Commit Graph

187 Commits

Author SHA1 Message Date
harmj0y 46f9c8986a Update enrichment_configuration.md 2025-11-06 11:16:52 -08:00
harmj0y cc17f5ab0a Update enrichment_configuration.md 2025-11-06 11:13:05 -08:00
harmj0y 78390b410b PII analyzer disabled by default, added documentation
- PII analyzer disabled by default, can be enabled via ENV variable
- Created `enrichment_configuration.md` documentation documenting all enrichment module configurations
2025-11-06 11:08:59 -08:00
Lee Chagolla-Christensen 6ec0a3b61a Workflow performance improvements (#87)
* upgrade to dapr postgresv2 statestore

* actually make it v2

* dapr state table name, cleanup subscriptions/globals

* proper exceptions

* formatting/lint

* Refactor workflow tracking and improve activity input handling

- Extract workflow tracking logic into dedicated WorkflowTrackingService
- Simplify activity signatures to accept specific parameters instead of generic dicts
- Remove unused asyncio event loop references from enrichment modules
- Update YaraRuleManager initialization and method names

* re-added workflow tracking in the DB

* update uvicorn prod options

* enrichment work parallelism, convert queues from broadcast to task queues

* Refactor pubsub and improve workflow parallelism

- Split Dapr pubsub Dapr yaml components into topic-specific queues (alerting, dotnet, dpapi, files, noseyparker, workflow_monitor)
- Update all Dapr volume mounts to reference new topic-specific pubsub components
- Converted queues to task queues
- Use YAML anchors to reduce duplication for file-enrichment replicas
- Pass asyncpg pool to enrichment modules instead of creating connections
- Add asyncpg_pool parameter throughout chromium and enrichment module analyzers
- Update VSCode workspace (removed InspectAssembly, renamed dotnet_api to dotnet_service)
- Added curl commands for Jaeger API to performance docs to help with perf troubleshooting
- Created common.queues module to centralize pubsub/topic names (eases
  future refactoring)

* worker mods

* Workflow performance tuning, fix pubsub config, CLI arg changes

- Fix pubsub deleteWhenUnused typo (deletedWhenUnused)
- Add LOG_LEVEL environment variable support across services
- CLI: Rename --repeat to --times, add --max-files option
- Increase files pubsub prefetchCount from 25 to 50
- Add MAX_PARALLEL_WORKFLOWS configuration
- Fix DotNetAssemblyAnalysis null handling with field validators
- Update dashboard to show cumulative files/findings over time
- Add RUST_LOG environment variable support to noseyparker
- Update CHANGELOG for 2.1.4 release notes

* Dapr 1.16.2 and use db transactions

- Upgrade all Dapr containers from 1.16.1 to 1.16.2
- Reduce enrichment parallelism default from 25 to 5 workflows
- Reduce healthcheck intervals from 10s to 5s for alerting and document conversion
- Fixed DPAPI eventing to use new pubsubs
- Refactor file_linking database operations to use atomic upserts and avoid deadlocks
- Add WriteOnceViolationError handling in DPAPI masterkey analyzer
- Wrap database operations in transactions for enrichment storage and plaintext indexing
- Fix postgres notification handler closure variable capture

* remove unused start_time

* Scheduler persistence, workflow concurrency tuning, and config cleanup

- Add volume for Dapr scheduler and init service
- Add scheduler dependency to file enrichment service
- Add async workflow client libraries
- Format and cleanup compose.yaml (spacing, indentation, empty lines)

* Migrate file_enrichment to async Dapr client and optimize Dockerfile

- Use async DaprClient where possible in file_enrichment
- Improve Dockerfile caching
- Add asyncpg connection pool helper and fix typo in secret store name
- Include VS Code debug configuration for document_conversion
- Remove unused dapr_client from DpapiBlobAnalyzer
- Clean up activity return types and better handle exceptions

* Enrichment tracking for NoseyParker and logging cleanup

- Add workflow_id to NoseyParkerInput and NoseyParkerOutput models
- Remove workflow lookup query in noseyparker subscription handler
- Adjust jaeger_perf_stats.sh output formatting and precision
- Add type hints for async functions

* noseyparker scanner perf, tracing for update_enrichment_results

---------

Co-authored-by: Lee Chagolla-Christensen <lee@localhost>
2025-11-04 14:06:59 -08:00
HarmJ0y cf63a3446e docs: update API documentation [skip ci] 2025-10-31 22:24:07 +00:00
harmj0y bfeb234e06 Update documentation
- Added `alerting` and `reporting` pages
- Updated `agents` page
2025-10-30 09:50:59 -07:00
harmj0y 2f24fea869 Update blog references in docs
-Update blog references in docs
2025-10-27 16:58:26 -07:00
HarmJ0y cd9e054116 docs: update API documentation [skip ci] 2025-10-27 23:41:04 +00:00
harmj0y d55076fd8e doc update
doc update
2025-10-27 13:58:01 -07:00
harmj0y 1e8e4f52e1 Merge branch 'nemesis-2.1.3' of https://github.com/SpecterOps/Nemesis into nemesis-2.1.3 2025-10-27 10:17:33 -07:00
harmj0y baa341be2b Update file_enrichment_modules.md 2025-10-27 10:17:31 -07:00
Lee Chagolla-Christensen b0799541c3 DpapiManager: use pg conn pool 2025-10-25 16:29:45 -07:00
Lee Chagolla-Christensen 003883c1cb remove max parallel workflows, extract DB from WorkflowManager 2025-10-24 01:57:38 -07:00
Lee Chagolla-Christensen c2dac2e8a7 Change DB access and update alerting
- Switch from using POSTGRES_CONNECTION_STRING to
  POSTGRES_USER/POSTGRES_PASSWORD/POSTGRES_DATABASE/etc.
- When no apprise URL is configured, use the test echo'ing endpoint
2025-10-18 21:36:27 -07:00
harmj0y e544d617af Added DPAPI documentation
- Added DPAPI documentation
2025-10-18 18:32:22 -07:00
harmj0y 0748f5abbc Added "Text Translator" agent
-Added "Text Translator" agent
2025-10-02 21:05:07 +09:00
harmj0y d46bff63f3 Updated chromium docs
-Updated `chromium` docs
2025-09-25 20:16:03 -07:00
harmj0y 1b48db7603 Updated agents.md documentation
-Updated `agents.md` documentation
2025-09-17 12:19:04 +03:00
harmj0y 90c430523a Delete .gitkeep 2025-09-02 18:35:16 -07:00
harmj0y f2feea47bc Some preemptive fixes for API doc generation 2025-09-02 18:14:53 -07:00
harmj0y 9b2dd9b43d Start of OpenAPI markdown doc generation (needs testing)
-Start of OpenAPI markdown doc generation (needs testing once merged to `main`)
2025-08-30 15:00:49 -07:00
harmj0y 8c936b29a1 Update index.md 2025-08-30 14:43:15 -07:00
harmj0y 414788be38 Added "Containers" documentation
- Added "Containers" documentation
- Linting for web_api/large_containers.py
2025-08-29 16:17:19 -07:00
harmj0y 40902d9d8f Version 2.1.3
- See CHANGELOG.md for summary of changes
2025-08-29 15:24:32 -07:00
harmj0y f4ef50f28c Update performance.md 2025-07-07 16:50:05 -07:00
Lee Chagolla-Christensen 9b2e8a4ce8 fix indent 2025-07-01 19:30:00 -07:00
harmj0y ef079a3e0c Update docker_compose.md 2025-06-27 14:06:17 -07:00
harmj0y 545bf502d8 Update CHANGELOG.md
-Update CHANGELOG.md
2025-06-27 13:53:04 -07:00
Lee Chagolla-Christensen 53f3f3ec5b link to env.example in docs 2025-06-27 11:59:58 -07:00
Lee Chagolla-Christensen 9aa13db594 add FQDN recommendation 2025-06-27 11:18:50 -07:00
harmj0y f5d488ef34 Update docker_compose.md 2025-06-27 10:09:15 -07:00
harmj0y b04998b3b6 Documentation update
-Documentation update
2025-06-27 10:05:44 -07:00
harmj0y cf29b7fc6f Updated quickstart.md docs
-Updated quickstart.md docs
2025-06-27 09:47:44 -07:00
Lee Chagolla-Christensen d6bdc9c6a9 update workspace file 2025-06-26 23:04:07 -07:00
Lee Chagolla-Christensen fafef1cb83 update cli docs 2025-06-26 22:46:28 -07:00
Lee Chagolla-Christensen 46269a9eea update CLI readme docs 2025-06-26 18:11:04 -07:00
Lee Chagolla-Christensen d62174fb21 update image 2025-06-26 17:55:05 -07:00
Lee Chagolla-Christensen 60d57379a6 update helper scripts + cli.md 2025-06-26 17:52:47 -07:00
Lee Chagolla-Christensen 31844405f5 update submit instructions in cli.md 2025-06-26 14:59:58 -07:00
Lee Chagolla-Christensen 1ce9dde651 doc updates 2025-06-26 14:02:38 -07:00
Lee Chagolla-Christensen b6adcf4efd add advanced docker compose stuff 2025-06-26 13:52:17 -07:00
Lee Chagolla-Christensen a5ccdd0fc1 update quickstart 2025-06-26 12:40:33 -07:00
Lee Chagolla-Christensen 9908a7a992 update start.sh 2025-06-25 22:27:02 -07:00
harmj0y 88ffe1422f Additional documentation
-How to change the Nemesis port
-How to change the SSL certs
-Performance tuning guidance
2025-06-19 15:35:07 +03:00
Lee Chagolla-Christensen 31f5998cf6 update mythic docs 2025-06-16 12:51:33 -07:00
harmj0y 8ef0541a3f Merge branch 'main' of https://github.com/SpecterOps/Nemesis 2025-06-15 10:53:37 +02:00
harmj0y c26be4f54a Update index.md 2025-06-15 10:53:10 +02:00
Matt Ehrnschwender d8894c0477 Add missing stylesheet for documentation theme (#70) 2025-06-14 22:50:22 +02:00
harmj0y 18af5774b6 Update usage_guide.md 2025-06-14 16:19:56 +02:00
harmj0y df3fe5a8d5 Update cli.md 2025-06-14 16:10:41 +02:00