup("currentUser"))},function(){return HTML.LI({"class":"dropdown"},HTML.A({"class":"dropdown-toggle",href:"#","data-toggle":"dropdown"},Blaze.View(function(){return Spacebars.mustache(Spacebars.dot(e.lookup("currentUser"),"profile","name"))}),"\n",HTML.B({"class":"caret"})),"\n",HTML.UL({"class":"dropdown-menu"},HTML.Comment('li: a(href="/user/{{currentUser._id}}") Profile'),"\n",Blaze.If(function(){return Spacebars.dataMustache(e.lookup("currentUserHasRole"),"admin")},function(){return[HTML.LI(HTML.A({href:"/users"},"User administration")),HTML.LI(HTML.A({href:"/config"},"SiLK server configuration"))]},function(){return HTML.LI(HTML.A({href:"/profile"},"Profile"))}),"\n",HTML.LI(HTML.A({href:"/help"},"Help")),"\n",HTML.LI({"class":"divider"}),"\n",HTML.LI(HTML.A({"class":"logout",href:"#"},"Logout"))))},function(){return Spacebars.include(e.lookupTemplate("login"))})),"\n",HTML.Raw(""))))})}();
!function(){Template.__checkName("notFound"),Template.notFound=new Template("Template.notFound",function(){var n=this;return HTML.Raw('')})}();
!function(){Template.__checkName("query"),Template.query=new Template("Template.query",function(){var e=this;return HTML.DIV({"class":["container-fluid"," ","query"]},HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},Blaze._TemplateWith(function(){return{_id:Spacebars.call(Spacebars.dot(e.lookup("queryObject"),"_id"))}},function(){return Spacebars.include(e.lookupTemplate("results"))}))))})}();
-!function(){Template.__checkName("results"),Template.results=new Template("Template.results",function(){var e=this;return Spacebars.With(function(){return Spacebars.call(e.lookup("query"))},function(){return HTML.DIV({"class":function(){return["results"," ","panel"," ","panel-default"," ",Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return"is-simple"})]}},HTML.DIV({"class":"panel-heading"},HTML.FORM({"class":"options-form"},Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),e.lookup("isQuick"))},function(){return Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return HTML.H3({"class":"panel-title"},HTML.A({href:function(){return Spacebars.mustache(e.lookup("path"))}},Blaze.View(function(){return Spacebars.mustache(e.lookup("displayName"))})),"\n",HTML.CharRef({html:" ",str:" "}),"\n",HTML.A({"class":"remove-from-dashboard",href:"#",title:"Remove query from dashboard (but keep in system)"},HTML.I({"class":["fa"," ","fa-times"," ","text-muted"]})))},function(){return HTML.DIV({"class":"form-group"},HTML.DIV({"class":"input-group"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("name"),value:Spacebars.call(e.lookup("name")),placeholder:Spacebars.call("Query name"),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}),"\n",HTML.DIV({"class":"input-group-btn"},HTML.BUTTON({"class":["btn"," ","btn-default"," ","dropdown-toggle"],"data-toggle":"dropdown",type:"button"},HTML.SPAN({"class":"caret"})),"\n",HTML.UL({"class":["dropdown-menu"," ","pull-right"]},HTML.LI(HTML.A({"class":"confirm",href:function(){return["/query/",Spacebars.mustache(e.lookup("_id")),"/remove"]},"data-confirmation":"Are you sure you want to delete this query?"},HTML.I({"class":["fa"," ","fa-trash-o"]}),"\n","Delete this query"))))))})}),"\n",HTML.DIV({"class":["results-buttons"," ","clearfix"]},HTML.DIV({"class":"pull-left"},Spacebars.include(e.lookupTemplate("controlsForTheHeartOfTheSun"))),"\n",HTML.DIV({"class":"pull-right"},HTML.DIV({"class":"btn-group"},HTML.BUTTON({"class":function(){return["toggle-is-utc"," ","btn"," ","btn-default"," ",Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return"btn-xs"})]},type:"button"},HTML.I({"class":["fa"," ","fa-fw"," ","fa-clock-o"]}),"\n",Blaze.If(function(){return Spacebars.call(e.lookup("isUTC"))},function(){return"UTC:"},function(){return"Local:"}),"\n",Blaze.View(function(){return Spacebars.mustache(e.lookup("now"))}))))),"\n",Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("interface"),"is","cmd")},function(){return[Spacebars.include(e.lookupTemplate("cmd")),Spacebars.include(e.lookupTemplate("exclusionsCmd")),Spacebars.include(e.lookupTemplate("cmdFieldsets"))]},function(){return[Spacebars.include(e.lookupTemplate("fieldsets")),HTML.DIV({"class":"secondary-controls"},Spacebars.include(e.lookupTemplate("controlsForTheHeartOfTheSun")))]})}))),"\n",Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),e.lookup("isOutputStale"))},function(){return Blaze.If(function(){return Spacebars.call(e.lookup("error"))},function(){return HTML.DIV({"class":"panel-body"},HTML.DIV({"class":["alert"," ","alert-danger"],role:"alert"},HTML.STRONG("Oh snap!"),"\n",HTML.PRE(Blaze.View(function(){return Spacebars.mustache(e.lookup("error"))}))))})}),"\n",Blaze.If(function(){return Spacebars.call(e.lookup("result"))},function(){return[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("presentation"),"is","table")},function(){return HTML.DIV({"class":"results-scroller"},Spacebars.include(e.lookupTemplate("table")))},function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),e.lookup("isOutputStale"))},function(){return Spacebars.include(e.lookupTemplate("chart"))})}),HTML.DIV({"class":"panel-body"},Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("presentation"),"is","table")},function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("output"),"in","rwcut","rwcount")},function(){return HTML.UL({"class":"pager"},HTML.LI({"class":function(){return["increment-start-rec-num"," ",[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("startRecNum"),"lte",1)},function(){return"disabled"})," ",Blaze.If(function(){return Spacebars.call(e.lookup("isOutputStale"))},function(){return"disabled"})]]},"data-increment":function(){return["-",Spacebars.mustache(Spacebars.dot(e.lookup("currentUser"),"profile","numRecs"))]}},HTML.A({href:"#"},HTML.I({"class":["fa"," ","fa-angle-left"]}),"\n","Previous")),"\n",HTML.LI({"class":"dropdown"},HTML.SELECT({"class":["num-recs"," ","form-control"]},Blaze.Each(function(){return Spacebars.call(e.lookup("numRecsOptions"))},function(){return HTML.OPTION({value:function(){return Spacebars.mustache(e.lookup("."))},selected:function(){return Spacebars.mustache(e.lookup("condition"),e.lookup("."),"is",Spacebars.dot(e.lookup("currentUser"),"profile","numRecs"))}},Blaze.View(function(){return Spacebars.mustache(e.lookup("."))})," per page")}))),"\n",HTML.LI({"class":function(){return["increment-start-rec-num"," ",[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),Spacebars.dot(e.lookup("rows"),"length"))},function(){return"disabled"})," ",Blaze.If(function(){return Spacebars.call(e.lookup("isOutputStale"))},function(){return"disabled"})]]},"data-increment":function(){return Spacebars.mustache(Spacebars.dot(e.lookup("currentUser"),"profile","numRecs"))}},HTML.A({href:"#"},"Next","\n",HTML.I({"class":["fa"," ","fa-angle-right"]}))))})}),"\n",Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("presentation"),"is","chart")},function(){return HTML.DIV({"class":["row"," ","form-horizontal"]},HTML.DIV({"class":["col-xs-4"," ","col-xs-offset-4"]},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":["control-label"," ","col-xs-4"]},"Chart height:"),"\n",HTML.DIV({"class":["input-group"," ","col-xs-6"]},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("chartHeight"),value:Spacebars.call(e.lookup("chartHeight")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}),"\n",HTML.SPAN({"class":"input-group-addon"},"px")))))}),HTML.DIV({"class":"extras"},HTML.A({"class":"download-csv",href:"#"},HTML.I({"class":["normal"," ","fa"," ","fa-file-excel-o"]}),"\n",HTML.I({"class":["loading"," ","fa"," ","fa-spinner"," ","fa-spin"],style:"display: none;"}),"\n","Download full CSV"),"\n",HTML.A({"class":"download-rwf",href:"#"},HTML.I({"class":["normal"," ","fa"," ","fa-file-archive-o"]}),"\n",HTML.I({"class":["loading"," ","fa"," ","fa-spinner"," ","fa-spin"],style:"display: none;"}),"\n","Download full RWF")),Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("output"),"in","rwcut")},function(){return HTML.FORM({"class":"display-fields-block"},HTML.FIELDSET(HTML.LEGEND("Display fields"),"\n",Blaze.Each(function(){return Spacebars.call(e.lookup("fieldsOrder"))},function(){return HTML.DIV({"class":"checkbox"},HTML.LABEL(HTML.INPUT({"class":"field-checkbox",type:"checkbox",checked:function(){return Spacebars.mustache(e.lookup("fieldIsSelected"),e.lookup(".."),"fields")},value:function(){return Spacebars.mustache(e.lookup("."))},"data-property":"fields"}),"\n",Blaze.View(function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))})))})))})]}))]}))})})}();
+!function(){Template.__checkName("results"),Template.results=new Template("Template.results",function(){var e=this;return Spacebars.With(function(){return Spacebars.call(e.lookup("query"))},function(){return HTML.DIV({"class":function(){return["results"," ","panel"," ","panel-default"," ",Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return"is-simple"})]}},HTML.DIV({"class":"panel-heading"},HTML.FORM({"class":"options-form"},Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),e.lookup("isQuick"))},function(){return Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return HTML.H3({"class":"panel-title"},HTML.A({href:function(){return Spacebars.mustache(e.lookup("path"))}},Blaze.View(function(){return Spacebars.mustache(e.lookup("displayName"))})),"\n",HTML.CharRef({html:" ",str:" "}),"\n",HTML.A({"class":"remove-from-dashboard",href:"#",title:"Remove query from dashboard (but keep in system)"},HTML.I({"class":["fa"," ","fa-times"," ","text-muted"]})))},function(){return HTML.DIV({"class":"form-group"},HTML.DIV({"class":"input-group"},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("name"),value:Spacebars.call(e.lookup("name")),placeholder:Spacebars.call("Query name"),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}),"\n",HTML.DIV({"class":"input-group-btn"},HTML.BUTTON({"class":["btn"," ","btn-default"," ","dropdown-toggle"],"data-toggle":"dropdown",type:"button"},HTML.SPAN({"class":"caret"})),"\n",HTML.UL({"class":["dropdown-menu"," ","pull-right"]},HTML.LI(HTML.A({"class":"confirm",href:function(){return["/query/",Spacebars.mustache(e.lookup("_id")),"/remove"]},"data-confirmation":"Are you sure you want to delete this query?"},HTML.I({"class":["fa"," ","fa-trash-o"]}),"\n","Delete this query"))))))})}),"\n",HTML.DIV({"class":["results-buttons"," ","clearfix"]},HTML.DIV({"class":"pull-left"},Spacebars.include(e.lookupTemplate("controlsForTheHeartOfTheSun"))),"\n",HTML.DIV({"class":"pull-right"},HTML.DIV({"class":"btn-group"},HTML.BUTTON({"class":function(){return["toggle-is-utc"," ","btn"," ","btn-default"," ",Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return"btn-xs"})]},type:"button"},HTML.I({"class":["fa"," ","fa-fw"," ","fa-clock-o"]}),"\n",Blaze.If(function(){return Spacebars.call(e.lookup("isUTC"))},function(){return"UTC:"},function(){return"Local:"}),"\n",Blaze.View(function(){return Spacebars.mustache(e.lookup("now"))}))))),"\n",Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("interface"),"is","cmd")},function(){return[Spacebars.include(e.lookupTemplate("cmd")),Spacebars.include(e.lookupTemplate("exclusionsCmd")),Spacebars.include(e.lookupTemplate("cmdFieldsets"))]},function(){return[Spacebars.include(e.lookupTemplate("fieldsets")),HTML.DIV({"class":"secondary-controls"},Spacebars.include(e.lookupTemplate("controlsForTheHeartOfTheSun")))]})}))),"\n",Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),e.lookup("isOutputStale"))},function(){return Blaze.If(function(){return Spacebars.call(e.lookup("error"))},function(){return HTML.DIV({"class":"panel-body"},HTML.DIV({"class":["alert"," ","alert-danger"],role:"alert"},HTML.STRONG("Oh snap!"),"\n",HTML.PRE(Blaze.View(function(){return Spacebars.mustache(e.lookup("error"))}))))})}),"\n",Blaze.If(function(){return Spacebars.call(e.lookup("result"))},function(){return[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("presentation"),"is","table")},function(){return HTML.DIV({"class":"results-scroller"},Spacebars.include(e.lookupTemplate("table")))},function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),e.lookup("isOutputStale"))},function(){return Spacebars.include(e.lookupTemplate("chart"))})}),HTML.DIV({"class":"panel-body"},Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("presentation"),"is","table")},function(){return Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("output"),"in","rwcut","rwcount")},function(){return HTML.UL({"class":"pager"},HTML.LI({"class":function(){return["increment-start-rec-num"," ",[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("startRecNum"),"lte",1)},function(){return"disabled"})," ",Blaze.If(function(){return Spacebars.call(e.lookup("isOutputStale"))},function(){return"disabled"})]]},"data-increment":function(){return["-",Spacebars.mustache(Spacebars.dot(e.lookup("currentUser"),"profile","numRecs"))]}},HTML.A({href:"#"},HTML.I({"class":["fa"," ","fa-angle-left"]}),"\n","Previous")),"\n",HTML.LI({"class":"dropdown"},HTML.SELECT({"class":["num-recs"," ","form-control"]},Blaze.Each(function(){return Spacebars.call(e.lookup("numRecsOptions"))},function(){return HTML.OPTION({value:function(){return Spacebars.mustache(e.lookup("."))},selected:function(){return Spacebars.mustache(e.lookup("condition"),e.lookup("."),"is",Spacebars.dot(e.lookup("currentUser"),"profile","numRecs"))}},Blaze.View(function(){return Spacebars.mustache(e.lookup("."))})," per page")}))),"\n",HTML.LI({"class":function(){return["increment-start-rec-num"," ",[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),Spacebars.dot(e.lookup("rows"),"length"))},function(){return"disabled"})," ",Blaze.If(function(){return Spacebars.call(e.lookup("isOutputStale"))},function(){return"disabled"})]]},"data-increment":function(){return Spacebars.mustache(Spacebars.dot(e.lookup("currentUser"),"profile","numRecs"))}},HTML.A({href:"#"},"Next","\n",HTML.I({"class":["fa"," ","fa-angle-right"]}))))})}),"\n",Blaze.If(function(){return Spacebars.dataMustache(e.lookup("not"),Spacebars.dot(e.lookup(".."),"isDashboard"))},function(){return[Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("presentation"),"is","chart")},function(){return HTML.DIV({"class":["row"," ","form-horizontal"]},HTML.DIV({"class":["col-xs-4"," ","col-xs-offset-4"]},HTML.DIV({"class":"form-group"},HTML.LABEL({"class":["control-label"," ","col-xs-4"]},"Chart height:"),"\n",HTML.DIV({"class":["input-group"," ","col-xs-6"]},Blaze._TemplateWith(function(){return{family:Spacebars.call("query"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("chartHeight"),value:Spacebars.call(e.lookup("chartHeight")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}),"\n",HTML.SPAN({"class":"input-group-addon"},"px")))))}),HTML.DIV({"class":"extras"},HTML.A({"class":"download-csv",href:"#"},HTML.I({"class":["normal"," ","fa"," ","fa-file-excel-o"]}),"\n",HTML.I({"class":["loading"," ","fa"," ","fa-spinner"," ","fa-spin"],style:"display: none;"}),"\n","Download full CSV"),"\n",HTML.A({"class":"download-rwf",href:"#"},HTML.I({"class":["normal"," ","fa"," ","fa-file-archive-o"]}),"\n",HTML.I({"class":["loading"," ","fa"," ","fa-spinner"," ","fa-spin"],style:"display: none;"}),"\n","Download full RWF")),Blaze.If(function(){return Spacebars.dataMustache(e.lookup("condition"),e.lookup("output"),"in","rwcut")},function(){return HTML.FORM({"class":"display-fields-block"},HTML.FIELDSET(HTML.LEGEND("Display fields"),"\n",Blaze.Each(function(){return Spacebars.call(e.lookup("fieldsOrder"))},function(){return HTML.DIV({"class":"checkbox"},HTML.LABEL({"data-toggle":"popover",title:function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))},"data-content":function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldDefinitions"))}},HTML.INPUT({"class":"field-checkbox",type:"checkbox",checked:function(){return Spacebars.mustache(e.lookup("fieldIsSelected"),e.lookup(".."),"fields")},value:function(){return Spacebars.mustache(e.lookup("."))},"data-property":"fields"}),"\n",Blaze.View(function(){return Spacebars.mustache(e.lookup("t"),e.lookup("fieldI18nString"))})))})))})]}))]}))})})}();
!function(){Template.__checkName("tuple"),Template.tuple=new Template("Template.tuple",function(){var e=this;return HTML.DIV({"class":["container-fluid"," ","tuple-default"," ","tuple"]},HTML.DIV({"class":"row"},HTML.DIV({"class":"col-xs-12"},Spacebars.With(function(){return Spacebars.call(e.lookup("tuple"))},function(){return HTML.FORM({"class":["panel"," ","panel-default"]},HTML.DIV({"class":"panel-heading"},HTML.DIV({"class":"form-group"},HTML.LABEL("Tuple File Name"),"\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"Tuple file name","data-content":"This is the name that will be referenced in the query builder. Tuples allow for searching for records based on the 5-tuple, where the values can occur in any direction."}),"\n",HTML.DIV({"class":"input-group"},Blaze._TemplateWith(function(){return{family:Spacebars.call("tuple"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("name"),value:Spacebars.call(e.lookup("name")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("input"))}),"\n",HTML.DIV({"class":"input-group-btn"},HTML.BUTTON({"class":["btn"," ","btn-default"," ","dropdown-toggle"],"data-toggle":"dropdown",type:"button"},HTML.SPAN({"class":"caret"})),"\n",HTML.UL({"class":["dropdown-menu"," ","pull-right"]},HTML.LI(HTML.A({"class":"confirm",href:function(){return["/tuple/",Spacebars.mustache(e.lookup("_id")),"/remove"]},"data-confirmation":"Are you sure you want to delete this Tuple file?"},HTML.I({"class":["fa"," ","fa-trash-o"]}),"\n","Delete this Tuple File"))))))),"\n",HTML.DIV({"class":"panel-body"},HTML.DIV({"class":"form-group"},HTML.LABEL("Note","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"Note","data-content":"These notes are for personal use and can be quickly referenced when examining tuples in the Tuple Files tab."})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("tuple"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("note"),value:Spacebars.call(e.lookup("note")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("textarea"))})),"\n",HTML.DIV({"class":"form-group"},HTML.LABEL("Tuple Values","\n",HTML.I({"class":["fa"," ","fa-question-circle"," ","text-muted"],"data-toggle":"popover",title:"Note","data-content":"You may enter a list of n-tuples, up to a 5-tuple. You may choose to 2 IP addresses instead of the full 5 tuple to examine records going in either direction or be port specific in order to filter more closely. For more information, see the options in the query builder."})),"\n",Blaze._TemplateWith(function(){return{family:Spacebars.call("tuple"),_id:Spacebars.call(e.lookup("_id")),property:Spacebars.call("contents"),value:Spacebars.call(e.lookup("contents")),isNew:Spacebars.call(e.lookup("isNew"))}},function(){return Spacebars.include(e.lookupTemplate("textarea"))})),"\n",HTML.DIV({"class":"form-group"},HTML.BUTTON({"class":["btn"," ","btn-primary"],type:"submit"},"Save"),"\n",HTML.SPAN({"class":["save-notice"," ","notice"," ","text-success"]},"Successfully saved"),"\n",HTML.SPAN({"class":["create-notice"," ","notice"," ","text-success"]},"Successfully created")),"\n",Blaze.If(function(){return Spacebars.call(Spacebars.dot(e.lookup("queries"),"count"))},function(){return[HTML.HR(),HTML.H4("Queries using this Tuple file"),HTML.UL(Blaze.Each(function(){return Spacebars.call(e.lookup("queries"))},function(){return HTML.LI(HTML.A({href:function(){return Spacebars.mustache(e.lookup("path"))}},Blaze.View(function(){return Spacebars.mustache(e.lookup("displayName"))})))}))]})))}))))})}();
@@ -266,13 +266,13 @@ Router=Package["iron:router"].Router,RouteController=Package["iron:router"].Rout
!function(){function e(e){for(var r=0,a=s.length;a>r;r++)e=e.replace(s[r],"");return e}function r(){for(var e="",r=10;r--;)e+=String.fromCharCode(25*Math.random()|97);return e}function a(e){return e.replace(">",">").replace("<","<").replace("\\","\\\\")}function i(e){var r="",a=e.match(/\s*[a-z-]+\s*=\s*(\x22|\x27)([^\1]*?)\1/gi);if(a)for(var i=0;i","'":"'","−":"−","ˆ":"ˆ","˜":"˜","Š":"Š","‹":"‹","Œ":"Œ","‘":"‘","’":"’","“":"“","”":"”","•":"•","–":"–","—":"—","™":"™","š":"š","›":"›","œ":"œ","Ÿ":"Ÿ","ƒ":"ƒ","Α":"Α","Β":"Β","Γ":"Γ","Δ":"Δ","Ε":"Ε","Ζ":"Ζ","Η":"Η","Θ":"Θ","Ι":"Ι","Κ":"Κ","Λ":"Λ","Μ":"Μ","Ν":"Ν","Ξ":"Ξ","Ο":"Ο","Π":"Π","Ρ":"Ρ","Σ":"Σ","Τ":"Τ","Υ":"Υ","Φ":"Φ","Χ":"Χ","Ψ":"Ψ","Ω":"Ω","α":"α","β":"β","γ":"γ","δ":"δ","ε":"ε","ζ":"ζ","η":"η","θ":"θ","ι":"ι","κ":"κ","λ":"λ","μ":"μ","ν":"ν","ξ":"ξ","ο":"ο","π":"π","ρ":"ρ","ς":"ς","σ":"σ","τ":"τ","υ":"υ","φ":"φ","χ":"χ","ψ":"ψ","ω":"ω","ϑ":"ϑ","ϒ":"ϒ","ϖ":"ϖ"," ":" "," ":" "," ":" ","":"","":"","":"","":"","‚":"‚","„":"„","†":"†","‡":"‡","…":"…","‰":"‰","′":"′","″":"″","‾":"‾","⁄":"⁄","ℑ":"ℑ","℘":"℘","ℜ":"ℜ","ℵ":"ℵ","←":"←","↑":"↑","→":"→","↓":"↓","↔":"↔","↵":"↵","⇐":"⇐","⇑":"⇑","⇒":"⇒","⇓":"⇓","⇔":"⇔","∀":"∀","∂":"∂","∃":"∃","∅":"∅","∇":"∇","∈":"∈","∉":"∉","∋":"∋","∏":"∏","∑":"∑","∗":"∗","√":"√","∝":"∝","∞":"∞","∠":"∠","∧":"∧","∨":"∨","∩":"∩","∪":"∪","∫":"∫","∴":"∴","∼":"∼","≅":"≅","≈":"≈","≠":"≠","≡":"≡","≤":"≤","≥":"≥","⊂":"⊂","⊃":"⊃","⊄":"⊄","⊆":"⊆","⊇":"⊇","⊕":"⊕","⊗":"⊗","⊥":"⊥","⋅":"⋅","⌈":"⌈","⌉":"⌉","⌊":"⌊","⌋":"⌋","⟨":"〈","⟩":"〉","◊":"◊","♠":"♠","♣":"♣","♥":"♥","♦":"♦"},n=function(e){if(!~e.indexOf("&"))return e;for(var r in c)e=e.replace(new RegExp(r,"g"),c[r]);return e=e.replace(/&#x(0*[0-9a-f]{2,5});?/gi,function(e,r){return String.fromCharCode(parseInt(+r,16))}),e=e.replace(/&#([0-9]{2,4});?/gi,function(e,r){return String.fromCharCode(+r)}),e=e.replace(/&/g,"&")},o={"document.cookie":"[removed]","document.write":"[removed]",".parentNode":"[removed]",".innerHTML":"[removed]","window.location":"[removed]","-moz-binding":"[removed]","":"-->","(":"<comment>"},l={"javascript\\s*:":"[removed]","expression\\s*(\\(|()":"[removed]","vbscript\\s*:":"[removed]","Redirect\\s+302":"[removed]","([\"'])?data\\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?":"[removed]"},s=[/%0[0-8bcef]/g,/%1[0-9a-f]/g,/[\x00-\x08]/g,/\x0b/g,/\x0c/g,/[\x0e-\x1f]/g],p=["javascript","expression","vbscript","script","base64","applet","alert","document","write","cookie","window"];t.xssClean=function(t,c){t=e(t);var s;do s=r();while(t.indexOf(s)>=0);t=t.replace(/\&([a-z\_0-9\-]+)\=([a-z\_0-9\-]+)/gi,s+"$1=$2"),t=t.replace(/(&#?[0-9a-z]{2,})([\x00-\x20])*;?/gi,"$1;$2"),t=t.replace(/(&#x?)([0-9A-F]+);?/gi,"$1$2;"),t=t.replace(new RegExp(s,"g"),"&");try{t=decodeURIComponent(t)}catch(u){}t=t.replace(/[a-z]+=([\'\"]).*?\1/gi,function(e,r){return e.replace(r,a(r))}),t=t.replace(/<\w+.*/gi,function(e){return e.replace(e,n(e))}),t=e(t),t=t.replace(" "," ");var m=t;for(var g in o)t=t.replace(new RegExp(g,"gi"),o[g]);for(var g in l)t=t.replace(new RegExp(g,"gi"),l[g]);for(var g=0,d=p.length;d>g;g++){var f=p[g].split("").join("\\s*")+"\\s*";t=t.replace(new RegExp("("+f+")(\\W)","ig"),function(e,r,a){return r.replace(/\s+/g,"")+a})}do{var v=t;t.match(/]*?)(>|$)/gi,function(e,r,a){var t=i(r.replace("<","").replace(">",""));return t=t.replace(/href=.*?(?:alert\(|alert(|javascript:|livescript:|mocha:|charset=|window\.|document\.|\.cookie|]*?)(\s?\/?>|$)/gi,function(e,r,a){var t=i(r.replace("<","").replace(">",""));return t=t.replace(/src=.*?(?:alert\(|alert(|javascript:|livescript:|mocha:|charset=|window\.|document\.|\.cookie|/gi,"[removed]"))}while(v!==t);var h=["\\bon\\w*","\\bstyle","\\bformaction"];c||h.push("xmlns");do{var x=[],b=0;if(x=x.concat(t.match(new RegExp("("+h.join("|")+")\\s*=\\s*(\\x22|\\x27)([^\\2]*?)(\\2)","ig"))),x=x.concat(t.match(new RegExp("("+h.join("|")+")\\s*=\\s*([^\\s>]*)","ig"))),x=x.filter(function(e){return null!==e}),x.length>0){for(var g=0;g|:\\-]","g"),"\\$&");t=t.replace(new RegExp("(<]+?)([^A-Za-z<>\\-])(.*?)("+x.join("|")+")(.*?)([\\s><]?)([><]*)","i"),function(e,r,a,i,t,c,n,o,l){return++b,r+a+" "+t+n+o+l})}}while(b>0);var w="alert|applet|audio|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|isindex|layer|link|meta|object|plaintext|style|script|textarea|title|video|xml|xss";t=t.replace(new RegExp("<(/*\\s*)("+w+")([^><]*)([><]*)","gi"),function(e,r,a,i,t){return"<"+r+a+i+t.replace(">",">").replace("<","<")}),t=t.replace(/(alert|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)/gi,"$1$2($3)");for(var g in o)t=t.replace(new RegExp(g,"gi"),o[g]);for(var g in l)t=t.replace(new RegExp(g,"gi"),l[g]);if(c&&t!==m)throw new Error("Image may contain XSS");return t}}();
-!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare,t,e;e=e||{},e.user=function(e,t){return null==t&&(t=Meteor.userId()),Meteor.users.findOne(t,{fields:e})},e.intval=function(e){return parseInt(e,10)||0},e.minute=6e4,e.hour=60*e.minute,e.datetimeFormat="YYYY/MM/DD HH:mm:ss.SSS",e.rwcutFields=["sIP","dIP","sPort","dPort","protocol","packets","bytes","flags","sTime","duration","eTime","sensor","class","scc","dcc","initialFlags","sessionFlags","application","type","icmpTypeCode"],e.rwstatsValues=["Records","Packets","Bytes"],e.rwcountFields=["Date","Records","Bytes","Packets"],e.rwcountLoadSchemes=["","bin-uniform","start-spike","end-spike","middle-spike","time-proportional","maximum-volume","minimum-volume"],e.tupleDirections=["","both","forward","reverse"],e.availableChartTypes={rwcut:[],rwstats:["BarChart","ColumnChart","PieChart"],rwcount:["LineChart"]},e.chartFieldTypes={sPort:"number",dPort:"number",protocol:"number",pro:"number",packets:"number",bytes:"number",sTime:"datetime",duration:"number",dur:"number",eTime:"datetime",Records:"number",Packets:"number",Bytes:"number",Date:"datetime","cumul_%":"number"},e.startDateOffsets={Hour:60..toString(),Day:1440..toString(),Week:10080..toString(),Month:43200..toString()},e.parseResult=function(e){var t,n,s,i,a;for(n=[],a=e.split("\n"),s=0,i=a.length;i>s;s++)t=a[s],n.push(t.split("|"));return n},e.queryTypes=["in","out","inweb","outweb","inicmp","outicmp","innull","outnull","int2int","ext2ext","other"],e.inputFields=["interface","cmd","exclusionsCmd","startDateEnabled","startDate","endDateEnabled","endDate","sensorEnabled","sensor","typesEnabled","types","daddressEnabled","daddress","saddressEnabled","saddress","anyAddressEnabled","anyAddress","dipSetEnabled","dipSet","sipSetEnabled","sipSet","anySetEnabled","anySet","tupleFileEnabled","tupleFile","tupleDirectionEnabled","tupleDirection","tupleDelimiterEnabled","tupleDelimiter","tupleFieldsEnabled","tupleFields","dportEnabled","dport","sportEnabled","sport","aportEnabled","aport","dccEnabled","dcc","sccEnabled","scc","protocolEnabled","protocol","flagsAllEnabled","flagsAll","activeTimeEnabled","activeTime","additionalParametersEnabled","additionalParameters","additionalExclusionsCmdEnabled","additionalExclusionsCmd"],e.filterOptions=function(e,t){var n,s,i,a,r,o;for(null==t&&(t=""),o=["--python-expr","--python-file","--pmap","--dynamic-library","--all-destination","--fail-destination","--pass-destination","--print-statistics","--print-volume-statistics","--xargs"],a=0,r=o.length;r>a;a++)n=o[a],i=new RegExp(n+"=?[^\\s]*","gi"),e=e.replace(i,"");return s=new RegExp("[^\\s\\=\\-\\/\\,\\.\\:0-9a-z"+t+"]","gi"),e=e.replace(s,"")},e.isDebug=Meteor.settings["public"].isDebug,t="undefined"!=typeof window?window:GLOBAL,t.isDebug=e.isDebug,t.cl="undefined"!=typeof console&&console.log&&_.isFunction(console.log)?_.bind(console.log,console):function(){}}();
+!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare,t,e;e=e||{},e.user=function(e,t){return null==t&&(t=Meteor.userId()),Meteor.users.findOne(t,{fields:e})},e.intval=function(e){return parseInt(e,10)||0},e.minute=6e4,e.hour=60*e.minute,e.datetimeFormat="YYYY/MM/DD HH:mm:ss.SSS",e.rwcutFields=["sIP","dIP","sPort","dPort","protocol","packets","bytes","flags","sTime","duration","eTime","sensor","class","scc","dcc","initialFlags","sessionFlags","application","type","icmpTypeCode"],e.rwstatsValues=["Records","Packets","Bytes"],e.rwcountFields=["Date","Records","Bytes","Packets"],e.rwcountLoadSchemes=["","bin-uniform","start-spike","end-spike","middle-spike","time-proportional","maximum-volume","minimum-volume"],e.tupleDirections=["","both","forward","reverse"],e.availableChartTypes={rwcut:[],rwstats:["BarChart","ColumnChart","PieChart"],rwcount:["LineChart"]},e.chartFieldTypes={sPort:"number",dPort:"number",protocol:"number",pro:"number",packets:"number",bytes:"number",sTime:"datetime",duration:"number",dur:"number",eTime:"datetime",Records:"number",Packets:"number",Bytes:"number",Date:"datetime","cumul_%":"number"},e.startDateOffsets={Hour:60..toString(),Day:1440..toString(),Week:10080..toString(),Month:43200..toString()},e.parseResult=function(e){var t,n,s,i,a;for(n=[],a=e.split("\n"),s=0,i=a.length;i>s;s++)t=a[s],n.push(t.split("|"));return n},e.queryTypes=["in","out","inweb","outweb","inicmp","outicmp","innull","outnull","int2int","ext2ext","other"],e.inputFields=["interface","cmd","exclusionsCmd","startDateEnabled","startDate","endDateEnabled","endDate","sensorEnabled","sensor","typesEnabled","types","daddressEnabled","daddress","saddressEnabled","saddress","anyAddressEnabled","anyAddress","dipSetEnabled","dipSet","sipSetEnabled","sipSet","anySetEnabled","anySet","tupleFileEnabled","tupleFile","tupleDirectionEnabled","tupleDirection","tupleDelimiterEnabled","tupleDelimiter","tupleFieldsEnabled","tupleFields","dportEnabled","dport","sportEnabled","sport","aportEnabled","aport","dccEnabled","dcc","sccEnabled","scc","protocolEnabled","protocol","flagsAllEnabled","flagsAll","activeTimeEnabled","activeTime","additionalParametersEnabled","additionalParameters","additionalExclusionsCmdEnabled","additionalExclusionsCmd"],e.filterOptions=function(e,t){var n,s,i,a,r,o;for(null==t&&(t=""),o=["--python-expr","--python-file","--pmap","--dynamic-library","--all-destination","--fail-destination","--pass-destination","--print-statistics","--print-volume-statistics","--xargs"],a=0,r=o.length;r>a;a++)n=o[a],i=new RegExp(n+"=?[^\\s]*","gi"),e=e.replace(i,"");return s=new RegExp("[^\\s\\=\\-\\/\\,\\.\\:0-9a-z_"+t+"]","gi"),e=e.replace(s,"")},e.isDebug=Meteor.settings["public"].isDebug,t="undefined"!=typeof window?window:GLOBAL,t.isDebug=e.isDebug,t.cl="undefined"!=typeof console&&console.log&&_.isFunction(console.log)?_.bind(console.log,console):function(){}}();
!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;e.linkRegExp=new RegExp(["(",'\\s|[^a-zA-Z0-9.\\+_\\/"\\>\\-]|^',")(?:","(","[a-zA-Z0-9\\+_\\-]+","(?:","\\.[a-zA-Z0-9\\+_\\-]+",")*@",")?(","http:\\/\\/|https:\\/\\/|ftp:\\/\\/",")?(?:(","(?:(?:[a-z0-9_%\\-_+]*[a-z][a-z0-9_%\\-_+]*[.:])+)",")(","(?:com|ca|co|edu|gov|net|org|dev|biz|cat|int|pro|tel|mil|aero|asia|coop|info|jobs|mobi|museum|name|post|travel|local|[0-9]{2,}|[a-z]{2})",")|file:\\/\\/)(","(?:","[\\/|\\?]","(?:","[\\-a-zA-Z0-9_%#*&+=~!?,;:.\\/]*",")*",")","[\\-\\/a-zA-Z0-9_%#*&+=~]","|","\\/?",")?",")(",'[^a-zA-Z0-9\\+_\\/"\\<\\-]|$',")"].join(""),"mg"),e.emailLinkRegExp=/(<[a-z]+ href=\")(http:\/\/)([a-zA-Z0-9\+_\-]+(?:\.[a-zA-Z0-9\+_\-]+)*@)/g,e.emailRegex=/^[^@]+@[^@]+$/gi,e.createTextSearchRegexp=function(a,t){return null==t&&(t=!1),a=e.escapeRegexp(a),t&&("left"===t?a="^"+a:"right"===t?a+="$":a="^"+a+"$"),new RegExp(a,"i")},e.escapeRegexp=function(e){return e.replace(/([.?*+^$[\]\\(){}|-])/g,"\\$1")}}();
!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare,r=[].indexOf||function(e){for(var r=0,t=this.length;t>r;r++)if(r in this&&this[r]===e)return r;return-1};e.Security={effectiveRoles:{admin:["admin","analyst"],analyst:["admin","analyst"]},groups:function(){return Object.keys(this.effectiveRoles)},currentUserHasRole:function(r){return e.Security.hasRole(Meteor.userId(),r)},userIdCanChangeUserGroupOrRemove:function(e,r){return e!==r._id&&this.hasRole(e,"admin")},hasRole:function(t,n){var i;return i=Meteor.users.findOne(t),i&&r.call(e.Security.effectiveRoles[i.group],n)>=0?!0:!1}}}();
-!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var t=__coffeescriptShare,e=[].indexOf||function(t){for(var e=0,s=this.length;s>e;e++)if(e in this&&this[e]===t)return e;return-1};t.User=function(){function t(t){var e,s;_.extend(this,t),this.email=null!=(e=this.emails)&&null!=(s=e[0])?s.address:void 0,this.name=this.profile.name,this.firstName=this.name.split(" ").slice(0,1).join(" "),this.lastName=this.name.split(" ").slice(1).join(" ")}return t}(),t.Config=function(){function t(t){_.extend(this,t)}return t.prototype.wrapCommand=function(t){return"ssh "+this.getSSHOptions()+" -p "+this.port+" "+this.user+"@"+this.host+' "'+t+'"'},t.prototype.getSSHOptions=function(){return"-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=error -i "+this.getIdentityFile()},t.prototype.getIdentityFile=function(){return this.identityFile?this.identityFile:process.env.PWD+"/settings/identity"},t}(),t.Query=function(){function s(s){var i,n,r,a,o,h,u,l,p,d,c,f,m,w,y,g,b,S,C,E,F,D,T,v,O;if(_.extend(this,s),this.header=[],this.rows=[],this.result){for(h=t.parseResult(this.result),"rwstats"===this.output&&(h.shift(),h.shift()),"rwcount"===this.output&&h.unshift(t.rwcountFields),p=h.shift(),f=0,g=p.length;g>f;f++)o=p[f],c={_id:o,name:o.trim(),isDistinct:!1,isPercentage:!1},0===c.name.indexOf("%")&&(c.isPercentage=!0,c.name=c.name.substr(1)),i=/-D.*$/i,c.name.match(i)&&(c.isDistinct=!0,c.name=c.name.replace(i,"")),c.chartType=c.isDistinct?"number":t.chartFieldTypes[c.name]||"string",this.header.push(c);if("chart"===this.presentation)for(m=0,b=h.length;b>m;m++){for(u=h[m],d=[],r=w=0,S=u.length;S>w;r=++w)if(l=u[r],c=this.header[r],!("rwcount"===this.output&&(v=c.name,e.call(this.rwcountFields,v)<0))){switch(c.chartType){case"number":l=parseFloat(l);break;case"date":case"datetime":a=moment.utc(l,"YYYY/MM/DDTHH:mm:ss.SSS"),l=a.toDate()}d.push(l)}this.rows.push(d)}else for(y=0,C=h.length;C>y;y++){for(u=h[y],d=[],r=D=0,E=u.length;E>D;r=++D)l=u[r],c=this.header[r],d.push({_id:c._id,value:l,queryId:this._id});this.rows.push(d)}for(n=[],O=this.header,T=0,F=O.length;F>T;T++)c=O[T],n.push(c);this.header=n}}return s.prototype.displayName=function(){return this.isQuick?"Quick query #"+this._id:this.name||"#"+this._id},s.prototype.inputCommand=function(t,e,s){var i,n,r,a,o,h;for(null==s&&(s=!1),i="rwfilter",i+=" "+this.inputOptions(t),t.siteConfigFile&&(i+=" --site-config-file="+t.siteConfigFile),r=i.search(RegExp(" (\\/|\\w)+\\.(rwf|rw)","i")),0>r&&t.dataRootdir&&(i+=" --data-rootdir="+t.dataRootdir),i+=" --pass=stdout",h=this.inputExclusions(),a=0,o=h.length;o>a;a++)n=h[a],i+=" | rwfilter --input-pipe=stdin",i+=" "+n,t.siteConfigFile&&(i+=" --site-config-file="+t.siteConfigFile),i+=" --fail=stdout";return i+=" > "+(t.dataTempdir||"/tmp")+"/"+this._id+".rwf",t.isSSH&&!s&&(i=t.wrapCommand(i)),i},s.prototype.inputOptions=function(e){var s,i,n,r,a,o;return"builder"===this["interface"]?(i=[],o=this.typesEnabled&&this.types.length&&_.difference(t.queryTypes,this.types).length?this.types.join(","):"all",i.push("--type="+o),"interval"===this.startDateType?(this.startDateEnabled&&this.startDate&&i.push("--start-date="+this.startDate),this.endDateEnabled&&this.endDate&&i.push("--end-date="+this.endDate),this.activeTimeEnabled&&this.activeTime&&i.push("--active-time="+this.activeTime)):this.startDateOffsetEnabled&&this.startDateOffset&&(r=t.intval(this.startDateOffset),s=moment.utc(),n=s.clone().subtract(r,"minutes"),i.push("--start-date="+n.format("YYYY/MM/DD:HH")),i.push("--end-date="+s.format("YYYY/MM/DD:HH")),i.push("--active-time="+n.format("YYYY/MM/DDTHH:mm:ss.SSS")+"-"+s.format("YYYY/MM/DDTHH:mm:ss.SSS"))),this.sensorEnabled&&this.sensor&&i.push("--sensor="+this.sensor),this.daddressEnabled&&this.daddress&&i.push("--daddress="+this.daddress),this.saddressEnabled&&this.saddress&&i.push("--saddress="+this.saddress),this.anyAddressEnabled&&this.anyAddress&&i.push("--any-address="+this.anyAddress),this.dipSetEnabled&&this.dipSet&&i.push("--dipset="+(e.dataTempdir||"/tmp")+"/"+this.dipSet+".rws"),this.sipSetEnabled&&this.sipSet&&i.push("--sipset="+(e.dataTempdir||"/tmp")+"/"+this.sipSet+".rws"),this.anySetEnabled&&this.anySet&&i.push("--anyset="+(e.dataTempdir||"/tmp")+"/"+this.anySet+".rws"),this.tupleFileEnabled&&this.tupleFile&&i.push("--tuple-file="+(e.dataTempdir||"/tmp")+"/"+this.tupleFile+".tuple"),this.tupleDirectionEnabled&&this.tupleDirection&&i.push("--tuple-direction="+this.tupleDirection),this.tupleDelimiterEnabled&&this.tupleDelimiter&&i.push("--tuple-delimiter="+this.tupleDelimiter),this.tupleFieldsEnabled&&this.tupleFields&&i.push("--tuple-fields="+this.tupleFields),this.dportEnabled&&this.dport&&i.push("--dport="+this.dport),this.sportEnabled&&this.sport&&i.push("--sport="+this.sport),this.aportEnabled&&this.aport&&i.push("--aport="+this.aport),this.dccEnabled&&this.dcc.length&&i.push("--dcc="+this.dcc.join(",")),this.sccEnabled&&this.scc.length&&i.push("--scc="+this.scc.join(",")),this.protocolEnabled&&this.protocol&&i.push("--protocol="+this.protocol),this.flagsAllEnabled&&this.flagsAll&&i.push("--flags-all="+this.flagsAll),this.additionalParametersEnabled&&this.additionalParameters&&i.push(this.additionalParameters),a=i.join(" ")):a=this.cmd,t.filterOptions(a)},s.prototype.inputExclusions=function(){var e;return e="","builder"===this["interface"]?this.additionalExclusionsCmdEnabled&&(e=this.additionalExclusionsCmd):e=this.exclusionsCmd,e=t.filterOptions(e),_.compact(e.split(/\s+(?:OR|\|\|)\s+/i))},s.prototype.outputCommand=function(t,e,s){switch(null==s&&(s=!1),this.output){case"rwcut":return this.outputRwcutCommand(t,e,s);case"rwstats":return this.outputRwstatsCommand(t,e,s);case"rwcount":return this.outputRwcountCommand(t,e,s)}},s.prototype.outputRwcutCommand=function(e,s,i){var n,r,a,o,h,u;return null==i&&(i=!1),r=[],this.sortField&&(h=["--fields="+this.sortField],this.sortReverse&&h.push("--reverse"),e.siteConfigFile&&h.push("--site-config-file="+e.siteConfigFile),u=h.join(" "),u=t.filterOptions(u),r.push("rwsort "+u)),a=["--num-recs="+s.numRecs,"--start-rec-num="+this.startRecNum,"--delimited"],this.fields.length&&a.push("--fields="+_.intersection(this.fieldsOrder,this.fields).join(",")),e.siteConfigFile&&a.push("--site-config-file="+e.siteConfigFile),o=a.join(" "),o=t.filterOptions(o),r.push("rwcut "+o),r[0]+=" "+(e.dataTempdir||"/tmp")+"/"+this._id+".rwf",n=r.join(" | "),e.isSSH&&!i&&(n=e.wrapCommand(n)),n},s.prototype.outputRwstatsCommand=function(s,i,n){var r,a,o,h,u,l,p,d,c,f,m,w;if(null==n&&(n=!1),a=["--delimited"],"builder"===this["interface"]){if(h=a,this.rwstatsFields.length&&h.push("--fields="+_.intersection(this.rwstatsFieldsOrder,this.rwstatsFields).join(",")),l=this.rwstatsValues.slice(0),p=this.rwstatsValuesOrder.slice(0),this.rwstatsPrimaryValue&&(l.unshift(this.rwstatsPrimaryValue),p.unshift(this.rwstatsPrimaryValue)),l.length){for(c=_.intersection(p,l),o=f=0,m=c.length;m>f;o=++f)d=c[o],e.call(t.rwstatsValues,d)<0&&(c[o]="distinct:"+d);h.push("--values="+c.join(",")),w=c[0],e.call(t.rwstatsValues,w)<0&&h.push("--no-percents")}switch(h.push("--"+this.rwstatsDirection),this.rwstatsMode){case"count":h.push("--count="+this.rwstatsCountModeValue);break;case"threshold":h.push("--threshold="+this.rwstatsThresholdModeValue);break;case"percentage":h.push("--percentage="+this.rwstatsPercentageModeValue)}this.rwstatsBinTimeEnabled&&h.push(this.rwstatsBinTime?"--bin-time="+this.rwstatsBinTime:"--bin-time"),s.siteConfigFile&&h.push("--site-config-file="+s.siteConfigFile),u=h.join(" ")}else u=this.rwstatsCmd+" "+a.join(" "),u=t.filterOptions(u);return r="rwstats "+u,r+=" "+(s.dataTempdir||"/tmp")+"/"+this._id+".rwf",s.isSSH&&!n&&(r=s.wrapCommand(r)),r},s.prototype.outputRwcountCommand=function(e,s,i){var n,r,a,o,h,u,l,p,d,c,f;return null==i&&(i=!1),r=["--delimited","--no-titles"],"builder"===this["interface"]?(u=r,this.rwcountBinSizeEnabled&&u.push("--bin-size="+this.rwcountBinSize),this.rwcountLoadSchemeEnabled&&u.push("--load-scheme="+this.rwcountLoadScheme),this.rwcountSkipZeroes&&u.push("--skip-zeroes"),e.siteConfigFile&&u.push("--site-config-file="+e.siteConfigFile),l=u.join(" ")):l=this.rwcountCmd+" "+r.join(" "),l=t.filterOptions(l),n="rwcount "+l,n+=" "+(e.dataTempdir||"/tmp")+"/"+this._id+".rwf","table"===this.presentation&&(this.sortField&&(a=t.rwcountFields.indexOf(this.sortField),d="--field-separator=\\| --key=+"+(a+1)+"n"+(this.sortReverse?"r":""),d=t.filterOptions(d,"\\\\\\|\\+"),p="sort "+d,n+=" | "+p),s.numRecs&&(h="--lines="+(this.startRecNum+s.numRecs-1),h=t.filterOptions(h),o="head "+h,f="--lines="+s.numRecs,f=t.filterOptions(f),c="tail "+f,n+=" | "+o+" | "+c)),e.isSSH&&!i&&(n=e.wrapCommand(n)),n},s.prototype.rwstatsCountModeValueIsEnabled=function(){return"count"===this.rwstatsMode},s.prototype.rwstatsThresholdModeValueIsEnabled=function(){return"threshold"===this.rwstatsMode},s.prototype.rwstatsPercentageModeValueIsEnabled=function(){return"percentage"===this.rwstatsMode},s.prototype.availableChartTypes=function(){return t.availableChartTypes[this.output]},s.prototype.path=function(){return"/query/"+this._id},s}(),t.IPSet=function(){function t(t){_.extend(this,t)}return t.prototype.displayName=function(){return this.name||"#"+this._id},t.prototype.objectSelectName=function(){return this.displayName()},t.prototype.objectSelectValue=function(){return this._id},t.prototype.path=function(){return"/ipset/"+this._id},t}(),t.Tuple=function(){function t(t){_.extend(this,t)}return t.prototype.displayName=function(){return this.name||"#"+this._id},t.prototype.objectSelectName=function(){return this.displayName()},t.prototype.objectSelectValue=function(){return this._id},t.prototype.path=function(){return"/tuple/"+this._id},t}(),t.Transformations={user:function(e){return e instanceof t.User||!e?e:new t.User(e)},config:function(e){return e instanceof t.Config||!e?e:new t.Config(e)},query:function(e){return e instanceof t.Query||!e?e:new t.Query(e)},ipset:function(e){return e instanceof t.IPSet||!e?e:new t.IPSet(e)},tuple:function(e){return e instanceof t.Tuple||!e?e:new t.Tuple(e)}}}();
+!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var t=__coffeescriptShare,e=[].indexOf||function(t){for(var e=0,s=this.length;s>e;e++)if(e in this&&this[e]===t)return e;return-1};t.User=function(){function t(t){var e,s;_.extend(this,t),this.email=null!=(e=this.emails)&&null!=(s=e[0])?s.address:void 0,this.name=this.profile.name,this.firstName=this.name.split(" ").slice(0,1).join(" "),this.lastName=this.name.split(" ").slice(1).join(" ")}return t}(),t.Config=function(){function t(t){_.extend(this,t)}return t.prototype.wrapCommand=function(t){return"ssh "+this.getSSHOptions()+" -p "+this.port+" "+this.user+"@"+this.host+' "'+t+'"'},t.prototype.getSSHOptions=function(){return"-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=error -i "+this.getIdentityFile()},t.prototype.getIdentityFile=function(){return this.identityFile?this.identityFile:process.env.PWD+"/settings/identity"},t}(),t.Query=function(){function s(s){var i,n,r,a,o,h,u,p,l,d,c,f,m,w,y,g,b,S,E,C,F,D,T,v,O;if(_.extend(this,s),this.header=[],this.rows=[],this.result){for(h=t.parseResult(this.result),"rwstats"===this.output&&(h.shift(),h.shift()),"rwcount"===this.output&&h.unshift(t.rwcountFields),l=h.shift(),f=0,g=l.length;g>f;f++)o=l[f],c={_id:o,name:o.trim(),isDistinct:!1,isPercentage:!1},0===c.name.indexOf("%")&&(c.isPercentage=!0,c.name=c.name.substr(1)),i=/-D.*$/i,c.name.match(i)&&(c.isDistinct=!0,c.name=c.name.replace(i,"")),c.chartType=c.isDistinct?"number":t.chartFieldTypes[c.name]||"string",this.header.push(c);if("chart"===this.presentation)for(m=0,b=h.length;b>m;m++){for(u=h[m],d=[],r=w=0,S=u.length;S>w;r=++w)if(p=u[r],c=this.header[r],!("rwcount"===this.output&&(v=c.name,e.call(this.rwcountFields,v)<0))){switch(c.chartType){case"number":p=parseFloat(p);break;case"date":case"datetime":a=moment.utc(p,"YYYY/MM/DDTHH:mm:ss.SSS"),p=a.toDate()}d.push(p)}this.rows.push(d)}else for(y=0,E=h.length;E>y;y++){for(u=h[y],d=[],r=D=0,C=u.length;C>D;r=++D)p=u[r],c=this.header[r],d.push({_id:c._id,value:p,queryId:this._id});this.rows.push(d)}for(n=[],O=this.header,T=0,F=O.length;F>T;T++)c=O[T],n.push(c);this.header=n}}return s.prototype.displayName=function(){return this.isQuick?"Quick query #"+this._id:this.name||"#"+this._id},s.prototype.inputCommand=function(t,e,s){var i,n,r,a,o,h,u,p,l;for(null==s&&(s=!1),i="rwfilter",i+=" "+this.inputOptions(t),"cmd"===this["interface"]&&(h=i.search(RegExp("--type","i")),0>h&&(i+=" --type=all ")),t.siteConfigFile&&(i+=" --site-config-file="+t.siteConfigFile),o=i.search(RegExp(" (\\/|\\w)+(\\/|\\w|\\-)*\\.(rwf|rw)","i")),0>o&&(a=i.search(RegExp(" (\\/|\\w)+(\\/|\\w|\\-)*\\.(pcap)","i")),a>=0?(r=i.match(RegExp("(\\/|\\w)+(\\/|\\w|\\-)*\\.(pcap)","i")),i+=" --input-pipe=stdin",i=i.replace(r[0],""),i="rwp2yaf2silk --in="+r[0]+" --out=- |"+i):t.dataRootdir&&(i+=" --data-rootdir="+t.dataRootdir)),i+=" --pass=stdout",l=this.inputExclusions(),u=0,p=l.length;p>u;u++)n=l[u],i+=" | rwfilter --input-pipe=stdin",i+=" "+n,t.siteConfigFile&&(i+=" --site-config-file="+t.siteConfigFile),i+=" --fail=stdout";return i+=" > "+(t.dataTempdir||"/tmp")+"/"+this._id+".rwf",t.isSSH&&!s&&(i=t.wrapCommand(i)),i},s.prototype.inputOptions=function(e){var s,i,n,r,a,o;return"builder"===this["interface"]?(i=[],o=this.typesEnabled&&this.types.length&&_.difference(t.queryTypes,this.types).length?this.types.join(","):"all",i.push("--type="+o),"interval"===this.startDateType?(this.startDateEnabled&&this.startDate&&i.push("--start-date="+this.startDate),this.endDateEnabled&&this.endDate&&i.push("--end-date="+this.endDate),this.activeTimeEnabled&&this.activeTime&&i.push("--active-time="+this.activeTime)):this.startDateOffsetEnabled&&this.startDateOffset&&(r=t.intval(this.startDateOffset),s=moment.utc(),n=s.clone().subtract(r,"minutes"),i.push("--start-date="+n.format("YYYY/MM/DD:HH")),i.push("--end-date="+s.format("YYYY/MM/DD:HH")),i.push("--active-time="+n.format("YYYY/MM/DDTHH:mm:ss.SSS")+"-"+s.format("YYYY/MM/DDTHH:mm:ss.SSS"))),this.sensorEnabled&&this.sensor&&i.push("--sensor="+this.sensor),this.daddressEnabled&&this.daddress&&i.push("--daddress="+this.daddress),this.saddressEnabled&&this.saddress&&i.push("--saddress="+this.saddress),this.anyAddressEnabled&&this.anyAddress&&i.push("--any-address="+this.anyAddress),this.dipSetEnabled&&this.dipSet&&i.push("--dipset="+(e.dataTempdir||"/tmp")+"/"+this.dipSet+".rws"),this.sipSetEnabled&&this.sipSet&&i.push("--sipset="+(e.dataTempdir||"/tmp")+"/"+this.sipSet+".rws"),this.anySetEnabled&&this.anySet&&i.push("--anyset="+(e.dataTempdir||"/tmp")+"/"+this.anySet+".rws"),this.tupleFileEnabled&&this.tupleFile&&i.push("--tuple-file="+(e.dataTempdir||"/tmp")+"/"+this.tupleFile+".tuple"),this.tupleDirectionEnabled&&this.tupleDirection&&i.push("--tuple-direction="+this.tupleDirection),this.tupleDelimiterEnabled&&this.tupleDelimiter&&i.push("--tuple-delimiter="+this.tupleDelimiter),this.tupleFieldsEnabled&&this.tupleFields&&i.push("--tuple-fields="+this.tupleFields),this.dportEnabled&&this.dport&&i.push("--dport="+this.dport),this.sportEnabled&&this.sport&&i.push("--sport="+this.sport),this.aportEnabled&&this.aport&&i.push("--aport="+this.aport),this.dccEnabled&&this.dcc.length&&i.push("--dcc="+this.dcc.join(",")),this.sccEnabled&&this.scc.length&&i.push("--scc="+this.scc.join(",")),this.protocolEnabled&&this.protocol&&i.push("--protocol="+this.protocol),this.flagsAllEnabled&&this.flagsAll&&i.push("--flags-all="+this.flagsAll),this.additionalParametersEnabled&&this.additionalParameters&&i.push(this.additionalParameters),a=i.join(" ")):a=this.cmd,t.filterOptions(a)},s.prototype.inputExclusions=function(){var e;return e="","builder"===this["interface"]?this.additionalExclusionsCmdEnabled&&(e=this.additionalExclusionsCmd):e=this.exclusionsCmd,e=t.filterOptions(e),_.compact(e.split(/\s+(?:OR|\|\|)\s+/i))},s.prototype.outputCommand=function(t,e,s){switch(null==s&&(s=!1),this.output){case"rwcut":return this.outputRwcutCommand(t,e,s);case"rwstats":return this.outputRwstatsCommand(t,e,s);case"rwcount":return this.outputRwcountCommand(t,e,s)}},s.prototype.outputRwcutCommand=function(e,s,i){var n,r,a,o,h,u;return null==i&&(i=!1),r=[],this.sortField&&(h=["--fields="+this.sortField],this.sortReverse&&h.push("--reverse"),e.siteConfigFile&&h.push("--site-config-file="+e.siteConfigFile),u=h.join(" "),u=t.filterOptions(u),r.push("rwsort "+u)),a=["--num-recs="+s.numRecs,"--start-rec-num="+this.startRecNum,"--delimited"],this.fields.length&&a.push("--fields="+_.intersection(this.fieldsOrder,this.fields).join(",")),e.siteConfigFile&&a.push("--site-config-file="+e.siteConfigFile),o=a.join(" "),o=t.filterOptions(o),r.push("rwcut "+o),r[0]+=" "+(e.dataTempdir||"/tmp")+"/"+this._id+".rwf",n=r.join(" | "),e.isSSH&&!i&&(n=e.wrapCommand(n)),n},s.prototype.outputRwstatsCommand=function(s,i,n){var r,a,o,h,u,p,l,d,c,f,m,w;if(null==n&&(n=!1),a=["--delimited"],"builder"===this["interface"]){if(h=a,this.rwstatsFields.length&&h.push("--fields="+_.intersection(this.rwstatsFieldsOrder,this.rwstatsFields).join(",")),p=this.rwstatsValues.slice(0),l=this.rwstatsValuesOrder.slice(0),this.rwstatsPrimaryValue&&(p.unshift(this.rwstatsPrimaryValue),l.unshift(this.rwstatsPrimaryValue)),p.length){for(c=_.intersection(l,p),o=f=0,m=c.length;m>f;o=++f)d=c[o],e.call(t.rwstatsValues,d)<0&&(c[o]="distinct:"+d);h.push("--values="+c.join(",")),w=c[0],e.call(t.rwstatsValues,w)<0&&h.push("--no-percents")}switch(h.push("--"+this.rwstatsDirection),this.rwstatsMode){case"count":h.push("--count="+this.rwstatsCountModeValue);break;case"threshold":h.push("--threshold="+this.rwstatsThresholdModeValue);break;case"percentage":h.push("--percentage="+this.rwstatsPercentageModeValue)}this.rwstatsBinTimeEnabled&&h.push(this.rwstatsBinTime?"--bin-time="+this.rwstatsBinTime:"--bin-time"),s.siteConfigFile&&h.push("--site-config-file="+s.siteConfigFile),u=h.join(" ")}else u=this.rwstatsCmd+" "+a.join(" "),u=t.filterOptions(u);return r="rwstats "+u,r+=" "+(s.dataTempdir||"/tmp")+"/"+this._id+".rwf",s.isSSH&&!n&&(r=s.wrapCommand(r)),r},s.prototype.outputRwcountCommand=function(e,s,i){var n,r,a,o,h,u,p,l,d,c,f;return null==i&&(i=!1),r=["--delimited","--no-titles"],"builder"===this["interface"]?(u=r,this.rwcountBinSizeEnabled&&u.push("--bin-size="+this.rwcountBinSize),this.rwcountLoadSchemeEnabled&&u.push("--load-scheme="+this.rwcountLoadScheme),this.rwcountSkipZeroes&&u.push("--skip-zeroes"),e.siteConfigFile&&u.push("--site-config-file="+e.siteConfigFile),p=u.join(" ")):p=this.rwcountCmd+" "+r.join(" "),p=t.filterOptions(p),n="rwcount "+p,n+=" "+(e.dataTempdir||"/tmp")+"/"+this._id+".rwf","table"===this.presentation&&(this.sortField&&(a=t.rwcountFields.indexOf(this.sortField),d="--field-separator=\\| --key=+"+(a+1)+"n"+(this.sortReverse?"r":""),d=t.filterOptions(d,"\\\\\\|\\+"),l="sort "+d,n+=" | "+l),s.numRecs&&(h="--lines="+(this.startRecNum+s.numRecs-1),h=t.filterOptions(h),o="head "+h,f="--lines="+s.numRecs,f=t.filterOptions(f),c="tail "+f,n+=" | "+o+" | "+c)),e.isSSH&&!i&&(n=e.wrapCommand(n)),n},s.prototype.rwstatsCountModeValueIsEnabled=function(){return"count"===this.rwstatsMode},s.prototype.rwstatsThresholdModeValueIsEnabled=function(){return"threshold"===this.rwstatsMode},s.prototype.rwstatsPercentageModeValueIsEnabled=function(){return"percentage"===this.rwstatsMode},s.prototype.availableChartTypes=function(){return t.availableChartTypes[this.output]},s.prototype.path=function(){return"/query/"+this._id},s}(),t.IPSet=function(){function t(t){_.extend(this,t)}return t.prototype.displayName=function(){return this.name||"#"+this._id},t.prototype.objectSelectName=function(){return this.displayName()},t.prototype.objectSelectValue=function(){return this._id},t.prototype.path=function(){return"/ipset/"+this._id},t}(),t.Tuple=function(){function t(t){_.extend(this,t)}return t.prototype.displayName=function(){return this.name||"#"+this._id},t.prototype.objectSelectName=function(){return this.displayName()},t.prototype.objectSelectValue=function(){return this._id},t.prototype.path=function(){return"/tuple/"+this._id},t}(),t.Transformations={user:function(e){return e instanceof t.User||!e?e:new t.User(e)},config:function(e){return e instanceof t.Config||!e?e:new t.Config(e)},query:function(e){return e instanceof t.Query||!e?e:new t.Query(e)},ipset:function(e){return e instanceof t.IPSet||!e?e:new t.IPSet(e)},tuple:function(e){return e instanceof t.Tuple||!e?e:new t.Tuple(e)}}}();
!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;Template.changePasswordAlertButtonsPanel.helpers,Template.changePasswordAlertButtonsPanel.rendered=function(){},Template.changePasswordAlertButtonsPanel.events({"click .change-button":function(e,t){return $(e.currentTarget).closest(".alert-message").find("form").submit()}})}();
@@ -399,7 +399,7 @@ queue:!1,duration:e.duration,easing:e.easing,complete:function(){0===a.to.opacit
!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;Template.login.rendered=function(){var r,a;return r=this.$(".signin form"),r.validate({rules:{email:{required:!0,email:!0},password:{required:!0,minlength:4}},messages:i18n.t("forms.login.messages",{returnObjectTrees:!0}),submitHandler:function(a){var o,s;return o=$(".email",a).val().toLowerCase(),s=$(".password",a).val(),Meteor.loginWithPassword(o,s,function(a){return a?r.validate().showErrors({password:i18n.t("serverErrors."+a.reason)}):($(document.body).trigger("popup.hide"),e.loginCallback())})}}),a=this.$(".signup form"),a.validate({rules:{email:{required:!0,email:!0},password:{required:!0,minlength:4},passwordAgain:{required:!0,equalTo:".signup .password"}},messages:i18n.t("forms.login.messages",{returnObjectTrees:!0}),submitHandler:function(r){var o,s;return o=$(".email",r).val().toLowerCase(),s=$(".password",r).val(),Accounts.createUser({email:o,password:s},function(r){return r?a.validate().showErrors({password:i18n.t("serverErrors."+r.reason)}):($(document.body).trigger("popup.hide"),e.loginCallback())})}}),e.isDebug?(a.find(".email").val(Random.id()+"@flowbat.com"),a.find(".password").val("asdfasdf"),a.find(".passwordAgain").val("asdfasdf")):void 0},Template.login.events({"click .sign-in-with-google":grab(function(r,a){return Meteor.loginWithGoogle({},e.loginCallback)}),"click .forgot-password":grab(function(e,r){return UI.insert(UI.renderWithData(Template.alert,{name:i18n.t("forms.login.passwordForgot.alert.name"),descriptionTemplateName:"forgotPasswordAlertDescription",descriptionTemplateData:{},buttonPanelTemplateName:"forgotPasswordAlertButtonsPanel",buttonPanelTemplateData:{}}),document.body)})})}();
-!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;Template.navbar.helpers,Template.navbar.rendered=function(){},Template.navbar.events({"click .create-quick-query":grab(function(r,t){var c;return c=e.Queries.insert({isQuick:!0}),Router.go("/query/"+c)}),"click .logout":grab(function(e,r){return Meteor.logout()})})}();
+!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;Template.navbar.helpers,Template.navbar.rendered=function(){},Blaze._allowJavascriptUrls(),Template.navbar.events({"click .create-quick-query":grab(function(r,t){var a;return a=e.Queries.insert({isQuick:!0}),Router.go("/query/"+a)}),"click .logout":grab(function(e,r){return Meteor.logout()})})}();
!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;Template.notFound.helpers,Template.notFound.rendered=function(){},Template.notFound.events}();
@@ -437,7 +437,7 @@ var XRegExp;XRegExp=XRegExp||function(e){"use strict";function t(e,t,n){var r;fo
!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;i18n.init({resStore:{},fallbackLng:"en",interpolationPrefix:"{{",interpolationSuffix:"}}"})}();
-!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;i18n.addResourceBundle("en",{name:"English",forms:{login:{email:"Email",password:"Password",passwordAgain:"Password again",forgotPassword:"Forgot password?",signup:"Let's go!",login:"Login",isLoggingIn:"Logging in...",messages:{email:{required:"Please specify your email",email:"Doesn't seem to be valid email"},password:{required:"Please specify your password",minlength:"Password should have at least 4 characters"},passwordAgain:{required:"Please repeat your password",equalTo:"The passwords should match"}},passwordForgot:{link:"Forgot password",alert:{name:"Reset password",emailPlaceholder:"Your email",reset:"Reset",errors:{userNotFound:"Account with that email does not exists."}}},passwordReset:{alert:{name:"Reset password",passwordPlaceholder:"New password",reset:"Reset",errors:{tokenNotFound:"Request is expired, try again."}}}},invite:{setPassword:"Set your password to begin using the application:"},profile:{header:"Profile settings",email:"Email address",emailPlaceholder:"Email address",name:"Name and surname",namePlaceholder:"Name and surname",password:"Password",passwordPlaceholder:"Password",passwordChange:{link:"Change password",alert:{name:"Change password",oldPasswordPlaceholder:"Old password",newPasswordPlaceholder:"New password",change:"Change",errors:{incorrectPassword:"Please specify correct old password"}}},phone:"Phone for SMS reminders",phonePlaceholder:"With country code; e.g. +1 260 123 45 67",phoneVerifyToReceiveSmsReminders:"Verify your number to receive SMS reminders.",phoneIsVerified:"This phone number is verified.",phoneSendVerificationCode:"Send verification code",youCanResendVerificationCodeInSomeMinutes:"You may request another verification code in {{minutes}} minutes.",phoneVerificationCodePlaceholder:"Verification code",phoneVerification:"Verification of {{phone}}",phoneVerify:"Verify",language:"Language",image:"Avatar",group:"Group",mode:"Mode",wrongVerificationCode:"Verification code doesn't match.",messages:{email:{required:"Email is required.",email:"Please enter a valid email address.",uniqueEmail:"Email already exists."},name:{required:"Name is required."},password:{required:"Password is required."},group:{required:"Group is required."},inserted:"User added successfully.",saved:"User updated successfully."}}},serverErrors:{"User not found":"User not found","Email already exists":"Email already exists","Incorrect password":"Incorrect password","User has no password set":"Please, follow the link from the invitation email and set a new password","Token expired":"Invitation link has expired"},"interface":{create:"Create",insert:"Add",update:"Edit",remove:"Delete",save:"Save",cancel:"Cancel",changesAreSavedAutomatically:"All changes are saved automatically."},rwcut:{fields:{sIP:"Source IP",dIP:"Destination IP",aIP:"Any IP",sPort:"Source port",dPort:"Destination port",aPort:"Any port",protocol:"IP protocol",pro:"$t(rwcut.fields.protocol)",packets:"Packet count",bytes:"Byte count",flags:"TCP flags",sTime:"Starting time",duration:"Duration",dur:"$t(rwcut.fields.duration)",eTime:"End time",sensor:"Sensor",sen:"$t(rwcut.fields.sensor)","class":"Sensor class",scc:"Source country",dcc:"Destination country",initialFlags:"Initial flags",sessionFlags:"Session flags",application:"Application",type:"Sensor type","sTime+msec":"starting time of flow including milliseconds (milliseconds are always displayed)","eTime+msec":"end time of flow including milliseconds (milliseconds are always displayed)","dur+msec":"duration of flow including milliseconds (milliseconds are always displayed)",iType:"ICMP type",iCode:"ICMP code",icmpTypeCode:"ICMP type & code",Records:"Records",Packets:"Packets",Bytes:"Bytes","cumul_%":"% Cumulative",Date:"Bin date and time"}},users:{fields:{username:"Username",email:"Email",name:"Name",group:"Group",actions:"Actions"},removeAlert:{name:"Delete user",description:"Are you sure you want to delete user?",remove:"Delete"}},groups:{admin:"Admin",analyst:"Analyst"}})}();
+!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;i18n.addResourceBundle("en",{name:"English",forms:{login:{email:"Email",password:"Password",passwordAgain:"Password again",forgotPassword:"Forgot password?",signup:"Let's go!",login:"Login",isLoggingIn:"Logging in...",messages:{email:{required:"Please specify your email",email:"Doesn't seem to be valid email"},password:{required:"Please specify your password",minlength:"Password should have at least 4 characters"},passwordAgain:{required:"Please repeat your password",equalTo:"The passwords should match"}},passwordForgot:{link:"Forgot password",alert:{name:"Reset password",emailPlaceholder:"Your email",reset:"Reset",errors:{userNotFound:"Account with that email does not exists."}}},passwordReset:{alert:{name:"Reset password",passwordPlaceholder:"New password",reset:"Reset",errors:{tokenNotFound:"Request is expired, try again."}}}},invite:{setPassword:"Set your password to begin using the application:"},profile:{header:"Profile settings",email:"Email address",emailPlaceholder:"Email address",name:"Name and surname",namePlaceholder:"Name and surname",password:"Password",passwordPlaceholder:"Password",passwordChange:{link:"Change password",alert:{name:"Change password",oldPasswordPlaceholder:"Old password",newPasswordPlaceholder:"New password",change:"Change",errors:{incorrectPassword:"Please specify correct old password"}}},phone:"Phone for SMS reminders",phonePlaceholder:"With country code; e.g. +1 260 123 45 67",phoneVerifyToReceiveSmsReminders:"Verify your number to receive SMS reminders.",phoneIsVerified:"This phone number is verified.",phoneSendVerificationCode:"Send verification code",youCanResendVerificationCodeInSomeMinutes:"You may request another verification code in {{minutes}} minutes.",phoneVerificationCodePlaceholder:"Verification code",phoneVerification:"Verification of {{phone}}",phoneVerify:"Verify",language:"Language",image:"Avatar",group:"Group",mode:"Mode",wrongVerificationCode:"Verification code doesn't match.",messages:{email:{required:"Email is required.",email:"Please enter a valid email address.",uniqueEmail:"Email already exists."},name:{required:"Name is required."},password:{required:"Password is required."},group:{required:"Group is required."},inserted:"User added successfully.",saved:"User updated successfully."}}},serverErrors:{"User not found":"User not found","Email already exists":"Email already exists","Incorrect password":"Incorrect password","User has no password set":"Please, follow the link from the invitation email and set a new password","Token expired":"Invitation link has expired"},"interface":{create:"Create",insert:"Add",update:"Edit",remove:"Delete",save:"Save",cancel:"Cancel",changesAreSavedAutomatically:"All changes are saved automatically."},rwcut:{fields:{sIP:"Source IP",dIP:"Destination IP",aIP:"Any IP",sPort:"Source port",dPort:"Destination port",aPort:"Any port",protocol:"IP protocol",pro:"$t(rwcut.fields.protocol)",packets:"Packet count",bytes:"Byte count",flags:"TCP flags",sTime:"Starting time",duration:"Duration",dur:"$t(rwcut.fields.duration)",eTime:"End time",sensor:"Sensor",sen:"$t(rwcut.fields.sensor)","class":"Sensor class",scc:"Source country",dcc:"Destination country",initialFlags:"Initial flags",sessionFlags:"Session flags",application:"Application",type:"Flow type","sTime+msec":"starting time of flow including milliseconds (milliseconds are always displayed)","eTime+msec":"end time of flow including milliseconds (milliseconds are always displayed)","dur+msec":"duration of flow including milliseconds (milliseconds are always displayed)",iType:"ICMP type",iCode:"ICMP code",icmpTypeCode:"ICMP type & code",Records:"Records",Packets:"Packets",Bytes:"Bytes","cumul_%":"% Cumulative",Date:"Bin date and time"}},field:{definitions:{sIP:"Source IP address. These can be specified during input as IP addresses or CIDR notation.",dIP:"Destination IP address. These can be specified during input as IP addresses or CIDR notation.",aIP:"Matches source or destination IP address. These can be specified during input as IP addresses or CIDR notation.",sPort:"Source ports can be specified during input as individual ports or hypenated ranges (IE: 0-1024)",dPort:"Destination ports can be specified during input as individual ports or hypenated ranges (IE: 0-1024)",aPort:"This will match against records with a source or destination port matching this value or range (IE: 0-1024).",protocol:"Pass the record if its IP Suite Protocol is in this INTEGER_LIST, possible values are 0-255.",pro:"$t(rwcut.fields.protocol)",packets:"Pass the record if its packet count is in this INTEGER_RANGE or value.",bytes:"Pass the record if its average bytes per packet count (bytes/packet) is in this DECIMAL_RANGE.",flags:"Pass the record if any of the HIGH_SET/MASK_SET pairs is true when looking at the bitwise OR of the TCP flags across all packets in the flow.",sTime:"Starting time of flow (seconds resolution).",duration:"Duration of flow (seconds resolution).",dur:"$t(rwcut.fields.duration)",eTime:"End time of the flow (seconds resolution).",sensor:"Name or ID of the sensor where the flow was collected.",sen:"$t(rwcut.fields.sensor)","class":"Binning by class and/or type equates to binning by the integer value used internally to represent the class/type pair. See the rwflowpack configuration.",scc:"This is filtering or grouping by source country code. The source country code refers to the country code associated with the source address per flow record.",dcc:"This is filtering or grouping by destination country code. The destination country code refers to the country code associated with the destination address per flow record.",initialFlags:"Pass the record if the initial HIGH_SET/MASK_SET pairs is true when looking at the bitwise OR of the TCP flags across the FIRST packet in the flow.",sessionFlags:"Pass the record if any of the HIGH_SET/MASK_SET pairs is true when looking at the bitwise OR of the TCP flags across all packets in the flow, excluding the first.",application:"The application value is the port number that is traditionally used for that type of traffic but is based on packet inspection by the generator. If the application cannot be determined, a 0 is used. Not all flow generators will inspect data to this level.",type:"Flow type. Types are defined in silk.conf, they typically refer to the direction of the flow. Examples include; int2","sTime+msec":"starting time of flow including milliseconds (milliseconds are always displayed)","eTime+msec":"end time of flow including milliseconds (milliseconds are always displayed)","dur+msec":"duration of flow including milliseconds (milliseconds are always displayed)",iType:"Pass the record if its ICMP (or ICMPv6) type is in this INTEGER_LIST; possible values 0-255.",iCode:"Pass the record if its ICMP (or ICMPv6) code is in this INTEGER_LIST; possible values 0-255.",icmpTypeCode:"ICMP type & code.",Records:"In rwstats, count the number of flow records that mapped to each bin.",Packets:"In rwstats, sum the number of packets across all records that mapped to each bin.",Bytes:"In rwstats, sum the number of bytes across all records that mapped to each bin.","cumul_%":"Cumulative-percentage",Date:"Bin date and time"}},users:{fields:{username:"Username",email:"Email",name:"Name",group:"Group",actions:"Actions"},removeAlert:{name:"Delete user",description:"Are you sure you want to delete user?",remove:"Delete"}},groups:{admin:"Admin",analyst:"Analyst"}})}();
!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;e.Queries=window.Queries=new Meteor.Collection("queries",{transform:e.Transformations.query}),e.IPSets=window.IPSets=new Meteor.Collection("ipsets",{transform:e.Transformations.ipset}),e.Tuples=window.Tuples=new Meteor.Collection("tuples",{transform:e.Transformations.tuple}),e.Configs=window.Configs=new Meteor.Collection("configs",{transform:e.Transformations.config})}();
@@ -459,7 +459,7 @@ var XRegExp;XRegExp=XRegExp||function(e){"use strict";function t(e,t,n){var r;fo
!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;Deps.autorun(function(t){return e.queriesHandle.ready()?(e.Queries.find({isOutputStale:!0}).forEach(function(t){return e.Queries.update(t._id,{$set:{isOutputStale:!0}})}),t.stop()):void 0})}();
-!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare,r=[].indexOf||function(e){for(var r=0,t=this.length;t>r;r++)if(r in this&&this[r]===e)return r;return-1};UI.registerHelper("fieldI18nString",function(){return"rwcut.fields."+this.trim()}),UI.registerHelper("fieldIsSelected",function(e,t){var i;return i=this.toString(),r.call(e[t],i)>=0}),UI.registerHelper("currentConfig",function(){return e.Configs.findOne()}),UI.registerHelper("currentTemplateName",function(){return Router.current().lookupTemplate()})}();
+!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare,r=[].indexOf||function(e){for(var r=0,t=this.length;t>r;r++)if(r in this&&this[r]===e)return r;return-1};UI.registerHelper("fieldI18nString",function(){return"rwcut.fields."+this.trim()}),UI.registerHelper("fieldDefinitions",function(){return"field.definitions."+this.trim()}),UI.registerHelper("fieldIsSelected",function(e,t){var i;return i=this.toString(),r.call(e[t],i)>=0}),UI.registerHelper("currentConfig",function(){return e.Configs.findOne()}),UI.registerHelper("currentTemplateName",function(){return Router.current().lookupTemplate()})}();
!function(){__coffeescriptShare="object"==typeof __coffeescriptShare?__coffeescriptShare:{};var e=__coffeescriptShare;e.Pivoting={fields2properties:{sIP:"saddress",dIP:"daddress",aIP:"anyAddress",sPort:"sport",dPort:"dport",aPort:"aport",protocol:"protocol",flags:"flagsAll",sTime:"startDate",eTime:"endDate",aTime:"activeTime",sensor:"sensor",scc:"scc",dcc:"dcc",type:"type"},fields2options:{sIP:"saddress",dIP:"daddress",aIP:"any-address",sPort:"sport",dPort:"dport",aPort:"aport",protocol:"protocol",pro:"protocol",packets:"packets",bytes:"bytes",flags:"flags-all",duration:"duration",dur:"duration",sTime:"start-date",eTime:"end-date",aTime:"active-time",sensor:"sensor",sen:"sensor","class":"class",scc:"scc",dcc:"dcc",initialFlags:"flags-initial",sessionFlags:"flags-session",application:"application",type:"type","sTime+msec":"start-date","eTime+msec":"end-date","dur+msec":"duration",iType:"icmp-type",iCode:"icmp-code"},execute:function(s,t,a){var i,c;switch(t){case"flags":case"initialFlags":case"sessionFlags":a=a+"/"+a;break;case"sTime":case"eTime":a=moment.utc(a,"YYYY/MM/DDTHH:mm:ss.SSS").format("YYYY/MM/DD:HH");break;case"type":case"scc":case"dcc":a=[a]}if(i={},"builder"===s["interface"]?(c=e.Pivoting.fields2properties[t],c||(c="additionalParameters",a=this.replace(s.additionalParameters,e.Pivoting.fields2options[t],a)),i[c+"Enabled"]=!0,i[c]=a):i.cmd=this.replace(s.cmd,e.Pivoting.fields2options[t],a),e.Queries.update(s._id,{$set:i}),"builder"===s["interface"])switch(t){case"type":case"scc":case"dcc":return _.defer(function(){return $(".query-"+t+"-editor").trigger("chosen:updated")})}},replace:function(e,s,t){var a,i;return a=new RegExp("--"+s+"=[^\\s]+","i"),i="--"+s+"="+t,e.match(a)?e.replace(a,i):e+" "+i}}}();
diff --git a/private/bundle/programs/web.browser/program.json b/private/bundle/programs/web.browser/program.json
index 142479d..fda3b24 100644
--- a/private/bundle/programs/web.browser/program.json
+++ b/private/bundle/programs/web.browser/program.json
@@ -2,22 +2,22 @@
"format": "web-program-pre1",
"manifest": [
{
- "path": "1e322250cb8e06a7df65d83b477136b7bbff504f.js",
+ "path": "b55cd89ecbf81d1372b4e1ed02e0e2ca813ec38f.js",
"where": "client",
"type": "js",
"cacheable": true,
- "url": "/1e322250cb8e06a7df65d83b477136b7bbff504f.js",
- "size": 1098924,
- "hash": "1e322250cb8e06a7df65d83b477136b7bbff504f"
+ "url": "/b55cd89ecbf81d1372b4e1ed02e0e2ca813ec38f.js",
+ "size": 1126909,
+ "hash": "b55cd89ecbf81d1372b4e1ed02e0e2ca813ec38f"
},
{
- "path": "5e50bc1ff2730b927bd5a8843b8180b18b6fba0e.css",
+ "path": "40985797a98c80d720d8ea9e7852aa5ed0291e35.css",
"where": "client",
"type": "css",
"cacheable": true,
- "url": "/5e50bc1ff2730b927bd5a8843b8180b18b6fba0e.css?meteor_css_resource=true",
- "size": 245223,
- "hash": "5e50bc1ff2730b927bd5a8843b8180b18b6fba0e"
+ "url": "/40985797a98c80d720d8ea9e7852aa5ed0291e35.css?meteor_css_resource=true",
+ "size": 245284,
+ "hash": "40985797a98c80d720d8ea9e7852aa5ed0291e35"
},
{
"path": "app/favicon.ico",
@@ -178,8 +178,8 @@
"type": "asset",
"cacheable": false,
"url": "/images/logo.png",
- "size": 7907,
- "hash": "42f4d3e45d585691b57e8108e18739efe21b41b9"
+ "size": 8565,
+ "hash": "1a62aaff9572d3a166612759f5fb9d6c1c30eaca"
},
{
"path": "app/images/minus.png",
diff --git a/private/bundle/settings/meteorsettings.json b/private/bundle/settings/meteorsettings.json
index 4f4369e..8eef778 100755
--- a/private/bundle/settings/meteorsettings.json
+++ b/private/bundle/settings/meteorsettings.json
@@ -7,7 +7,7 @@ METEOR_SETTINGS='{
"secret": ""
},
"public": {
- "version": "FlowBAT v1.4.0",
+ "version": "FlowBAT v1.5.0",
"isDebug": false,
"googleAnalytics": {
"property": "",
diff --git a/private/bundle/settings/prod.sample.json b/private/bundle/settings/prod.sample.json
index 40a8a4f..e5a96ff 100644
--- a/private/bundle/settings/prod.sample.json
+++ b/private/bundle/settings/prod.sample.json
@@ -7,7 +7,7 @@
"secret": ""
},
"public": {
- "version": "FlowBAT v1.4.0",
+ "version": "FlowBAT v1.5.0",
"isDebug": false,
"googleAnalytics": {
"property": "",
diff --git a/public/images/logo.png b/public/images/logo.png
index d401103..b61e827 100644
Binary files a/public/images/logo.png and b/public/images/logo.png differ
diff --git a/server/execution.coffee b/server/execution.coffee
index 62b84bd..4094eb5 100644
--- a/server/execution.coffee
+++ b/server/execution.coffee
@@ -256,6 +256,8 @@ executeQuery = (query, config, profile, callback) ->
result = stdout.trim()
error = stderr.trim()
code = if err then err.code else 0
+ if error.indexOf("Rejected") isnt -1
+ error = null
callback(result, error, code)
))
diff --git a/settings/dev.json b/settings/dev.json
index c45bd5a..082ba1b 100644
--- a/settings/dev.json
+++ b/settings/dev.json
@@ -7,7 +7,7 @@
"secret": ""
},
"public": {
- "version": "FlowBAT v1.4.0",
+ "version": "FlowBAT v1.5.0",
"isDebug": false,
"googleAnalytics": {
"property": "",
diff --git a/settings/meteorsettings.json b/settings/meteorsettings.json
index 4f4369e..8eef778 100755
--- a/settings/meteorsettings.json
+++ b/settings/meteorsettings.json
@@ -7,7 +7,7 @@ METEOR_SETTINGS='{
"secret": ""
},
"public": {
- "version": "FlowBAT v1.4.0",
+ "version": "FlowBAT v1.5.0",
"isDebug": false,
"googleAnalytics": {
"property": "",
diff --git a/settings/prod.sample.json b/settings/prod.sample.json
index 40a8a4f..e5a96ff 100644
--- a/settings/prod.sample.json
+++ b/settings/prod.sample.json
@@ -7,7 +7,7 @@
"secret": ""
},
"public": {
- "version": "FlowBAT v1.4.0",
+ "version": "FlowBAT v1.5.0",
"isDebug": false,
"googleAnalytics": {
"property": "",
diff --git a/support/silkanalysisonly.sh b/support/silkanalysisonly.sh
new file mode 100644
index 0000000..d966637
--- /dev/null
+++ b/support/silkanalysisonly.sh
@@ -0,0 +1,168 @@
+#!/bin/bash
+
+# Automatic SiLK Installation Script
+# Chris Sanders & Jason Smith
+
+exec > >(tee -a silkanalysisinstall.log)
+exec 2> >(tee -a silkanalysisinstall.log >&2)
+
+silkversion=$(echo "3.11.0.1")
+lfbversion=$(echo "1.7.1")
+workingDir=$PWD
+
+ask() {
+ # http://djm.me/ask
+ while true; do
+
+ if [ "${2:-}" = "Y" ]; then
+ prompt="Y/n"
+ default=Y
+ elif [ "${2:-}" = "N" ]; then
+ prompt="y/N"
+ default=N
+ else
+ prompt="y/n"
+ default=
+ fi
+
+ # Ask the question
+ read -p "$1 [$prompt] " REPLY
+
+ # Default?
+ if [ -z "$REPLY" ]; then
+ REPLY=$default
+ fi
+
+ # Check if the reply is valid
+ case "$REPLY" in
+ Y|y) return 0 ;;
+ N|n) return 1 ;;
+ *) echo "You must give a y or n answer." ;;
+ esac
+
+ done
+}
+
+echo "$(tput setaf 6)This script will install the SiLK Analysis Toolset and dependencies only. This is useful for users that are only interacting with flow data that might reside on another device. If you wish to have full flow collection, use silkonabox.sh."
+echo "You will be prompted to enter your password in order to gain the appropriate priviledges to perform this install."
+echo "!!!!!An internet connection IS $(tput sgr0)$(tput setaf 1)required$(tput sgr0)$(tput setaf 6) in order to complete this installation!!!!!$(tput sgr0)"
+
+#Check if there is an internet connection
+wget -q --tries=10 --timeout=20 --spider http://google.com
+if [[ $? -eq 0 ]]; then
+ echo "$(tput setaf 2)It appears that you do have an internet connection.$(tput sgr0)"
+else
+ echo "$(tput setaf 1)It appears that you do not have an internet connection! This installation will fail.$(tput sgr0)"
+ if ask "$(tput setaf 2)Do you want to try anyways?$(tput sgr0)$(tput setaf 1)Success is unlikely.$(tput sgr0)"; then
+ echo ""
+ else
+ echo "That was probably a good choice if this is your first time running this install."
+ exit 1
+ fi
+fi
+
+if ask "$(tput setaf 3)Do you wish to proceed?$(tput sgr0)"; then
+ echo
+else
+ exit 1
+fi
+
+cd $workingDir
+
+echo "$(tput setaf 6)Checking installed packages...$(tput sgr0)"
+sudo apt-get update -qq
+
+# Install Prerequisites
+echo -e "$(tput setaf 6)Installing Prerequisites. This might require your password and take a few minutes.$(tput sgr0)"
+sudo apt-get -qq -y install glib2.0 libglib2.0-dev libpcap-dev g++ python-dev make gcc
+
+if which rwp2yaf2silk > /dev/null; then
+ echo -e "$(tput setaf 2)It looks like SiLK might already be installed.$(tput sgr0)"
+ if ask "$(tput setaf 3)Do you wish to proceed and try installing anyways?$(tput sgr0)"; then
+ echo
+ else
+ exit 1
+ fi
+ else
+ # Download and Extract SiLK Components
+ if [ ! -f libfixbuf-$lfbversion.tar.gz ]; then
+ echo -e "$(tput setaf 6)libfixbuf-$lfbversion.tar.gz not found. Downloading.$(tput sgr0)"
+ wget http://tools.netsa.cert.org/releases/libfixbuf-$lfbversion.tar.gz
+ else
+ if ask "$(tput setaf 3)libfixbuf-$lfbversion.tar.gz found. Remove original and download again?$(tput sgr0)"; then
+ echo
+ rm libfixbuf-$lfbversion.tar.gz
+ wget http://tools.netsa.cert.org/releases/libfixbuf-$lfbversion.tar.gz
+ fi
+ fi
+ if [ ! -f silk-$silkversion.tar.gz ]; then
+ echo -e "$(tput setaf 6)silk-$silkversion.tar.gz not found. Downloading.$(tput sgr0)"
+ wget http://tools.netsa.cert.org/releases/silk-$silkversion.tar.gz
+ else
+ if ask "$(tput setaf 3)silk-$silkversion.tar.gz found. Remove original and download again?$(tput sgr0)"; then
+ echo
+ rm silk-$silkversion.tar.gz
+ wget http://tools.netsa.cert.org/releases/silk-$silkversion.tar.gz
+ fi
+ fi
+ tar zxf libfixbuf-$lfbversion.tar.gz
+ tar zxf silk-$silkversion.tar.gz
+
+ # Install Libfixbuf
+ echo -e "$(tput setaf 6)Building libfixbuf...$(tput sgr0)"
+ cd libfixbuf-$lfbversion/
+ ./configure
+ make
+ sudo make install
+
+ # Create Data Directory and Install SiLK
+ sudo mkdir /data
+ echo -e "$(tput setaf 6)Building SiLK...$(tput sgr0)"
+ cd ../silk-$silkversion/
+ ./configure --with-libfixbuf=/usr/local/lib/pkgconfig/ --with-python
+ make
+ sudo make install
+
+ echo "$(tput setaf 6)Cleaning up tar files...$(tput sgr0)"
+ rm ../libfixbuf-$lfbversion.tar.gz
+ rm ../silk-$silkversion.tar.gz
+
+# Configure SiLk
+ cat > silk.conf << "EOF"
+ /usr/local/lib
+ /usr/local/lib/silk
+EOF
+
+ sudo mv silk.conf /etc/ld.so.conf.d/
+ sudo ldconfig
+ sudo cp site/twoway/silk.conf /data
+
+ cat > sensors.conf << "EOF"
+ probe S0 ipfix
+ listen-on-port 18001
+ protocol tcp
+ listen-as-host 127.0.0.1
+ end probe
+ group my-network
+ ipblocks 192.168.0.0/16 # address of eth0. CHANGE THIS.
+ ipblocks 172.16.0.0/12 # other blocks you consider internal
+ ipblocks 10.0.0.0/8 # other blocks you consider internal
+ end group
+ sensor S0
+ ipfix-probes S0
+ internal-ipblocks @my-network
+ external-ipblocks remainder
+ end sensor
+EOF
+
+ sudo mv sensors.conf /data
+
+fi
+
+## Download country code database - These can be updated as needed via the commands below
+wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
+gzip -d -c GeoIP.dat.gz | rwgeoip2ccmap --encoded-input > country_codes.pmap
+sudo mv country_codes.pmap /usr/local/share/silk/
+
+echo -e "$(tput setaf 2)SiLK installation finished..$(tput sgr0)"
+exit 0
diff --git a/support/silkonabox.sh b/support/silkonabox.sh
index 0567d0b..0582df9 100755
--- a/support/silkonabox.sh
+++ b/support/silkonabox.sh
@@ -7,7 +7,7 @@ exec > >(tee -a silkinstall.log)
exec 2> >(tee -a silkinstall.log >&2)
silkversion=$(echo "3.11.0.1")
-yafversion=$(echo "2.8.0")
+yafversion=$(echo "2.8.1")
lfbversion=$(echo "1.7.1")
workingDir=$PWD
