3564 commits

Author	SHA1	Message	Date
Luca Deri	20b373ef13	eBPF fixes	2022-06-14 18:03:49 +02:00
Alfredo Cardigliano	2b3f138300	Disable flow dump to syslog on MacOS due to broken openlog API on Sierra and later	2022-06-14 16:36:39 +02:00
MatteoBiscosi	dee321129f	Standardized score to ecs	2022-06-13 19:25:43 +02:00
Alfredo Cardigliano	db0fc0a871	Add more process information	2022-06-10 15:30:46 +02:00
Alfredo Cardigliano	8ddf0e6998	Store cli/srv location in alerts	2022-06-09 11:27:41 +02:00
Alfredo Cardigliano	bbf2edb5d5	Add process/container/tcp info for both client and server. Parse container id.	2022-06-08 18:27:17 +02:00
Alfredo Cardigliano	b5566ee3de	Set parsed ebpf info flag	2022-06-08 12:07:17 +02:00
MatteoBiscosi	021086e44f	Added dpi and guessed badge to flow list and details	2022-06-08 10:51:19 +02:00
MatteoBiscosi	b40d26f2e8	Changed confidence from string to number	2022-06-07 17:59:42 +02:00
Alfredo Cardigliano	0a662c1a25	Add initial process IE colleciton from nProbe	2022-06-07 17:43:32 +02:00
Luca Deri	c57364a00d	Added hostname cleanup	2022-06-07 15:40:59 +02:00
Luca Deri	9d364c69b4	Fixed TCP with no answer alert definition	2022-06-07 13:11:35 +02:00
Luca Deri	0ae4341d9b	Added %L7_CONFIDENCE support	2022-06-06 14:05:42 +02:00
Luca Deri	48bf0c7de3	Implemented DHCP storm detection	2022-06-05 13:28:32 +02:00
Luca Deri	8234249b20	nDPI Risk information is now saved earlier in the flow	2022-06-01 11:12:10 +02:00
Alfredo Cardigliano	71586ef4ad	Fix log collection from multiple clients and purge idle	2022-06-01 10:11:49 +02:00
MatteoBiscosi	3509b3b74b	Added dns fragmented alert	2022-05-31 18:34:22 +02:00
MatteoBiscosi	ad3ada6826	Added flow risk info to alert description	2022-05-31 17:16:12 +02:00
MatteoBiscosi	167cf6484a	Updated ndpi flow risk alerts	2022-05-31 17:15:21 +02:00
Luca Deri	930a2ac34d	Added support for FlowRiskInfo via nProbe	2022-05-31 11:29:32 +02:00
Luca Deri	fb481d4f23	Added flow riskInfo field containing the nDPI-generated JSON	2022-05-30 23:02:00 +02:00
Luca Deri	b0919c9dba	Added flow risk info	2022-05-30 22:30:05 +02:00
MatteoBiscosi	3867b03978	Added protocol information dumped even with no alerts (#6649)	2022-05-30 17:54:16 +02:00
MatteoBiscosi	e9147aa37d	Implemented connection failed alert (#6622)	2022-05-27 10:45:25 +02:00
Luca Deri	90c983e106	Patch for avoid seting hostnames with invalid strings	2022-05-26 19:18:25 +02:00
MatteoBiscosi	0ac8da733f	Fixed server name not used for server ips (#6623)	2022-05-25 11:29:08 +02:00
MatteoBiscosi	72f814c36c	Added vlan support to exclusion lists (#6510)	2022-05-24 12:22:24 +02:00
MatteoBiscosi	22568f3da6	Added local network filters to service/periodicity maps (#6460)	2022-05-19 13:07:32 +02:00
Luca Deri	681fdb75b0	Fix for #6605	2022-05-18 18:47:38 +02:00
Luca Deri	b09ab3e47a	Fixed bug that prevented flows to be dumped on ClickHouse	2022-05-18 18:46:01 +02:00
Luca Deri	2380d80642	Added DHCP MAC stats	2022-05-16 23:30:50 +02:00
MatteoBiscosi	7b51a4ca61	Added Fin Scan check (#5903)	2022-05-16 17:18:11 +02:00
Luca Deri	af7c4c71db	Cleaned up ClickHouse code	2022-05-16 13:37:25 +02:00
Luca Deri	b0158f89c2	Reworked MAC/IP Reassociation alert used to detect spoofind and MITM (Man In The Middle) Attacks	2022-05-15 19:17:18 +02:00
Luca Deri	cdbb0e5380	Implements #6598	2022-05-15 16:57:48 +02:00
Luca Deri	7c038e29da	Implemented IEC104 Invalid Command Transition check/alert	2022-05-11 23:16:45 +02:00
MatteoBiscosi	fa0578c8a9	Added filter for second host in flows (#2722)	2022-05-10 12:45:50 +02:00
Luca Deri	1ada912998	Added the ability to locate clickhouse-client on non standard locations	2022-05-06 21:27:07 +02:00
Luca Deri	3e2c3aee0c	Database initializations fixes	2022-05-06 20:29:27 +02:00
MatteoBiscosi	2bcf7c8dfa	Added Suspicious Entropy alert (#6563)	2022-05-04 22:11:44 +02:00
Luca Deri	dd2c27cecb	Implements partial sends to avoid dropping the connection when the client is slow or unresponsive (#6553)	2022-05-04 11:52:39 +02:00
Luca Deri	cf516f7411	Fixed IEC continuous dissection	2022-05-04 10:19:31 +02:00
Luca Deri	64dd3fa940	Improved ICMP data exfiltration detection	2022-05-04 00:31:55 +02:00
Luca Deri	0e05c21d9f	Added support for error code	2022-05-02 13:04:01 +02:00
MatteoBiscosi	ef1c963090	Added ECS 8 support (#6552)	2022-04-29 18:01:12 +02:00
Luca	5310c05bc2	Fixes #6455	2022-04-29 10:19:25 +02:00
Luca Deri	5347d613d6	Improved host walk for lua scripts	2022-04-28 23:12:18 +02:00
MatteoBiscosi	345ff43fc5	Cleaned up local host stats code (#6336)	2022-04-28 11:43:05 +02:00
Luca Deri	61d33f673a	Improved hosts map	2022-04-27 22:42:33 +02:00
Luca Deri	b2f20317b8	Reworked host map	2022-04-27 16:37:26 +02:00