vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-02 00:40:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Reworked unexpected host behaviour alert

Browse source 
Implements #5128
This commit is contained in:
Matteo Biscosi 2021-03-24 15:37:44 +01:00
parent d1d203a479
commit 78aedbcebe
11 changed files with 293 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/plugins/alerts/security/unexpected_host_behaviour/modules/active_flows_behaviour.lua
View file

@ -2,6 +2,7 @@
-- (C) 2019-21 - ntop.org
--
require "lua_utils"
local alerts_api = require "alerts_api"
local alert_severities = require "alert_severities"
local alert_consts = require("alert_consts")
@ -15,8 +16,8 @@ local handler = {}
-- @brief See risk_handler.lua
function handler.handle_behaviour(params, stats, host_ip)
alerts_api.handlerPeerBehaviour(params, stats["as_client"], stats["tot_num_anomalies"], host_ip, "client" --[[ as client --]], nil, "Active Flows Behaviour as Client")
alerts_api.handlerPeerBehaviour(params, stats["as_server"], stats["tot_num_anomalies"], host_ip, "server" --[[ as server --]], nil, "Active Flows Behaviour as Server")
alerts_api.handlerPeerBehaviour(params, stats["as_client"], nil, host_ip, nil, alert_consts.alert_types.alert_active_flows_anomaly_client)
alerts_api.handlerPeerBehaviour(params, stats["as_server"], nil, host_ip, nil, alert_consts.alert_types.alert_active_flows_anomaly_server)
end
-- #################################################################

3
scripts/plugins/alerts/security/unexpected_host_behaviour/modules/contacted_hosts_behaviour.lua
View file

@ -2,6 +2,7 @@
-- (C) 2019-21 - ntop.org
--
require "lua_utils"
local alerts_api = require "alerts_api"
local alert_severities = require "alert_severities"
local alert_consts = require("alert_consts")
@ -15,7 +16,7 @@ local handler = {}
-- @brief See risk_handler.lua
function handler.handle_behaviour(params, stats, host_ip)
alerts_api.handlerPeerBehaviour(params, stats, nil, host_ip, nil --[[ as client --]], nil, "Contacts Behaviour")
alerts_api.handlerPeerBehaviour(params, stats, nil, host_ip, nil, alert_consts.alert_types.alert_contacts_anomaly)
end
-- #################################################################

5
scripts/plugins/alerts/security/unexpected_host_behaviour/modules/score_behaviour.lua
View file

@ -2,6 +2,7 @@
-- (C) 2019-21 - ntop.org
--
require "lua_utils"
local alerts_api = require "alerts_api"
local alert_severities = require "alert_severities"
local alert_consts = require("alert_consts")
@ -15,8 +16,8 @@ local handler = {}
-- @brief See risk_handler.lua
function handler.handle_behaviour(params, stats, host_ip)
alerts_api.handlerPeerBehaviour(params, stats["as_client"], stats["tot_num_anomalies"], host_ip, "client" --[[ as client --]], 5, "Score Behaviour as Client")
alerts_api.handlerPeerBehaviour(params, stats["as_server"], stats["tot_num_anomalies"], host_ip, "server" --[[ as server --]], 5, "Score Behaviour as Server")
alerts_api.handlerPeerBehaviour(params, stats["as_client"], stats["tot_num_anomalies"], host_ip, 10, alert_consts.alert_types.alert_score_anomaly_client)
alerts_api.handlerPeerBehaviour(params, stats["as_server"], stats["tot_num_anomalies"], host_ip, 10, alert_consts.alert_types.alert_score_anomaly_server)
end
-- #################################################################