feat(opensearch-web): replace top nav with collapsible sidebar, extend to all 25 modules

Replace the flat horizontal nav bar with a collapsible left sidebar
grouped by protocol category (Core, Files & Certs, Authentication,
Infrastructure, OT/SCADA, Diagnostic). Group expand/collapse state is
persisted in localStorage; the sidebar itself can be collapsed to icon-
only mode with tooltip fallback.

Overview matrix gains collapsible column groups per category (non-core
groups start collapsed). Modules without a src_ip field (pe,
capture_loss) are excluded from the matrix and from IP pivot queries —
run_cross_protocol_query and the ip_pivot route now check
SUPPORTS_IP_FILTER before including a module.

Template rendering for log_view, log_rows, and ip_pivot is now driven
by WEB_COLUMNS instead of per-protocol if/elif chains, making new
modules automatically appear without template edits. record_detail
conditionally hides the FP filter button when SUPPORTS_FP=False.

MODULE_PARAM_KEYS is extended for all 15 new modules. proto_icons and
category_icons are lifted out of base.html into an inject_nav_data
context processor in app.py so they are available to all templates.

- Fix WEB_CATEGORY on FTP module: "core" → "infrastructure"

Author: liamadale

apps/opensearch_web/app.py

@@ -15,7 +15,12 @@
     make_mantis_blueprint,
 )
 from apps.shared.jinja_globals import register_shared_helpers
-from src.querier.zeek_modules import MODULES
+from src.querier.zeek_modules import (
+    CATEGORY_LABELS,
+    CATEGORY_ORDER,
+    MODULES,
+    MODULES_BY_CATEGORY,
+)
 from src.querier.zeek_modules.base import TIME_RANGES
 from src.utils.format import fmt_dur
 
@@ -39,27 +44,75 @@ def create_app() -> Flask:
     app.register_blueprint(make_mantis_blueprint(_resolve_city))
     app.register_blueprint(make_cache_blueprint(wcache))
 
-    # Make TIME_RANGES and MODULES available to all templates
+    # Make TIME_RANGES, MODULES, and nav data available to all templates
     @app.context_processor
-    def inject_globals():
+    def inject_globals() -> dict:
         return {
             "TIME_RANGES": TIME_RANGES,
-            "MODULES": list(MODULES.keys()),
+            "MODULES": MODULES,
             "script_name": request.environ.get("SCRIPT_NAME", ""),
         }
 
+    @app.context_processor
+    def inject_nav_data() -> dict:
+        return {
+            "proto_icons": {
+                "conn": "fa-network-wired",
+                "dns": "fa-server",
+                "http": "fa-globe",
+                "ssl": "fa-lock",
+                "smtp": "fa-envelope",
+                "rdp": "fa-desktop",
+                "smb": "fa-folder-open",
+                "ssh": "fa-terminal",
+                "notice": "fa-bell",
+                "weird": "fa-triangle-exclamation",
+                "files": "fa-file",
+                "x509": "fa-certificate",
+                "pe": "fa-file-code",
+                "kerberos": "fa-key",
+                "ntlm": "fa-user-lock",
+                "dhcp": "fa-address-card",
+                "ftp": "fa-file-arrow-up",
+                "radius": "fa-wifi",
+                "sip": "fa-phone",
+                "tunnel": "fa-circle-nodes",
+                "ntp": "fa-clock",
+                "modbus": "fa-microchip",
+                "dnp3": "fa-bolt",
+                "capture_loss": "fa-gauge",
+                "dpd": "fa-circle-question",
+            },
+            "category_icons": {
+                "core": "fa-layer-group",
+                "files": "fa-folder",
+                "auth": "fa-shield-halved",
+                "infrastructure": "fa-sitemap",
+                "ot": "fa-industry",
+                "diagnostic": "fa-stethoscope",
+            },
+            "category_order": CATEGORY_ORDER,
+            "category_labels": CATEGORY_LABELS,
+            "modules_by_category": MODULES_BY_CATEGORY,
+        }
+
     # ------------------------------------------------------------------
     # GET /  — cross-protocol IP matrix
     # ------------------------------------------------------------------
     @app.route("/")
     def overview():
         search_params = build_search_params_from_request(request)
         rows = run_cross_protocol_query(search_params)
+        # Build per-category module lists, excluding non-IP modules (pe, capture_loss)
+        ip_modules_by_category = {
+            cat: [lt for lt in lts if MODULES[lt].SUPPORTS_IP_FILTER]
+            for cat, lts in MODULES_BY_CATEGORY.items()
+        }
         return render_template(
             "overview.html",
             rows=rows,
             search_params=search_params,
-            log_types=list(MODULES.keys()),
+            ip_modules_by_category=ip_modules_by_category,
         )
 
     # ------------------------------------------------------------------
@@ -71,7 +124,9 @@ def ip_pivot(ip: str):
         search_params["src_ip"] = ip
 
         results: dict = {}
-        for lt in MODULES:
+        for lt, mod in MODULES.items():
+            if not mod.SUPPORTS_IP_FILTER:
+                continue  # pe, capture_loss have no src_ip to pivot on
             sp = dict(search_params)
             results[lt] = cached_run_query(lt, sp)
 
@@ -80,7 +135,6 @@ def ip_pivot(ip: str):
             ip=ip,
             results=results,
             search_params=search_params,
-            log_types=list(MODULES.keys()),
             MODULE_PARAM_KEYS=MODULE_PARAM_KEYS,
         )
 
@@ -102,6 +156,7 @@ def log_view(log_type: str):
             search_params=search_params,
             extra_keys=extra_keys,
             detail_fields=mod.DETAIL_FIELDS,
+            web_columns=mod.WEB_COLUMNS,
         )
 
     # ------------------------------------------------------------------
@@ -120,6 +175,7 @@ def api_search(log_type: str):
             log_type=log_type,
             records=records,
             detail_fields=mod.DETAIL_FIELDS,
+            web_columns=mod.WEB_COLUMNS,
         )
 
     # ------------------------------------------------------------------
@@ -142,6 +198,7 @@ def api_detail(log_type: str, i: int):
             detail_fields=mod.DETAIL_FIELDS,
             idx=i,
             log_type=log_type,
+            supports_fp=mod.SUPPORTS_FP,
         )
 
     # ------------------------------------------------------------------

apps/opensearch_web/queries.py

@@ -9,6 +9,7 @@
 
 # Protocol-specific search_params keys forwarded from HTTP request
 MODULE_PARAM_KEYS: dict = {
+    # Core
     "conn": [],
     "dns": ["dns_query", "rcode", "qtype"],
     "http": ["http_method", "http_host", "http_uri", "status_code"],
@@ -19,6 +20,26 @@
     "ssh": ["ssh_failed_only", "ssh_auth_result"],
     "notice": ["notice_note"],
     "weird": ["weird_name"],
+    # Files & Certs
+    "files": ["mime", "hash", "source_proto", "extracted_only", "dest_ip"],
+    "x509": ["subject", "issuer", "san", "self_signed", "expired"],
+    "pe": ["no_aslr", "no_dep", "only_32bit"],
+    # Authentication
+    "kerberos": ["client", "service", "request_type", "cipher", "failed_only"],
+    "ntlm": ["username", "domain", "failed_only"],
+    "radius": ["username", "mac", "failed_only"],
+    # Infrastructure
+    "dhcp": ["hostname", "mac", "assigned_ip"],
+    "ftp": ["user", "command", "reply_code", "anon_only"],
+    "sip": ["method", "status_code", "user_agent"],
+    "ntp": ["mode", "version"],
+    "tunnel": ["tunnel_type"],
+    # OT / SCADA
+    "modbus": ["function", "exceptions_only"],
+    "dnp3": ["function"],
+    # Diagnostic
+    "capture_loss": [],
+    "dpd": ["analyzer"],
 }
 
 
@@ -51,18 +72,23 @@ def cached_run_query(log_type: str, search_params: dict) -> list:
 
 
 def run_cross_protocol_query(search_params: dict) -> list:
-    """Query all log types in parallel, aggregate by src_ip, sort by total freq."""
+    """Query all IP-capable log types in parallel, aggregate by src_ip, sort by total freq.
+
+    Modules with SUPPORTS_IP_FILTER=False (pe, capture_loss) are excluded — they have no
+    src_ip to aggregate on.
+    """
+    ip_modules = {lt: mod for lt, mod in MODULES.items() if mod.SUPPORTS_IP_FILTER}
     results_by_type: dict = {}
-    with ThreadPoolExecutor(max_workers=len(MODULES)) as ex:
-        futures = {ex.submit(cached_run_query, lt, search_params): lt for lt in MODULES}
+    with ThreadPoolExecutor(max_workers=len(ip_modules)) as ex:
+        futures = {ex.submit(cached_run_query, lt, search_params): lt for lt in ip_modules}
         for f in as_completed(futures):
             lt = futures[f]
             try:
                 results_by_type[lt] = f.result()
             except Exception:
                 results_by_type[lt] = []
 
-    ip_data: dict = defaultdict(lambda: {"per_protocol": {lt: 0 for lt in MODULES}, "total": 0})
+    ip_data: dict = defaultdict(lambda: {"per_protocol": {lt: 0 for lt in ip_modules}, "total": 0})
     for lt, records in results_by_type.items():
         for rec in records:
             ip = rec.get("src_ip", "")