vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-01 00:19:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add syn-vs-rst and misbehaving-vs-total-flows alerts

Browse source
This commit is contained in:
emanuele-f 2019-08-27 16:32:47 +02:00
parent 606e681d8e
commit 3bf6ed1ecd
6 changed files with 204 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

34
scripts/lua/modules/alerts_api.lua
View file

@ -853,6 +853,40 @@ end
-- ##############################################
function alerts_api.anomalousTCPFlagsType(num_syn, num_rst, ratio, is_sent, granularity)
return({
alert_type = alert_consts.alert_types.anomalous_tcp_flags,
alert_subtype = ternary(is_sent, "sent", "rcvd"),
alert_granularity = alert_consts.alerts_granularities[granularity],
alert_severity = alert_consts.alert_severities.warning,
alert_type_params = {
num_syn = num_syn,
num_rst = num_rst,
is_sent = is_sent,
ratio = ratio,
}
})
end
-- ##############################################
function alerts_api.misbehavingFlowsRatioType(misbehaving_flows, total_flows, ratio, is_sent, granularity)
return({
alert_type = alert_consts.alert_types.misbehaving_flows_ratio,
alert_subtype = ternary(is_sent, "sent", "rcvd"),
alert_granularity = alert_consts.alerts_granularities[granularity],
alert_severity = alert_consts.alert_severities.warning,
alert_type_params = {
misbehaving_flows = misbehaving_flows,
total_flows = total_flows,
is_sent = is_sent,
ratio = ratio,
}
})
end
-- ##############################################
function alerts_api.load_check_modules(subdir, str_granularity)
local checks_dir = os_utils.fixPath(ALERT_CHECKS_MODULES_BASEDIR .. "/" .. subdir)
local available_modules = {}