feat: UI auth, settings tab, syslog live connector, auto ground truth, multi-run benchmark, interpretation guide — 125/125

Author: marjatmm-sec

.env.example

@@ -41,3 +41,8 @@ QUTE_SIGMA_COMMUNITY_REPO=https://github.com/SigmaHQ/sigma
 # ── UI ────────────────────────────────────────────────────────────
 QUTE_UI_PORT=8503
 QUTE_UI_THEME=dark
+
+# ── UI Authentication ─────────────────────────────────────────────
+# Leave blank to disable authentication (dev mode)
+# To set a password run: python3 scripts/set_password.py
+QUTE_UI_PASSWORD_HASH=

README.md

@@ -204,8 +204,12 @@ These are honest limitations you should understand before using Qute:
 
   v0.1.0  Initial scaffold — schema, parsers, quantum harness, benchmark layer
   v0.2.0  Few-shot rule generation (done), GPU validation (done),
-          Ising CNN decoder integration, Yara-L backend (pending)
+          Syslog TCP/UDP live connector (done),
+          Ising CNN decoder integration (pending),
+          Additional pySigma backends: OpenSearch, QRadar, Elasticsearch
+          (blocked on pySigma ecosystem version alignment)
   v0.3.0  SecGraph-AI integration module (Neo4j export)
+          Auth hash stored in DuckDB (no restart required for password changes)
   v0.4.0  Real QPU backend testing, expanded qubit count
 
 ---

config.py

@@ -72,8 +72,9 @@ def _resolve_host(env_key: str) -> str:
 )
 
 # ── UI ────────────────────────────────────────────────────────────
-UI_PORT  = int(os.getenv("QUTE_UI_PORT", "8503"))
-UI_THEME = os.getenv("QUTE_UI_THEME", "dark")
+UI_PORT          = int(os.getenv("QUTE_UI_PORT", "8503"))
+UI_THEME         = os.getenv("QUTE_UI_THEME", "dark")
+UI_PASSWORD_HASH = os.getenv("QUTE_UI_PASSWORD_HASH", "")
 
 if __name__ == "__main__":
     print(f"OLLAMA_URL        : {OLLAMA_URL}")

requirements.txt

@@ -13,7 +13,6 @@ grpcio>=1.62.0
 pySigma>=0.11.0
 pySigma-backend-splunk>=0.3.0
 pySigma-backend-microsoft365defender>=0.3.0
-pySigma-backend-qradar-aql>=0.3.0
 PyYAML>=6.0.1
 
 # ── LLM / Classical AI ───────────────────────────────────────────
@@ -37,3 +36,4 @@ rich>=13.7.0
 uuid6>=2024.1.12
 pytz>=2024.1
 numpy>=1.26.0
+bcrypt>=4.0.0

scripts/set_password.py

@@ -0,0 +1,100 @@
+"""
+Qute -- scripts/set_password.py
+Interactive script to set the UI password.
+Generates a bcrypt hash and writes it to .env
+
+Usage:
+    python3 scripts/set_password.py
+"""
+
+import re
+import sys
+import getpass
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+try:
+    import bcrypt
+except ImportError:
+    print("bcrypt not installed. Run: pip install bcrypt")
+    sys.exit(1)
+
+ROOT     = Path(__file__).resolve().parent.parent
+ENV_FILE = ROOT / ".env"
+MIN_LENGTH = 12
+
+
+def check_complexity(password: str) -> list:
+    issues = []
+    if len(password) < MIN_LENGTH:
+        issues.append(f"At least {MIN_LENGTH} characters")
+    if not re.search(r"[A-Z]", password):
+        issues.append("At least one uppercase letter")
+    if not re.search(r"[a-z]", password):
+        issues.append("At least one lowercase letter")
+    if not re.search(r"\d", password):
+        issues.append("At least one number")
+    if not re.search(r"[!@#$%^&*()\-_=+\[\]{};:'\",.<>/?\\|`~]", password):
+        issues.append("At least one special character")
+    return issues
+
+
+def hash_password(password: str) -> str:
+    salt = bcrypt.gensalt(rounds=12)
+    return bcrypt.hashpw(password.encode(), salt).decode()
+
+
+def update_env(hash_value: str) -> None:
+    if not ENV_FILE.exists():
+        ENV_FILE.write_text("")
+
+    content = ENV_FILE.read_text()
+    key = "QUTE_UI_PASSWORD_HASH"
+
+    if key in content:
+        lines = content.splitlines()
+        new_lines = []
+        for line in lines:
+            if line.startswith(f"{key}="):
+                new_lines.append(f"{key}={hash_value}")
+            else:
+                new_lines.append(line)
+        ENV_FILE.write_text("\n".join(new_lines) + "\n")
+    else:
+        with open(ENV_FILE, "a") as f:
+            f.write(f"\n# UI Authentication\n")
+            f.write(f"{key}={hash_value}\n")
+
+
+def main():
+    print("Qute UI Password Setup")
+    print("=" * 40)
+    print("Requirements: 12+ chars, upper, lower, number, special")
+    print()
+
+    while True:
+        password = getpass.getpass("Enter new password: ")
+        issues = check_complexity(password)
+        if issues:
+            print("Password does not meet requirements:")
+            for issue in issues:
+                print(f"  x {issue}")
+            print()
+            continue
+
+        confirm = getpass.getpass("Confirm password: ")
+        if password != confirm:
+            print("Passwords do not match. Try again.\n")
+            continue
+        break
+
+    print("Generating hash...")
+    hash_value = hash_password(password)
+    update_env(hash_value)
+    print(f"Password hash written to {ENV_FILE}")
+    print("Restart the UI for changes to take effect.")
+
+
+if __name__ == "__main__":
+    main()

src/ui/app.py

@@ -41,6 +41,11 @@
 from benchmark.comparator import BenchmarkComparator, quick_benchmark
 from benchmark.metrics import compute_metrics
 
+# ── Authentication ────────────────────────────────────────────────
+from ui.auth import require_auth
+if not require_auth():
+    st.stop()
+
 # ── Initialise DB ─────────────────────────────────────────────────
 initialise()
 
@@ -77,12 +82,13 @@
     st.caption("Apache 2.0 · [GitHub](https://github.com/marjatmm-sec/qute)")
 
 # ── Tabs ──────────────────────────────────────────────────────────
-tab_ingest, tab_rules, tab_quantum, tab_benchmark, tab_report = st.tabs([
+tab_ingest, tab_rules, tab_quantum, tab_benchmark, tab_report, tab_settings = st.tabs([
     "📥 Ingest",
     "📋 Rules",
     "⚛️ Quantum",
     "📊 Benchmark",
     "📄 Report",
+    "⚙️ Settings",
 ])
 
 
@@ -934,3 +940,172 @@ def get_std(report, head, metric):
                 st.info("No benchmark history to export.")
         except Exception as e:
             st.error(f"Export error: {e}")
+
+# ══════════════════════════════════════════════════════════════════
+# TAB 6 — SETTINGS
+# ══════════════════════════════════════════════════════════════════
+with tab_settings:
+    st.header("Settings")
+
+    # ── Authentication ────────────────────────────────────────────
+    st.subheader("UI Authentication")
+
+    from ui.auth import is_auth_enabled, check_password
+    from config import UI_PASSWORD_HASH
+    import bcrypt as _bcrypt
+    import re as _re
+
+    MIN_LENGTH = 12
+
+    def _check_complexity(pw: str) -> list:
+        issues = []
+        if len(pw) < MIN_LENGTH:
+            issues.append(f"At least {MIN_LENGTH} characters")
+        if not _re.search(r"[A-Z]", pw):
+            issues.append("At least one uppercase letter")
+        if not _re.search(r"[a-z]", pw):
+            issues.append("At least one lowercase letter")
+        if not _re.search(r"\d", pw):
+            issues.append("At least one number")
+        if not _re.search(r"[!@#$%^&*()\-_=+\[\]{};:'\",.<>/?\\|`~]", pw):
+            issues.append("At least one special character")
+        return issues
+
+    def _write_hash_to_env(hash_value: str) -> None:
+        from pathlib import Path
+        env_path = Path("/app/.env") if Path("/app/.env").exists() else Path(".env")
+        if not env_path.exists():
+            env_path.write_text("")
+        content = env_path.read_text()
+        key = "QUTE_UI_PASSWORD_HASH"
+        if key in content:
+            lines = content.splitlines()
+            lines = [
+                f"{key}={hash_value}" if l.startswith(f"{key}=") else l
+                for l in lines
+            ]
+            env_path.write_text("\n".join(lines) + "\n")
+        else:
+            with open(env_path, "a") as f:
+                f.write(f"\n# UI Authentication\n{key}={hash_value}\n")
+
+    if is_auth_enabled():
+        st.success("🔒 Password protection is **enabled**.")
+        st.markdown("**Change password**")
+        with st.form("change_password_form"):
+            current_pw  = st.text_input("Current password", type="password")
+            new_pw      = st.text_input("New password", type="password")
+            confirm_pw  = st.text_input("Confirm new password", type="password")
+            submitted   = st.form_submit_button("Update password")
+
+            if submitted:
+                if not check_password(current_pw):
+                    st.error("Current password is incorrect.")
+                elif new_pw != confirm_pw:
+                    st.error("New passwords do not match.")
+                else:
+                    issues = _check_complexity(new_pw)
+                    if issues:
+                        st.error("Password requirements not met:")
+                        for issue in issues:
+                            st.markdown(f"  - {issue}")
+                    else:
+                        h = _bcrypt.hashpw(new_pw.encode(), _bcrypt.gensalt(rounds=12)).decode()
+                        _write_hash_to_env(h)
+                        st.success("✅ Password updated.")
+                        st.info(
+                            "To activate: restart the UI.\n\n"
+                            "**Docker:** `docker compose restart qute-app`\n\n"
+                            "**Local:** stop and rerun `streamlit run src/ui/app.py --server.port=8503`"
+                        )
+
+        st.markdown("---")
+        st.markdown("**Disable authentication**")
+        if st.button("🔓 Remove password protection", type="secondary"):
+            _write_hash_to_env("")
+            st.warning("Authentication disabled.")
+            st.info(
+                "To activate: restart the UI.\n\n"
+                "**Docker:** `docker compose restart qute-app`\n\n"
+                "**Local:** stop and rerun `streamlit run src/ui/app.py --server.port=8503`"
+            )
+
+    else:
+        st.warning("🔓 Password protection is **disabled**. Anyone with access to port 8503 can use the UI.")
+        st.markdown("**Set a password**")
+        st.caption(f"Requirements: {MIN_LENGTH}+ characters, uppercase, lowercase, number, special character.")
+
+        with st.form("set_password_form"):
+            new_pw     = st.text_input("New password", type="password")
+            confirm_pw = st.text_input("Confirm password", type="password")
+            submitted  = st.form_submit_button("Enable password protection", type="primary")
+
+            if submitted:
+                if new_pw != confirm_pw:
+                    st.error("Passwords do not match.")
+                else:
+                    issues = _check_complexity(new_pw)
+                    if issues:
+                        st.error("Password requirements not met:")
+                        for issue in issues:
+                            st.markdown(f"  - {issue}")
+                    else:
+                        h = _bcrypt.hashpw(new_pw.encode(), _bcrypt.gensalt(rounds=12)).decode()
+                        _write_hash_to_env(h)
+                        st.success("✅ Password set.")
+                        st.info(
+                            "To activate: restart the UI.\n\n"
+                            "**Docker:** `docker compose restart qute-app`\n\n"
+                            "**Local:** stop and rerun `streamlit run src/ui/app.py --server.port=8503`"
+                        )
+
+    # ── Syslog listener settings ──────────────────────────────────
+    st.markdown("---")
+    st.subheader("Syslog Listener")
+    st.caption("Configure the live syslog listener. Changes take effect when you start/restart the listener in the Ingest tab.")
+
+    from store.settings import get_setting, set_setting
+    from store.settings import SYSLOG_PORT, SYSLOG_PROTOCOL, SYSLOG_ENABLED
+
+    s_port  = st.number_input(
+        "Default port",
+        min_value=1024, max_value=65535,
+        value=get_int_setting(SYSLOG_PORT, 5514),
+    )
+    s_proto = st.selectbox(
+        "Default protocol",
+        ["both", "udp", "tcp"],
+        index=["both","udp","tcp"].index(get_setting(SYSLOG_PROTOCOL, "both")),
+    )
+
+    if st.button("Save listener defaults"):
+        set_setting(SYSLOG_PORT,     str(s_port))
+        set_setting(SYSLOG_PROTOCOL, s_proto)
+        st.success("Defaults saved.")
+
+    # ── Quantum settings ──────────────────────────────────────────
+    st.markdown("---")
+    st.subheader("Quantum")
+    st.caption("These settings affect new benchmark runs. Currently active session settings are shown in the Quantum tab.")
+
+    from config import QUANTUM_SHOTS, ISING_NOISE_ENABLED, ISING_DEPOLAR_PROB
+    st.metric("Shots per circuit", QUANTUM_SHOTS)
+    st.metric("Noise enabled", str(ISING_NOISE_ENABLED))
+    st.metric("Depolarising probability", ISING_DEPOLAR_PROB)
+    st.caption("To change quantum settings edit .env and restart the container.")
+
+    # ── About ─────────────────────────────────────────────────────
+    st.markdown("---")
+    st.subheader("About")
+    st.markdown("""
+    **Qute** — Quantum Unified Threat Engine
+
+    A local-first, open-source research platform for classical-quantum
+    comparative security detection.
+
+    - License: Apache 2.0
+    - GitHub: [marjatmm-sec/qute](https://github.com/marjatmm-sec/qute)
+    - Docs: [docs/](docs/)
+    """)
+    st.caption(f"CUDA-Q: {'available' if CUDAQ_AVAILABLE else 'not available (CPU mode)'} · "
+               f"LLM: {OLLAMA_MODEL} · DB: {DB_PATH}")