Commit graph

7003 commits

Author SHA1 Message Date
Alfredo Cardigliano
49a1803555 Fix ip/vlan filters on flow alerts 2021-07-02 10:58:34 +02:00
MatteoBiscosi
04865c8938 Implements #5596 added external href to suspicious file transfer 2021-07-02 10:39:58 +02:00
Simone Mainardi
e70c16be27 Adds cog icon to configure checks from the flow details page
Addresses #5606
2021-07-01 17:28:37 +02:00
MatteoBiscosi
fcf4084a03 Fixes #5590 removed table.concat function and changed with tconcat 2021-07-01 16:30:23 +02:00
Simone Mainardi
68db177da4 Implements alert anchor in flow details
Implements #5606
2021-07-01 16:14:08 +02:00
Alfredo Cardigliano
24f9364c36 Handle special cases for engaged alerts with the new filtering engine 2021-07-01 15:37:43 +02:00
Alfredo Cardigliano
0a02f7a88e Cleanup unused function 2021-07-01 14:55:50 +02:00
Alfredo Cardigliano
f3dc40c1c0 Port 'role' filters to the new filtering engine 2021-07-01 14:48:58 +02:00
MatteoBiscosi
17cd2efb00 Implements #5587 behavior analysis enabled by the alerts 2021-07-01 13:57:09 +02:00
Simone Mainardi
2b58ed6708 Improve invalid host behavior - add flow alerts anchor
Implements #5603
2021-07-01 13:01:22 +02:00
Alfredo Cardigliano
6827241e13 Defer sql condition generation. Rework handling of special cases of conditions. Fix host/vlan filters. 2021-07-01 12:41:36 +02:00
Alfredo Cardigliano
25aa2c0a9f Engaged alert filtering (wip) 2021-07-01 09:42:47 +02:00
Alfredo Cardigliano
26868ca62c Set missing entities in alert definitions 2021-07-01 09:03:02 +02:00
Luca
336f1f3d9f Adding observationPoint support (WIP) 2021-06-30 20:03:37 +02:00
Alfredo Cardigliano
ae912ba460 Add comments 2021-06-30 18:45:13 +02:00
MatteoBiscosi
b487946452 Fixes #5590 concatenation using function 2021-06-30 18:32:36 +02:00
MatteoBiscosi
a8e187dece Fixes #5584 invalid table layout in ZMQ Interfaces 2021-06-30 17:35:45 +02:00
Alfredo Cardigliano
93459b0e67 Add filter on network name to modal 2021-06-30 17:19:43 +02:00
MatteoBiscosi
a04d1a25bf Removed concatenation and used the tconcat function 2021-06-30 17:22:19 +02:00
Simone Mainardi
7869d45208 Fixes actions for active monitoring alerts 2021-06-30 17:15:26 +02:00
Alfredo Cardigliano
cac020c537 Use build_where_clause to build where clause 2021-06-30 16:39:08 +02:00
Alfredo Cardigliano
85d0b0cffa Cleanup filters on ip 2021-06-30 16:33:57 +02:00
Alfredo Cardigliano
d92de684cf Rework add_time_filter 2021-06-30 16:27:05 +02:00
Alfredo Cardigliano
612c68f1f3 Remove return beraking loops 2021-06-30 16:09:05 +02:00
Alfredo Cardigliano
1e0c6287a2 Fix role filters 2021-06-30 15:57:26 +02:00
Alfredo Cardigliano
2c6e210552 Missing require. Debug cleanup. 2021-06-30 15:40:32 +02:00
Alfredo Cardigliano
b3eace3839 Fix role_cli_srv validation 2021-06-30 15:37:09 +02:00
Alfredo Cardigliano
18402ac55d Fix add_role_cli_srv_filter 2021-06-30 15:25:03 +02:00
Simone Mainardi
f14b38bd6b Implements alert sort by duration 2021-06-30 15:34:34 +02:00
Alfredo Cardigliano
d6e33043aa Add support for multiple tags of the same type in the alert filter (backend) 2021-06-30 15:18:47 +02:00
Simone Mainardi
0a6b513710 Implements ability to store/search/filter host alerts by cli/srv
Addresses #5575
2021-06-30 12:58:00 +02:00
l3wiz
b3b45ee522 Fixed layout in ZMQ interfaces (Issue #5584) 2021-06-30 12:48:17 +02:00
Alfredo Cardigliano
1d6a8bfe25 Accept list of filters for alerts 2021-06-30 11:38:26 +02:00
MatteoBiscosi
c601031299 Fixes chart labels not correct (#5582 #5583) 2021-06-30 11:42:28 +02:00
Alfredo Cardigliano
1627da8dfc Add support for multiple tags of the same type in the alert filter (frontend) 2021-06-30 11:10:11 +02:00
Simone Mainardi
2a7b32056a Unifies attacker/victim roles between flows and hosts 2021-06-30 11:03:00 +02:00
MatteoBiscosi
545d4b8f29 Fixes elephant flow error and copy constructor 2021-06-29 22:10:45 +02:00
Luca
fa5271b4d7 Implemented observationPoint menu support 2021-06-29 21:18:51 +02:00
Simone Mainardi
18cbfc5b3a Fixes for invalid checks for packet/non-packet interfaces
Addresses #5519
2021-06-29 18:43:00 +02:00
Alfredo Cardigliano
a8d08b2d3e Add support for more filter operators in alerts explorer 2021-06-29 18:25:45 +02:00
Simone Mainardi
f48670a557 Prevents loading nEdge-only checks on non-nEdge systems
Partially addresses #5519
2021-06-29 18:05:47 +02:00
MatteoBiscosi
be198c2a99 Added L7 iface proto behavior analysis and alert (#5499 #5474) 2021-06-29 16:50:56 +02:00
Simone Mainardi
755bad5985 Fixes alerts page broken in community due to missing snmp_utils.lua
Fixes #5580
2021-06-29 12:31:50 +02:00
Simone Mainardi
536423553f Fixes load of custom categories
Fixes #5578
2021-06-29 11:38:28 +02:00
Simone Mainardi
972d6610f3 Implements alert filters for local network alerts
Implements #5577
2021-06-29 10:57:39 +02:00
Simone Mainardi
9f93c823d9 Removes debug print 2021-06-28 14:56:55 +02:00
Luca
b43ea2c78e Initial work towards support of observation points 2021-06-28 14:56:25 +02:00
Simone Mainardi
e572f1e61e Batched iteration of hosts to build geomap (avoids large walks)
Addresses #5526
2021-06-28 14:54:32 +02:00
MatteoBiscosi
4620e5c72d Fixes alert utils null indexing 2021-06-28 12:41:56 +02:00
MatteoBiscosi
c3a85560a7 Fixes wrongly formatter used for behavior anomaly alert 2021-06-28 11:38:39 +02:00