Add support for external (REST) host alerts (#7170)

scripts/lua/modules/alert_definitions/host/host_alert_external_script.lua

@@ -0,0 +1,79 @@
+--
+-- (C) 2019-23 - ntop.org
+--
+
+-- ##############################################
+
+local host_alert_keys = require "host_alert_keys"
+
+local json = require("dkjson")
+local alert_creators = require "alert_creators"
+
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local host_alert_external_script = classes.class(alert)
+
+-- ##############################################
+
+host_alert_external_script.meta = {
+  alert_key = host_alert_keys.host_alert_external_script,
+  i18n_title = "alerts_dashboard.external_script",
+  icon = "fas fa-fw fa-life-ring",
+  has_attacker = true,
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @param one_param The first alert param
+-- @param another_param The second alert param
+-- @return A table with the alert built
+function host_alert_external_script:init(metric, value, operator, threshold)
+   -- Call the parent constructor
+   self.super:init()
+
+   self.alert_type_params = alert_creators.createThresholdCross(metric, value, operator, threshold)
+end
+
+-- #######################################################
+
+-- @brief Format an alert into a human-readable string
+-- @param ifid The integer interface id of the generated alert
+-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
+-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
+-- @return A human-readable string
+function host_alert_external_script.format(ifid, alert, alert_type_params)
+  local alert_consts = require "alert_consts"
+
+  return i18n("alert_messages.external_script", { message = alert_type_params["message"] } )
+end
+
+-- #######################################################
+
+-- @brief Prepare a table containing a set of filters useful to query historical flows that contributed to the generation of this alert
+-- @param ifid The integer interface id of the generated alert
+-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
+-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
+-- @return A human-readable string
+function host_alert_external_script.filter_to_past_flows(ifid, alert, alert_type_params)
+   local res = {}
+   local host_key = hostinfo2hostkey({ip = alert["ip"], vlan = alert["vlan_id"]})
+
+   -- Filter by client or server, depending on whether this alert is as-client or as-server
+   if alert["is_client"] == true or alert["is_client"] == "1" then
+      res["cli_ip"] = host_key
+   elseif alert["is_server"] == true or alert["is_server"] == "1" then
+      res["srv_ip"] = host_key
+   end
+
+   return res
+end
+
+-- #######################################################
+
+return host_alert_external_script

scripts/lua/modules/alert_keys/host_alert_keys.lua

@@ -33,6 +33,7 @@ local host_alert_keys = {
   host_alert_custom_lua_script           = 24,
   host_alert_rst_scan                    = 25,
   host_alert_traffic_volume              = 26,
+  host_alert_external_script             = 27,
   
   -- NOTE: Keep in sync with HostAlertTypeEnum in ntop_typedefs.h
 }

scripts/lua/modules/check_definitions/host/external_host_script.lua

@@ -0,0 +1,30 @@
+--
+-- (C) 2019-23 - ntop.org
+--
+
+local checks = require("checks")
+local host_alert_keys = require "host_alert_keys"
+local alert_consts = require("alert_consts")
+
+-- #################################################################
+
+local p2p = {
+  -- Script category
+  category = checks.check_categories.network,
+  severity = alert_consts.get_printable_severities().error,
+
+  default_enabled = false,
+  alert_id = host_alert_keys.host_alert_external_script,
+
+  default_value = {
+  },
+
+  gui = {
+     i18n_title = "alerts_thresholds_config.external_host_script_title",
+     i18n_description = "alerts_thresholds_config.external_host_script_description",
+  },
+}
+
+-- #################################################################
+
+return p2p

scripts/lua/rest/v2/trigger/host/alert.lua

@@ -0,0 +1,52 @@
+--
+-- (C) 2013-21 - ntop.org
+--
+
+local dirs = ntop.getDirs()
+package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path
+package.path = dirs.installdir .. "/scripts/lua/modules/alert_store/?.lua;" .. package.path
+
+require "lua_utils"
+local auth = require "auth"
+local rest_utils = require "rest_utils"
+local all_alert_store = require "all_alert_store".new()
+
+--
+-- Trigger a custom host alert
+-- Example: curl -u admin:admin -H "Content-Type: application/json" -d '{"ifid": 0, "host": "192.168.2.134", "vlan": 0, "score": 100, "info": "Custom alert triggered thrugh the REST API"}' http://localhost:3000/lua/rest/v2/trigger/host/alert.lua
+--
+-- NOTE: in case of invalid login, no error is returned but redirected to login
+--
+
+local rc = rest_utils.consts.success.ok
+
+local ifid = _POST["ifid"]
+local hostinfo = url2hostinfo(_POST)
+local score = _POST["score"] or "0"
+local info = _POST["info"]
+
+if not auth.has_capability(auth.capabilities.alerts) then
+   rest_utils.answer(rest_utils.consts.err.not_granted)
+   return
+end
+
+if isEmptyString(ifid) then
+   rc = rest_utils.consts.err.invalid_interface
+   rest_utils.answer(rc)
+   return
+end
+
+if isEmptyString(hostinfo['host']) or
+   isEmptyString(info) then
+   rc = rest_utils.consts.err.invalid_args
+   rest_utils.answer(rc)
+   return
+end
+
+interface.select(ifid)
+
+interface.triggerExternalHostAlert(hostinfo2hostkey(hostinfo), tonumber(score), info)
+
+local res = {}
+
+rest_utils.answer(rc, res)