Migrates alerts to an object-oriented implementation

Migrates alert_malicious_signature alert_elephant_local_to_remote alert_elephant_remote_to_local

Migrates long_lived

Migrates alert_flow_blocked

Migrates alert_tls_old_version

Migrates alert_tls_certificate_mismatch

Migrates alert_tls_certificate_expired

Migrates alert_tls_unsafe_ciphers

Migrates alert_tls_certificate_selfsigned

Migrates alert_potentially_dangerous_protocol

Migrates alert_snmp_device_reset

Migrates alert_port_mac_changed

Migrates alert_port_duplexstatus_change

Mirgates alert_port_errors

Migrates alert_port_status_change

Migrates alert_port_load_threshold_exceeded

Migrates alert_data_exfiltration

Migrates alert_dns_data_exfiltration

Migrates alert_suspicious_tcp_probing alert_suspicious_tcp_syn_probing alert_tcp_connection_refused

Migrates alert_dns_invalid_query

Migrates alert_attack_mitigation_via_snmp

Migrates alert_lateral_movement

Migrates alert_periodicity_update

Migrates alert_dns_positive_error_ratio

Migrates alert_iec104_error

scripts/lua/modules/alert_definitions/alert_suspicious_tcp_probing.lua

@@ -0,0 +1,53 @@
+--
+-- (C) 2019-20 - ntop.org
+--
+
+-- ##############################################
+
+local alert_keys = require "alert_keys"
+local status_keys = require "flow_keys"
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_suspicious_tcp_probing = classes.class(alert)
+
+-- ##############################################
+
+alert_suspicious_tcp_probing.meta = {
+   status_key = status_keys.ntopng.status_suspicious_tcp_probing,
+   alert_key = alert_keys.ntopng.alert_suspicious_tcp_probing,
+   i18n_title = "flow_details.suspicious_tcp_probing",
+   icon = "fas fa-exclamation",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @return A table with the alert built
+function alert_suspicious_tcp_probing:init()
+   -- Call the parent constructor
+   self.super:init()
+
+   self.alert_type_params = {
+      -- No params
+   }
+end
+
+-- #######################################################
+
+-- @brief Format an alert into a human-readable string
+-- @param ifid The integer interface id of the generated alert
+-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
+-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
+-- @return A human-readable string
+function alert_suspicious_tcp_probing.format(ifid, alert, alert_type_params)
+   return i18n("flow_details.suspicious_tcp_probing")
+end
+
+-- #######################################################
+
+return alert_suspicious_tcp_probing