vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-01 00:19:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Implemented Scan Realtime Alert (#9106)

Browse source 
* Implemented Scan Realtime Alert

* Removed old scan alerts
This commit is contained in:
Manuel Ceroni 2025-04-04 12:42:46 +02:00 • committed by GitHub
parent 7a27942b9f
commit e1328ae36b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
29 changed files with 211 additions and 1176 deletions
Download patch file Download diff file Expand all files Collapse all files

45
scripts/lua/modules/check_definitions/host/fin_scan.lua
View file

@ -1,45 +0,0 @@
--
-- (C) 2019-24 - ntop.org
--
local checks = require("checks")
local alert_consts = require("alert_consts")
local host_alert_keys = require "host_alert_keys"
local fin_scan = {
-- Script category
category = checks.check_categories.network,
default_enabled = false,
alert_id = host_alert_keys.host_alert_fin_scan,
severity = alert_consts.get_printable_severities().error,
-- The default threshold value. The format is specific of the
-- "threshold_cross" input builder
default_value = {
operator = "gt",
threshold = 256,
},
-- Allow user script configuration from the GUI
gui = {
i18n_title = "alerts_dashboard.tcp_fin_scan",
i18n_description = "entity_thresholds.fin_scan_description",
-- The input builder to use to draw the gui
input_builder = "threshold_cross",
-- Specific parameters of this input builder
i18n_field_unit = checks.field_units.fin_min,
-- max allowed threshold value
field_max = 65535,
-- min allowed threshold value
field_min = 1,
-- threshold check operator. "gt" for ">", "lt" or "<"
field_operator = "gt";
}
}
-- #################################################################
return fin_scan

45
scripts/lua/modules/check_definitions/host/rst_scan.lua
View file

@ -1,45 +0,0 @@
--
-- (C) 2019-24 - ntop.org
--
local checks = require("checks")
local alert_consts = require("alert_consts")
local host_alert_keys = require "host_alert_keys"
local rst_scan = {
-- Script category
category = checks.check_categories.network,
default_enabled = false,
alert_id = host_alert_keys.host_alert_rst_scan,
severity = alert_consts.get_printable_severities().error,
-- The default threshold value. The format is specific of the
-- "threshold_cross" input builder
default_value = {
operator = "gt",
threshold = 256,
},
-- Allow user script configuration from the GUI
gui = {
i18n_title = "entity_thresholds.rst_scan_title",
i18n_description = "entity_thresholds.rst_scan_description",
-- The input builder to use to draw the gui
input_builder = "threshold_cross",
-- Specific parameters of this input builder
i18n_field_unit = checks.field_units.rst_min,
-- max allowed threshold value
field_max = 65535,
-- min allowed threshold value
field_min = 1,
-- threshold check operator. "gt" for ">", "lt" or "<"
field_operator = "gt";
}
}
-- #################################################################
return rst_scan

48
scripts/lua/modules/check_definitions/host/scan_detection.lua
View file

@ -1,48 +0,0 @@
--
-- (C) 2019-24 - ntop.org
--
local checks = require("checks")
local host_alert_keys = require "host_alert_keys"
local alert_consts = require("alert_consts")
local script = {
-- Script category
category = checks.check_categories.security,
-- This module is disabled by default
default_enabled = false,
alert_id = host_alert_keys.host_alert_scan_detected,
severity = alert_consts.get_printable_severities().error,
default_value = {
operator = "gt",
threshold = 32,
},
-- See below
hooks = {},
-- Allow user script configuration from the GUI
gui = {
i18n_title = "entity_thresholds.scan_detection_title",
i18n_description = "entity_thresholds.scan_detection_description",
-- The input builder to use to draw the gui
input_builder = "threshold_cross",
-- Specific parameters of this input builder
i18n_field_unit = checks.field_units.flows,
-- max allowed threshold value
field_max = 65535,
-- min allowed threshold value
field_min = 1,
-- threshold check operator. "gt" for ">", "lt" or "<"
field_operator = "gt";
}
}
-- #################################################################
return script

45
scripts/lua/modules/check_definitions/host/syn_scan.lua
View file

@ -1,45 +0,0 @@
--
-- (C) 2019-24 - ntop.org
--
local checks = require("checks")
local host_alert_keys = require "host_alert_keys"
local alert_consts = require("alert_consts")
local syn_scan = {
-- Script category
category = checks.check_categories.network,
severity = alert_consts.get_printable_severities().error,
default_enabled = false,
alert_id = host_alert_keys.host_alert_syn_scan,
-- The default threshold value. The format is specific of the
-- "threshold_cross" input builder
default_value = {
operator = "gt",
threshold = 256,
},
-- Allow user script configuration from the GUI
gui = {
i18n_title = "entity_thresholds.syn_scan_title",
i18n_description = "entity_thresholds.syn_scan_description",
-- The input builder to use to draw the gui
input_builder = "threshold_cross",
-- Specific parameters of this input builder
i18n_field_unit = checks.field_units.syn_min,
-- max allowed threshold value
field_max = 65535,
-- min allowed threshold value
field_min = 1,
-- threshold check operator. "gt" for ">", "lt" or "<"
field_operator = "gt";
}
}
-- #################################################################
return syn_scan