vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-01 00:19:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Set flow l7 proto when collecting flows from suricata

Browse source
This commit is contained in:
Alfredo Cardigliano 2024-11-06 12:06:55 +01:00
parent 10f2fe880f
commit 3d87347f4c
2 changed files with 23 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
scripts/lua/modules/check_definitions/syslog/suricata.lua
View file

@ -81,6 +81,23 @@ end
-- #################################################################
local function parsenDPIMetadata(event_ndpi, flow)
-- Read nDPI metadata coming from the ndpi plugin in Suricata
if event_ndpi.proto_id then
local parts = string.split(event_ndpi.proto_id, "%.")
if parts and #parts > 1 then
flow.master_protocol = tonumber(parts[1])
flow.app_protocol = tonumber(parts[2])
else
flow.app_protocol = tonumber(event_ndpi.proto_id)
end
end
end
-- #################################################################
local function parseNetflowMetadata(event_flow, flow)
flow.first_switched_iso8601 = event_flow.start
flow.last_switched_iso8601 = event_flow['end']
@ -193,6 +210,10 @@ function syslog_module.hooks.handleEvent(syslog_conf, message, host, priority)
flow.SURICATA_APP_PROTO = event.app_proto
flow.COMMUNITY_ID = event.community_id
if event.ndpi then
parsenDPIMetadata(event.ndpi, flow)
end
if event.event_type == "alert" then
if event.flow ~= nil then