vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-03 09:20:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Added host category to flow and host alerts (#4767)

Browse source 
* Fixed shell endpoint bug and added notice when executing the script

* Added victim and attacker to security plugins

* Updated hosts alert with host_category info

* Added host category to hosts alert description

* Added host category to flows

Co-authored-by: matteo <biscosi@ntop.org>
This commit is contained in:
Matteo Biscosi 2020-11-20 19:14:07 +01:00 • committed by GitHub
parent ca19885d71
commit 507583db64
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
21 changed files with 128 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/plugins/alerts/security/device_application_not_allowed/user_scripts/flow/device_protocol_not_allowed.lua
View file

@ -30,7 +30,8 @@ function script.hooks.protocolDetected(now)
if(flow.isDeviceProtocolNotAllowed()) then
local proto_info = flow.getDeviceProtoAllowedInfo()
local flow_score = 80
local cli_score, srv_score
local cli_score, srv_score, attacker, victim
local flow_info = flow.getInfo()
local alert_info = {
["cli.devtype"] = proto_info["cli.devtype"],
@ -42,18 +43,24 @@ function script.hooks.protocolDetected(now)
alert_info["devproto_forbidden_id"] = proto_info["cli.disallowed_proto"]
cli_score = 80
srv_score = 5
attacker = flow_info.cli.ip
victim = flow_info.srv.ip
else
alert_info["devproto_forbidden_peer"] = "srv"
alert_info["devproto_forbidden_id"] = proto_info["srv.disallowed_proto"]
cli_score = 5
srv_score = 80
attacker = flow_info.srv.ip
victim = flow_info.cli.ip
end
local dev_proto_not_allowed_type = flow_consts.status_types.status_device_protocol_not_allowed.create(
alert_info["cli.devtype"],
alert_info["srv.devtype"],
alert_info["devproto_forbidden_peer"],
alert_info["devproto_forbidden_id"]
alert_info["devproto_forbidden_id"],
attacker,
victim
)
alerts_api.trigger_status(dev_proto_not_allowed_type, alert_consts.alert_severities.error, cli_score, srv_score, flow_score)