diff --git a/scripts/locales/en.lua b/scripts/locales/en.lua
index adb49dec49..ad7ee2f417 100644
--- a/scripts/locales/en.lua
+++ b/scripts/locales/en.lua
@@ -469,8 +469,9 @@ local lang = {
["attack_mitigation_via_snmp_success"] = "Interface %{port} admin status on SNMP device %{device} set to %{admin_down}: %{granularity} %{metric} crossed by %{entity} [%{value} %{op} %{threshold}]",
["broadcast_domain_info"] = "It is unlikely to see ARP traffic between those IPs as they are seemingly belonging to different broadcast domains. Check for hosts and networks configurations.",
["broadcast_domain_too_large"] = "ARP traffic from %{src_mac}/%{spa} to %{dst_mac}/%{tpa} detected.",
- ["contacted_peers_as_cli"] = "Too many Peers contacted as client by %{host} %{numeric_ip} [%{value} > %{dyn_threshold}].",
- ["contacted_peers_as_srv"] = "Too many Peers contacted as server by %{host} %{numeric_ip} [%{value} > %{dyn_threshold}].",
+ ["contacted_peers"] = "Too many Peers contacted by %{host} %{host_category}. As a client: [%{value_cli} > %{dyn_threshold_cli}]. As a server: [%{value_srv} > %{dyn_threshold_srv}].",
+ ["contacted_peers_as_cli"] = "Too many Peers contacted as a client by %{host} %{host_category} [%{value_cli} > %{dyn_threshold_cli}].",
+ ["contacted_peers_as_srv"] = "Too many Peers contacted as a server by %{host} %{host_category} [%{value_srv} > %{dyn_threshold_srv}].",
["device_has_connected"] = "The device %{device} has connected to the network.",
["device_has_disconnected"] = "The device %{device} has disconnected from the network.",
["flow_flood_attacker"] = "%{entity}%{host_category} is a flow flooder [%{value} > %{threshold} flows sent]",
diff --git a/scripts/lua/modules/alert_definitions/alert_contacted_peers.lua b/scripts/lua/modules/alert_definitions/alert_contacted_peers.lua
index 8196fbabfa..0d70261dd6 100644
--- a/scripts/lua/modules/alert_definitions/alert_contacted_peers.lua
+++ b/scripts/lua/modules/alert_definitions/alert_contacted_peers.lua
@@ -10,6 +10,7 @@ local format_utils = require("format_utils")
local classes = require "classes"
-- Make sure to import the Superclass!
local alert = require "alert"
+local json = require ("dkjson")
-- ##############################################
@@ -25,44 +26,51 @@ alert_contacted_peers.meta = {
-- ##############################################
-function alert_contacted_peers:init(value, cli_or_srv, dyn_threshold, ip, host)
+function alert_contacted_peers:init(value_srv, value_cli, dyn_threshold_srv, dyn_threshold_cli)
-- Call the parent constructor
self.super:init()
self.alert_type_params = {
- value = value,
- cli_or_srv = cli_or_srv,
- dyn_threshold = dyn_threshold,
- ip = ip,
- host = host
+ value_cli = value_cli,
+ value_srv = value_srv,
+ dyn_threshold_cli = dyn_threshold_cli,
+ dyn_threshold_srv = dyn_threshold_srv
}
end
-- #######################################################
function alert_contacted_peers.format(ifid, alert, alert_type_params)
- local host = alert_type_params.host
- local numeric_ip = alert_type_params.ip
- local ip_label = host and host.label or numeric_ip
-
- if numeric_ip ~= host.host then
- numeric_ip = string.format("(%s)", numeric_ip)
- else
- numeric_ip = ""
- end
+ local alert_consts = require "alert_consts"
+ local host = firstToUpper(alert_consts.formatAlertEntity(ifid, alert_consts.alertEntityRaw(alert["alert_entity"]), alert["alert_entity_val"]))
+ local host_category = format_utils.formatAddressCategory((json.decode(alert.alert_json)).alert_generation.host_info)
+ local triggered_as_srv = false
+ local triggered_as_cli = false
local msg_params = {
- host = ip_label,
- numeric_ip = numeric_ip,
- dyn_threshold = alert_type_params.dyn_threshold,
- value = alert_type_params.value
+ host = host,
+ host_category = host_category
}
+
+ if alert_type_params.value_cli > 0 then
+ msg_params.value_cli = alert_type_params.value_cli
+ msg_params.dyn_threshold_cli = alert_type_params.dyn_threshold_cli
+ triggered_as_cli = true
+ end
- if alert_type_params.cli_or_srv == true then
- return (i18n("alert_messages.alert_contacted_peers_as_cli", msg_params))
- else
- return (i18n("alert_messages.alert_contacted_peers_as_srv", msg_params))
+ if alert_type_params.value_srv > 0 then
+ msg_params.value_srv = alert_type_params.value_srv
+ msg_params.dyn_threshold_srv = alert_type_params.dyn_threshold_srv
+ triggered_as_srv = true
end
+
+ if triggered_as_srv == true and triggered_as_cli == true then
+ return (i18n("alert_messages.contacted_peers", msg_params))
+ elseif triggered_as_srv == true then
+ return (i18n("alert_messages.contacted_peers_as_srv", msg_params))
+ else
+ return (i18n("alert_messages.contacted_peers_as_cli", msg_params))
+ end
end
-- #######################################################