vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-01 08:29:36 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Possible fix for dga domain alert description (#8325)

Browse source
This commit is contained in:
Matteo Biscosi 2024-05-08 12:28:13 -04:00
parent 44196a5d63
commit 9b8695eb05
1 changed files with 1 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

32
scripts/lua/modules/alert_definitions/flow/alert_ndpi_suspicious_dga_domain.lua
View file

@ -39,37 +39,7 @@ end
-- #######################################################
function alert_ndpi_suspicious_dga_domain.format(ifid, alert, alert_type_params)
local domain = alert_type_params.dga_domain
local href = ''
local info = ''
if not isEmptyString(domain) then
-- URL check
local url = alert_type_params.dga_domain
if string.find(url, 'https') then
url = url:gsub('://', '')
url = url:gsub('https', '')
end
local proto = string.lower(interface.getnDPIProtoName(tonumber(alert["l7_master_proto"])))
proto = ternary(((proto) and (proto == 'http')), 'http', 'https')
href = url
end
if alert_type_params.proto and alert_type_params.proto.http then
return i18n("alert_messages.suspicious_dga_domain_http", {
domain = domain,
href = href,
info = info
})
else
return i18n("alert_messages.suspicious_dga_domain_other", {
domain = domain,
href = href,
info = info
})
end
return
end
-- #######################################################