vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-05 19:04:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Revert "Migrates alerts to an object-oriented implementation"

Browse source 
This reverts commit fbc283f12f.
This commit is contained in:
matteo 2020-12-22 13:13:57 +01:00
parent fbc283f12f
commit e24ef4ef35
108 changed files with 1741 additions and 2797 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/plugins/alerts/security/flow_risks/modules/ndpi_binary_application_transfer_handler.lua
View file

@ -5,7 +5,6 @@
local alerts_api = require "alerts_api"
local flow_consts = require("flow_consts")
local alert_severities = require "alert_severities"
local alert_consts = require("alert_consts")
-- #################################################################
@ -22,13 +21,11 @@ function handler.handle_risk(risk_id, flow_score, cli_score, srv_score)
local url = http_info["protos.http.last_url"] or ""
-- Set flow status and trigger an alert when a suspicious file transfer is detected
local alert = alert_consts.alert_types.alert_suspicious_file_transfer.new(
local suspicious_file_transfer_type = flow_consts.status_types.status_suspicious_file_transfer.create(
http_info
)
alert:set_severity(alert_severities.error)
alert:trigger_status(cli_score or 0, srv_score or 0, flow_score or 0)
alerts_api.trigger_status(suspicious_file_transfer_type, alert_severities.error, cli_score or 0, srv_score or 0, flow_score or 0)
end

11
scripts/plugins/alerts/security/flow_risks/modules/ndpi_known_protocol_on_non_standard_port_handler.lua
View file

@ -5,7 +5,6 @@
local alerts_api = require "alerts_api"
local flow_consts = require("flow_consts")
local alert_severities = require "alert_severities"
local alert_consts = require("alert_consts")
-- #################################################################
@ -17,14 +16,12 @@ local handler = {}
function handler.handle_risk(risk_id, flow_score, cli_score, srv_score)
-- NDPI_KNOWN_PROTOCOL_ON_NON_STANDARD_PORT
-- Set the flow status and trigger an alert when a known protocol is found to use a non-standard port
local alert = alert_consts.alert_types.alert_known_proto_on_non_std_port.new(
-- Set the flow status and trigger an alert when a known protocol is found to use a non-standard port
local known_proto_on_non_std_port_type = flow_consts.status_types.status_known_proto_on_non_std_port.create(
flow.getInfo()
)
alert:set_severity(alert_severities.info)
alert:trigger_status(cli_score or 0, srv_score or 0, flow_score or 0)
alerts_api.trigger_status(known_proto_on_non_std_port_type, alert_severities.info, cli_score or 0, srv_score or 0, flow_score or 0)
end

8
scripts/plugins/alerts/security/flow_risks/modules/risk_handler.lua
View file

@ -5,7 +5,6 @@
local alerts_api = require "alerts_api"
local flow_consts = require("flow_consts")
local alert_severities = require "alert_severities"
local alert_consts = require("alert_consts")
-- #################################################################
@ -24,13 +23,12 @@ local handler = {}
function handler.handle_risk(risk_id, flow_score, cli_score, srv_score)
-- Set a flow status for the generic flow_risk. This will also
-- cause an alert to be generated.
local alert = alert_consts.alert_types.alert_flow_risk.new(
local flow_risk_type = flow_consts.status_types.status_flow_risk.create(
risk_id
)
alerts_api.trigger_status(flow_risk_type, alert_severities.warning, cli_score or 0, srv_score or 0, flow_score or 0)
alert:set_severity(alert_severities.warning)
alert:trigger_status(cli_score or 0, srv_score or 0, flow_score or 0)
end
-- #################################################################