Possible fix for issue description and removed Connection Refused alert (#9233)

scripts/lua/modules/alert_definitions/flow/alert_tcp_connection_refused.lua

@@ -1,56 +0,0 @@
---
--- (C) 2019-24 - ntop.org
---
-
--- ##############################################
-
-local flow_alert_keys = require "flow_alert_keys"
--- Import the classes library.
-local classes = require "classes"
--- Make sure to import the Superclass!
-local alert = require "alert"
--- Import Mitre Att&ck utils
-local mitre = require "mitre_utils"
-
--- ##############################################
-
-local alert_tcp_connection_refused = classes.class(alert)
-
--- ##############################################
-
-alert_tcp_connection_refused.meta = {
-   alert_key = flow_alert_keys.flow_alert_tcp_connection_refused,
-   i18n_title = "flow_checks_config.tcp_connection_refused",
-   icon = "fas fa-fw fa-exclamation",
-
-   -- Mitre Att&ck Matrix values
-   mitre_values = {
-      mitre_tactic = mitre.tactic.discovery,
-      mitre_technique = mitre.technique.network_service_discovery,
-      mitre_id = "T1046"
-   },
-}
-
--- ##############################################
-
--- @brief Prepare an alert table used to generate the alert
--- @return A table with the alert built
-function alert_tcp_connection_refused:init()
-   -- Call the parent constructor
-   self.super:init()
-end
-
--- #######################################################
-
--- @brief Format an alert into a human-readable string
--- @param ifid The integer interface id of the generated alert
--- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
--- @param alert_type_params Table `alert_type_params` as built in the `:init` method
--- @return A human-readable string
-function alert_tcp_connection_refused.format(ifid, alert, alert_type_params)
-   return
-end
-
--- #######################################################
-
-return alert_tcp_connection_refused

scripts/lua/modules/alert_keys/flow_alert_keys.lua

@@ -26,7 +26,7 @@ local flow_alert_keys = {
    flow_alert_notused_4                            = 17, -- No longer used, can be recycled
    flow_alert_notused_5                            = 18, -- No longer used, can be recycled
    flow_alert_tcp_packets_issues                   = 19,
-   flow_alert_tcp_connection_refused               = 20,
+   flow_alert_notused_6                            = 20,
    flow_alert_tcp_severe_connection_issues         = 21,
    flow_alert_tls_certificate_expired              = 22,
    flow_alert_tls_certificate_mismatch             = 23,

scripts/lua/modules/historical_flow_details_formatter.lua

@@ -296,6 +296,7 @@ local function format_historical_issue_description(alert, alert_id, score,
     end
     -- If alert risk is 0 then it comes from ntonpg, else nDPI
     local alert_risk = ntop.getFlowAlertRisk(tonumber(alert_id))
+    local check_risk = true
     local alert_src
     local riskLabel = ""
 
@@ -305,6 +306,7 @@ local function format_historical_issue_description(alert, alert_id, score,
         if isEmptyString(msg) and not isEmptyString(info) then msg = info end
         -- Adapting to the new alerts format
         if alert_info and alert then
+            check_risk = false
             alert.alert_id = alert_id
             info = alert_utils.formatFlowAlertMessage(interface.getId(), alert,
                                                       alert_info, false, true,
@@ -314,7 +316,7 @@ local function format_historical_issue_description(alert, alert_id, score,
         alert_src = "nDPI"
     end
 
-    if riskInfo then
+    if riskInfo and check_risk then
         if type(riskInfo) == "string" then -- backward compatibility
             riskInfo = json.decode(riskInfo)
         end