vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-04-29 23:49:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Implements risk-based filtering of flow alerts

Browse source
This commit is contained in:
Simone Mainardi 2021-02-16 15:25:20 +01:00
parent c8a7232ef9
commit f4dff6f2e7
8 changed files with 60 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

18
scripts/lua/modules/user_scripts.lua
View file

@ -141,6 +141,16 @@ local available_subdirs = {
-- Check for equality on either the master or application protocol
return flow.getProtocol() == tonumber(val)
end
},
flow_risk_bitmap = {
lint = http_lint.validateNumber,
match = function(context, val)
-- Convert the string-bitmap to a number
val = tonumber(val)
-- Check if there's at least one risk in common between val
-- and the actual flow bitmap of risks
return (val & flow.getRiskBitmap()) ~= 0
end
}
-- info = http_lint.validateUnquoted,
},
@ -1621,13 +1631,13 @@ function user_scripts.getFilterPreset(alert)
if not available_subdirs[subdir_id]["filter"] then
return ''
end
-- Checking if the script has default filter fields or not
-- if not, getting the default for the subdir
if script["filter"] and script["filter"]["default_fields"] then
filter_to_use = script["filter"]["default_fields"] or {}
else
filter_to_use = available_subdirs[subdir_id]["filter"]["default_fields"] or {}
filter_to_use = script["filter"]["default_fields"]
elseif available_subdirs[subdir_id]["filter"]["default_fields"] then
filter_to_use = available_subdirs[subdir_id]["filter"]["default_fields"]
end
local filter_table = {}