831 commits

Author	SHA1	Message	Date
MatteoBiscosi	e6d50ceeb8	Added total flows and historical flow ref to obs points	2021-11-26 13:24:14 +01:00
MatteoBiscosi	39cfd02a51	Removed duplicated Observation Point code	2021-11-26 12:48:18 +01:00
MatteoBiscosi	82782332f7	Added Observation Point deserialization at startup	2021-11-25 21:34:11 +01:00
MatteoBiscosi	a4b8e712a0	Added Observation points stats and timeseries (#6085)	2021-11-19 16:30:11 +01:00
Luca Deri	fbe997a4d9	Added efficient ClickHouse data export	2021-11-11 17:53:13 +01:00
Luca Deri	f4c512d552	Code cleanup and stubs for supporting ClickHouse (via -F clickhouse)	2021-10-21 11:58:08 +02:00
Luca Deri	d91d69f2a7	Encapsulated traffic is accounted for the lenght of the encapsulated packet and not of the original packet	2021-10-11 21:42:02 +02:00
Luca Deri	aff1723fcb	Removes shared nDPI instance that leades to crashes when multiple interfaces are used	2021-10-07 10:50:26 +02:00
MatteoBiscosi	4e693dc9f1	Added probes filter to host page (#5157)	2021-09-30 12:15:25 +02:00
Luca	df906622eb	Typo	2021-09-30 12:01:05 +02:00
Simone Mainardi	a1b31b054e	Adds {periodicity,service} maps and alerts to nEdge ... Addresses #5917	2021-09-28 11:44:07 +02:00
Simone Mainardi	e9c26b79f8	Implements UI badges color-coded using engaged alert severities ... Addresses #5881	2021-09-24 17:25:34 +02:00
Simone Mainardi	3ab14250b8	Implements per-severity breakdown of engaged alerts in C++ ... Addresses the backend of #5881	2021-09-24 16:25:12 +02:00
MatteoBiscosi	6c4720e4fa	Reworked top sites and removed duplicated code	2021-08-23 17:03:30 +02:00
MatteoBiscosi	90c9e556af	Removed duplicated code	2021-08-20 16:39:54 +02:00
MatteoBiscosi	af26dbfa36	Fixes segv due to top sites corrupted pointer (#5772)	2021-08-20 10:54:35 +02:00
Simone Mainardi	d7edcfeaf2	Cleanup MDNS resolution ... Addresses #5730	2021-08-12 17:26:01 +02:00
Simone Mainardi	9cc80dfd78	Fixes to handle the learning status phase in map stats	2021-08-10 15:42:44 +02:00
Simone Mainardi	18ddef32ae	Implements limit switch for service and periodicity maps	2021-08-09 15:12:45 +02:00
Simone Mainardi	d0d8b49da2	Refactors periodicity map lua name	2021-08-09 14:58:11 +02:00
MatteoBiscosi	73be980960	Fixes lateral movement alert	2021-08-05 20:29:38 +02:00
Simone Mainardi	ab80e3b4ee	Allows service/periodicity maps search by MAC ... Addresses #5625	2021-07-27 17:31:17 +02:00
Simone Mainardi	1a552d24ec	Cleanup excessive traffic check (to be implemented as host check)	2021-07-27 11:39:40 +02:00
Simone Mainardi	6f79dc4341	Fixes hanging shutdown when interfaces init. is not complete	2021-07-21 11:48:12 +02:00
Simone Mainardi	c5d876207c	Fixes nEdge interface stats inc	2021-07-13 16:50:20 +02:00
Simone Mainardi	65769a7f42	Parses sflow samples via ZMQ, determines interfs. w/ sampled traff.	2021-07-09 15:57:26 +02:00
Simone Mainardi	2790f29f6e	Fixes alerted flows counters for view interfaces	2021-07-07 15:17:18 +02:00
Luca Deri	620823cf33	Cleaned up code for ZMQ collectors (some extra cleanup is necessary however)	2021-07-07 01:38:45 +02:00
Luca	112c931226	Observation point code cleanup (WIP)	2021-07-01 23:26:15 +02:00
Luca	336f1f3d9f	Adding observationPoint support (WIP)	2021-06-30 20:03:37 +02:00
Luca	fa5271b4d7	Implemented observationPoint menu support	2021-06-29 21:18:51 +02:00
MatteoBiscosi	be198c2a99	Added L7 iface proto behavior analysis and alert (#5499 #5474)	2021-06-29 16:50:56 +02:00
Luca	b43ea2c78e	Initial work towards support of observation points	2021-06-28 14:56:25 +02:00
MatteoBiscosi	c3a85560a7	Fixes wrongly formatter used for behavior anomaly alert	2021-06-28 11:38:39 +02:00
Luca	ff3f9a43a1	Introduced traffic direction in ZMQ when %DIRECTION information ... element is set in the nProbe template (-T)	2021-06-28 09:13:58 +02:00
Simone Mainardi	03b1633d1a	Adds extra tracing for alert drops ... Addresses #5558	2021-06-23 16:13:47 +02:00
MatteoBiscosi	5a02d2a0d7	Fixed lateral movement not triggering	2021-06-18 11:08:44 +02:00
Simone Mainardi	ee58f52c51	Refactors user_scripts to checks (c++)	2021-06-16 19:06:29 +02:00
Simone Mainardi	40f5c4e821	Refactors {flow,host}callbacks into {flow,host}checks (C++)	2021-06-16 15:27:38 +02:00
Luca Deri	846d24c5e9	Initial VLANid rework	2021-06-15 23:01:59 +02:00
Matteo Biscosi	0e1f16c9b9	Fixes #5492 behavior code rework	2021-06-14 16:46:12 +02:00
Matteo Biscosi	f12934ef9e	Implements Traffic TX/RX and Score Behavior analysis (#5473) (#5472)	2021-06-10 17:31:29 +02:00
Luca Deri	944747fe94	Implemented multi-stacked MPLS/PPPoE/PPP dissection	2021-06-10 10:59:26 +02:00
Simone Mainardi	08fb295be9	Implements support for roles (attacker/victim) filtering of alerts ... Implements #5425	2021-05-31 12:32:56 +02:00
Simone Mainardi	8f6ad08f27	Reworks host pools reload without sleeps ... Addresses #5412	2021-05-26 17:23:41 +02:00
Simone Mainardi	bb3f8ed168	Implements efficient unexpected_new_device alert	2021-05-11 19:03:40 +02:00
Alfredo Cardigliano	450b6c4575	Remove AlertsManager (no longer used). Add back entity value or 5-tuple to exported alerts (fix #5285)	2021-05-10 10:57:43 +02:00
Simone Mainardi	ec5a92514d	Fixes and simplifies getters of engaged alert counters	2021-05-07 15:06:55 +02:00
Simone Mainardi	7dea0f7f35	Implements alert badges on top of the alerts page	2021-05-07 11:16:05 +02:00
Simone Mainardi	ec06e6568f	Simplifies and keeps per-family alert counters	2021-05-07 10:21:32 +02:00