vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-04-29 15:39:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add server malicious JA3 signature check and improve alert information

Browse source 
Closes #2880
This commit is contained in:
emanuele-f 2019-09-24 13:30:32 +02:00
parent 81a3199a44
commit 1bf89fdb4d
6 changed files with 85 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/lua/modules/lua_utils.lua
View file

@ -2552,16 +2552,27 @@ end
function formatMaliciousSignature(flowstatus_info)
local res = i18n("alerts_dashboard.malicious_signature_detected")
local cli_signature = flowstatus_info.cli_ja3_signature or
(flowstatus_info.ja3_signature --[[ for compatibility with existing alerts ]])
local srv_signature = flowstatus_info.srv_ja3_signature
if not flowstatus_info then
return res
end
if(flowstatus_info.ja3_signature ~= nil) then
if(cli_signature ~= nil) then
res = i18n("flow_details.malicious_ja3_signature", {
signature = flowstatus_info.ja3_signature,
url = "https://sslbl.abuse.ch/ja3-fingerprints/" .. flowstatus_info.ja3_signature,
signature = cli_signature,
url = "https://sslbl.abuse.ch/ja3-fingerprints/" .. cli_signature,
icon = " <i class=\"fa fa-external-link\"></i>",
cli_or_srv = i18n("client"),
})
elseif(srv_signature ~= nil) then
res = i18n("flow_details.malicious_ja3_signature", {
signature = srv_signature,
url = "https://sslbl.abuse.ch/ja3-fingerprints/" .. srv_signature,
icon = " <i class=\"fa fa-external-link\"></i>",
cli_or_srv = i18n("server"),
})
end