vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-05 19:15:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Set flow alert first seen

Browse source
This commit is contained in:
Alfredo Cardigliano 2022-01-18 15:35:21 +01:00
parent 17d756c622
commit d191d59d59
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/lua/modules/alert_store/flow_alert_store.lua
View file

@ -59,7 +59,7 @@ function flow_alert_store:insert(alert)
extra_values,
alert.alert_id,
self:_convert_ifid(interface.getId()),
alert.tstamp,
alert.first_seen,
alert.tstamp,
ntop.mapScoreToSeverity(alert.score),
alert.ip_version,
@ -369,7 +369,7 @@ function flow_alert_store:format_record(value, no_html)
if not no_html and alert_json then
local active_flow = interface.findFlowByKeyAndHashId(alert_json["ntopng.key"], alert_json["hash_entry_id"])
if active_flow and active_flow["seen.first"] < tonumber(value["tstamp"]) then
if active_flow and active_flow["seen.first"] < tonumber(value["tstamp_end"]) then
local href = string.format("%s/lua/flow_details.lua?flow_key=%u&flow_hash_id=%u",
ntop.getHttpPrefix(), active_flow["ntopng.key"], active_flow["hash_entry_id"])
active_url = href
@ -614,7 +614,7 @@ function flow_alert_store:format_record(value, no_html)
end
record['filter'] = {
epoch_begin = tonumber(value["tstamp"]) - 1,
epoch_begin = tonumber(value["tstamp"]),
epoch_end = tonumber(value["tstamp_end"]) + 1,
bpf = table.concat(rules, " and "),
}
@ -703,8 +703,8 @@ function flow_alert_store:get_alert_details(value)
details[#details + 1] = {
label = i18n("show_alerts.alert_datetime"),
content = fmt['tstamp']['label'],
}
}
details[#details + 1] = {
label = i18n("score"),
content = '<span style="color: ' .. fmt['score']['color'] .. '">' .. fmt['score']['label'] .. '</span>',