Alfredo Cardigliano
59c4ca4d4e
Add install_disk2disk_conf
2023-04-11 17:39:35 +02:00
Matteo Biscosi
f6ce278e9e
Added Historical Flow fields when downloading ( #6851 )
2023-03-31 10:48:54 +00:00
Luca Deri
a7aa8bcbc0
Updated schema with parametric cluster name
2023-01-19 08:50:22 +01:00
Luca Deri
a1b9c31e6d
Updated tables defnition for cluster
2023-01-17 13:31:34 +01:00
Luca Deri
6ac2fc7623
Changed table definition
2023-01-14 14:37:46 +01:00
Luca Deri
662bfd2313
Changes for supporting clickhouse-cluster
2023-01-13 22:28:31 +01:00
Alfredo Cardigliano
e4404a291b
Fix view drop
2023-01-09 12:44:27 +01:00
Alfredo Cardigliano
039b842ce5
Fix where condition in all_alerts_view
2022-12-27 19:41:32 +01:00
Luca Deri
c744b96473
Disabled stratosphere labs blacklist as it contains too many false positives
2022-12-01 10:27:44 +01:00
Alfredo Cardigliano
4a000a5b69
Improve check for RH based systems
2022-08-26 09:31:25 +02:00
Alfredo Cardigliano
416ca7b7fb
Add exporter and interface info to flow alerts schema ( #6808 )
2022-08-22 15:43:18 +02:00
Luca Deri
704d4c31fe
Fixed typo
2022-08-16 18:00:22 +02:00
Luca Deri
ac90e492a0
Added Stratosphere Labs Blacklist support
2022-08-16 17:56:24 +02:00
Luca Deri
bb822527af
Category is now set to malware
2022-08-16 17:55:52 +02:00
Alfredo Cardigliano
61244379ea
Rename misleading file name (CH schema also includes flows)
2022-07-21 17:47:02 +02:00
Luca
5e8769b1b5
Reworked builtin lists
...
- they are now defined in httpdocs/misc/lists in JSON formt
- built-in lists (ntop maintained) are stored in httpdocs/misc/lists/nultin
- custom lists go into httpdocs/misc/lists/custom
2022-07-11 19:18:16 +02:00
MatteoBiscosi
e73e2c9fc6
Added support to ELK version 8 ( #6651 )
2022-06-28 14:52:04 +02:00
Alfredo Cardigliano
f633292e83
Add cli/srv location to flow alerts
2022-06-09 10:40:33 +02:00
Alfredo Cardigliano
b5934b802d
Add dst2src and src2dst packets in flow, required by flow alerts
2022-05-25 18:26:22 +02:00
Alfredo Cardigliano
37d1986933
Check that maintenance is defined and != 0 in automatic package updates
2022-05-23 10:30:48 +02:00
Alfredo Cardigliano
86899d42f7
Fix IPv6 in flow alerts when using clickhouse view
2022-05-11 13:04:53 +02:00
Alfredo Cardigliano
9940cf7b34
Update sqlite schema
2022-05-11 09:50:08 +02:00
Alfredo Cardigliano
addecb93e8
Move info field out of the json for flow alerts
2022-05-11 09:47:52 +02:00
Alfredo Cardigliano
8d5ddda7d4
Fix flow alert delete with clickhouse view (add IS_ALERT_DELETED flag)
2022-05-10 09:46:21 +02:00
MatteoBiscosi
ef1c963090
Added ECS 8 support ( #6552 )
2022-04-29 18:01:12 +02:00
Alfredo Cardigliano
0204d4734a
Implement acknowledge for flow alerts using the historical flows table
2022-04-26 17:23:25 +02:00
Alfredo Cardigliano
fdce648cf2
Create flow alerts view in alert_store_schema_clickhouse.sql. All tables are now created in the same place, both for flows and alerts.
2022-04-21 15:13:40 +02:00
Alfredo Cardigliano
dce7bbeebf
Add Rocky check in ntopng-utils-manage-updates.in
2022-04-05 10:20:36 +02:00
Alfredo Cardigliano
bb393c54d9
Move alter table for country before interface_id as the latter is expected to fail
2022-04-01 10:20:53 +02:00
Alfredo Cardigliano
47f00f1b4b
Fix alter table failures in SQLite
2022-03-31 09:45:26 +02:00
uccidibuti
e204bf01d4
Missing Network/Pool Alert Filter #6418
2022-03-30 19:58:26 +02:00
Alfredo Cardigliano
090fdc9b18
Add country to host alerts
2022-03-30 12:50:31 +02:00
Luca
b9287db3aa
Fixed SQLite initialization issue
2022-02-01 12:14:54 +01:00
Alfredo Cardigliano
cc1ba9c9a9
Move alter table to avoid failures
2022-01-27 17:15:48 +01:00
Simone Mainardi
37fe090a28
Implements Clickhouse retention using partitioned alert tables
...
Addresses #6030
2021-11-11 12:28:41 +01:00
Alfredo Cardigliano
fb2ff7f2a4
Add rowid based on UUID to clickhouse ( #6046 )
2021-11-05 19:12:36 +01:00
Luca Deri
13407f6761
Fixes for dumping alerts into ClickHouse
2021-11-04 19:05:50 +01:00
Luca Deri
3dcd2b9e09
Code rework
2021-11-04 11:16:57 +01:00
Alfredo Cardigliano
af0cade6ba
Log from crontab scripts to file only (no stdout to avoid sending emails)
2021-09-16 09:59:26 +02:00
Alfredo Cardigliano
ad726155a9
Halves number of cron script executions
2021-08-02 11:08:29 +02:00
Alfredo Cardigliano
e247139c02
Add ip_version to the alert DB. Add filter on IP version in alert explorer.
2021-07-09 18:04:27 +02:00
Simone Mainardi
feb65be1ca
Implements acknowledged alerts
...
Implements #5600
2021-07-02 14:58:38 +02:00
Simone Mainardi
0a6b513710
Implements ability to store/search/filter host alerts by cli/srv
...
Addresses #5575
2021-06-30 12:58:00 +02:00
Simone Mainardi
63168f5ff2
Implements 'Subject' column for interface alerts
...
Addresses #5563
2021-06-24 15:51:17 +02:00
Alfredo Cardigliano
3f6c415db6
Remove --with-new-pkgs when using install
2021-06-18 10:27:33 +02:00
Alfredo Cardigliano
59f8e74788
Using install instead of upgrade in the updates script to handle kept back packages
2021-06-18 10:11:45 +02:00
Simone Mainardi
567655ad70
Fixes for active monitoring alerts
...
Fixes #5415
2021-05-27 15:18:10 +02:00
Alfredo Cardigliano
a097c85052
Remove attacker2victim/victim2attacker columns. Add icons for attacker/victim. Add has_attacker/has_victim fitlers. ( fix #5302 )
2021-05-25 12:42:44 +02:00
Simone Mainardi
bc6008be28
Reports all alerts inside a flow alert (not jsut the predominant)
...
Implements #5316
2021-05-13 15:51:05 +02:00
Alfredo Cardigliano
4d9d2331d4
Fix ifid range in interface_alerts schema ( fix #5295 )
2021-05-10 15:08:47 +02:00