Commit graph

131 commits

Author SHA1 Message Date
Alfredo Cardigliano
59c4ca4d4e Add install_disk2disk_conf 2023-04-11 17:39:35 +02:00
Matteo Biscosi
f6ce278e9e Added Historical Flow fields when downloading (#6851) 2023-03-31 10:48:54 +00:00
Luca Deri
a7aa8bcbc0 Updated schema with parametric cluster name 2023-01-19 08:50:22 +01:00
Luca Deri
a1b9c31e6d Updated tables defnition for cluster 2023-01-17 13:31:34 +01:00
Luca Deri
6ac2fc7623 Changed table definition 2023-01-14 14:37:46 +01:00
Luca Deri
662bfd2313 Changes for supporting clickhouse-cluster 2023-01-13 22:28:31 +01:00
Alfredo Cardigliano
e4404a291b Fix view drop 2023-01-09 12:44:27 +01:00
Alfredo Cardigliano
039b842ce5 Fix where condition in all_alerts_view 2022-12-27 19:41:32 +01:00
Luca Deri
c744b96473 Disabled stratosphere labs blacklist as it contains too many false positives 2022-12-01 10:27:44 +01:00
Alfredo Cardigliano
4a000a5b69 Improve check for RH based systems 2022-08-26 09:31:25 +02:00
Alfredo Cardigliano
416ca7b7fb Add exporter and interface info to flow alerts schema (#6808) 2022-08-22 15:43:18 +02:00
Luca Deri
704d4c31fe Fixed typo 2022-08-16 18:00:22 +02:00
Luca Deri
ac90e492a0 Added Stratosphere Labs Blacklist support 2022-08-16 17:56:24 +02:00
Luca Deri
bb822527af Category is now set to malware 2022-08-16 17:55:52 +02:00
Alfredo Cardigliano
61244379ea Rename misleading file name (CH schema also includes flows) 2022-07-21 17:47:02 +02:00
Luca
5e8769b1b5 Reworked builtin lists
- they are now defined in httpdocs/misc/lists in JSON formt
- built-in lists (ntop maintained) are stored in httpdocs/misc/lists/nultin
- custom lists go into httpdocs/misc/lists/custom
2022-07-11 19:18:16 +02:00
MatteoBiscosi
e73e2c9fc6 Added support to ELK version 8 (#6651) 2022-06-28 14:52:04 +02:00
Alfredo Cardigliano
f633292e83 Add cli/srv location to flow alerts 2022-06-09 10:40:33 +02:00
Alfredo Cardigliano
b5934b802d Add dst2src and src2dst packets in flow, required by flow alerts 2022-05-25 18:26:22 +02:00
Alfredo Cardigliano
37d1986933 Check that maintenance is defined and != 0 in automatic package updates 2022-05-23 10:30:48 +02:00
Alfredo Cardigliano
86899d42f7 Fix IPv6 in flow alerts when using clickhouse view 2022-05-11 13:04:53 +02:00
Alfredo Cardigliano
9940cf7b34 Update sqlite schema 2022-05-11 09:50:08 +02:00
Alfredo Cardigliano
addecb93e8 Move info field out of the json for flow alerts 2022-05-11 09:47:52 +02:00
Alfredo Cardigliano
8d5ddda7d4 Fix flow alert delete with clickhouse view (add IS_ALERT_DELETED flag) 2022-05-10 09:46:21 +02:00
MatteoBiscosi
ef1c963090 Added ECS 8 support (#6552) 2022-04-29 18:01:12 +02:00
Alfredo Cardigliano
0204d4734a Implement acknowledge for flow alerts using the historical flows table 2022-04-26 17:23:25 +02:00
Alfredo Cardigliano
fdce648cf2 Create flow alerts view in alert_store_schema_clickhouse.sql. All tables are now created in the same place, both for flows and alerts. 2022-04-21 15:13:40 +02:00
Alfredo Cardigliano
dce7bbeebf Add Rocky check in ntopng-utils-manage-updates.in 2022-04-05 10:20:36 +02:00
Alfredo Cardigliano
bb393c54d9 Move alter table for country before interface_id as the latter is expected to fail 2022-04-01 10:20:53 +02:00
Alfredo Cardigliano
47f00f1b4b Fix alter table failures in SQLite 2022-03-31 09:45:26 +02:00
uccidibuti
e204bf01d4 Missing Network/Pool Alert Filter #6418 2022-03-30 19:58:26 +02:00
Alfredo Cardigliano
090fdc9b18 Add country to host alerts 2022-03-30 12:50:31 +02:00
Luca
b9287db3aa Fixed SQLite initialization issue 2022-02-01 12:14:54 +01:00
Alfredo Cardigliano
cc1ba9c9a9 Move alter table to avoid failures 2022-01-27 17:15:48 +01:00
Simone Mainardi
37fe090a28 Implements Clickhouse retention using partitioned alert tables
Addresses #6030
2021-11-11 12:28:41 +01:00
Alfredo Cardigliano
fb2ff7f2a4 Add rowid based on UUID to clickhouse (#6046) 2021-11-05 19:12:36 +01:00
Luca Deri
13407f6761 Fixes for dumping alerts into ClickHouse 2021-11-04 19:05:50 +01:00
Luca Deri
3dcd2b9e09 Code rework 2021-11-04 11:16:57 +01:00
Alfredo Cardigliano
af0cade6ba Log from crontab scripts to file only (no stdout to avoid sending emails) 2021-09-16 09:59:26 +02:00
Alfredo Cardigliano
ad726155a9 Halves number of cron script executions 2021-08-02 11:08:29 +02:00
Alfredo Cardigliano
e247139c02 Add ip_version to the alert DB. Add filter on IP version in alert explorer. 2021-07-09 18:04:27 +02:00
Simone Mainardi
feb65be1ca Implements acknowledged alerts
Implements #5600
2021-07-02 14:58:38 +02:00
Simone Mainardi
0a6b513710 Implements ability to store/search/filter host alerts by cli/srv
Addresses #5575
2021-06-30 12:58:00 +02:00
Simone Mainardi
63168f5ff2 Implements 'Subject' column for interface alerts
Addresses #5563
2021-06-24 15:51:17 +02:00
Alfredo Cardigliano
3f6c415db6 Remove --with-new-pkgs when using install 2021-06-18 10:27:33 +02:00
Alfredo Cardigliano
59f8e74788 Using install instead of upgrade in the updates script to handle kept back packages 2021-06-18 10:11:45 +02:00
Simone Mainardi
567655ad70 Fixes for active monitoring alerts
Fixes #5415
2021-05-27 15:18:10 +02:00
Alfredo Cardigliano
a097c85052 Remove attacker2victim/victim2attacker columns. Add icons for attacker/victim. Add has_attacker/has_victim fitlers. (fix #5302) 2021-05-25 12:42:44 +02:00
Simone Mainardi
bc6008be28 Reports all alerts inside a flow alert (not jsut the predominant)
Implements #5316
2021-05-13 15:51:05 +02:00
Alfredo Cardigliano
4d9d2331d4 Fix ifid range in interface_alerts schema (fix #5295) 2021-05-10 15:08:47 +02:00