vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-04-29 23:49:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Implements info-based flow alert exclusion filters

Browse source
This commit is contained in:
Simone Mainardi 2021-02-16 16:22:06 +01:00
parent f4dff6f2e7
commit 209a9be5e6
3 changed files with 33 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

26
scripts/lua/modules/user_scripts.lua
View file

@ -151,8 +151,14 @@ local available_subdirs = {
-- and the actual flow bitmap of risks
return (val & flow.getRiskBitmap()) ~= 0
end
},
info = {
lint = http_lint.validateSingleWord,
match = function(context, val)
-- Search for substring val inside the flow info field
return not not flow.getFlowInfoField():find(val)
end
}
-- info = http_lint.validateUnquoted,
},
},
-- No pools for flows
@ -1604,9 +1610,8 @@ end
-- ##############################################
-- @brief Returns the list of the default filters of a specific alert
function user_scripts.getFilterPreset(alert)
local alert_json = json.decode(alert["alert_json"])
local alert_generation = alert_json["alert_generation"]
function user_scripts.getFilterPreset(alert, alert_info)
local alert_generation = alert_info["alert_generation"]
if not alert_generation then
return ''
@ -1643,9 +1648,18 @@ function user_scripts.getFilterPreset(alert)
local filter_table = {}
local index = 1
for _, field in pairs(filter_to_use) do
if alert[field] then
-- Check for field existance in the alert
local field_val = alert[field]
-- If the filed does not exist, try and look it up inside `alert_info`, that is,
-- a decoded JSON table containing variable alert data.
if not field_val then
field_val = alert_info[field]
end
if field_val then
-- Forming the string e.g. srv_addr=1.1.1.1
filter_table[index] = field .. "=" .. alert[field]
filter_table[index] = field .. "=" .. field_val
index = index + 1
end
end