vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-04-29 07:29:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[VS] Fix alert generation.

Browse source
This commit is contained in:
Nicolo Maio 2023-10-12 16:58:55 +02:00
parent 5e37771d8b
commit be6c2e0d4f
2 changed files with 22 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

24
scripts/lua/modules/alert_definitions/other/alert_vulnerability_scan.lua
View file

@ -54,17 +54,21 @@ function alert_vulnerability_scan.format(ifid, alert, alert_type_params)
end
--]]
if (alert_type_params.scan_type == "tcp_portscan" or alert_type_params.scan_type == "tcp_openports") then
msg = msg .. i18n('vulnerability_scan_alert_ports_changed_cases.'..alert_type_params.tcp_ports_case, {
open_ports_num = alert_type_params.tcp_open_ports.num,
open_ports = alert_type_params.tcp_open_ports.ports,
closed_ports_num = alert_type_params.tcp_closed_ports.num,
closed_ports = alert_type_params.tcp_closed_ports.ports,
protocol = i18n("tcp")
})
msg = msg:gsub("%,", ", ")
if (not isEmptyString(alert_type_params.tcp_ports_case)) then
msg = msg .. i18n('vulnerability_scan_alert_ports_changed_cases.'..alert_type_params.tcp_ports_case, {
open_ports_num = alert_type_params.tcp_open_ports.num,
open_ports = alert_type_params.tcp_open_ports.ports,
closed_ports_num = alert_type_params.tcp_closed_ports.num,
closed_ports = alert_type_params.tcp_closed_ports.ports,
protocol = i18n("tcp")
})
msg = msg:gsub("%,", ", ")
end
elseif (alert_type_params.scan_type == "udp_portscan") then
if (not isEmptyString(alert_type_params.udp_ports_case)) then
msg = msg .. i18n('vulnerability_scan_alert_ports_changed_cases.'..alert_type_params.udp_ports_case, {
open_ports_num = alert_type_params.udp_open_ports.num,
open_ports = alert_type_params.udp_open_ports.ports,
@ -76,6 +80,8 @@ function alert_vulnerability_scan.format(ifid, alert, alert_type_params)
end
end
if alert_type_params.num_new_cve_issues then
local new_cve = table.concat(alert_type_params.new_cve or {}, ", ")
if alert_type_params.num_new_cve_issues > 5 then