vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-01 00:19:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Migrates alerts to an object-oriented implementation

Browse source 
Migrates alert_malicious_signature alert_elephant_local_to_remote alert_elephant_remote_to_local

Migrates long_lived

Migrates alert_flow_blocked

Migrates alert_tls_old_version

Migrates alert_tls_certificate_mismatch

Migrates alert_tls_certificate_expired

Migrates alert_tls_unsafe_ciphers

Migrates alert_tls_certificate_selfsigned

Migrates alert_potentially_dangerous_protocol

Migrates alert_snmp_device_reset

Migrates alert_port_mac_changed

Migrates alert_port_duplexstatus_change

Mirgates alert_port_errors

Migrates alert_port_status_change

Migrates alert_port_load_threshold_exceeded

Migrates alert_data_exfiltration

Migrates alert_dns_data_exfiltration

Migrates alert_suspicious_tcp_probing alert_suspicious_tcp_syn_probing alert_tcp_connection_refused

Migrates alert_dns_invalid_query

Migrates alert_attack_mitigation_via_snmp

Migrates alert_lateral_movement

Migrates alert_periodicity_update

Migrates alert_dns_positive_error_ratio

Migrates alert_iec104_error
This commit is contained in:
Simone Mainardi 2020-12-22 09:54:55 +01:00
parent 35a66a0c8a
commit 3baa932a01
50 changed files with 1495 additions and 812 deletions
Download patch file Download diff file Expand all files Collapse all files

113
scripts/lua/modules/alert_definitions/alert_attack_mitigation_via_snmp.lua
View file

@ -1,44 +1,30 @@
--
-- (C) 2020 - ntop.org
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- #######################################################
-- ##############################################
local function formatAttackMitigationViaSNMPAlert(ifid, alert, threshold_info)
local alert_severities = require "alert_severities"
local alert_consts = require("alert_consts")
local snmp_consts = require "snmp_consts"
local entity = alert_consts.formatAlertEntity(ifid, alert_consts.alertEntityRaw(alert["alert_entity"]), alert["alert_entity_val"])
local engine_label = alert_consts.alertEngineLabel(alert_consts.alertEngine(alert_consts.sec2granularity(alert["alert_granularity"])))
local alert_attack_mitigation_via_snmp = classes.class(alert)
local i18n_k = "alert_messages.attack_mitigation_via_snmp_success"
if not threshold_info.success then
i18n_k = "alert_messages.attack_mitigation_via_snmp_failure"
end
-- ##############################################
return i18n(i18n_k, {
granularity = engine_label:lower(),
metric = threshold_info.metric,
entity = entity,
value = string.format("%u", math.ceil(threshold_info.value)),
op = "&".. (threshold_info.operator or "gt") ..";",
threshold = threshold_info.threshold,
device = threshold_info.access_port.snmp_device_ip,
url = snmpDeviceUrl(threshold_info.access_port.snmp_device_ip),
port = threshold_info.access_port.id,
port_url = snmpIfaceUrl(threshold_info.access_port.snmp_device_ip, threshold_info.access_port.id),
admin_down = snmp_consts.snmp_ifstatus("2" --[[ down --]])
})
end
alert_attack_mitigation_via_snmp.meta = {
alert_key = alert_keys.ntopng.alert_attack_mitigation_via_snmp,
i18n_title = "alerts_dashboard.attack_mitigation_snmp_title",
icon = "fa fa-stop-circle",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param alert_subtype A string indicating the subtype for this threshold cross (e.g,. 'score', 'active', 'packets', ...)
-- @param alert_granularity A granularity as defined in `alert_consts.alerts_granularities`
-- @param metric Same as `alert_subtype`
-- @param value A number indicating the measure which crossed the threshold
-- @param operator A string indicating the operator used when evaluating the threshold, one of "gt", ">", "<"
@ -46,30 +32,55 @@ end
-- @param access_port A table containing access port details with keys: name, trunk, id, and snmp_device_ip
-- @param success Whether the admin status of the port has been successfully toggled to down
-- @return A table with the alert built
function createAttackMitigationViaSNMPAlert(alert_severity, alert_subtype, alert_granularity, metric, value, operator, threshold, access_port, success)
local threshold_type = {
alert_subtype = alert_subtype,
alert_granularity = alert_granularity,
alert_severity = alert_severity,
alert_type_params = {
metric = metric,
value = value,
operator = operator,
threshold = threshold,
access_port = access_port,
success = success
}
}
function alert_attack_mitigation_via_snmp:init(metric, value, operator, threshold, access_port, success)
-- Call the paren constructor
self.super:init()
return threshold_type
self.alert_type_params = {
metric = metric,
value = value,
operator = operator,
threshold = threshold,
access_port = access_port,
success = success
}
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_attack_mitigation_via_snmp,
i18n_title = "alerts_dashboard.attack_mitigation_snmp_title",
i18n_description = formatAttackMitigationViaSNMPAlert,
icon = "fa fa-stop-circle",
creator = createAttackMitigationViaSNMPAlert,
}
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_attack_mitigation_via_snmp.format(ifid, alert, alert_type_params)
local alert_severities = require "alert_severities"
local alert_consts = require("alert_consts")
local snmp_consts = require "snmp_consts"
local entity = alert_consts.formatAlertEntity(ifid, alert_consts.alertEntityRaw(alert["alert_entity"]), alert["alert_entity_val"])
local engine_label = alert_consts.alertEngineLabel(alert_consts.alertEngine(alert_consts.sec2granularity(alert["alert_granularity"])))
local i18n_k = "alert_messages.attack_mitigation_via_snmp_success"
if not alert_type_params.success then
i18n_k = "alert_messages.attack_mitigation_via_snmp_failure"
end
return i18n(i18n_k, {
granularity = engine_label:lower(),
metric = alert_type_params.metric,
entity = entity,
value = string.format("%u", math.ceil(alert_type_params.value)),
op = "&".. (alert_type_params.operator or "gt") ..";",
threshold = alert_type_params.threshold,
device = alert_type_params.access_port.snmp_device_ip,
url = snmpDeviceUrl(alert_type_params.access_port.snmp_device_ip),
port = alert_type_params.access_port.id,
port_url = snmpIfaceUrl(alert_type_params.access_port.snmp_device_ip, alert_type_params.access_port.id),
admin_down = snmp_consts.snmp_ifstatus("2" --[[ down --]])
})
end
-- #######################################################
return alert_attack_mitigation_via_snmp

53
scripts/lua/modules/alert_definitions/alert_data_exfiltration.lua Normal file
View file

@ -0,0 +1,53 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_data_exfiltration = classes.class(alert)
-- ##############################################
alert_data_exfiltration.meta = {
status_key = status_keys.ntopng.status_data_exfiltration,
alert_key = alert_keys.ntopng.alert_data_exfiltration,
i18n_title = "flow_details.data_exfiltration",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @return A table with the alert built
function alert_data_exfiltration:init()
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
-- No params
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_data_exfiltration.format(ifid, alert, alert_type_params)
return i18n("flow_details.data_exfiltration")
end
-- #######################################################
return alert_data_exfiltration

53
scripts/lua/modules/alert_definitions/alert_dns_data_exfiltration.lua Normal file
View file

@ -0,0 +1,53 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_dns_data_exfiltration = classes.class(alert)
-- ##############################################
alert_dns_data_exfiltration.meta = {
status_key = status_keys.ntopng.status_dns_data_exfiltration,
alert_key = alert_keys.ntopng.alert_dns_data_exfiltration,
i18n_title = "flow_details.dns_data_exfiltration",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @return A table with the alert built
function alert_dns_data_exfiltration:init()
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
-- No params
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_dns_data_exfiltration.format(ifid, alert, alert_type_params)
return i18n("flow_details.dns_data_exfiltration")
end
-- #######################################################
return alert_dns_data_exfiltration

53
scripts/lua/modules/alert_definitions/alert_dns_invalid_query.lua Normal file
View file

@ -0,0 +1,53 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_dns_invalid_query = classes.class(alert)
-- ##############################################
alert_dns_invalid_query.meta = {
status_key = status_keys.ntopng.status_dns_invalid_query,
alert_key = alert_keys.ntopng.alert_dns_invalid_query,
i18n_title = "flow_details.dns_invalid_query",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @return A table with the alert built
function alert_dns_invalid_query:init()
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
-- No params
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_dns_invalid_query.format(ifid, alert, alert_type_params)
return i18n("flow_details.dns_invalid_query")
end
-- #######################################################
return alert_dns_invalid_query

84
scripts/lua/modules/alert_definitions/alert_dns_positive_error_ratio.lua
View file

@ -2,56 +2,66 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
local format_utils = require "format_utils"
local json = require("dkjson")
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_dns_positive_error_ratio = classes.class(alert)
-- ##############################################
alert_dns_positive_error_ratio.meta = {
alert_key = alert_keys.ntopng.alert_dns_positive_error_ratio,
i18n_title = "dns_positive_error_ratio.title",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param alert_granularity A granularity as defined in `alert_consts.alerts_granularities`
-- @param alert_subtype A string with the subtype of the alert
-- @param requests The number of requests
-- @param replies The number of replies
-- @return A table with the alert built
local function createDnsPositiveErrorRatio(alert_severity, alert_granularity, type, positives, errors)
local built = {
alert_granularity = alert_granularity,
alert_severity = alert_severity,
alert_type_params = {
type = type,
positives = positives,
errors= errors,
}
function alert_dns_positive_error_ratio:init(type, positives, errors)
-- Call the paren constructor
self.super:init()
self.alert_type_params = {
type = type,
positives = positives,
errors = errors,
}
return built
end
-- #######################################################
function dnsPositiveErrorRatioFormatter(ifid, alert, info)
local type = ""
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_dns_positive_error_ratio.format(ifid, alert, alert_type_params)
local type = ""
if info.type == "dns_rcvd" then
type = "Received"
else
type = "Sent"
end
return(i18n("dns_positive_error_ratio.positive_error_ratio_descr", {
type = type,
positives = info.positives,
errors = info.errors,
}))
if alert_type_params.type == "dns_rcvd" then
type = "Received"
else
type = "Sent"
end
return(i18n("dns_positive_error_ratio.positive_error_ratio_descr", {
type = type,
positives = alert_type_params.positives,
errors = alert_type_params.errors,
}))
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_dns_positive_error_ratio,
i18n_title = "dns_positive_error_ratio.title",
i18n_description = dnsPositiveErrorRatioFormatter,
icon = "fas fa-exclamation",
creator = createDnsPositiveErrorRatio,
}
return alert_dns_positive_error_ratio

61
scripts/lua/modules/alert_definitions/alert_elephant_local_to_remote.lua Normal file
View file

@ -0,0 +1,61 @@
--
-- (C) 2019-20 - ntop.org
--
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_elephant_local_to_remote = classes.class(alert)
-- ##############################################
alert_elephant_local_to_remote.meta = {
status_key = status_keys.ntopng.status_elephant_local_to_remote,
alert_key = alert_keys.ntopng.alert_elephant_local_to_remote,
i18n_title = "flow_details.elephant_flow_l2r",
icon = "fas fa-exclamation",
}
-- #######################################################
-- @brief Prepare an alert table used to generate the alert
-- @param l2r_threshold Local-to-Remote threshold, in bytes, for a flow to be considered an elephant
-- @param r2l_threshold Remote-to-Local threshold, in bytes, for a flow to be considered an elephant
-- @return A table with the alert built
function alert_elephant_local_to_remote:init(l2r_threshold, r2l_threshold)
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
["elephant.l2r_threshold"] = l2r_threshold,
["elephant.r2l_threshold"] = r2l_threshold,
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_elephant_local_to_remote.format(ifid, alert, alert_type_params)
return formatElephantFlowStatus(alert_type_params, true --[[ l2r ]])
end
-- #######################################################
return alert_elephant_local_to_remote
-- #######################################################

61
scripts/lua/modules/alert_definitions/alert_elephant_remote_to_local.lua Normal file
View file

@ -0,0 +1,61 @@
--
-- (C) 2019-20 - ntop.org
--
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_elephant_remote_to_local = classes.class(alert)
-- ##############################################
alert_elephant_remote_to_local.meta = {
status_key = status_keys.ntopng.status_elephant_remote_to_local,
alert_key = alert_keys.ntopng.alert_elephant_remote_to_local,
i18n_title = "flow_details.elephant_flow_r2l",
icon = "fas fa-exclamation",
}
-- #######################################################
-- @brief Prepare an alert table used to generate the alert
-- @param l2r_threshold Local-to-Remote threshold, in bytes, for a flow to be considered an elephant
-- @param r2l_threshold Remote-to-Local threshold, in bytes, for a flow to be considered an elephant
-- @return A table with the alert built
function alert_elephant_remote_to_local:init(l2r_threshold, r2l_threshold)
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
["elephant.l2r_threshold"] = l2r_threshold,
["elephant.r2l_threshold"] = r2l_threshold,
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_elephant_remote_to_local.format(ifid, alert, alert_type_params)
return formatElephantFlowStatus(alert_type_params, false --[[ r2l ]])
end
-- #######################################################
return alert_elephant_remote_to_local
-- #######################################################

56
scripts/lua/modules/alert_definitions/alert_flow_blocked.lua
View file

@ -2,28 +2,52 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_flow_blocked = classes.class(alert)
-- ##############################################
alert_flow_blocked.meta = {
status_key = status_keys.ntopng.status_blocked, -- A flow status key
alert_key = alert_keys.ntopng.alert_flow_blocked,
i18n_title = "flow_details.flow_blocked_by_bridge",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @return A table with the alert built
local function createFlowBlocked(alert_severity)
local built = {
alert_severity = alert_severity,
alert_type_params = {
}
}
function alert_flow_blocked:init()
-- Call the parent constructor
self.super:init()
return built
self.alert_type_params = {
-- No params
}
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_flow_blocked,
i18n_title = "alerts_dashboard.blocked_flow",
icon = "fas fa-ban",
creator = createFlowBlocked,
}
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_flow_blocked.format(ifid, alert, alert_type_params)
return i18n("flow_details.flow_blocked_by_bridge")
end
-- #######################################################
return alert_flow_blocked

62
scripts/lua/modules/alert_definitions/alert_iec104_error.lua
View file

@ -2,34 +2,52 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
local format_utils = require "format_utils"
local json = require("dkjson")
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
local json = require "dkjson"
local format_utils = require "format_utils"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_iec104_error = classes.class(alert)
-- ##############################################
alert_iec104_error.meta = {
alert_key = alert_keys.ntopng.alert_iec104_error,
i18n_title = "alerts_dashboard.iec104_error",
icon = "fas fa-subway",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param alert_granularity A granularity as defined in `alert_consts.alerts_granularities`
-- @param last_error A string with the lastest influxdb error
-- @return A table with the alert built
local function createIEC104Error(alert_severity, alert_granularity, alert_subtype, last_error)
local threshold_type = {
alert_severity = alert_severity,
alert_subtype = alert_subtype,
alert_granularity = alert_granularity,
alert_type_params = {
error_msg = last_error
},
}
function alert_iec104_error:init(last_error)
-- Call the paren constructor
self.super:init()
return threshold_type
self.alert_type_params = {
error_msg = last_error
}
end
-- #######################################################
local function formatIEC104ErrorMessage(ifid, alert, status)
local msg = json.decode(status.error_msg)
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_iec104_error.format(ifid, alert, alert_type_params)
local msg = json.decode(alert_type_params.error_msg)
local vlanId = alert.vlanId or 0
local client = ip2label(msg.client.ip, msg.vlanId)
local server = ip2label(msg.server.ip, msg.vlanId)
@ -53,10 +71,4 @@ end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_iec104_error,
i18n_title = "alerts_dashboard.iec104_error",
i18n_description = formatIEC104ErrorMessage,
icon = "fas fa-subway",
creator = createIEC104Error,
}
return alert_iec104_error

65
scripts/lua/modules/alert_definitions/alert_lateral_movement.lua
View file

@ -2,37 +2,50 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
local format_utils = require "format_utils"
local json = require("dkjson")
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_lateral_movement = classes.class(alert)
-- ##############################################
alert_lateral_movement.meta = {
alert_key = alert_keys.ntopng.alert_lateral_movement,
i18n_title = "alerts_dashboard.lateral_movement",
icon = "fas fa-arrows-alt-h",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param alert_granularity A granularity as defined in `alert_consts.alerts_granularities`
-- @param last_error A table containing the last lateral movement error, e.g.,
-- {"event":"create","shost":"192.168.2.153","dhost":"224.0.0.68","dport":1968,"vlan_id":0,"l4":17,"l7":0,"first_seen":1602488355,"last_seen":1602488355,"num_uses":1}
-- @return A table with the alert built
local function createLateralMovementError(alert_severity, alert_granularity, last_error)
-- Create a subtype, to avoid merging multiple lateral movement alerts together
local alert_subtype = last_error.shost .. "/" .. last_error.dhost .. "/" .. last_error.dport .. "/" .. last_error.l4 .. "/" .. last_error.l7
local threshold_type = {
alert_severity = alert_severity,
alert_subtype = alert_subtype,
alert_granularity = alert_granularity,
alert_type_params = {
error_msg = last_error
},
}
function alert_lateral_movement:init(last_error)
-- Call the paren constructor
self.super:init()
return threshold_type
self.alert_type_params = {
error_msg = last_error
}
end
-- #######################################################
local function formatLateralMovementErrorMessage(ifid, alert, status)
local msg = status.error_msg
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_lateral_movement.format(ifid, alert, alert_type_params)
local msg = alert_type_params.error_msg
local vlan_id = msg.vlan_id or 0
local client = {host = msg.shost, vlan = vlan_id}
local server = {host = msg.dhost, vlan = vlan_id}
@ -41,21 +54,15 @@ local function formatLateralMovementErrorMessage(ifid, alert, status)
" <i class=\"fas fa-exchange-alt fa-lg\" aria-hidden=\"true\" data-original-title=\"\" title=\"\"></i> " ..
hostinfo2detailshref(server, nil, hostinfo2label(server))..
" ["..i18n("port")..": "..msg.dport.."]"
rsp = rsp .. "["..i18n("application")..": "..interface.getnDPIProtoName(msg.l7).."]"
if not isEmptyString(msg.info) then
rsp = rsp .. "[" .. msg.info .. "]"
end
return(rsp)
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_lateral_movement,
i18n_title = "alerts_dashboard.lateral_movement",
i18n_description = formatLateralMovementErrorMessage,
icon = "fas fa-arrows-alt-h",
creator = createLateralMovementError,
}
return alert_lateral_movement

71
scripts/lua/modules/alert_definitions/alert_longlived.lua Normal file
View file

@ -0,0 +1,71 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_longlived = classes.class(alert)
-- ##############################################
alert_longlived.meta = {
status_key = status_keys.ntopng.status_longlived,
alert_key = alert_keys.ntopng.alert_longlived,
i18n_title = "flow_details.longlived_flow",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param longlived_threshold Threshold, in seconds, for a flow to be considered longlived
-- @return A table with the alert built
function alert_longlived:init(longlived_threshold)
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
["longlived.threshold"] = longlived_threshold
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_longlived.format(ifid, alert, alert_type_params)
local threshold = ""
local res = i18n("flow_details.longlived_flow")
if not alert_type_params then
return res
end
if alert_type_params["longlived.threshold"] then
threshold = alert_type_params["longlived.threshold"]
end
res = string.format("%s<sup><i class='fas fa-info-circle' aria-hidden='true' title='"..i18n("flow_details.longlived_flow_descr").."'></i></sup>", res)
if threshold ~= "" then
res = string.format("%s [%s]", res, i18n("flow_details.longlived_exceeded", {amount = secondsToTime(threshold)}))
end
return res
end
-- #######################################################
return alert_longlived

52
scripts/lua/modules/alert_definitions/alert_malicious_signature.lua
View file

@ -2,10 +2,52 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
-- ##############################################
return {
alert_key = alert_keys.ntopng.alert_malicious_signature,
i18n_title = "alerts_dashboard.malicious_signature_detected",
icon = "fas fa-ban",
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_malicious_signature = classes.class(alert)
-- ##############################################
alert_malicious_signature.meta = {
status_key = status_keys.ntopng.status_malicious_signature, -- A flow status key
alert_key = alert_keys.ntopng.alert_malicious_signature,
i18n_title = "alerts_dashboard.malicious_signature_detected",
icon = "fas fa-ban",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @return A table with the alert built
function alert_malicious_signature:init()
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
-- No params
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_malicious_signature.format(ifid, alert, alert_type_params)
return i18n("alerts_dashboard.malicious_signature_detected")
end
-- #######################################################
return alert_malicious_signature

89
scripts/lua/modules/alert_definitions/alert_periodicity_update.lua
View file

@ -1,80 +1,85 @@
--
-- (C) 2020 - ntop.org
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
local format_utils = require "format_utils"
local json = require("dkjson")
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_periodicity_update = classes.class(alert)
-- ##############################################
alert_periodicity_update.meta = {
alert_key = alert_keys.ntopng.alert_periodicity_update,
i18n_title = "alerts_dashboard.alert_periodicity_update",
icon = "fas fa-arrows-alt-h",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param alert_granularity A granularity as defined in `alert_consts.alerts_granularities`
-- @param last_error A table containing the last lateral movement error, e.g.,
-- {"event":"create","shost":"192.168.2.153","dhost":"224.0.0.68","dport":1968,"vlan_id":0,"l4":17,"l7":0,"first_seen":1602488355,"last_seen":1602488355,"num_uses":1}
-- @return A table with the alert built
local function createPeriodicityUpdateError(alert_severity, alert_granularity, last_error, created_or_removed)
-- Create a subtype, to avoid merging multiple lateral movement alerts together
local alert_subtype = last_error.shost .. "/" .. last_error.dhost .. "/" .. last_error.dport .. "/" .. last_error.l4 .. "/" .. last_error.l7
local threshold_type = {
alert_severity = alert_severity,
alert_subtype = alert_subtype,
alert_granularity = alert_granularity,
alert_type_params = {
error_msg = last_error,
created_or_removed = created_or_removed
},
}
function alert_periodicity_update:init(last_error, created_or_removed)
-- Call the paren constructor
self.super:init()
return threshold_type
self.alert_type_params = {
error_msg = last_error,
created_or_removed = created_or_removed
}
end
-- #######################################################
local function formatPeriodicityUpdateErrorMessage(ifid, alert, status)
local msg = status.error_msg
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_periodicity_update.format(ifid, alert, alert_type_params)
local msg = alert_type_params.error_msg
local vlan_id = msg.vlan_id or 0
local client = {host = msg.shost, vlan = vlan_id}
local server = {host = msg.dhost, vlan = vlan_id}
local rsp
if status.created_or_removed == "create" then
if alert_type_params.created_or_removed == "create" then
rsp = "flow: "
rsp = rsp .. hostinfo2detailshref(client, nil, hostinfo2label(client))..
" <i class=\"fas fa-exchange-alt fa-lg\" aria-hidden=\"true\" data-original-title=\"\" title=\"\"></i> " ..
hostinfo2detailshref(server, nil, hostinfo2label(server))..
" ["..i18n("port")..": "..msg.dport.."]"
" <i class=\"fas fa-exchange-alt fa-lg\" aria-hidden=\"true\" data-original-title=\"\" title=\"\"></i> " ..
hostinfo2detailshref(server, nil, hostinfo2label(server))..
" ["..i18n("port")..": "..msg.dport.."]"
rsp = rsp .. "["..i18n("application")..": "..interface.getnDPIProtoName(msg.l7).."]"
if not isEmptyString(msg.info) then
rsp = rsp .. "[" .. msg.info .. "]"
rsp = rsp .. "[" .. msg.info .. "]"
end
rsp = rsp .. ", is now periodic (frequency " .. msg["frequency"] .. " seconds)"
else
rsp = "Periodic flow ended: "
rsp = rsp .. hostinfo2detailshref(client, nil, hostinfo2label(client))..
" <i class=\"fas fa-exchange-alt fa-lg\" aria-hidden=\"true\" data-original-title=\"\" title=\"\"></i> " ..
hostinfo2detailshref(server, nil, hostinfo2label(server))..
" ["..i18n("port")..": "..msg.dport.."]"
" <i class=\"fas fa-exchange-alt fa-lg\" aria-hidden=\"true\" data-original-title=\"\" title=\"\"></i> " ..
hostinfo2detailshref(server, nil, hostinfo2label(server))..
" ["..i18n("port")..": "..msg.dport.."]"
rsp = rsp .. "["..i18n("application")..": "..interface.getnDPIProtoName(msg.l7).."]"
if not isEmptyString(msg.info) then
rsp = rsp .. "[" .. msg.info .. "]"
rsp = rsp .. "[" .. msg.info .. "]"
end
end
return(rsp)
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_periodicity_update,
i18n_title = "alerts_dashboard.alert_periodicity_update",
i18n_description = formatPeriodicityUpdateErrorMessage,
icon = "fas fa-arrows-alt-h",
creator = createPeriodicityUpdateError,
}
return alert_periodicity_update

72
scripts/lua/modules/alert_definitions/alert_port_duplexstatus_change.lua
View file

@ -2,50 +2,64 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_port_duplexstatus_change = classes.class(alert)
-- ##############################################
alert_port_duplexstatus_change.meta = {
alert_key = alert_keys.ntopng.alert_port_duplexstatus_change,
i18n_title = "alerts_dashboard.snmp_port_duplexstatus_change",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param device_ip A string with the ip address of the snmp device
-- @param if_index The index of the port that changed
-- @param interface_name The string with the name of the port that changed
-- @param status The new duplex status
-- @return A table with the alert built
local function createPortDuplexstatusChange(alert_severity, device_ip, if_index, interface_name, status)
local built = {
alert_severity = alert_severity,
alert_type_params = {
device = device_ip,
interface = if_index,
interface_name = interface_name,
status = status
},
function alert_port_duplexstatus_change:init(device_ip, if_index, interface_name, status)
-- Call the paren constructor
self.super:init()
self.alert_type_params = {
device = device_ip,
interface = if_index,
interface_name = interface_name,
status = status
}
return built
end
-- #######################################################
local function snmpPortDuplexChangeFormatter(ifid, alert, info)
local snmp_consts = require "snmp_consts"
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_port_duplexstatus_change.format(ifid, alert, alert_type_params)
local snmp_consts = require "snmp_consts"
return(i18n("alerts_dashboard.snmp_port_changed_duplex_status",
{device = info.device,
port = info.interface_name or info.interface,
url = snmpDeviceUrl(info.device),
port_url = snmpIfaceUrl(info.device, info.interface),
new_op = snmp_consts.snmp_duplexstatus(info.status)}))
return(i18n("alerts_dashboard.snmp_port_changed_duplex_status",
{device = alert_type_params.device,
port = alert_type_params.interface_name or alert_type_params.interface,
url = snmpDeviceUrl(alert_type_params.device),
port_url = snmpIfaceUrl(alert_type_params.device, alert_type_params.interface),
new_op = snmp_consts.snmp_duplexstatus(alert_type_params.status)}))
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_port_duplexstatus_change,
i18n_title = "alerts_dashboard.snmp_port_duplexstatus_change",
i18n_description = snmpPortDuplexChangeFormatter,
icon = "fas fa-exclamation",
creator = createPortDuplexstatusChange,
}
return alert_port_duplexstatus_change

68
scripts/lua/modules/alert_definitions/alert_port_errors.lua
View file

@ -2,45 +2,61 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_port_errors = classes.class(alert)
-- ##############################################
alert_port_errors.meta = {
alert_key = alert_keys.ntopng.alert_port_errors,
i18n_title = "alerts_dashboard.snmp_port_errors",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param device_ip A string with the ip address of the snmp device
-- @param if_index The index of the port that changed
-- @param interface_name The string with the name of the port that changed
-- @return A table with the alert built
local function createPortErrors(alert_severity, device_ip, if_index, interface_name)
local built = {
alert_severity = alert_severity,
alert_type_params = {
device = device_ip,
interface = if_index,
interface_name = interface_name,
},
function alert_port_errors:init(device_ip, if_index, interface_name)
-- Call the paren constructor
self.super:init()
self.alert_type_params = {
device = device_ip,
interface = if_index,
interface_name = interface_name,
}
return built
end
-- #######################################################
local function snmpInterfaceErrorsFormatter(ifid, alert, info)
return(i18n("alerts_dashboard.snmp_port_errors_increased",
{device = info.device,
port = info.interface_name or info.interface,
url = snmpDeviceUrl(info.device),
port_url = snmpIfaceUrl(info.device, info.interface)}))
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_port_errors.format(ifid, alert, alert_type_params)
return(i18n("alerts_dashboard.snmp_port_errors_increased",
{
device = alert_type_params.device,
port = alert_type_params.interface_name or alert_type_params.interface,
url = snmpDeviceUrl(alert_type_params.device),
port_url = snmpIfaceUrl(alert_type_params.device, alert_type_params.interface)
}))
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_port_errors,
i18n_title = "alerts_dashboard.snmp_port_errors",
i18n_description = snmpInterfaceErrorsFormatter,
icon = "fas fa-exclamation",
creator = createPortErrors,
}
return alert_port_errors

90
scripts/lua/modules/alert_definitions/alert_port_load_threshold_exceeded.lua
View file

@ -2,12 +2,29 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_port_load_threshold_exceeded = classes.class(alert)
-- ##############################################
alert_port_load_threshold_exceeded.meta = {
alert_key = alert_keys.ntopng.alert_port_load_threshold_exceeded,
i18n_title = "alerts_dashboard.snmp_port_load_threshold_exceeded",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param device_ip A string with the ip address of the snmp device
-- @param if_index The index of the port that changed
-- @param interface_name The string with the name of the port that changed
@ -15,44 +32,41 @@ local alert_keys = require "alert_keys"
-- @param out_load The egress load in percentage
-- @param load_threshold The threshold configured for the load
-- @return A table with the alert built
local function createPortLoadThresholdExceeded(alert_severity, device_ip, if_index, interface_name, in_load, out_load, load_threshold)
local built = {
alert_severity = alert_severity,
alert_type_params = {
device = device_ip,
interface = if_index,
interface_name = interface_name,
in_load = in_load,
out_load = out_load,
load_threshold = load_threshold,
},
function alert_port_load_threshold_exceeded:init(device_ip, if_index, interface_name, in_load, out_load, load_threshold)
-- Call the paren constructor
self.super:init()
self.alert_type_params = {
device = device_ip,
interface = if_index,
interface_name = interface_name,
in_load = in_load,
out_load = out_load,
load_threshold = load_threshold,
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_port_load_threshold_exceeded.format(ifid, alert, alert_type_params)
local fmt = {
device = alert_type_params.device,
port = alert_type_params.interface_name or alert_type_params.interface,
url = snmpDeviceUrl(alert_type_params.device),
port_url = snmpIfaceUrl(alert_type_params.device, alert_type_params.interface),
in_load = alert_type_params.in_load,
out_load = alert_type_params.out_load,
threshold = alert_type_params.load_threshold,
}
return built
return(i18n("alerts_dashboard.snmp_port_load_threshold_exceeded_message", fmt))
end
-- #######################################################
local function snmpPortLoadThresholdFormatter(ifid, alert, info)
local fmt = {
device = info.device,
port = info.interface_name or info.interface,
url = snmpDeviceUrl(info.device),
port_url = snmpIfaceUrl(info.device, info.interface),
in_load = info.in_load,
out_load = info.out_load,
threshold = info.load_threshold,
}
return(i18n("alerts_dashboard.snmp_port_load_threshold_exceeded_message", fmt))
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_port_load_threshold_exceeded,
i18n_title = "alerts_dashboard.snmp_port_load_threshold_exceeded",
i18n_description = snmpPortLoadThresholdFormatter,
icon = "fas fa-exclamation",
creator = createPortLoadThresholdExceeded,
}
return alert_port_load_threshold_exceeded

82
scripts/lua/modules/alert_definitions/alert_port_mac_changed.lua
View file

@ -2,12 +2,29 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_port_mac_changed = classes.class(alert)
-- ##############################################
alert_port_mac_changed.meta = {
alert_key = alert_keys.ntopng.alert_port_mac_changed,
i18n_title = "alerts_dashboard.alert_snmp_interface_mac_changed_title",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param device_ip A string with the ip address of the snmp device
-- @param if_index The index of the port that changed
-- @param interface_name The string with the name of the port that changed
@ -15,44 +32,41 @@ local alert_keys = require "alert_keys"
-- @param prev_seen_device A string with the ip address of the previous snmp device
-- @param prev_seen_port The index of the previous port
-- @return A table with the alert built
local function createPortMacChange(alert_severity, device_ip, if_index, interface_name, mac, prev_seen_device, prev_seen_port)
local built = {
alert_severity = alert_severity,
alert_type_params = {
device = device_ip,
interface = if_index,
interface_name = interface_name,
mac = mac,
prev_seen_device = prev_seen_device,
prev_seen_port = prev_seen_port,
},
function alert_port_mac_changed:init(device_ip, if_index, interface_name, mac, prev_seen_device, prev_seen_port)
-- Call the paren constructor
self.super:init()
self.alert_type_params = {
device = device_ip,
interface = if_index,
interface_name = interface_name,
mac = mac,
prev_seen_device = prev_seen_device,
prev_seen_port = prev_seen_port,
}
return built
end
-- #######################################################
local function portMacChangedFormatter(ifid, alert, info)
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_port_mac_changed.format(ifid, alert, alert_type_params)
return(i18n("alerts_dashboard.alert_snmp_interface_mac_changed_description",
{mac_url = getMacUrl(info.mac),
mac = info.mac,
device = info.device,
port = info.interface_name or info.interface,
url = snmpDeviceUrl(info.device),
port_url = snmpIfaceUrl(info.device, info.interface),
prev_device_url = snmpDeviceUrl(info.prev_seen_device),
prev_device = info.prev_seen_device,
prev_port_url = snmpIfaceUrl(info.prev_seen_device, info.prev_seen_port),
prev_port = info.prev_seen_port}))
{mac_url = getMacUrl(alert_type_params.mac),
mac = alert_type_params.mac,
device = alert_type_params.device,
port = alert_type_params.interface_name or alert_type_params.interface,
url = snmpDeviceUrl(alert_type_params.device),
port_url = snmpIfaceUrl(alert_type_params.device, alert_type_params.interface),
prev_device_url = snmpDeviceUrl(alert_type_params.prev_seen_device),
prev_device = alert_type_params.prev_seen_device,
prev_port_url = snmpIfaceUrl(alert_type_params.prev_seen_device, alert_type_params.prev_seen_port),
prev_port = alert_type_params.prev_seen_port}))
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_port_mac_changed,
i18n_title = "alerts_dashboard.alert_snmp_interface_mac_changed_title",
i18n_description = portMacChangedFormatter,
icon = "fas fa-exclamation",
creator = createPortMacChange,
}
return alert_port_mac_changed

68
scripts/lua/modules/alert_definitions/alert_port_status_change.lua
View file

@ -2,50 +2,64 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_port_status_change = classes.class(alert)
-- ##############################################
alert_port_status_change.meta = {
alert_key = alert_keys.ntopng.alert_port_status_change,
i18n_title = "alerts_dashboard.snmp_port_status_change",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param device_ip A string with the ip address of the snmp device
-- @param if_index The index of the port that changed
-- @param interface_name The string with the name of the port that changed
-- @param status A string with the new status
-- @return A table with the alert built
local function createPortStatusChange(alert_severity, device_ip, if_index, interface_name, status)
local built = {
alert_severity = alert_severity,
alert_type_params = {
device = device_ip,
interface = if_index,
interface_name = interface_name,
status = status,
},
}
function alert_port_status_change:init(device_ip, if_index, interface_name, status)
-- Call the paren constructor
self.super:init()
return built
self.alert_type_params = {
device = device_ip,
interface = if_index,
interface_name = interface_name,
status = status,
}
end
-- #######################################################
local function portStatusChangeFormatter(ifid, alert, info)
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_port_status_change.format(ifid, alert, alert_type_params)
local snmp_consts = require "snmp_consts"
return(i18n("alerts_dashboard.snmp_port_changed_operational_status",
{device = info.device,
port = info.interface_name or info.interface,
url = snmpDeviceUrl(info.device),
port_url = snmpIfaceUrl(info.device, info.interface),
new_op = snmp_consts.snmp_ifstatus(info.status)}))
{device = alert_type_params.device,
port = alert_type_params.interface_name or alert_type_params.interface,
url = snmpDeviceUrl(alert_type_params.device),
port_url = snmpIfaceUrl(alert_type_params.device, alert_type_params.interface),
new_op = snmp_consts.snmp_ifstatus(alert_type_params.status)}))
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_port_status_change,
i18n_title = "alerts_dashboard.snmp_port_status_change",
i18n_description = portStatusChangeFormatter,
icon = "fas fa-exclamation",
creator = createPortStatusChange,
}
return alert_port_status_change

67
scripts/lua/modules/alert_definitions/alert_potentially_dangerous_protocol.lua
View file

@ -2,41 +2,52 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_potentially_dangerous_protocol = classes.class(alert)
-- ##############################################
alert_potentially_dangerous_protocol.meta = {
status_key = status_keys.ntopng.status_potentially_dangerous,
alert_key = alert_keys.ntopng.alert_potentially_dangerous_protocol,
i18n_title = "flow_details.potentially_dangerous_protocol",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param tls_version A string indicating the TLS version detected, or nil when version is not available
-- @param tls_info A lua table with TLS info gererated calling `flow.getTLSInfo()`
-- @return A table with the alert built
local function createPotentiallyDangerous(tls_version, tls_info)
tls_info = tls_info or {}
local server_cn = tls_info["protos.tls.server_names"] or ""
local client_cn = tls_info["protos.tls.client_requested_server_name"] or ""
function alert_potentially_dangerous_protocol:init()
-- Call the parent constructor
self.super:init()
local built = {
alert_type_params = {
tls_version = tls_version,
["tls_crt.cli"] = client_cn,
["tls_crt.srv"] = server_cn,
["tls_crt.notBefore"] = tls_info["protos.tls.notBefore"],
["tls_crt.notAfter"] = tls_info["protos.tls.notAfter"],
["tls_crt.issuerDN"] = tls_info["protos.tls.issuerDN"] or "",
["tls_crt.now"] = os.time(),
["cli_ja3_signature"] = tls_info["protos.tls.ja3.client_hash"],
}
self.alert_type_params = {
-- No params
}
return built
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_potentially_dangerous_protocol,
i18n_title = "alerts_dashboard.potentially_dangerous_protocol",
i18n_description = "alert_messages.potentially_dangerous_protocol_description",
icon = "fas fa-exclamation",
creator = createPotentiallyDangerous,
}
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_potentially_dangerous_protocol.format(ifid, alert, alert_type_params)
return i18n("flow_details.potentially_dangerous_protocol")
end
-- #######################################################
return alert_potentially_dangerous_protocol

60
scripts/lua/modules/alert_definitions/alert_snmp_device_reset.lua
View file

@ -2,41 +2,53 @@
-- (C) 2019-20 - ntop.org
--
local alert_keys = require "alert_keys"
-- ##############################################
-- #######################################################
local alert_keys = require "alert_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_snmp_device_reset = classes.class(alert)
-- ##############################################
alert_snmp_device_reset.meta = {
alert_key = alert_keys.ntopng.alert_snmp_device_reset,
i18n_title = "alerts_dashboard.alert_snmp_device_reset_title",
icon = "fas fa-power-off",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_severities`
-- @param alert_granularity A granularity as defined in `alert_consts.alerts_granularities`
-- @param device_ip A string with the ip address of the snmp device
-- @return A table with the alert built
local function createDeviceReset(alert_severity, alert_granularity, device_ip)
local built = {
alert_severity = alert_severity,
alert_granularity = alert_granularity,
alert_type_params = {
device = device_ip,
},
function alert_snmp_device_reset:init(device_ip)
-- Call the paren constructor
self.super:init()
self.alert_type_params = {
device = device_ip
}
return built
end
-- #######################################################
local function snmpDeviceResetFormatter(ifid, alert, info)
return(i18n("alerts_dashboard.alert_snmp_device_reset_description",
{device = info.device,
url = snmpDeviceUrl(info.device)}))
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_snmp_device_reset.format(ifid, alert, alert_type_params)
return(i18n("alerts_dashboard.alert_snmp_device_reset_description",
{device = alert_type_params.device,
url = snmpDeviceUrl(alert_type_params.device)}))
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_snmp_device_reset,
i18n_title = "alerts_dashboard.alert_snmp_device_reset_title",
i18n_description = snmpDeviceResetFormatter,
icon = "fas fa-power-off",
creator = createDeviceReset,
}
return alert_snmp_device_reset

53
scripts/lua/modules/alert_definitions/alert_suspicious_tcp_probing.lua Normal file
View file

@ -0,0 +1,53 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_suspicious_tcp_probing = classes.class(alert)
-- ##############################################
alert_suspicious_tcp_probing.meta = {
status_key = status_keys.ntopng.status_suspicious_tcp_probing,
alert_key = alert_keys.ntopng.alert_suspicious_tcp_probing,
i18n_title = "flow_details.suspicious_tcp_probing",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @return A table with the alert built
function alert_suspicious_tcp_probing:init()
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
-- No params
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_suspicious_tcp_probing.format(ifid, alert, alert_type_params)
return i18n("flow_details.suspicious_tcp_probing")
end
-- #######################################################
return alert_suspicious_tcp_probing

53
scripts/lua/modules/alert_definitions/alert_suspicious_tcp_syn_probing.lua Normal file
View file

@ -0,0 +1,53 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_suspicious_tcp_syn_probing = classes.class(alert)
-- ##############################################
alert_suspicious_tcp_syn_probing.meta = {
status_key = status_keys.ntopng.status_suspicious_tcp_syn_probing,
alert_key = alert_keys.ntopng.alert_suspicious_tcp_syn_probing,
i18n_title = "flow_details.suspicious_tcp_syn_probing",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @return A table with the alert built
function alert_suspicious_tcp_syn_probing:init()
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
-- No params
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_suspicious_tcp_syn_probing.format(ifid, alert, alert_type_params)
return i18n("flow_details.suspicious_tcp_syn_probing")
end
-- #######################################################
return alert_suspicious_tcp_syn_probing

53
scripts/lua/modules/alert_definitions/alert_tcp_connection_refused.lua Normal file
View file

@ -0,0 +1,53 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_tcp_connection_refused = classes.class(alert)
-- ##############################################
alert_tcp_connection_refused.meta = {
status_key = status_keys.ntopng.status_tcp_connection_refused,
alert_key = alert_keys.ntopng.alert_tcp_connection_refused,
i18n_title = "flow_details.tcp_connection_refused",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @return A table with the alert built
function alert_tcp_connection_refused:init()
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
-- No params
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_tcp_connection_refused.format(ifid, alert, alert_type_params)
return i18n("flow_details.tcp_connection_refused")
end
-- #######################################################
return alert_tcp_connection_refused

65
scripts/lua/modules/alert_definitions/alert_tls_certificate_expired.lua Normal file
View file

@ -0,0 +1,65 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_tls_certificate_expired = classes.class(alert)
-- ##############################################
alert_tls_certificate_expired.meta = {
status_key = status_keys.ntopng.status_tls_certificate_expired,
alert_key = alert_keys.ntopng.alert_tls_certificate_expired,
i18n_title = "flow_details.tls_certificate_expired",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param tls_info A lua table with TLS info gererated calling `flow.getTLSInfo()`
-- @return A table with the alert built
function alert_tls_certificate_expired:init(tls_info)
-- Call the parent constructor
self.super:init()
tls_info = tls_info or {}
self.alert_type_params = {
["tls_crt.notBefore"] = tls_info["protos.tls.notBefore"],
["tls_crt.notAfter"] = tls_info["protos.tls.notAfter"],
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_tls_certificate_expired.format(ifid, alert, alert_type_params)
if not alert_type_params then
return i18n("flow_details.tls_certificate_expired")
end
local crts = {}
crts[#crts + 1] = formatEpoch(alert_type_params["tls_crt.notBefore"])
crts[#crts + 1] = formatEpoch(alert_type_params["tls_crt.notAfter"])
return string.format("%s [%s]", i18n("flow_details.tls_certificate_expired"), table.concat(crts, " - "))
end
-- #######################################################
return alert_tls_certificate_expired

72
scripts/lua/modules/alert_definitions/alert_tls_certificate_mismatch.lua Normal file
View file

@ -0,0 +1,72 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_tls_certificate_mismatch = classes.class(alert)
-- ##############################################
alert_tls_certificate_mismatch.meta = {
status_key = status_keys.ntopng.status_tls_certificate_mismatch,
alert_key = alert_keys.ntopng.alert_tls_certificate_mismatch,
i18n_title = "flow_details.tls_certificate_mismatch",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param tls_info A lua table with TLS info gererated calling `flow.getTLSInfo()`
-- @return A table with the alert built
function alert_tls_certificate_mismatch:init(tls_info)
-- Call the parent constructor
self.super:init()
tls_info = tls_info or {}
local server_cn = tls_info["protos.tls.server_names"] or ""
local client_cn = tls_info["protos.tls.client_requested_server_name"] or ""
self.alert_type_params = {
["tls_crt.cli"] = client_cn,
["tls_crt.srv"] = server_cn,
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_tls_certificate_mismatch.format(ifid, alert, alert_type_params)
if not alert_type_params then
return i18n("flow_details.tls_certificate_mismatch")
end
local crts = {}
if not isEmptyString(alert_type_params["tls_crt.cli"]) then
crts[#crts + 1] = string.format("[%s: %s]", i18n("flow_details.client_requested"), alert_type_params["tls_crt.cli"]:gsub(",", ", "))
end
if not isEmptyString(alert_type_params["tls_crt.srv"]) then
crts[#crts + 1] = string.format("[%s: %s]", i18n("flow_details.tls_server_names"), alert_type_params["tls_crt.srv"]:gsub(",", ", "))
end
return string.format("%s %s", i18n("flow_details.tls_certificate_mismatch"), table.concat(crts, " "))
end
-- #######################################################
return alert_tls_certificate_mismatch

63
scripts/lua/modules/alert_definitions/alert_tls_certificate_selfsigned.lua Normal file
View file

@ -0,0 +1,63 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_tls_certificate_selfsigned = classes.class(alert)
-- ##############################################
alert_tls_certificate_selfsigned.meta = {
status_key = status_keys.ntopng.status_tls_certificate_selfsigned,
alert_key = alert_keys.ntopng.alert_tls_certificate_selfsigned,
i18n_title = "flow_details.tls_certificate_selfsigned",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param tls_info A lua table with TLS info gererated calling `flow.getTLSInfo()`
-- @return A table with the alert built
function alert_tls_certificate_selfsigned:init(tls_info)
-- Call the parent constructor
self.super:init()
tls_info = tls_info or {}
self.alert_type_params = {
["tls_crt.issuerDN"] = tls_info["protos.tls.issuerDN"] or "",
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_tls_certificate_selfsigned.format(ifid, alert, alert_type_params)
if not alert_type_params then
return i18n("flow_details.tls_certificate_selfsigned")
end
local crts = {}
crts[#crts + 1] = alert_type_params["tls_crt.issuerDN"]
return string.format("%s [Issuer/Subject: %s]", i18n("flow_details.tls_certificate_selfsigned"), table.concat(crts, " - "))
end
-- #######################################################
return alert_tls_certificate_selfsigned

66
scripts/lua/modules/alert_definitions/alert_tls_old_version.lua Normal file
View file

@ -0,0 +1,66 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_tls_old_version = classes.class(alert)
-- ##############################################
alert_tls_old_version.meta = {
status_key = status_keys.ntopng.status_tls_old_protocol_version,
alert_key = alert_keys.ntopng.alert_tls_old_protocol_version,
i18n_title = "flow_details.tls_old_protocol_version",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @param tls_version A number indicating the TLS version detected, or nil when version is not available
-- @return A table with the alert built
function alert_tls_old_version:init(tls_version)
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
tls_version = tls_version,
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_tls_old_version.format(ifid, alert, alert_type_params)
local msg = i18n("flow_details.tls_old_protocol_version")
if(alert_type_params and alert_type_params.tls_version) then
local ver_str = ntop.getTLSVersionName(alert_type_params.tls_version)
if(ver_str == nil) then
ver_str = string.format("%u", alert_type_params.tls_version)
end
msg = msg .. " (" .. ver_str .. ")"
end
return(msg)
end
-- #######################################################
return alert_tls_old_version

53
scripts/lua/modules/alert_definitions/alert_tls_unsafe_ciphers.lua Normal file
View file

@ -0,0 +1,53 @@
--
-- (C) 2019-20 - ntop.org
--
-- ##############################################
local alert_keys = require "alert_keys"
local status_keys = require "flow_keys"
-- Import the classes library.
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
-- ##############################################
local alert_tls_unsafe_ciphers = classes.class(alert)
-- ##############################################
alert_tls_unsafe_ciphers.meta = {
status_key = status_keys.ntopng.status_tls_unsafe_ciphers,
alert_key = alert_keys.ntopng.alert_tls_unsafe_ciphers,
i18n_title = "flow_details.tls_unsafe_ciphers",
icon = "fas fa-exclamation",
}
-- ##############################################
-- @brief Prepare an alert table used to generate the alert
-- @return A table with the alert built
function alert_tls_unsafe_ciphers:init()
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
-- No params
}
end
-- #######################################################
-- @brief Format an alert into a human-readable string
-- @param ifid The integer interface id of the generated alert
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
-- @return A human-readable string
function alert_tls_unsafe_ciphers.format(ifid, alert, alert_type_params)
return i18n("flow_details.tls_unsafe_ciphers")
end
-- #######################################################
return alert_tls_unsafe_ciphers