Commit graph

136 commits

Author SHA1 Message Date
Simone Mainardi
68246efd01 Decouples periodic hash table updates using a thread pool 2019-10-27 17:40:07 +01:00
Alfredo Cardigliano
1332ca1b0d Increased syn scan default limit 2019-10-25 15:13:24 +02:00
Alfredo Cardigliano
96ef3c05e7 New alert when the number of idle entries in the hash tabel exceeds a configured threshold (implements #3005) 2019-10-25 14:29:37 +02:00
emanuele-f
1d5ff7c4e7 Remove global flow user scripts on/off 2019-10-25 13:12:47 +02:00
emanuele-f
f8ccfe24d8 Add flow scripts labels and descriptions 2019-10-25 12:16:19 +02:00
Alfredo Cardigliano
c29409673b Added alerts for TCP SYN Scan Host and Network as victims (implements #2963) 2019-10-24 16:59:33 +02:00
Alfredo Cardigliano
afbb34e262 TCP SYN Scan detection (implements #2963) 2019-10-24 15:35:26 +02:00
emanuele-f
0c96c49157 Avoid redis KEYS command for MUD 2019-10-23 11:24:33 +02:00
Alfredo Cardigliano
3f7d8726aa Fix flow key in external alerta 2019-10-22 17:38:59 +02:00
Alfredo Cardigliano
d05777df1e External alerts API update and cleanup 2019-10-22 15:08:06 +02:00
emanuele-f
b3374651ce Merge branch 'alerts_cleanup' into dev 2019-10-22 10:50:21 +02:00
emanuele-f
b3a8c6d49a Migrate C flow status alerts to Lua user scripts
- Alerts and flow status cleanup
- Community flow user scripts migration
- Implement scripts filters by l7 proto and packet interface only
- Migrate flow2statusinfojson
- Lower flow periodic update to 30 seconds if there is flow activity
- Display flow scripts without a gui section
2019-10-22 10:42:22 +02:00
Simone Mainardi
ab1687fb44 Fixes triggere/release of alerts at mixed granularities 2019-10-21 23:30:45 +02:00
Simone Mainardi
5b3f34b72a Fixes flapping of engaged alerts 2019-10-21 17:41:50 +02:00
Simone Mainardi
e80dc962f4 Optimizes host.getFullInfo with smaller functions in periodic scripts 2019-10-21 16:21:03 +02:00
Luca Deri
9190762a92 Removed work in progress script 2019-10-20 12:03:45 +02:00
Simone Mainardi
83715798ac Fixes 5-min host custom scripts taking too long 2019-10-18 19:18:48 +02:00
Simone Mainardi
945deec076 Minor fix 2019-10-18 18:55:49 +02:00
Simone Mainardi
a6571252fd Adds debug code do estimate cost of host.getFullInfo calls 2019-10-18 18:44:09 +02:00
Simone Mainardi
43d0b89bd9 Prevens tons of unnecessary calls to alerts_api.trigger() 2019-10-17 18:54:13 +02:00
Simone Mainardi
f8443ff03d Disk space reclaim and defrag of alerts db 2019-10-17 12:12:28 +02:00
emanuele-f
e0fd591db2 Add ability to reset a status bit 2019-10-16 16:21:18 +02:00
emanuele-f
9786581526 flow.getInfo now returns minimal information 2019-10-16 13:57:54 +02:00
emanuele-f
7a14a9cf11 Improvements in status definition API 2019-10-16 10:33:19 +02:00
Luca Deri
f0fd69e650 Updated script with trigger moved from protocol detected to idle/flow terminated 2019-10-15 22:17:43 +02:00
Luca Deri
3b5e56d802 Added script for detecting unidirectional UDP flows 2019-10-15 21:56:48 +02:00
emanuele-f
9ea7ff01b8 Improve flow alert trigger logic and fix support for custom message 2019-10-15 18:36:41 +02:00
emanuele-f
b217909966 Split flow status definitions in multiple files 2019-10-15 17:28:45 +02:00
Simone Mainardi
3950c3ddc8 Support for 5-min timeseries resolution in InfluxDB 2019-10-15 15:06:20 +02:00
emanuele-f
90cadaf560 Fix periodic scripts being called every minute with hasHighResolutionTs 2019-10-15 11:18:00 +02:00
Luca Deri
0a64d694a1 Warning fix 2019-10-14 11:20:33 +02:00
emanuele-f
2fdc860ed2 Add support for custom flow alerts in user scripts 2019-10-11 19:48:11 +02:00
emanuele-f
0ddc82d7db Port blacklisted flow alerts to new api 2019-10-11 16:32:37 +02:00
emanuele-f
cbfcff9633 Fix missing performed_lua_calls initialization 2019-10-11 14:36:34 +02:00
emanuele-f
7bd6feb622 Rename check_module -> user_script 2019-10-10 18:14:53 +02:00
emanuele-f
b8f1a039fb Fix always_enabled required for non-alert scripts 2019-10-10 18:03:36 +02:00
emanuele-f
75cf795521 Unify teardown function 2019-10-10 17:24:24 +02:00
emanuele-f
e7e2f43646 Fix Flow::isLuaCallPerformed 2019-10-10 15:17:41 +02:00
emanuele-f
09dcf4e7c6 Improve L4 protocol filter 2019-10-10 15:04:58 +02:00
emanuele-f
4c715c7d73 Implement L4 protocol filter in flow user scripts 2019-10-10 13:37:01 +02:00
Simone Mainardi
4ef7d35296 Benchmarks for hosts interface and network scripts 2019-10-10 11:54:31 +02:00
emanuele-f
ab0094c1c3 Unify syslog with user scripts API 2019-10-09 18:53:19 +02:00
Simone Mainardi
b9fa26174c Implements generalized benchmarks for any user_script 2019-10-09 18:48:01 +02:00
emanuele-f
e66889154c Migrate flow script documentation and document traffic element scripts 2019-10-09 17:23:51 +02:00
Simone Mainardi
a49e934570 Removes a debug print 2019-10-09 15:19:21 +02:00
Simone Mainardi
816f3819cc Removes overridden metatable in flow.lua 2019-10-09 15:17:43 +02:00
emanuele-f
ffd3b4c1ee Users scripts api changes and initial documentation 2019-10-09 15:12:28 +02:00
emanuele-f
ede9a7940a Generalize periodic and flows callbacks
Now periodic callbacks are properly called even when alerts are disabled
The granularity filter and check_function has been replaced with a more generic hooks list
2019-10-07 19:05:43 +02:00
Simone Mainardi
aa652145d0 Unifies flows, timeseries and top-talkers data retention
Implements #2897
2019-10-07 16:35:32 +02:00
Simone Mainardi
359599c4eb Removes static Flow::lua_method_id_to_name map moving it in a flow method 2019-10-07 12:32:50 +02:00