Uses plugin modules as flow-risk handlers

scripts/plugins/alerts/security/flow_risks/modules/ndpi_binary_application_transfer_handler.lua

@@ -0,0 +1,36 @@
+--
+-- (C) 2019-20 - ntop.org
+--
+
+local flow_consts = require("flow_consts")
+
+-- #################################################################
+
+local handler = {}
+
+-- #################################################################
+
+-- @brief See risk_handler.lua
+function handler.handle_risk(flow_score, cli_score, srv_score)
+   -- NDPI_BINARY_APPLICATION_TRANSFER
+   -- scripts/lua/modules/alert_definitions/alert_suspicious_file_transfer.lua
+
+   local http_info = flow.getHTTPInfo()
+   local url = http_info["protos.http.last_url"] or ""
+
+   -- Set flow status and trigger an alert when a suspicious file transfer is detected
+   flow.triggerStatus(
+      flow_consts.status_types.status_suspicious_file_transfer.create(
+	 flow_consts.status_types.status_suspicious_file_transfer.alert_severity,
+	 http_info
+      ),
+      flow_score or 0, -- flow_score
+      cli_score or 0,  -- cli_score
+      srv_score or 0   -- srv_score
+   )
+end
+
+-- #################################################################
+
+return handler
+

scripts/plugins/alerts/security/flow_risks/modules/ndpi_known_protocol_on_non_standard_port_handler.lua

@@ -0,0 +1,34 @@
+--
+-- (C) 2019-20 - ntop.org
+--
+
+local flow_consts = require("flow_consts")
+
+-- #################################################################
+
+local handler = {}
+
+-- #################################################################
+
+-- @brief See risk_handler.lua
+function handler.handle_risk(flow_score, cli_score, srv_score)
+   -- NDPI_KNOWN_PROTOCOL_ON_NON_STANDARD_PORT
+   -- scripts/lua/modules/alert_definitions/alert_known_proto_on_non_std_port.lua
+   local info = flow.getInfo()
+
+   -- Set the flow status and trigger an alert when a known protocol is found to use a non-standard port
+   flow.triggerStatus(
+      flow_consts.status_types.status_known_proto_on_non_std_port.create(
+	 flow_consts.status_types.status_known_proto_on_non_std_port.alert_severity,
+	 info
+      ),
+      flow_score or 0, -- flow_score
+      cli_score or 0,  -- cli_score
+      srv_score or 0   -- srv_score
+   )
+end
+
+-- #################################################################
+
+return handler
+

scripts/plugins/alerts/security/flow_risks/modules/risk_handler.lua

@@ -0,0 +1,40 @@
+--
+-- (C) 2019-20 - ntop.org
+--
+
+local flow_consts = require("flow_consts")
+
+-- #################################################################
+
+-- Default risk handler for all flow-risks that don't have
+-- a specific handler coded
+local handler = {}
+
+-- #################################################################
+
+-- @brief Called by flow_risks.lua when a risk for the flow is detected.
+--       flow_risks.lua also passes flow-, client- and server-score as parameters
+-- @param flow_score   An integer score that will be added to the total flow score
+-- @param cli_score An integer score that will be added to the client score
+-- @param srv_score An integer score that will be added to the server score
+function handler.handle_risk(flow_score, cli_score, srv_score)
+   -- A generic handler for all flow risks
+   local info = flow.getInfo()
+
+   -- Trigger a flow status for the generic flow_risk. This will also
+   -- cause an alert to be generated.
+   flow.triggerStatus(
+      flow_consts.status_types.status_flow_risk.create(
+	 flow_consts.status_types.status_flow_risk.alert_severity,
+	 info
+      ),
+      flow_score or 0, -- flow_score
+      cli_score or 0,  -- cli_score
+      srv_score or 0   -- srv_score
+   )
+end
+
+-- #################################################################
+
+return handler
+