Updated ndpi alerts (#7200)

scripts/lua/modules/alert_definitions/flow/alert_malicious_signature.lua

@@ -1,52 +0,0 @@
---
--- (C) 2019-22 - ntop.org
---
-
--- ##############################################
-
-local flow_alert_keys = require "flow_alert_keys"
--- Import the classes library.
-local classes = require "classes"
--- Make sure to import the Superclass!
-local alert = require "alert"
-
--- ##############################################
-
-local alert_malicious_signature = classes.class(alert)
-
--- ##############################################
-
-alert_malicious_signature.meta = {
-   alert_key = flow_alert_keys.flow_alert_malicious_signature,
-   i18n_title = "flow_risk.malicious_signature_detected",
-   icon = "fas fa-fw fa-ban",
-
-   has_victim = true,
-   has_attacker = true,
-}
-
--- ##############################################
-
--- @brief Prepare an alert table used to generate the alert
--- @return A table with the alert built
-function alert_malicious_signature:init()
-   -- Call the parent constructor
-   self.super:init()
-end
-
--- #######################################################
-
--- @brief Format an alert into a human-readable string
--- @param ifid The integer interface id of the generated alert
--- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
--- @param alert_type_params Table `alert_type_params` as built in the `:init` method
--- @return A human-readable string
-function alert_malicious_signature.format(ifid, alert, alert_type_params)
-   return(i18n("alerts_dashboard.malicious_signature_detected", {
-		  ja3_hash = alert_type_params["ja3_client_hash"]
-   }))
-end
-
--- #######################################################
-
-return alert_malicious_signature

scripts/lua/modules/alert_definitions/flow/alert_ndpi_desktop_or_file_sharing_session.lua

@@ -0,0 +1,38 @@
+--
+-- (C) 2019-22 - ntop.org
+--
+
+-- ##############################################
+
+local flow_alert_keys = require "flow_alert_keys"
+
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_ndpi_desktop_or_file_sharing_session = classes.class(alert)
+
+-- ##############################################
+
+alert_ndpi_desktop_or_file_sharing_session.meta = {
+  alert_key = flow_alert_keys.flow_alert_ndpi_desktop_or_file_sharing_session,
+  i18n_title = "flow_checks_config.desktop_or_file_sharing_session",
+  icon = "fas fa-fw fa-info-circle",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @return A table with the alert built
+function alert_ndpi_desktop_or_file_sharing_session:init()
+   -- Call the parent constructor
+   self.super:init()
+end
+
+-- #######################################################
+
+return alert_ndpi_desktop_or_file_sharing_session
+

scripts/lua/modules/alert_definitions/flow/alert_ndpi_http_obsolete_server.lua

@@ -0,0 +1,38 @@
+--
+-- (C) 2019-22 - ntop.org
+--
+
+-- ##############################################
+
+local flow_alert_keys = require "flow_alert_keys"
+
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_ndpi_http_obsolete_server = classes.class(alert)
+
+-- ##############################################
+
+alert_ndpi_http_obsolete_server.meta = {
+  alert_key = flow_alert_keys.flow_alert_ndpi_http_obsolete_server,
+  i18n_title = "flow_checks_config.http_obsolete_server",
+  icon = "fas fa-fw fa-info-circle",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @return A table with the alert built
+function alert_ndpi_http_obsolete_server:init()
+   -- Call the parent constructor
+   self.super:init()
+end
+
+-- #######################################################
+
+return alert_ndpi_http_obsolete_server
+

scripts/lua/modules/alert_definitions/flow/alert_ndpi_malicious_ja3.lua

@@ -0,0 +1,38 @@
+--
+-- (C) 2019-22 - ntop.org
+--
+
+-- ##############################################
+
+local flow_alert_keys = require "flow_alert_keys"
+
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_ndpi_malicious_ja3 = classes.class(alert)
+
+-- ##############################################
+
+alert_ndpi_malicious_ja3.meta = {
+  alert_key = flow_alert_keys.flow_alert_ndpi_malicious_ja3,
+  i18n_title = "flow_checks_config.malicious_ja3",
+  icon = "fas fa-fw fa-info-circle",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @return A table with the alert built
+function alert_ndpi_malicious_ja3:init()
+   -- Call the parent constructor
+   self.super:init()
+end
+
+-- #######################################################
+
+return alert_ndpi_malicious_ja3
+

scripts/lua/modules/alert_definitions/flow/alert_ndpi_malicious_sha1_certificate.lua

@@ -0,0 +1,38 @@
+--
+-- (C) 2019-22 - ntop.org
+--
+
+-- ##############################################
+
+local flow_alert_keys = require "flow_alert_keys"
+
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_ndpi_malicious_sha1_certificate = classes.class(alert)
+
+-- ##############################################
+
+alert_ndpi_malicious_sha1_certificate.meta = {
+  alert_key = flow_alert_keys.flow_alert_ndpi_malicious_sha1_certificate,
+  i18n_title = "flow_checks_config.malicious_sha1_certificate",
+  icon = "fas fa-fw fa-info-circle",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @return A table with the alert built
+function alert_ndpi_malicious_sha1_certificate:init()
+   -- Call the parent constructor
+   self.super:init()
+end
+
+-- #######################################################
+
+return alert_ndpi_malicious_sha1_certificate
+

scripts/lua/modules/alert_definitions/flow/alert_ndpi_periodic_flow.lua

@@ -0,0 +1,38 @@
+--
+-- (C) 2019-22 - ntop.org
+--
+
+-- ##############################################
+
+local flow_alert_keys = require "flow_alert_keys"
+
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_ndpi_periodic_flow = classes.class(alert)
+
+-- ##############################################
+
+alert_ndpi_periodic_flow.meta = {
+  alert_key = flow_alert_keys.flow_alert_ndpi_periodic_flow,
+  i18n_title = "flow_checks_config.ndpi_periodic_flow",
+  icon = "fas fa-fw fa-info-circle",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @return A table with the alert built
+function alert_ndpi_periodic_flow:init()
+   -- Call the parent constructor
+   self.super:init()
+end
+
+-- #######################################################
+
+return alert_ndpi_periodic_flow
+

scripts/lua/modules/alert_definitions/flow/alert_ndpi_tls_fatal_alert.lua

@@ -0,0 +1,38 @@
+--
+-- (C) 2019-22 - ntop.org
+--
+
+-- ##############################################
+
+local flow_alert_keys = require "flow_alert_keys"
+
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_ndpi_tls_fatal_alert = classes.class(alert)
+
+-- ##############################################
+
+alert_ndpi_tls_fatal_alert.meta = {
+  alert_key = flow_alert_keys.flow_alert_ndpi_tls_fatal_alert,
+  i18n_title = "flow_checks_config.tls_fatal_alert",
+  icon = "fas fa-fw fa-info-circle",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @return A table with the alert built
+function alert_ndpi_tls_fatal_alert:init()
+   -- Call the parent constructor
+   self.super:init()
+end
+
+-- #######################################################
+
+return alert_ndpi_tls_fatal_alert
+

scripts/lua/modules/alert_definitions/flow/alert_ndpi_tls_old_protocol_version.lua

@@ -12,12 +12,12 @@ local alert = require "alert"
 
 -- ##############################################
 
-local alert_tls_old_protocol_version = classes.class(alert)
+local alert_ndpi_tls_old_protocol_version = classes.class(alert)
 
 -- ##############################################
 
-alert_tls_old_protocol_version.meta = {
-   alert_key = flow_alert_keys.flow_alert_tls_old_protocol_version,
+alert_ndpi_tls_old_protocol_version.meta = {
+   alert_key = flow_alert_keys.flow_alert_ndpi_tls_old_protocol_version,
    i18n_title = "flow_details.tls_old_protocol_version",
    icon = "fas fa-fw fa-exclamation",
 }
@@ -27,7 +27,7 @@ alert_tls_old_protocol_version.meta = {
 -- @brief Prepare an alert table used to generate the alert
 -- @param tls_version A number indicating the TLS version detected, or nil when version is not available
 -- @return A table with the alert built
-function alert_tls_old_protocol_version:init()
+function alert_ndpi_tls_old_protocol_version:init()
    -- Call the parent constructor
    self.super:init()
 end
@@ -39,7 +39,7 @@ end
 -- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
 -- @param alert_type_params Table `alert_type_params` as built in the `:init` method
 -- @return A human-readable string
-function alert_tls_old_protocol_version.format(ifid, alert, alert_type_params)
+function alert_ndpi_tls_old_protocol_version.format(ifid, alert, alert_type_params)
    local msg = ""
 
    if(alert_type_params and alert_type_params.tls_version) then
@@ -60,4 +60,4 @@ end
 
 -- #######################################################
 
-return alert_tls_old_protocol_version
+return alert_ndpi_tls_old_protocol_version

scripts/lua/modules/alert_definitions/flow/alert_ndpi_tls_suspicious_extension.lua

@@ -0,0 +1,38 @@
+--
+-- (C) 2019-22 - ntop.org
+--
+
+-- ##############################################
+
+local flow_alert_keys = require "flow_alert_keys"
+
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_ndpi_tls_suspicious_extension = classes.class(alert)
+
+-- ##############################################
+
+alert_ndpi_tls_suspicious_extension.meta = {
+  alert_key = flow_alert_keys.flow_alert_ndpi_tls_suspicious_extension,
+  i18n_title = "flow_checks_config.tls_suspicious_extension",
+  icon = "fas fa-fw fa-info-circle",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @return A table with the alert built
+function alert_ndpi_tls_suspicious_extension:init()
+   -- Call the parent constructor
+   self.super:init()
+end
+
+-- #######################################################
+
+return alert_ndpi_tls_suspicious_extension
+

scripts/lua/modules/alert_definitions/flow/alert_ndpi_tls_uncommon_alpn.lua

@@ -0,0 +1,38 @@
+--
+-- (C) 2019-22 - ntop.org
+--
+
+-- ##############################################
+
+local flow_alert_keys = require "flow_alert_keys"
+
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_ndpi_tls_uncommon_alpn = classes.class(alert)
+
+-- ##############################################
+
+alert_ndpi_tls_uncommon_alpn.meta = {
+  alert_key = flow_alert_keys.flow_alert_ndpi_tls_uncommon_alpn,
+  i18n_title = "flow_checks_config.tls_uncommon_alpn",
+  icon = "fas fa-fw fa-info-circle",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @return A table with the alert built
+function alert_ndpi_tls_uncommon_alpn:init()
+   -- Call the parent constructor
+   self.super:init()
+end
+
+-- #######################################################
+
+return alert_ndpi_tls_uncommon_alpn
+