Migrates alerts to an object-oriented implementation

Migrates alert_malicious_signature alert_elephant_local_to_remote alert_elephant_remote_to_local

Migrates long_lived

Migrates alert_flow_blocked

Migrates alert_tls_old_version

Migrates alert_tls_certificate_mismatch

Migrates alert_tls_certificate_expired

Migrates alert_tls_unsafe_ciphers

Migrates alert_tls_certificate_selfsigned

Migrates alert_potentially_dangerous_protocol

Migrates alert_snmp_device_reset

Migrates alert_port_mac_changed

Migrates alert_port_duplexstatus_change

Mirgates alert_port_errors

Migrates alert_port_status_change

Migrates alert_port_load_threshold_exceeded

Migrates alert_data_exfiltration

Migrates alert_dns_data_exfiltration

Migrates alert_suspicious_tcp_probing alert_suspicious_tcp_syn_probing alert_tcp_connection_refused

Migrates alert_dns_invalid_query

Migrates alert_attack_mitigation_via_snmp

Migrates alert_lateral_movement

Migrates alert_periodicity_update

Migrates alert_dns_positive_error_ratio

Migrates alert_iec104_error

scripts/lua/modules/alert_definitions/alert_longlived.lua

@@ -0,0 +1,71 @@
+--
+-- (C) 2019-20 - ntop.org
+--
+
+-- ##############################################
+
+local alert_keys = require "alert_keys"
+local status_keys = require "flow_keys"
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_longlived = classes.class(alert)
+
+-- ##############################################
+
+alert_longlived.meta = {
+   status_key = status_keys.ntopng.status_longlived,
+   alert_key = alert_keys.ntopng.alert_longlived,
+   i18n_title = "flow_details.longlived_flow",
+   icon = "fas fa-exclamation",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @param longlived_threshold Threshold, in seconds, for a flow to be considered longlived
+-- @return A table with the alert built
+function alert_longlived:init(longlived_threshold)
+   -- Call the parent constructor
+   self.super:init()
+
+   self.alert_type_params = {
+      ["longlived.threshold"] = longlived_threshold
+   }
+end
+
+-- #######################################################
+
+-- @brief Format an alert into a human-readable string
+-- @param ifid The integer interface id of the generated alert
+-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
+-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
+-- @return A human-readable string
+function alert_longlived.format(ifid, alert, alert_type_params)
+   local threshold = ""
+   local res = i18n("flow_details.longlived_flow")
+
+   if not alert_type_params then
+      return res
+   end
+
+   if alert_type_params["longlived.threshold"] then
+      threshold = alert_type_params["longlived.threshold"]
+   end
+
+   res = string.format("%s<sup><i class='fas fa-info-circle' aria-hidden='true' title='"..i18n("flow_details.longlived_flow_descr").."'></i></sup>", res)
+
+   if threshold ~= "" then
+      res = string.format("%s [%s]", res, i18n("flow_details.longlived_exceeded", {amount = secondsToTime(threshold)}))
+   end
+
+   return res
+end
+
+-- #######################################################
+
+return alert_longlived