API & PlumbWatch integration

PlumbTrack is stdlib-only, like PlumbWatch. Point PlumbWatch's alert output at /api/alerts and detections become scored risks automatically.

Endpoints

Method	Path	Purpose
GET	/api/risks	List all risks (JSON, with computed score/severity)
POST	/api/risks	Create a risk (JSON body)
POST	/api/alerts	Ingest one PlumbWatch event (or a list) → auto-create/dedup risk
GET	/api/activity	Full activity stream (audit trail) with a `?since=` id cursor — what PlumbWatch captures
GET	/backup	Download a live snapshot of the database
GET	/api/dashboard	Metrics JSON
GET	/api/compliance	NIST CSF 2.0 / CIS coverage + gaps JSON
GET	/api/poam	POA&M open items JSON
GET / POST	/api/policies	List / create governance policies
GET	/api/evidence	List evidence items (with linked risk/policy)
GET	/api/acceptances	List active risk acceptances
GET	/api/exceptions	List active policy exceptions/waivers
GET	/export/{poam,register,policies,evidence}.csv	Downloadable CSV exports

Wire PlumbWatch in (on the Defender, VM 111)

PlumbWatch appends alerts to /var/lib/plumbwatch/events.jsonl. Tail new lines and POST each to PlumbTrack:

tail -f /var/lib/plumbwatch/events.jsonl | while read line; do
  curl -s -X POST http://grc.helpwithcert.com:80/api/alerts \
       -H 'Content-Type: application/json' -d "$line"
done

Event format (tolerant)

Recognised fields: kind/type (sqli, ssh_bruteforce, portscan, web_enum), src/ip, msg. Unknown kinds are inferred from msg, else filed as unclassified. Repeat alerts with the same kind+source increment a hit counter instead of duplicating.

{"kind": "sqli", "src": "10.10.10.60", "severity": "CRITICAL",
 "msg": "SQLi payload on :80 - ' OR '1'='1"}

Test it now (PowerShell)

Invoke-RestMethod -Method Post -Uri http://grc.helpwithcert.com:80/api/alerts -ContentType application/json `
  -Body '{"kind":"portscan","src":"10.10.10.60","msg":"nmap -sS"}'