Commit graph

509 commits

Author SHA1 Message Date
Simone Mainardi
b8dc6653fa Reworks handling of HTTP host names
Addresses #5706
2021-07-23 12:34:19 +02:00
Simone Mainardi
71089c8270 Reworks handling of TLS host names
Addresses #5706
2021-07-23 12:23:32 +02:00
Simone Mainardi
132b2cb7c4 Minor score cleanup
Addresses #5694 along with companion pro commit
2021-07-20 12:32:22 +02:00
Luca Deri
e55f88faa2 ZMQ timeout optimizazion 2021-07-09 16:36:46 +02:00
Luca
112c931226 Observation point code cleanup (WIP) 2021-07-01 23:26:15 +02:00
Luca
336f1f3d9f Adding observationPoint support (WIP) 2021-06-30 20:03:37 +02:00
Simone Mainardi
40f5c4e821 Refactors {flow,host}callbacks into {flow,host}checks (C++) 2021-06-16 15:27:38 +02:00
Luca Deri
846d24c5e9 Initial VLANid rework 2021-06-15 23:01:59 +02:00
Matteo Biscosi
bcc717689f Partially Implements traffic blocking (#5387) 2021-05-21 18:40:49 +02:00
Luca Deri
7b52a9c268 Improved host resolution via indirect HTTP/TLS/QUIC/MDNS naming 2021-05-18 07:20:13 +02:00
Simone Mainardi
6ae7664de0 Fixes missing interface and host score timeseries
Fixes #5300
2021-05-12 17:17:57 +02:00
Matteo Biscosi
3cb65f4b49 Added reset button for blacklisted flow stats 2021-04-19 18:46:02 +02:00
Luca Deri
76afff76d1 Created timeseries for blacklisted hosts 2021-04-18 15:28:31 +02:00
Luca Deri
adc00cbdc3 Added counter for tracking flows with balcklisted hosts 2021-04-18 11:44:38 +02:00
Matteo Biscosi
87d5cd2ff0 Added nDPI stats per host getter 2021-04-16 10:23:09 +02:00
Matteo Biscosi
90b306ae76 Re-added lower/upper bound to flow/score anomaly alert 2021-04-14 12:27:47 +02:00
Matteo Biscosi
090374926f Fixes uninitialized value into host remote access alert 2021-04-12 17:58:34 +02:00
Matteo Biscosi
fa5910c06f Implemented flow and host alert for remote access 2021-04-12 16:34:36 +02:00
Alfredo Cardigliano
700ccac48d Keep track of max score 2021-04-12 11:00:36 +02:00
Luca Deri
8b2faf21f5 Added script for checking flow number anomalies 2021-04-11 13:59:47 +02:00
Alfredo Cardigliano
921b67ee5e Move and rename counters used by alerts 2021-04-09 17:17:48 +02:00
Alfredo Cardigliano
b67f0ed89c Cleanup alerts_map which is not used 2021-04-09 12:05:41 +02:00
Alfredo Cardigliano
bcf003dad4 Cleanup release API 2021-04-09 11:28:37 +02:00
Alfredo Cardigliano
db6746e1a3 Enqueue host alert release status to avoid concurrency issues. Change SPSCQueue dequeue to behave similar to std lists. 2021-04-09 09:45:11 +02:00
Alfredo Cardigliano
c97196c071 Host alert score code cleanup 2021-04-08 18:23:46 +02:00
Luca
a4047c5a1c Implements flow callbacks and alerts in C++
Scaffolding code of the host scripts

Scaffolding code for host alerts

Adds host_callbacks/ for .cpp files

Implements all classes for host callbacks

Removes pro/enterprise host callbacks

Adds typedefs with callback deltas

Compilation fix

Creates instances of host callbacks in loader

Link fix

Removes redundant/non-necessary host alerts

Merges Scan and Flood callbacks together

Removes outdated API files

Refactors alert keys into entity|id

Refactors all flow alert_{...} into flow_alert_{...}

Refactors C++ flow alert_{...} into flow_alert_{...}

Reworks alert ids to include an entity type

Cleanup and merge alertTypeRaw with getAlertType

Minor fix

Refactors alert definitions and keys into sub directories

Implement host alert callback execution and trigger/release logic

Update callbacks API

Adds base CallbacksLoader for {Host,Flow}CallbacksLoader

Implements load of host user scripts with periodicities

Implements runtime reload of host callbacks

Add logic for periodic callbacks

Add 'expired' flag to host alerts

Implements execution of host callbacks and SYN flood checks

Adds triggerAlertAsync calls to SYNFlood

Implements JSON host alert generation info

Handle callback getPeriod. Optimize callback lookup.

Implements host recipients in C++

Add callback status

Define destructor

Iterator fixes

Cleanup host Lua calls (now performed in C++)

Changes to show new host alerts in SQLite

Adds release/engage action on alert JSON

Move AlertableEntity to OtherAlertableEntity, inheriting from a new AlertableEntity. Add HostAlertableEntity.

Implements SYN Flood Attacker with params

Uses parametrized thresholds to trigger syn flood alerts

Implements build alert of both attacker and victim

Implement HostAlertableEntity

Implements SYN scan attacker/victim alerts

Implements flow flood attacker/victim alerts

Removes a debug flag

Add virtual allocStatus

Add HostAlert disableAutoRelease()

Add Ãexplicit releaseAlert()

Implements SYNFloodHostCallbackStatus

Implements SYNScanHostCallbackStatus

Implements FlowFloodHostCallbackStatus

Change trigger API to handle cli/src score

Implements {DNS,SMTP,NTP}ServerContactsAlert

Reworks ServerContacts host alerts

Implement exclusion bitmaps for host alerts

Implements {SMTP,DNS,NTP}ServerContactsAlert

Adds host_info to the generated alert JSON

Minor cleanup

Optimize access to callback status

Move RepliesRequestsRatio to pro

Rework triggerAlert on host to avoid multiple call and unneeded status data

Compilation fix

Reworked host alerts API (wip)

Cleanup unused host callbacks

Compilation fixes

Finishes backend implementation of host alerts exclusions

Rework host callbacks executor

Implements disable of host alerts

Port SYNFlood to the new api

Cleanup

Reduce duplicated code

Comments

Port ServerContacts to the new api

Clenaup

Adds parsing of configuration for host callbacks

Port SYNScanAlert to the new API

Port FlowFlood to the new API

Cleanup unused HostAlert getName

Reworks DNSRequestsErrorsRatioAlert

Adds JSON for DNSTrafficAlert

Adds FlowsAlert

Adds P2PTrafficAlert

Add RepliesRequestsRatioAlert

Adds ScoreAlert

Adds ThroughputAlert

Adds TrafficAlert

Fixes for scan/flood alerts

DNS ratio alert support

Add HTTP stats getters

Implements deltas for many host callbacks

Host score inc

Adds missing Alert params to host alerts

Release all host alerts on idle

Refactors score classes

Implements class Score to contain scores for hosts, flows, etc

Adds scores to VLANs, Networks, ASes and Countries

Host callbacks can trigger a single alert now

FlowFlood, SYNFloo, SYNScan now inherit from FlowHits

Move severity and score to constructor

Add else branch to hits callbacks

Alert definition update for flows_flood, syn_flood, syn_scan

Update field name

Engaged alert init

Adds score incs/decs for AS, VLAN, country, os and network

Restore network scripts

Restored other alert definitions for floods

Handle decreasing alert score

Removes include

Rename flows_flood to flow_flood for consistency

Restored alert_tcp_syn_flood_victim alert_tcp_syn_scan_victim definitions

Fixes for non-host engaged/release alerts

Cleanup LuaEngineFlow and LuaEngineHost classes

Fixes old calls to host lua during shutdown

Removes AlertCheckLuaEngine instance

Fixes purging of flows

Fixes alerts release upon shutdown causing wrong uses

Removes a debug flag

Fix getNumEngagedAlerts

Cleanup unnecessary host callbacks

Removes array of callback statuses inside host

Bitmap fixes

Refactors Bitmap into Bitmap128

Implements 16-bits bitmaps for host alerts

Adds class HostCallbacksStatus

Moves callback status p2p and DNS inside HostCallbacksStatus

Removes unused callbacks in typedefs

Minor cleanup

Adds trigger/release for DNS/p2p alerts

Reworks UI of hosts user scripts

Rename HostCallbackType to HostCallbackID, getType to getID, others
2021-04-03 09:53:15 +02:00
Simone Mainardi
aea9138bfb Implements flow callbacks and alerts in C++ 2021-03-22 09:51:36 +01:00
Simone Mainardi
bdf3069227 Fixes for interface/host.lua [attempt to index a function value] 2021-02-03 15:06:07 +01:00
Matteo Biscosi
eba1aaa359 Implements #4984 core Internet resources misuse script 2021-02-03 12:41:18 +01:00
Matteo Biscosi
fe01117324 Implements #4006 alerts when host contacts an unusual number of peers
Partial implementation, the rest is under the Pro Repository
2021-02-02 13:31:21 +01:00
Luca Deri
0b4e2757c1 Added host contact counters for core servers 2021-01-28 23:42:03 +01:00
Matteo Biscosi
288463b5d0 Implements #4973 partial local broadcast domain calculation 2021-01-27 09:59:05 +01:00
Luca Deri
6b6066e15b Improved brodcast host detection
Fixed invalid is_broadcast host report
2021-01-26 16:38:51 +01:00
Simone Mainardi
d11e58c498 Operating systems set fixes 2021-01-21 14:38:14 +01:00
Matteo Biscosi
43fa8cf6e9 Implements OperatingSystem Hash
Implements #1599
2021-01-21 11:14:52 +01:00
Luca
685bab35f4 Fix invalid host serialization for MAC-based interfaces 2021-01-20 08:38:43 +01:00
Simone Mainardi
7641faab96 Allows DHCP hosts to be serialized by Mac 2021-01-19 16:57:10 +01:00
Matteo Biscosi
864723c151 Fixed top sites problem and added a slice of top OS stats 2021-01-18 18:12:53 +01:00
Matteo Biscosi
4586833114 Fixed #4896 service map nodes have numerical label even though a symbolic name exists 2021-01-11 17:42:49 +01:00
Luca Deri
a1178a0791 Updated (C) 2021-01-02 12:08:23 +01:00
Luca Deri
06161556ac Fixes issues with unexpected XXX alerts where impacted server was not reported
Added Lua getFlowProtoClientIP/getFlowProtoServerIP calls in flows
2020-11-25 15:52:03 +01:00
Luca Deri
249477929a Exported additional host information when serializing flows 2020-11-20 12:59:51 +01:00
Luca Deri
17266b71a6 Extended flow alert JSON 2020-11-17 17:04:11 +01:00
Luca Deri
7758e0dea1 Reworked DoH code 2020-11-11 16:19:39 +01:00
Matteo Biscosi
5a8fd8efd7
Fixes #2115 and added shell script user guide (#4702)
* Added shell endpoint user guide

* Fixes #2115 std::new exceptions not always handled

* Removed a nothrow due to the insert of a try-catch statement

* Trying to implement #4421

Co-authored-by: matteo <biscosi@ntop.org>
2020-11-11 12:28:18 +01:00
Alfredo Cardigliano
109c79eafa Add score sorter in the backend 2020-11-02 11:24:40 +01:00
Simone Mainardi
a0056ef2b7 Unifies alerted and misbehaving flows on hosts
Fixes #4596
2020-10-19 10:19:22 +02:00
Simone Mainardi
30f46a15da Misbehaving flows cleanup 2020-10-16 11:28:46 +02:00
Simone Mainardi
e5f95c0237 Reworks/cleanup host score code 2020-10-15 12:25:27 +02:00
Simone Mainardi
24839a7135 Alerted flows counter fixes 2020-10-14 16:46:09 +02:00