vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-04-29 23:49:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix elephant flows description. Print exceeding threshold only. #9075

Browse source
This commit is contained in:
Alfredo Cardigliano 2025-04-14 14:36:49 +02:00
parent 1bd1568240
commit 8e9532680d
2 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/lua/modules/alert_definitions/flow/alert_elephant_flow.lua
View file

@ -15,6 +15,7 @@ local alert = require "alert"
local json = require "dkjson"
-- Import Mitre Att&ck utils
local mitre = require "mitre_utils"
local format_utils = require "format_utils"
-- ##############################################
@ -59,27 +60,26 @@ function alert_elephant_flow.format(ifid, alert, alert_type_params)
local res = ""
if alert_type_params and (alert_type_params["l2r_bytes"] or alert_type_params["r2l_bytes"]) then
local l2r_bytes = bytesToSize(alert_type_params["l2r_bytes"])
local r2l_bytes = bytesToSize(alert_type_params["r2l_bytes"])
res = string.format("%s<sup><i class='fas fa-info-circle' aria-hidden='true' title='"..i18n("flow_details.elephant_flow_descr").."'></i></sup>", res)
if alert_type_params["l2r_bytes"] and
alert_type_params["l2r_threshold"] and
alert_type_params["l2r_threshold"] > 0 and
alert_type_params["l2r_bytes"] > alert_type_params["l2r_threshold"] then
local l2r_bytes = bytesToSize(alert_type_params["l2r_bytes"])
local l2r_threshold = bytesToSize(alert_type_params["l2r_threshold"])
l2r_bytes = l2r_bytes .." > "..l2r_threshold
res = res .. " " .. i18n("flow_details.elephant_exceeded_l2r", {value = l2r_bytes, threshold = l2r_threshold})
end
if alert_type_params["r2l_bytes"] and
alert_type_params["r2l_threshold"] and
alert_type_params["l2r_threshold"] > 0 and
alert_type_params["r2l_bytes"] > alert_type_params["r2l_threshold"] then
local r2l_bytes = bytesToSize(alert_type_params["r2l_bytes"])
local r2l_threshold = bytesToSize(alert_type_params["r2l_threshold"])
r2l_bytes = r2l_bytes .. " > "..r2l_threshold
res = res .. " " .. i18n("flow_details.elephant_exceeded_r2l", {value = r2l_bytes, threshold = r2l_threshold})
end
res = string.format("%s<sup><i class='fas fa-info-circle' aria-hidden='true' title='"..i18n("flow_details.elephant_flow_descr").."'></i></sup>", res)
res = string.format("%s %s", res, i18n("flow_details.elephant_exceeded", {l2r = l2r_bytes, r2l = r2l_bytes}))
end
if alert["json"] then