vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-04-29 23:49:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Added host category to flow and host alerts (#4767)

Browse source 
* Fixed shell endpoint bug and added notice when executing the script

* Added victim and attacker to security plugins

* Updated hosts alert with host_category info

* Added host category to hosts alert description

* Added host category to flows

Co-authored-by: matteo <biscosi@ntop.org>
This commit is contained in:
Matteo Biscosi 2020-11-20 19:14:07 +01:00 • committed by GitHub
parent ca19885d71
commit 507583db64
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
21 changed files with 128 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/lua/modules/alert_definitions/alert_tcp_syn_scan.lua
View file

@ -2,8 +2,12 @@
-- (C) 2019-20 - ntop.org
--
local json = require("dkjson")
local alert_keys = require "alert_keys"
local alert_creators = require "alert_creators"
local format_utils = require "format_utils"
-- ##############################################
local function formatSynScan(ifid, alert, threshold_info)
local alert_consts = require("alert_consts")
@ -12,12 +16,14 @@ local function formatSynScan(ifid, alert, threshold_info)
if(alert.alert_subtype == "syn_scan_attacker") then
return i18n("alert_messages.syn_scan_attacker", {
entity = firstToUpper(entity),
host_category = format_utils.formatAddressCategory((json.decode(alert.alert_json)).alert_generation.host_info),
value = string.format("%u", math.ceil(threshold_info.value)),
threshold = threshold_info.threshold,
})
else
return i18n("alert_messages.syn_scan_victim", {
entity = firstToUpper(entity),
host_category = format_utils.formatAddressCategory((json.decode(alert.alert_json)).alert_generation.host_info),
value = string.format("%u", math.ceil(threshold_info.value)),
threshold = threshold_info.threshold,
})