mirror of
https://github.com/ntop/ntopng.git
synced 2026-04-29 23:49:33 +00:00
Implemented Scan Realtime Alert (#9106)
* Implemented Scan Realtime Alert * Removed old scan alerts
This commit is contained in:
Manuel Ceroni
GitHub
parent
7a27942b9f
commit
e1328ae36b
29 changed files with 211 additions and 1176 deletions
|
|
@ -1,5 +1,5 @@
|
|||
--
|
||||
-- (C) 2019-24 - ntop.org
|
||||
-- (C) 2019-25 - ntop.org
|
||||
--
|
||||
|
||||
-- ##############################################
|
||||
|
|
@ -8,59 +8,46 @@ local host_alert_keys = require "host_alert_keys"
|
|||
|
||||
local json = require("dkjson")
|
||||
local alert_creators = require "alert_creators"
|
||||
-- Import the classes library.
|
||||
local classes = require "classes"
|
||||
-- Make sure to import the Superclass!
|
||||
local alert = require "alert"
|
||||
-- Import Mitre Att&ck utils
|
||||
local mitre = require "mitre_utils"
|
||||
|
||||
-- ##############################################
|
||||
|
||||
local host_alert_scan_detected = classes.class(alert)
|
||||
local host_alert_scan_realtime = classes.class(alert)
|
||||
|
||||
-- ##############################################
|
||||
|
||||
host_alert_scan_detected.meta = {
|
||||
alert_key = host_alert_keys.host_alert_scan_detected, -- host_alert_keys.lua
|
||||
i18n_title = "alerts_dashboard.scan_detected",
|
||||
icon = "fas fa-fw fa-life-ring",
|
||||
has_attacker = true,
|
||||
host_alert_scan_realtime.meta = {
|
||||
alert_key = host_alert_keys.host_alert_scan_realtime,
|
||||
i18n_title = "alerts_dashboard.scan_realtime",
|
||||
icon = "fas fa-exclamation-triangle",
|
||||
|
||||
-- Mitre Att&ck Matrix values
|
||||
mitre_values = {
|
||||
mitre_tactic = mitre.tactic.reconnaissance,
|
||||
mitre_technique = mitre.technique.active_scanning,
|
||||
mitre_id = "T1595"
|
||||
},
|
||||
-- Mitre Att&ck Matrix values
|
||||
mitre_values = {},
|
||||
has_attacker = true,
|
||||
}
|
||||
|
||||
-- ##############################################
|
||||
|
||||
function host_alert_scan_detected:init(metric, value, operator, threshold)
|
||||
-- Call the parent constructor
|
||||
self.super:init()
|
||||
|
||||
self.alert_type_params.value = value
|
||||
self.alert_type_params.operator = operator
|
||||
self.alert_type_params.threshold = threshold
|
||||
self.alert_type_params.metric = metric
|
||||
-- @brief Prepare an alert table used to generate the alert
|
||||
-- @return A table with the alert built
|
||||
function host_alert_scan_realtime:init(ifid, client, attack)
|
||||
self.super:init()
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
function host_alert_scan_detected.format(ifid, alert, alert_type_params)
|
||||
-- @brief Format an alert into a human-readable string
|
||||
-- @param ifid The integer interface id of the generated alert
|
||||
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
|
||||
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
|
||||
-- @return A human-readable string
|
||||
function host_alert_scan_realtime.format(ifid, alert, alert_type_params)
|
||||
local alert_consts = require("alert_consts")
|
||||
local entity = alert_consts.formatHostAlert(ifid, alert["ip"], alert["vlan_id"])
|
||||
|
||||
if (alert_type_params.is_rx_only) then
|
||||
return i18n("alert_messages.rx_scan_detected",{
|
||||
entity = entity,
|
||||
as_server = alert_type_params.as_server,
|
||||
num_server_ports = alert_type_params.num_server_ports,
|
||||
})
|
||||
else
|
||||
local i18n_key
|
||||
local i18n_key
|
||||
if alert_type_params.attack_type == 0 then
|
||||
local formatted_alert_type_params = alert_creators.createThresholdCross(
|
||||
alert_type_params.metric,
|
||||
alert_type_params.value,
|
||||
|
|
@ -72,25 +59,40 @@ function host_alert_scan_detected.format(ifid, alert, alert_type_params)
|
|||
value = string.format("%u", math.ceil(formatted_alert_type_params.value or 0)),
|
||||
threshold = formatted_alert_type_params.threshold or 0,
|
||||
})
|
||||
elseif alert_type_params.attack_type == 1 then
|
||||
return i18n("alert_messages.rx_scan_detected",{
|
||||
entity = entity,
|
||||
as_server = alert_type_params.as_server,
|
||||
num_server_ports = alert_type_params.num_server_ports,
|
||||
})
|
||||
else
|
||||
if alert_type_params.attack_type == 2 then
|
||||
if alert_type_params.is_attacker then
|
||||
i18n_key = "alert_messages.syn_scan_attacker"
|
||||
else
|
||||
i18n_key = "alert_messages.syn_scan_victim"
|
||||
end
|
||||
elseif alert_type_params.attack_type == 3 then
|
||||
if alert_type_params.is_attacker then
|
||||
i18n_key = "alert_messages.fin_scan_attacker"
|
||||
else
|
||||
i18n_key = "alert_messages.fin_scan_victim"
|
||||
end
|
||||
elseif alert_type_params.attack_type == 4 then
|
||||
if alert_type_params.is_attacker then
|
||||
i18n_key = "alert_messages.rst_scan_attacker"
|
||||
else
|
||||
i18n_key = "alert_messages.rst_scan_victim"
|
||||
end
|
||||
end
|
||||
return i18n(i18n_key, {
|
||||
entity = entity,
|
||||
value = string.format("%u", math.ceil(alert_type_params.value or 0)),
|
||||
threshold = alert_type_params.threshold or 0,
|
||||
})
|
||||
end
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
-- @brief Prepare a table containing a set of filters useful to query historical flows that contributed to the generation of this alert
|
||||
-- @param ifid The integer interface id of the generated alert
|
||||
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
|
||||
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
|
||||
-- @return A human-readable string
|
||||
function host_alert_scan_detected.filter_to_past_flows(ifid, alert, alert_type_params)
|
||||
local res = {}
|
||||
local host_key = hostinfo2hostkey({ip = alert["ip"], vlan = alert["vlan_id"]})
|
||||
|
||||
-- TODO
|
||||
|
||||
return res
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
return host_alert_scan_detected
|
||||
return host_alert_scan_realtime
|
||||
|
|
@ -1,95 +0,0 @@
|
|||
--
|
||||
-- (C) 2019-24 - ntop.org
|
||||
--
|
||||
|
||||
-- ##############################################
|
||||
|
||||
local host_alert_keys = require "host_alert_keys"
|
||||
|
||||
local json = require("dkjson")
|
||||
local alert_creators = require "alert_creators"
|
||||
-- Import the classes library.
|
||||
local classes = require "classes"
|
||||
-- Make sure to import the Superclass!
|
||||
local alert = require "alert"
|
||||
-- Import Mitre Att&ck utils
|
||||
local mitre = require "mitre_utils"
|
||||
|
||||
-- ##############################################
|
||||
|
||||
local host_alert_tcp_fin_scan = classes.class(alert)
|
||||
|
||||
-- ##############################################
|
||||
|
||||
host_alert_tcp_fin_scan.meta = {
|
||||
alert_key = host_alert_keys.host_alert_fin_scan,
|
||||
i18n_title = "alerts_dashboard.tcp_fin_scan",
|
||||
icon = "fas fa-fw fa-life-ring",
|
||||
has_attacker = true,
|
||||
|
||||
-- Mitre Att&ck Matrix values
|
||||
mitre_values = {
|
||||
mitre_tactic = mitre.tactic.reconnaissance,
|
||||
mitre_technique = mitre.technique.active_scanning,
|
||||
mitre_id = "T1595"
|
||||
},
|
||||
}
|
||||
|
||||
-- ##############################################
|
||||
|
||||
function host_alert_tcp_fin_scan:init(metric, value, operator, threshold)
|
||||
-- Call the parent constructor
|
||||
self.super:init()
|
||||
|
||||
self.alert_type_params = alert_creators.createThresholdCross(metric, value, operator, threshold)
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
function host_alert_tcp_fin_scan.format(ifid, alert, alert_type_params)
|
||||
local alert_consts = require("alert_consts")
|
||||
local entity = alert_consts.formatHostAlert(ifid, alert["ip"], alert["vlan_id"])
|
||||
local i18n_key
|
||||
|
||||
if alert_type_params.is_attacker then
|
||||
i18n_key = "alert_messages.fin_scan_attacker"
|
||||
else
|
||||
i18n_key = "alert_messages.fin_scan_victim"
|
||||
end
|
||||
|
||||
return i18n(i18n_key, {
|
||||
entity = entity,
|
||||
value = string.format("%u", math.ceil(alert_type_params.value or 0)),
|
||||
threshold = alert_type_params.threshold or 0,
|
||||
})
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
-- @brief Prepare a table containing a set of filters useful to query historical flows that contributed to the generation of this alert
|
||||
-- @param ifid The integer interface id of the generated alert
|
||||
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
|
||||
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
|
||||
-- @return A human-readable string
|
||||
function host_alert_tcp_fin_scan.filter_to_past_flows(ifid, alert, alert_type_params)
|
||||
local res = {}
|
||||
local host_key = hostinfo2hostkey({ip = alert["ip"], vlan = alert["vlan_id"]})
|
||||
|
||||
-- Filter by client or server, depending on whether this alert is as-client or as-server
|
||||
if alert["is_client"] == true or alert["is_client"] == "1" then
|
||||
res["cli_ip"] = host_key
|
||||
elseif alert["is_server"] == true or alert["is_server"] == "1" then
|
||||
res["srv_ip"] = host_key
|
||||
end
|
||||
|
||||
res["src2dst_tcp_flags"] = 0x01 -- Has fin
|
||||
res["dst2src_tcp_flags"] = -0x01 -- Does NOT have fin
|
||||
|
||||
res["l4proto"] = "TCP"
|
||||
|
||||
return res
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
return host_alert_tcp_fin_scan
|
||||
|
|
@ -1,94 +0,0 @@
|
|||
--
|
||||
-- (C) 2019-24 - ntop.org
|
||||
--
|
||||
|
||||
-- ##############################################
|
||||
|
||||
local host_alert_keys = require "host_alert_keys"
|
||||
|
||||
local alert_creators = require "alert_creators"
|
||||
-- Import the classes library.
|
||||
local classes = require "classes"
|
||||
-- Make sure to import the Superclass!
|
||||
local alert = require "alert"
|
||||
-- Import Mitre Att&ck utils
|
||||
local mitre = require "mitre_utils"
|
||||
|
||||
-- ##############################################
|
||||
|
||||
local host_alert_tcp_rst_scan = classes.class(alert)
|
||||
|
||||
-- ##############################################
|
||||
|
||||
host_alert_tcp_rst_scan.meta = {
|
||||
alert_key = host_alert_keys.host_alert_rst_scan,
|
||||
i18n_title = "alerts_dashboard.tcp_rst_scan",
|
||||
icon = "fas fa-fw fa-life-ring",
|
||||
has_attacker = true,
|
||||
|
||||
-- Mitre Att&ck Matrix values
|
||||
mitre_values = {
|
||||
mitre_tactic = mitre.tactic.reconnaissance,
|
||||
mitre_technique = mitre.technique.active_scanning,
|
||||
mitre_id = "T1595"
|
||||
},
|
||||
}
|
||||
|
||||
-- ##############################################
|
||||
|
||||
function host_alert_tcp_rst_scan:init(metric, value, operator, threshold)
|
||||
-- Call the parent constructor
|
||||
self.super:init()
|
||||
|
||||
self.alert_type_params = alert_creators.createThresholdCross(metric, value, operator, threshold)
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
function host_alert_tcp_rst_scan.format(ifid, alert, alert_type_params)
|
||||
local alert_consts = require("alert_consts")
|
||||
local entity = alert_consts.formatHostAlert(ifid, alert["ip"], alert["vlan_id"])
|
||||
local i18n_key
|
||||
|
||||
if alert_type_params.is_attacker then
|
||||
i18n_key = "alert_messages.rst_scan_attacker"
|
||||
else
|
||||
i18n_key = "alert_messages.rst_scan_victim"
|
||||
end
|
||||
|
||||
return i18n(i18n_key, {
|
||||
entity = entity,
|
||||
value = string.format("%u", math.ceil(alert_type_params.value or 0)),
|
||||
threshold = alert_type_params.threshold or 0,
|
||||
})
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
-- @brief Prepare a table containing a set of filters useful to query historical flows that contributed to the generation of this alert
|
||||
-- @param ifid The integer interface id of the generated alert
|
||||
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
|
||||
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
|
||||
-- @return A human-readable string
|
||||
function host_alert_tcp_rst_scan.filter_to_past_flows(ifid, alert, alert_type_params)
|
||||
local res = {}
|
||||
local host_key = hostinfo2hostkey({ip = alert["ip"], vlan = alert["vlan_id"]})
|
||||
|
||||
-- Filter by client or server, depending on whether this alert is as-client or as-server
|
||||
if alert["is_client"] == true or alert["is_client"] == "1" then
|
||||
res["cli_ip"] = host_key
|
||||
elseif alert["is_server"] == true or alert["is_server"] == "1" then
|
||||
res["srv_ip"] = host_key
|
||||
end
|
||||
|
||||
res["src2dst_tcp_flags"] = 0x01 -- Has rst
|
||||
res["dst2src_tcp_flags"] = -0x01 -- Does NOT have rst
|
||||
|
||||
res["l4proto"] = "TCP"
|
||||
|
||||
return res
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
return host_alert_tcp_rst_scan
|
||||
|
|
@ -1,95 +0,0 @@
|
|||
--
|
||||
-- (C) 2019-24 - ntop.org
|
||||
--
|
||||
|
||||
-- ##############################################
|
||||
|
||||
local host_alert_keys = require "host_alert_keys"
|
||||
|
||||
local json = require("dkjson")
|
||||
local alert_creators = require "alert_creators"
|
||||
-- Import the classes library.
|
||||
local classes = require "classes"
|
||||
-- Make sure to import the Superclass!
|
||||
local alert = require "alert"
|
||||
-- Import Mitre Att&ck utils
|
||||
local mitre = require "mitre_utils"
|
||||
|
||||
-- ##############################################
|
||||
|
||||
local host_alert_tcp_syn_scan = classes.class(alert)
|
||||
|
||||
-- ##############################################
|
||||
|
||||
host_alert_tcp_syn_scan.meta = {
|
||||
alert_key = host_alert_keys.host_alert_syn_scan,
|
||||
i18n_title = "alerts_dashboard.tcp_syn_scan",
|
||||
icon = "fas fa-fw fa-life-ring",
|
||||
has_attacker = true,
|
||||
|
||||
-- Mitre Att&ck Matrix values
|
||||
mitre_values = {
|
||||
mitre_tactic = mitre.tactic.reconnaissance,
|
||||
mitre_technique = mitre.technique.active_scanning,
|
||||
mitre_id = "T1595"
|
||||
},
|
||||
}
|
||||
|
||||
-- ##############################################
|
||||
|
||||
function host_alert_tcp_syn_scan:init(metric, value, operator, threshold)
|
||||
-- Call the parent constructor
|
||||
self.super:init()
|
||||
|
||||
self.alert_type_params = alert_creators.createThresholdCross(metric, value, operator, threshold)
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
function host_alert_tcp_syn_scan.format(ifid, alert, alert_type_params)
|
||||
local alert_consts = require("alert_consts")
|
||||
local entity = alert_consts.formatHostAlert(ifid, alert["ip"], alert["vlan_id"])
|
||||
local i18n_key
|
||||
|
||||
if alert_type_params.is_attacker then
|
||||
i18n_key = "alert_messages.syn_scan_attacker"
|
||||
else
|
||||
i18n_key = "alert_messages.syn_scan_victim"
|
||||
end
|
||||
|
||||
return i18n(i18n_key, {
|
||||
entity = entity,
|
||||
value = string.format("%u", math.ceil(alert_type_params.value or 0)),
|
||||
threshold = alert_type_params.threshold or 0,
|
||||
})
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
-- @brief Prepare a table containing a set of filters useful to query historical flows that contributed to the generation of this alert
|
||||
-- @param ifid The integer interface id of the generated alert
|
||||
-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
|
||||
-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
|
||||
-- @return A human-readable string
|
||||
function host_alert_tcp_syn_scan.filter_to_past_flows(ifid, alert, alert_type_params)
|
||||
local res = {}
|
||||
local host_key = hostinfo2hostkey({ip = alert["ip"], vlan = alert["vlan_id"]})
|
||||
|
||||
-- Filter by client or server, depending on whether this alert is as-client or as-server
|
||||
if alert["is_client"] == true or alert["is_client"] == "1" then
|
||||
res["cli_ip"] = host_key
|
||||
elseif alert["is_server"] == true or alert["is_server"] == "1" then
|
||||
res["srv_ip"] = host_key
|
||||
end
|
||||
|
||||
res["src2dst_tcp_flags"] = 0x02 -- Has SYN
|
||||
res["dst2src_tcp_flags"] = -0x02 -- Does NOT have SYN
|
||||
|
||||
res["l4proto"] = "TCP"
|
||||
|
||||
return res
|
||||
end
|
||||
|
||||
-- #######################################################
|
||||
|
||||
return host_alert_tcp_syn_scan
|
||||
Loading…
Add table
Add a link
Reference in a new issue