4339 commits

Author	SHA1	Message	Date
Alfredo Cardigliano	32585a34d0	Fix query on attacker/victim	2021-05-17 09:51:59 +02:00
Simone Mainardi	ccb61a7444	Harmonizes remaining hardcoded Lua scores	2021-05-15 11:00:20 +02:00
Simone Mainardi	38b47d5aa8	Unifies scores using nDPI for Lua-triggered alerts	2021-05-15 10:37:42 +02:00
Alfredo Cardigliano	c8731f5bfa	Add filter support for host role (attacker/victim)	2021-05-14 19:37:56 +02:00
Alfredo Cardigliano	026571e6a7	Move all render code to datatable-utils. Cleanup attacker/victim rendering.	2021-05-14 19:01:39 +02:00
Matteo Biscosi	553a059557	Added getters and setters for host pools policy	2021-05-14 17:41:06 +02:00
Alfredo Cardigliano	cefcd8c021	Severity filter improvements	2021-05-14 16:05:44 +02:00
Alfredo Cardigliano	206f1bb608	Move 'add filter' button to the tags bar. Fix filter dialog for all families (#5292)	2021-05-14 15:53:30 +02:00
Alfredo Cardigliano	30e0bd8675	Add ability to filter by alert type (#5292)	2021-05-14 15:23:28 +02:00
Matteo Biscosi	4b31a0d21c	Added score timeseries for vlan, as, subnet and country ... Implements #5317	2021-05-14 14:58:18 +02:00
Alfredo Cardigliano	f1c343ed83	Add cli/srv ip/port filters to flow alerts, ip filter to host alerts (#5292)	2021-05-14 11:15:08 +02:00
Alfredo Cardigliano	064c20db29	Implement support for alert filters using a dialog (WIP)	2021-05-13 19:02:28 +02:00
Simone Mainardi	bc6008be28	Reports all alerts inside a flow alert (not jsut the predominant) ... Implements #5316	2021-05-13 15:51:05 +02:00
Matteo Biscosi	4d5cd3b3af	Added score stats to VLAN/Country/AS/Network	2021-05-13 11:09:16 +02:00
Simone Mainardi	b7f12727e2	Implements spillover description column for flow alerts	2021-05-12 18:43:12 +02:00
Simone Mainardi	6ae7664de0	Fixes missing interface and host score timeseries ... Fixes #5300	2021-05-12 17:17:57 +02:00
Simone Mainardi	8cf7635fb6	Calibrates scores associated to flow risks	2021-05-12 15:10:52 +02:00
Simone Mainardi	d45ab54934	Harmonizes scores for Lua-triggered alerts ... Addresses #5315	2021-05-12 12:56:12 +02:00
Alfredo Cardigliano	b784ffa90c	Return an empty series when there are no alerts	2021-05-12 11:45:13 +02:00
Simone Mainardi	1c746a04c1	Cleanup unnecessary flags after sys/non-sys changes	2021-05-12 10:14:20 +02:00
Simone Mainardi	a743a1604d	Unifies names across alerts, pools and user scripts ... Fixes #5311	2021-05-12 10:07:26 +02:00
Simone Mainardi	bb3f8ed168	Implements efficient unexpected_new_device alert	2021-05-11 19:03:40 +02:00
Alfredo Cardigliano	03bf2bca5e	Fix attacker/victim records	2021-05-11 18:52:09 +02:00
Alfredo Cardigliano	bd190c22d1	Set record family when it applies	2021-05-11 18:13:48 +02:00
Alfredo Cardigliano	6c9b546383	Improve alert description for some families	2021-05-11 18:11:10 +02:00
Matteo Biscosi	1fa6159ab2	Implements attacker and victim sorting flow alert table	2021-05-11 17:24:10 +02:00
Alfredo Cardigliano	41b72c1125	Cleanup alert description (move configset link as additional field). Add ellipsis to long descriptions, with tooltips.	2021-05-11 17:18:13 +02:00
Alfredo Cardigliano	3180f83e5f	Fix network entity name to match the user scripts configuration	2021-05-11 16:04:27 +02:00
Simone Mainardi	6deadca5fb	Fixes redir. URL when switching between sys/non-sys	2021-05-11 14:52:49 +02:00
Alfredo Cardigliano	f801f86dc6	Add alert type to alert description and ability to filter on alert type for all alert families. (fix #5312)	2021-05-11 14:40:24 +02:00
Simone Mainardi	53ffd160de	Fixes sort by attacker/victim in host page	2021-05-11 14:36:58 +02:00
Simone Mainardi	6767a5b8c7	Additional cleanup for system interface handling	2021-05-11 14:13:06 +02:00
Alfredo Cardigliano	aea96c3bbc	Fix filter on alert_id	2021-05-11 14:06:07 +02:00
Matteo Biscosi	dd6ed25022	Fixes null value into flow alert page	2021-05-11 13:10:51 +02:00
Simone Mainardi	33495e0188	Fixes system interface selection mixed between Lua and C++	2021-05-11 12:51:34 +02:00
Matteo Biscosi	c9b08d52a0	Implemented attacker and victim column ... Implements #5310	2021-05-11 12:46:49 +02:00
Alfredo Cardigliano	fc85cc20ef	Add alert name to the description. Add support for filtering on alert type (wip)	2021-05-11 12:33:51 +02:00
Alfredo Cardigliano	3ad0e12795	Add support for cli/srv port filtering in flow alerts	2021-05-10 18:08:42 +02:00
Simone Mainardi	6fa3a2cc27	Fixes duration for engaged alerts always set to <1 second	2021-05-10 15:42:46 +02:00
Simone Mainardi	95d27351af	Removes a debug print	2021-05-10 15:19:51 +02:00
Simone Mainardi	457af5d222	Fixes flapping of Lua-triggered engaged alerts ... Fixes #5304	2021-05-10 15:18:19 +02:00
Simone Mainardi	bfc9e72193	Fixes label for zero TCP window alerts	2021-05-10 13:02:53 +02:00
Simone Mainardi	74603b8fe6	Implements alerts summary page for engaged alerts	2021-05-10 12:20:27 +02:00
Matteo Biscosi	1bb5fac8be	Removed unused variable ... Implements #5302	2021-05-10 11:14:31 +02:00
Matteo Biscosi	aaadd8728f	Changed aesthetical attacker/victim alert table view ... Implements #5302	2021-05-10 11:12:14 +02:00
Alfredo Cardigliano	16da9a3961	Cleanup unised alerts code	2021-05-10 11:10:35 +02:00
Alfredo Cardigliano	450b6c4575	Remove AlertsManager (no longer used). Add back entity value or 5-tuple to exported alerts (fix #5285)	2021-05-10 10:57:43 +02:00
Matteo Biscosi	11b37bc695	Added victim and attacker columns to flow/host alerts ... Implements #5302	2021-05-10 10:24:32 +02:00
Simone Mainardi	87d8c89107	Fixes missing certificate names in TLS mismatch alerts ... Fixes #5299	2021-05-10 09:25:09 +02:00
Simone Mainardi	27fcd52bf9	Improves message for obsolete TLS ... Addresses #5299	2021-05-10 08:55:49 +02:00