589 commits

Author	SHA1	Message	Date
Luca Deri	8be49d4608	Workaround for #9897	2025-12-16 19:49:25 +01:00
Matteo Biscosi	3975ed3018	Fixes flow alert description (#9873)	2025-12-04 11:47:21 +01:00
Matteo Biscosi	cd243d0d20	Possible fix for vacuum query (#9478)	2025-11-20 11:43:29 +01:00
Alfredo Cardigliano	1eee15c61e	Fix tag_utils.tag_operators: split labels and sql	2025-09-15 15:30:04 +02:00
Alfredo Cardigliano	137eee2dcd	Add support for 'Is empty' and 'Is not empty' in filters	2025-09-15 14:48:55 +02:00
Alfredo Cardigliano	036c6826bd	Change AS link and fix time in AS alert details	2025-09-12 12:18:18 +02:00
Alfredo Cardigliano	07437c5812	Rework DB classess hierarchy (this should address #9576). Add db check (#9620)	2025-09-12 09:15:56 +00:00
Alfredo Cardigliano	5fd9089eeb	Add alert details page to AS alerts	2025-09-11 15:51:44 +02:00
Alfredo Cardigliano	1781c95191	Fix ASN column	2025-09-08 10:38:29 +02:00
Alfredo Cardigliano	a5f3fc3d47	safety check	2025-09-08 10:38:16 +02:00
Matteo Biscosi	e8cdfbf461	Fixes as name not set in alerts	2025-08-27 11:03:23 +02:00
Alfredo Cardigliano	f9ce9e0597	Fix historical AS alerts	2025-08-25 16:18:46 +02:00
Alfredo Cardigliano	52b4c29a18	Remove debug traces	2025-08-25 15:20:45 +02:00
Alfredo Cardigliano	f1ba753b90	Add as_alert_store.lua	2025-08-25 14:45:47 +02:00
Alfredo Cardigliano	ba382f7316	Add AS alert entity. Fix AS threshold crossed.	2025-08-25 14:45:22 +02:00
GabrieleDeri	f73a547a76	Added blacklisted icon to IP addr on mysql alert details #9438 (#9443) ... * Added ch flows export to file before ttl delete. Need to add pref for path getter * Added clickhouse ttl export path pref * Fixed naming in clickhouse flow archive * Updated naming in clickhouse flow archive pref * Removed clickhouse archive path pref * Added IXP mode pref #9421 * Removed unused prefs ch flows archive * Added blacklisted icon to IP addr on mysql alert details	2025-07-28 11:46:36 +02:00
Luca Deri	0a60f0d4b2	Fixes packets math #9438	2025-07-25 17:52:38 +02:00
Alfredo Cardigliano	6f9d7cd14f	Major code rework to fully use the clickhouse API in place of Mysql	2025-06-09 15:33:57 +02:00
Alfredo Cardigliano	c68027248f	Extend alerts_api.addAlertGenerationInfo with host attributes (#9220)	2025-05-27 13:15:01 +02:00
Alfredo Cardigliano	bb810adeff	Add native clickhouse support for queries	2025-05-16 11:14:18 +02:00
Matteo Biscosi	2ba9fcda17	Fixes suspicious DGA domain alert (#8978)	2025-03-06 15:45:20 +01:00
Matteo Biscosi	a251974b21	Fixes misstyping	2025-02-28 11:18:23 +01:00
Matteo Biscosi	fb44f88f34	Fixes missing where and query not working (#8999)	2025-02-28 11:15:41 +01:00
Alfredo Cardigliano	cc71465273	Fix example	2025-02-26 14:46:27 +01:00
GabrieleDeri	117b6e3f0c	Added documentation for duplicate alerts silencing logic (#8992)	2025-02-25 09:26:46 +01:00
Alfredo Cardigliano	d0d724ac80	Do not add is_engaged field for flow alerts as it is not required	2025-01-03 12:20:34 +01:00
Alfredo Cardigliano	24c3745810	Fix engaged alerts rendering for all families	2024-12-30 12:24:23 +01:00
Alfredo Cardigliano	25ee73bbe3	Fix alerts chart for alerts engaged before the time interval (#8795)	2024-12-30 12:02:54 +01:00
Alfredo Cardigliano	a5c59a2c48	Check max alert engage time to optimize queries (#8795)	2024-12-27 18:45:55 +01:00
Alfredo Cardigliano	e242395dd2	Show engaged time interval in alerts	2024-12-20 12:44:21 +01:00
Matteo Biscosi	02760c9303	Unified alert details page for ch and not (#8825)	2024-12-18 16:12:00 +01:00
Alfredo Cardigliano	d8d7330f11	Rework alert serialization. Change alert info format (info for all triggered alerts are now generated)	2024-12-10 13:27:57 +01:00
Matteo Biscosi	2a47b8667f	Fixes mac addresses alerts	2024-12-02 17:32:55 +01:00
Matteo Biscosi	f160e11007	Added is in memory parameter and removed port 0 (#8843)	2024-11-29 12:02:58 +01:00
Alfredo Cardigliano	8c0094f354	Fix flow alerts lookup for non predominant alerts (alerts_map_h/alerts_map_l integer columns)	2024-11-20 11:44:06 +01:00
Alfredo Cardigliano	a8cb1a3359	Fix network print	2024-11-19 09:46:14 +01:00
Alfredo Cardigliano	3d5a351508	Fix typo	2024-11-13 16:38:15 +01:00
Alfredo Cardigliano	2aa46f98ac	Implement aggregated page for all alert families	2024-11-12 16:22:06 +01:00
Alfredo Cardigliano	2da5925181	Fix all alerts page. Fix require attention results.	2024-11-11 15:59:58 +01:00
Alfredo Cardigliano	f3963c9eb1	Split alert_status (engaged, historical, acknowledged) and require_attention flag	2024-11-11 12:46:25 +01:00
Alfredo Cardigliano	6bde30030d	Check engaged alerts up to 1 day before to avoid full db scan	2024-11-11 10:50:58 +01:00
Alfredo Cardigliano	959f8b25cb	Remove useless condition for engaged alerts on flow alerts	2024-11-11 09:46:49 +01:00
Alfredo Cardigliano	7f8fd301aa	Show engaged alerts also in the Require Attention tab	2024-11-08 17:10:13 +01:00
Alfredo Cardigliano	04d2649911	Add comment on chart function	2024-11-08 17:00:41 +01:00
Alfredo Cardigliano	299057f119	Add ability to filter on alert status (#8795)	2024-11-08 16:16:56 +01:00
Alfredo Cardigliano	42dc80aa06	Fix tstamp condition to handle engaged alerts	2024-11-08 15:35:41 +01:00
Alfredo Cardigliano	7dedfa1a8c	Add schema for in-memory engaged_host_alerts table and host_alerts_view aggregated view on ClickHouse	2024-11-08 12:46:41 +01:00
Alfredo Cardigliano	ac48c01f57	Fix query count in case of no result	2024-11-08 09:52:48 +01:00
Alfredo Cardigliano	64028e3f8b	Add/remove engaged alerts from the in-memory db (currently working on SQLite)	2024-11-08 09:07:56 +01:00
Matteo Biscosi	88e9608e13	Added is engaged icon	2024-11-07 17:22:12 +01:00