Description

This PR adds a new /health/overview API endpoint that provides a consolidated overview of the system status and key observables . It is accessible only to admin users.

Features

• Reports system status including:
  • Database connectivity (up / down / degraded)
  • Django-Q cluster status (up / idle / down)
  • Elasticsearch cluster status (up / down / not configured)
  • System uptime in seconds
• Aggregates overview data:
  • IOC counts (total and new in last 24h)
  • Cowrie session counts (total and last 24h)
  • Honeypots (total and active)
  • Threat lists (FireHol, Mass Scanners, Tor exit nodes)
  • Django-Q jobs (scheduled, failed last 24h, successful last 24h)

API Response

{
  "system": {
    "uptime_seconds": 580,
    "database": "up",
    "qcluster": "up",
    "elasticsearch": "up"
  },
  "overview": {
    "iocs": {
      "total": 0,
      "new_last_24h": 0
    },
    "sessions": {
      "total": 0,
      "last_24h": 0
    },
    "honeypots": {
      "total": 7,
      "active": 1
    },
    "threat_lists": {
      "firehol": 0,
      "mass_scanners": 0,
      "tor_exit_nodes": 0
    },
    "jobs": {
      "scheduled": 9,
      "failed_last_24h": 0,
      "successful_last_24h": 16
    }
  }
}

Related issues

closes: #845

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue).
• New feature (non-breaking change which adds functionality).
• Breaking change (fix or feature that would cause existing functionality to not work as expected).

Checklist

• I have read and understood the rules about how to Contribute to this project.
• The pull request is for the branch develop.
• I have added documentation of the new features.
• Linter (Ruff) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.
• I have added tests for the feature/bug I solved. All the tests (new and old ones) gave 0 errors.
• If changes were made to an existing model/serializer/view, the docs were updated and regenerated (check CONTRIBUTE.md).
• If the GUI has been modified:
  • I have a provided a screenshot of the result in the PR.
  • I have created new frontend tests for the new component or updated existing ones.

Important Rules

• If you miss to compile the Checklist properly, your PR won't be reviewed by the maintainers.
• If your changes decrease the overall tests coverage (you will know after the Codecov CI job is done), you should add the required tests to fix the problem
• Everytime you make changes to the PR and you think the work is done, you should explicitly ask for a review. After being reviewed and received a "change request", you should explicitly ask for a review again once you have made the requested changes.