vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-04-29 15:39:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Implements builders for each flow status definition

Browse source 
[FlowsK] alert_blacklisted_country.lua

[FlowsK] alert_flow_blacklisted.lua

[FlowsK] alert_device_protocol_not_allowed.lua

[FlowsK] external_alert.lua

[FlowsK] alert_potentially_dangerous_protocol.lua

[FlowsK] tls_certificate_mismatch.lua

[FlowsK] tls_certificate_expired.lua

[FlowsK] tls_malicious_signature.lua

[FlowsK] elephant_flows.lua

[FlowsK] not_purged.lua

[FlowsK] web_mining.lua

[FlowsK] potentially_dangerous.lua

[FlowsK] alert_flow_blocked.lua
This commit is contained in:
Simone Mainardi 2020-04-27 12:42:26 +02:00
parent f323aa741c
commit ab1690ad9e
18 changed files with 258 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

20
scripts/lua/modules/alert_definitions/alert_flow_misbehaviour.lua
View file

@ -4,8 +4,28 @@
local alert_keys = require "alert_keys"
-- #######################################################
-- @brief Prepare an alert table used to generate the alert
-- @param alert_severity A severity as defined in `alert_consts.alert_severities`
-- @param l2r_threshold Local-to-Remote threshold, in bytes, for a flow to be considered an elephant
-- @param r2l_threshold Remote-to-Local threshold, in bytes, for a flow to be considered an elephant
-- @return A table with the alert built
local function buildFlowMisbehaviour(alert_severity, l2r_threshold, r2l_threshold)
local built = {
alert_severity = alert_severity,
["elephant.l2r_threshold"] = l2r_threshold,
["elephant.r2l_threshold"] = r2l_threshold,
}
return built
end
-- #######################################################
return {
alert_key = alert_keys.ntopng.alert_flow_misbehaviour,
i18n_title = "alerts_dashboard.flow_misbehaviour",
icon = "fas fa-exclamation",
builder = buildFlowMisbehaviour,
}