Function _parse_arp_scan_output

webapp_modern.py:1811–1835

(output)

    """Last verdict from the passive network-integrity monitor (for the
    dashboard chip). Reflects config even when the monitor hasn't run yet."""
    with _net_integrity_lock:
        state = dict(_net_integrity_state)
    state['monitor_enabled'] = bool(shared_data.config.get('net_integrity_monitor_enabled', False))
    state['interval_min'] = shared_data.config.get('net_integrity_interval_min', 5)
    state['extended_enabled'] = bool(shared_data.config.get('net_integrity_extended_enabled', True))
    state['batch_size'] = shared_data.config.get('net_integrity_batch_size', 3)
    state['interface'] = shared_data.config.get('net_integrity_interface', '') or ''
    return jsonify({'success': True, **state})


# ==========================================================================
# Watchtower — unified alert pane for the standalone passive watchers.
# The deep daemons (arp_guard, ndpwatch, wifiwatch, certwatch, snmpwatch,
# isiswatch, igmpwatch) each write their own JSON-lines log; Watchtower tails
# them all, normalizes into one shape, shows them in one pane, and pages the
# high/critical ones through a single deduped Pushover path. Read-only over the
# logs — it captures nothing. Opt-in via watchtower_enabled.
# ==========================================================================

_watchtower_lock = threading.Lock()
_watchtower = None            # lazy watchtower.Watchtower instance
_wt_seen = {}                 # pushover dedup: key -> {'rank', 'ts'}
_wt_seen_loaded = False
_wt_summary = {'enabled': False, 'ts': None, 'total': 0}

# Cross-signal correlation: fold the same normalized alert stream into
# attack-chain *incidents* (see incident_engine.py). Paged once per incident when
# it first becomes a named campaign or escalates.