Fairplay Evolves: Introducing the Web Dashboard and API

Intro

When Fairplay was first released, the focus was clear: to help Red Teams protect their operations by silently monitoring file hashes across multiple online sources and generating timely notifications when payloads are encountered. Since then, we have been steadily expanding the project to make it easier to operate in real engagements, collaborate across a team and keep visibility high without adding overhead.

This post highlights the newest features we added, with an emphasis on operational convenience: a web dashboard, a dedicated API layer and streamlined management of monitored indicators and detections.

Web Dashboard

Fairplay now includes a web frontend that provides a single place to review and manage what the framework is tracking. The dashboard is designed to make simpler use during an engagement, while keeping the data model aligned with Fairplay’s modular backend.

Key capabilities include:

• Dashboard: Overview of recent activity and quick visibility into what is hot.
• IOCs: List, detail and create/edit flows (backed by the same JSON definitions under ioc/ that the collectors use, with the database as a mirror for queries).
• Detections: Llist, detail and create/edit flows aligned with the SQLite model (including soft-delete semantics where applicable).
• Theme: Light/dark toggle for long sessions.
• Reset DB: A sidebar action that asks for confirmation, then calls the backend to clear all rows in the SQLite tables used for detections and IOC mirroring.

API Layer

To support the dashboard and enable easier integrations, we added a dedicated API component. The API provides structured endpoints that expose Fairplay data in a predictable way and make it simpler to plug Fairplay into other internal tooling.

SQLite Migration

As part of making Fairplay more reliable and easier to operate over time, we migrated storage from the previous in-memory JSON approach to a SQLite database. This change improves persistence and sets a cleaner foundation for the web dashboard and API.

The upgrade path is designed to be smooth. After pulling the latest version, on the first run of the tool Fairplay will detect existing JSON data and automatically import it into the SQLite database, so you can keep using your existing IOCs and historical detections without having to re-create anything manually. From that point on, Fairplay will continue operating using the database as the source of truth.

CLI Extensions

For operators that prefer to work from the console, Fairplay’s CLI has also been extended with new functionality. The goal is to keep the console-first workflow fully viable: manage and review IOCs and detections in order to get immediate feedback directly in the terminal, without requiring the web dashboard.

Extensibility and Contributions

Fairplay remains a Python3 modular framework at its core and the original goals have not changed: extensibility, quiet monitoring and flexible notifications. The dashboard and API are meant to enhance those goals by making Fairplay easier to operate and easier to integrate.

Contributions are welcome through Pull Requests submitted on the repository, both for new collectors/notifiers and for improvements to the API and web dashboard. If you have ideas for new sources, new notification channels, or workflow improvements that help Red Teams move faster while staying safe, we would love to hear from you.