Simone Mainardi
68246efd01
Decouples periodic hash table updates using a thread pool
2019-10-27 17:40:07 +01:00
Alfredo Cardigliano
1332ca1b0d
Increased syn scan default limit
2019-10-25 15:13:24 +02:00
Alfredo Cardigliano
96ef3c05e7
New alert when the number of idle entries in the hash tabel exceeds a configured threshold (implements #3005 )
2019-10-25 14:29:37 +02:00
emanuele-f
1d5ff7c4e7
Remove global flow user scripts on/off
2019-10-25 13:12:47 +02:00
emanuele-f
f8ccfe24d8
Add flow scripts labels and descriptions
2019-10-25 12:16:19 +02:00
Alfredo Cardigliano
c29409673b
Added alerts for TCP SYN Scan Host and Network as victims (implements #2963 )
2019-10-24 16:59:33 +02:00
Alfredo Cardigliano
afbb34e262
TCP SYN Scan detection (implements #2963 )
2019-10-24 15:35:26 +02:00
emanuele-f
0c96c49157
Avoid redis KEYS command for MUD
2019-10-23 11:24:33 +02:00
Alfredo Cardigliano
3f7d8726aa
Fix flow key in external alerta
2019-10-22 17:38:59 +02:00
Alfredo Cardigliano
d05777df1e
External alerts API update and cleanup
2019-10-22 15:08:06 +02:00
emanuele-f
b3374651ce
Merge branch 'alerts_cleanup' into dev
2019-10-22 10:50:21 +02:00
emanuele-f
b3a8c6d49a
Migrate C flow status alerts to Lua user scripts
...
- Alerts and flow status cleanup
- Community flow user scripts migration
- Implement scripts filters by l7 proto and packet interface only
- Migrate flow2statusinfojson
- Lower flow periodic update to 30 seconds if there is flow activity
- Display flow scripts without a gui section
2019-10-22 10:42:22 +02:00
Simone Mainardi
ab1687fb44
Fixes triggere/release of alerts at mixed granularities
2019-10-21 23:30:45 +02:00
Simone Mainardi
5b3f34b72a
Fixes flapping of engaged alerts
2019-10-21 17:41:50 +02:00
Simone Mainardi
e80dc962f4
Optimizes host.getFullInfo with smaller functions in periodic scripts
2019-10-21 16:21:03 +02:00
Luca Deri
9190762a92
Removed work in progress script
2019-10-20 12:03:45 +02:00
Simone Mainardi
83715798ac
Fixes 5-min host custom scripts taking too long
2019-10-18 19:18:48 +02:00
Simone Mainardi
945deec076
Minor fix
2019-10-18 18:55:49 +02:00
Simone Mainardi
a6571252fd
Adds debug code do estimate cost of host.getFullInfo calls
2019-10-18 18:44:09 +02:00
Simone Mainardi
43d0b89bd9
Prevens tons of unnecessary calls to alerts_api.trigger()
2019-10-17 18:54:13 +02:00
Simone Mainardi
f8443ff03d
Disk space reclaim and defrag of alerts db
2019-10-17 12:12:28 +02:00
emanuele-f
e0fd591db2
Add ability to reset a status bit
2019-10-16 16:21:18 +02:00
emanuele-f
9786581526
flow.getInfo now returns minimal information
2019-10-16 13:57:54 +02:00
emanuele-f
7a14a9cf11
Improvements in status definition API
2019-10-16 10:33:19 +02:00
Luca Deri
f0fd69e650
Updated script with trigger moved from protocol detected to idle/flow terminated
2019-10-15 22:17:43 +02:00
Luca Deri
3b5e56d802
Added script for detecting unidirectional UDP flows
2019-10-15 21:56:48 +02:00
emanuele-f
9ea7ff01b8
Improve flow alert trigger logic and fix support for custom message
2019-10-15 18:36:41 +02:00
emanuele-f
b217909966
Split flow status definitions in multiple files
2019-10-15 17:28:45 +02:00
Simone Mainardi
3950c3ddc8
Support for 5-min timeseries resolution in InfluxDB
2019-10-15 15:06:20 +02:00
emanuele-f
90cadaf560
Fix periodic scripts being called every minute with hasHighResolutionTs
2019-10-15 11:18:00 +02:00
Luca Deri
0a64d694a1
Warning fix
2019-10-14 11:20:33 +02:00
emanuele-f
2fdc860ed2
Add support for custom flow alerts in user scripts
2019-10-11 19:48:11 +02:00
emanuele-f
0ddc82d7db
Port blacklisted flow alerts to new api
2019-10-11 16:32:37 +02:00
emanuele-f
cbfcff9633
Fix missing performed_lua_calls initialization
2019-10-11 14:36:34 +02:00
emanuele-f
7bd6feb622
Rename check_module -> user_script
2019-10-10 18:14:53 +02:00
emanuele-f
b8f1a039fb
Fix always_enabled required for non-alert scripts
2019-10-10 18:03:36 +02:00
emanuele-f
75cf795521
Unify teardown function
2019-10-10 17:24:24 +02:00
emanuele-f
e7e2f43646
Fix Flow::isLuaCallPerformed
2019-10-10 15:17:41 +02:00
emanuele-f
09dcf4e7c6
Improve L4 protocol filter
2019-10-10 15:04:58 +02:00
emanuele-f
4c715c7d73
Implement L4 protocol filter in flow user scripts
2019-10-10 13:37:01 +02:00
Simone Mainardi
4ef7d35296
Benchmarks for hosts interface and network scripts
2019-10-10 11:54:31 +02:00
emanuele-f
ab0094c1c3
Unify syslog with user scripts API
2019-10-09 18:53:19 +02:00
Simone Mainardi
b9fa26174c
Implements generalized benchmarks for any user_script
2019-10-09 18:48:01 +02:00
emanuele-f
e66889154c
Migrate flow script documentation and document traffic element scripts
2019-10-09 17:23:51 +02:00
Simone Mainardi
a49e934570
Removes a debug print
2019-10-09 15:19:21 +02:00
Simone Mainardi
816f3819cc
Removes overridden metatable in flow.lua
2019-10-09 15:17:43 +02:00
emanuele-f
ffd3b4c1ee
Users scripts api changes and initial documentation
2019-10-09 15:12:28 +02:00
emanuele-f
ede9a7940a
Generalize periodic and flows callbacks
...
Now periodic callbacks are properly called even when alerts are disabled
The granularity filter and check_function has been replaced with a more generic hooks list
2019-10-07 19:05:43 +02:00
Simone Mainardi
aa652145d0
Unifies flows, timeseries and top-talkers data retention
...
Implements #2897
2019-10-07 16:35:32 +02:00
Simone Mainardi
359599c4eb
Removes static Flow::lua_method_id_to_name map moving it in a flow method
2019-10-07 12:32:50 +02:00