Commit graph

702 commits

Author SHA1 Message Date
Simone Mainardi
132dccf362 Implements filter to see acknowledged alerts
Addresses #5600
2021-07-06 14:26:25 +02:00
MatteoBiscosi
17cd2efb00 Implements #5587 behavior analysis enabled by the alerts 2021-07-01 13:57:09 +02:00
Alfredo Cardigliano
b3eace3839 Fix role_cli_srv validation 2021-06-30 15:37:09 +02:00
Simone Mainardi
0a6b513710 Implements ability to store/search/filter host alerts by cli/srv
Addresses #5575
2021-06-30 12:58:00 +02:00
Alfredo Cardigliano
1d6a8bfe25 Accept list of filters for alerts 2021-06-30 11:38:26 +02:00
Luca
fa5271b4d7 Implemented observationPoint menu support 2021-06-29 21:18:51 +02:00
MatteoBiscosi
be198c2a99 Added L7 iface proto behavior analysis and alert (#5499 #5474) 2021-06-29 16:50:56 +02:00
Simone Mainardi
6121eec89c Implements ability to filter/search iface alerts by subject
Addresses #5563
2021-06-24 16:44:23 +02:00
Simone Mainardi
e33af8a23c Refactors script_categories into check_categories (c++ and lua) 2021-06-16 18:43:55 +02:00
Simone Mainardi
76fd315d1b Refactors user_scripts into checks (lua) 2021-06-16 18:02:22 +02:00
Alfredo Cardigliano
6624e382ab HaEnable support for OR in ninde flow explorer. Cleanup operator separator (configured in tag_utils). Cleanup code. 2021-06-14 17:26:50 +02:00
Alfredo Cardigliano
20eeb76f7e Fix cetegory id validation 2021-06-10 15:51:12 +02:00
Matteo Biscosi
0d2b764c84 Added asn to nindex flows (#5468) 2021-06-09 15:34:56 +02:00
Matteo Biscosi
06724ea8e8 Fixes nIndex 0 ports for non TCP/UDP (#5447) 2021-06-07 09:33:49 +02:00
Matteo Biscosi
40e7427f82 Added pref for timestamp column in flow tables (#5392) 2021-06-04 17:38:22 +02:00
Matteo Biscosi
5dfcf415cf Fixes 0 port not filtered in nindex 2021-06-04 09:53:31 +02:00
Alfredo Cardigliano
a097c85052 Remove attacker2victim/victim2attacker columns. Add icons for attacker/victim. Add has_attacker/has_victim fitlers. (fix #5302) 2021-05-25 12:42:44 +02:00
Alfredo Cardigliano
c8731f5bfa Add filter support for host role (attacker/victim) 2021-05-14 19:37:56 +02:00
Alfredo Cardigliano
064c20db29 Implement support for alert filters using a dialog (WIP) 2021-05-13 19:02:28 +02:00
Alfredo Cardigliano
aea96c3bbc Fix filter on alert_id 2021-05-11 14:06:07 +02:00
Simone Mainardi
917a3add9f Removes debug flag flow_only_interface 2021-05-06 11:51:50 +02:00
Simone Mainardi
ddc3c3de6b Implements ability to disable all alerts
Implements #5283
2021-05-05 13:07:19 +02:00
Simone Mainardi
83f0c38937 Massive cleanup of old alerts code 2021-05-03 18:16:46 +02:00
Simone Mainardi
44861bcc0c Fixes deletion of old alerts 2021-05-03 16:48:30 +02:00
Alfredo Cardigliano
92b4ae4828 Alerts DB housekeeping 2021-04-29 19:31:49 +02:00
Simone Mainardi
c4afa4e833 Fixes VLAN filters not honored in past host alerts 2021-04-27 12:10:08 +02:00
Simone Mainardi
2278926da4 Merge branch 'alerts-store' into dev 2021-04-26 19:59:30 +02:00
Simone Mainardi
c7082a4647 Implements new alerts database and drilldown
alert store skeleton

Alert database type changes

Implement alert store for host alerts. All alert store skeletons.

Fix class method access

Enable tracing

Implements simple queries for host alerts

Implement flow alert store

Fixes escaping of INSERT queries

Flow alerts database schema fixes

Adds escaping for alert JSON in flows and hosts

Implements queries .select() for alerts store

Adds limit and offset to perform paginated queries

Adds new REST getter for flow alerts

Name changes alert_severity to severity, alert_json to json

Fixes alert message not shown

Implement active monitoring alerts store

Implements sort of queries in the new dataabase

Changes alert_type to alert_id

Implement mac alerts store

Fixes flow alert messages

Implement system alerts store

Implement snmp alert store

Add missing items to the flow alerts

Add missing items to the host alerts

Add missing items to the mac alerts

Implements COUNT aplerts api

Add device_name to snmp alerts

add flow alerts templates

updated gitignore

fix for missing order field

add families defined in `alert_store_schema.sql`

Reworks and simplifies alert store subclasses

Implements REST API to fetch alert timeseries

Fixes date in flow REST api

Host alert json fix

Add get/host/alert/list.lua

Move alert/list.lua to alert/past/list.lua

Add alert/past/list.lua for all alert families

Add entity_id to system table to identify the alert type based on <alert_id, entity_id>

Add missing field

Implements facilities to query engaged alerts via REST

Handle both historical and past alerts in alert/list.lua

Fix count

Update params of select_historical

Implement method to add family-specific filters

Add alert/ts.lua for all alert families

Implements facilities and REST endpoints to delete alerts

Implements ordering of alert queries

Fix add_order_by group_by

Rest API tests update

Tests output update

Remove debug trace

Use alert_id instead of type. Add more flow alert info.

Update http lint

Format obsolete tlv version alerts. Add more host info.

Add row_id to list of alerts

Fix selection of engaged alerts

Add test for mac alerts (bcast domains)

Removes attempt to format alerts as flow alerts

Fixes interface selection for active monitoring

Update test output with rest changes

Add more fields to be ignores

Set alert count to 1 for the time being

add bar timeseries chart

add apexcharts

improvements on timeseries bar chart

registered chart callbakcs

working on alert page

fix for date format

Fixes acrive monitoring REST API

Fixes alignment of grouped alert data

Additional fix for alert histogram

remove useless if

formatting alerts page

fixes on flows alert stats table

rename local networks to device

format host pagie in alert_stats

add tag support for hosts and flow

implemented single delete action

add release modal

Fixes format of threshold cross interface alerts

Fixes wrong increase of dropped alerts

Implements exclusion list for invalid dns queries

Reworks exclusions lists for hosts and flows

Addresses #5212
Addresses #5113

Adds host alert keys in host callbacks definitions

Adds alert ids to flow callbacks

fix for not working button (#5215)

Fixes reported timeseries name

removed any additional button inside chart's toolbar (#5200)

Add tables for interfaces, networks, users to the schema. Skeleton alert_store classes

fixed broken range picker layout in firefox (#5199)

Alert insert fixes

Add more info to network alerts

Add rest endpoint for interface, network, user alerts

Fix endpoint selection in alerts_stats

Unifies columns between engaged and past alerts

Fixes Missing mandatory 'alert_granularity'

Minor fixes for missing alert_severity

Fixes arithmetic on a nil value (field 'last_seen')

Fixes get/system/alert/list.lua

use tstamp for column names (#5221)

Implements host alert formatter

Add alerts_store format_record_common

Use common format_record for am, system alerts

Use common format_record for all alerts

Fixes formatting of alerts of all types

Fixes nil in function 'hostinfo2label'

fixes on disable modal

add pages for network, user and interface endpoint (#5224)

Set alert_entity in all classes

Unifies influxdb alerts into system alerts

Addresses #5224

Unifies process alerts into system alerts

Addresses #5224

Cleanup unused periodicActivityEntity

Unifies category lists alerts into system alerts

Addresses #5224

Aligns new alert enums

Addresses #5224

Fixes alert page links

Fixes insertion of interface alerts

Implement filters for Host alerts

Fixes active monitoring alerts not triggering

Implement filters on flow alerts

Fixes for internal alerts timestamp and subtype

implements disable for the alerts

formatted alert disable label

Add address and device type to mac alert records

fix for delete alert toggle

Fix access to entity_val in alert_unexpected_new_device

add mac address and device type inside table

Fixes for new alert fields not handled

Fixes alert_definitions to handle new fields

Add ip/port to snmp alert records

Implements deletion of stored flow alerts

Add alert_name to all alert records via rest. Fix duration.

fixes for snmp tab

Implements delete of past host alerts

Add name to snmp alert records

fixes on system tab

Fix Date column

fixes link

Update menu

Fixes bad argument #3 to 'format' in snmp alerts

updated interface link

new alerts url for host (#5228)

Fixes sort of engaged alert

Minor cleanup

Fixes data returned for local network alerts

Fix duration for one shot. Note.

Fix duration override

Fixes interface selection for system alerts

Move host alert page

fixes for local network tab

Minor fix

Fix engaged host alerts

fixes on user tab

Fix alert_user_activity message
2021-04-26 19:41:34 +02:00
Matteo Biscosi
ddd366e429 Implements Flow Status and DSCP filter in nindex 2021-04-20 12:21:35 +02:00
Matteo Biscosi
3cb65f4b49 Added reset button for blacklisted flow stats 2021-04-19 18:46:02 +02:00
Matteo Biscosi
9fc31a68db Added top talkers and top scores for the new dashboard 2021-04-07 15:23:51 +02:00
Alfredo Cardigliano
9ed3afd918 Add Emit Host Alerts pref (fix #5154) 2021-04-07 09:21:26 +02:00
Matteo Biscosi
91a495f496 Implemented nindex select based on the visible columns 2021-04-02 16:54:15 +02:00
gabryon99
4b794a8d6b add visible_columns paramater and removed columns from get request 2021-04-02 14:21:58 +02:00
Matteo Biscosi
e41fefda67 Added Flow risk column to nindex and new filters to nindex page 2021-04-01 18:20:23 +02:00
Matteo Biscosi
6f29186743 Added bytes and packets filter to new nindex table 2021-03-30 12:06:09 +02:00
Matteo Biscosi
faa699328e Fixed l7proto filtering not working 2021-03-29 18:55:43 +02:00
Matteo Biscosi
778ba880bf Added support for operators used by nindex new table 2021-03-29 17:03:37 +02:00
gabryon99
adb3a690e9 removed duplicated length 2021-03-25 10:24:58 +01:00
gabryon99
25b9d99cd0 minor improvements on nindex_flows.lua 2021-03-25 09:40:21 +01:00
Luca Deri
d216d5573a Added server side datatable handling 2021-03-24 18:10:35 +01:00
Matteo Biscosi
b176f1098a Added support for Uppercase lvl 4 proto 2021-03-24 15:38:43 +01:00
Luca Deri
d1d203a479 Fixed missing validation 2021-03-24 15:16:47 +01:00
Matteo Biscosi
c7b5a07ec2 Fixes past alerts filter not working 2021-03-23 09:35:09 +01:00
Luca
e2f619c281 Added the ability to turn off (via preferences) flow alerts generation that is enabled by default. 2021-03-22 12:27:26 +01:00
Simone Mainardi
f61ffc045b Merge branch 'c-user-scripts' into dev 2021-03-22 10:36:13 +01:00
Simone Mainardi
aea9138bfb Implements flow callbacks and alerts in C++ 2021-03-22 09:51:36 +01:00
gabryon99
7fe316a568 add save/load functions for the table view 2021-03-19 13:34:31 +01:00
gabryon99
59725e0355 add a test page containing datetimepicker range 2021-03-09 13:50:15 +01:00
Alfredo Cardigliano
fa311e3ade Rework user script working sets (a single configset is supported now) 2021-03-01 15:37:45 +01:00