Migrates alerts to an object-oriented implementation

Migrates alert_malicious_signature alert_elephant_local_to_remote alert_elephant_remote_to_local

Migrates long_lived

Migrates alert_flow_blocked

Migrates alert_tls_old_version

Migrates alert_tls_certificate_mismatch

Migrates alert_tls_certificate_expired

Migrates alert_tls_unsafe_ciphers

Migrates alert_tls_certificate_selfsigned

Migrates alert_potentially_dangerous_protocol

Migrates alert_snmp_device_reset

Migrates alert_port_mac_changed

Migrates alert_port_duplexstatus_change

Mirgates alert_port_errors

Migrates alert_port_status_change

Migrates alert_port_load_threshold_exceeded

Migrates alert_data_exfiltration

Migrates alert_dns_data_exfiltration

Migrates alert_suspicious_tcp_probing alert_suspicious_tcp_syn_probing alert_tcp_connection_refused

Migrates alert_dns_invalid_query

Migrates alert_attack_mitigation_via_snmp

Migrates alert_lateral_movement

Migrates alert_periodicity_update

Migrates alert_dns_positive_error_ratio

Migrates alert_iec104_error

scripts/lua/modules/alert_definitions/alert_tls_certificate_selfsigned.lua

@@ -0,0 +1,63 @@
+--
+-- (C) 2019-20 - ntop.org
+--
+
+-- ##############################################
+
+local alert_keys = require "alert_keys"
+local status_keys = require "flow_keys"
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_tls_certificate_selfsigned = classes.class(alert)
+
+-- ##############################################
+
+alert_tls_certificate_selfsigned.meta = {
+   status_key = status_keys.ntopng.status_tls_certificate_selfsigned,
+   alert_key = alert_keys.ntopng.alert_tls_certificate_selfsigned,
+   i18n_title = "flow_details.tls_certificate_selfsigned",
+   icon = "fas fa-exclamation",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @param tls_info A lua table with TLS info gererated calling `flow.getTLSInfo()`
+-- @return A table with the alert built
+function alert_tls_certificate_selfsigned:init(tls_info)
+   -- Call the parent constructor
+   self.super:init()
+
+   tls_info = tls_info or {}
+
+   self.alert_type_params = {
+      ["tls_crt.issuerDN"]  = tls_info["protos.tls.issuerDN"] or "",
+   }
+end
+
+-- #######################################################
+
+-- @brief Format an alert into a human-readable string
+-- @param ifid The integer interface id of the generated alert
+-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
+-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
+-- @return A human-readable string
+function alert_tls_certificate_selfsigned.format(ifid, alert, alert_type_params)
+   if not alert_type_params then
+      return i18n("flow_details.tls_certificate_selfsigned")
+   end
+
+   local crts = {}
+   crts[#crts + 1] = alert_type_params["tls_crt.issuerDN"]
+
+   return string.format("%s [Issuer/Subject: %s]", i18n("flow_details.tls_certificate_selfsigned"), table.concat(crts, " - "))
+end
+
+-- #######################################################
+
+return alert_tls_certificate_selfsigned