vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-05 19:15:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Uses nDPI-calculated risks for TLS alerts

Browse source
This commit is contained in:
Simone Mainardi 2020-05-15 11:54:18 +02:00
parent c318b13989
commit 058f2a32be
6 changed files with 70 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

64
scripts/plugins/flow_risks/user_scripts/flow/flow_risks.lua
View file

@ -4,6 +4,7 @@
local user_scripts = require("user_scripts")
local flow_consts = require("flow_consts")
local flow_risks = require("flow_risk_utils")
-- #################################################################
@ -23,45 +24,38 @@ local script = {
-- #################################################################
function script.hooks.protocolDetected(now)
local flow_risk = flow.getRiskInfo()
-- For value information see nDPI/src/include/ndpi_typedefs.h
if flow.hasRisk(flow_risks.risks.ndpi_binary_application_transfer) then
local http_info = flow.getHTTPInfo()
local url = http_info["protos.http.last_url"] or ""
for label,value in pairs(flow_risk) do
if(value == 4) then
local http_info = flow.getHTTPInfo()
local url = http_info["protos.http.last_url"] or ""
-- NDPI_BINARY_APPLICATION_TRANSFER
-- scripts/lua/modules/alert_definitions/alert_suspicious_file_transfer.lua
flow.triggerStatus(
flow_consts.status_types.status_suspicious_file_transfer.create(
flow_consts.status_types.status_suspicious_file_transfer.alert_severity,
http_info
),
200, -- flow_score
200, -- cli_score
200 -- srv_score
)
elseif(value == 5) then
-- NDPI_KNOWN_PROTOCOL_ON_NON_STANDARD_PORT
-- scripts/lua/modules/alert_definitions/alert_known_proto_on_non_std_port.lua
local info = flow.getInfo()
-- NDPI_BINARY_APPLICATION_TRANSFER
-- scripts/lua/modules/alert_definitions/alert_suspicious_file_transfer.lua
flow.triggerStatus(
flow_consts.status_types.status_suspicious_file_transfer.create(
flow_consts.status_types.status_suspicious_file_transfer.alert_severity,
http_info
),
200, -- flow_score
200, -- cli_score
200 -- srv_score
)
end
flow.triggerStatus(
flow_consts.status_types.status_known_proto_on_non_std_port.create(
flow_consts.status_types.status_known_proto_on_non_std_port.alert_severity,
info
),
100, -- flow_score
100, -- cli_score
100 -- srv_score
)
end
if flow.hasRisk(flow_risks.risks.ndpi_known_protocol_on_non_standard_port) then
-- NDPI_KNOWN_PROTOCOL_ON_NON_STANDARD_PORT
-- scripts/lua/modules/alert_definitions/alert_known_proto_on_non_std_port.lua
local info = flow.getInfo()
-- TODO: handle additional nDPI risks identified
-- io.write("[flow_risks.lua] Risk "..value.."/"..label.." found\n")
flow.triggerStatus(
flow_consts.status_types.status_known_proto_on_non_std_port.create(
flow_consts.status_types.status_known_proto_on_non_std_port.alert_severity,
info
),
100, -- flow_score
100, -- cli_score
100 -- srv_score
)
end
end