Simone Mainardi
377ecf5c3f
Fixes user script ip_reassignment.lua after configset changes
2021-03-01 19:07:30 +01:00
Alfredo Cardigliano
fa311e3ade
Rework user script working sets (a single configset is supported now)
2021-03-01 15:37:45 +01:00
Simone Mainardi
ca863efc56
Fixes recipients.lua: attempt to index a nil value
...
Fixes #5077
2021-03-01 11:07:53 +01:00
Alfredo Cardigliano
47b3c8a969
Check low goodput for established connections (e.g. do not generate alerts for connection reset with 0 goodput) ( #5068 )
2021-02-26 16:39:15 +01:00
Matteo Biscosi
39d3618351
Fixes flow alerts table column width and description
2021-02-26 16:10:48 +01:00
Alfredo Cardigliano
4f0ac39efe
Add more protocols to be filtered ( #5068 )
2021-02-26 15:36:37 +01:00
Matteo Biscosi
fa5088d49b
Removed useless description from some flow alert
2021-02-26 12:58:06 +01:00
Matteo Biscosi
e521ce6cdc
Removed incorrect scripts from flow interfaces
...
This alerts shouldn't be used in flow interfaces but only in packets one because the flow interfaces doesn't have/have incorrect informations regaring these fields
2021-02-26 12:35:16 +01:00
Simone Mainardi
36e26cd0fc
Cleanup old ip reassignment / remote to remote alerts code
...
Fixes #5038
2021-02-26 11:36:21 +01:00
Simone Mainardi
76006d6250
Fixes IP reassignment code that is now per-interface
...
Implements #5038
2021-02-26 11:21:04 +01:00
Matteo Biscosi
41163ac7f6
Implements low risk alert type must be further split
...
Implements #5066
2021-02-25 19:09:17 +01:00
Matteo Biscosi
6a4c6cf30c
Implements noisy low goodput alert
...
Implements #5068
2021-02-25 12:21:29 +01:00
Matteo Biscosi
dbfdec34fe
Implements Local Host behaviour analysis and it's alert
...
Alert in case the host has an unexpected behaviour
2021-02-25 12:04:05 +01:00
Matteo Biscosi
49ae038c3f
Implements #5038 cleanup IP reassigment code
...
Removed debug print and used setPref instead of setCache
2021-02-25 11:00:09 +01:00
Matteo Biscosi
9632c62bfa
Implements cleanup IP reassignment code
...
Implements #5038
2021-02-19 15:36:27 +01:00
Simone Mainardi
c70c635e3f
Fixes TLS-risks sometimes handled twice
2021-02-18 14:45:02 +01:00
Simone Mainardi
823c6ddc81
Fixes flow risks no longer triggering
2021-02-18 11:20:17 +01:00
Simone Mainardi
9314f36cc5
Fixes remote to remote alerts setting nil scores
2021-02-18 10:59:36 +01:00
Matteo Biscosi
0c0ba319c2
Modified default fields for flow risk alert
2021-02-17 11:55:07 +01:00
Matteo Biscosi
711bcb21d0
Added exclusion list to the flow risk script
2021-02-17 11:46:45 +01:00
Simone Mainardi
f4dff6f2e7
Implements risk-based filtering of flow alerts
2021-02-16 15:25:20 +01:00
Alfredo Cardigliano
910974da91
Update alert type for external alert ( fix #5037 )
2021-02-15 18:12:39 +01:00
Alfredo Cardigliano
f245caf83c
Deterministic selection of flow risk
2021-02-12 17:47:54 +01:00
Simone Mainardi
6d651f0661
mplements layer-4 protocol as filter for flow user scripts
2021-02-12 16:25:45 +01:00
Simone Mainardi
c0ee292530
Implements l7_proto as filter for flow user scripts
2021-02-12 16:08:27 +01:00
Simone Mainardi
84ac0f4dfc
Implements filtering of flow user scripts
2021-02-12 12:56:06 +01:00
Simone Mainardi
fefc3c39b0
Reworks user script filters lint and functions
2021-02-11 17:59:35 +01:00
Matteo Biscosi
d6d0780507
Implements add the ability to suppress specific alerts
...
Implements #4942
2021-02-11 17:13:07 +01:00
Matteo Biscosi
769658268f
Implements add the ability to suppress specific alerts
...
Implements #4942
Partially implemented alerts exclusion list
Added User Script exclusion list to settings
Implements add the ability to suppress specific alerts
Implements #4942
2021-02-10 15:35:54 +01:00
Simone Mainardi
146b8fc1b0
Adds skeleton for alerts exclusion lists
...
Addresses #4942
2021-02-05 09:41:50 +01:00
Matteo Biscosi
d3853aaf90
Implements internet resources misuse script with exception list
...
Implements #4984
2021-02-04 15:10:52 +01:00
Matteo Biscosi
88251ea79d
Implements #4984 core Internet resources misuse script
...
Fixes no release by the alert
2021-02-03 15:42:14 +01:00
Simone Mainardi
63bd289bbf
Fixes for contacts-based alerts
2021-02-03 15:16:41 +01:00
Simone Mainardi
12fd088bce
Fixes SMTP Contacts default
2021-02-03 14:31:08 +01:00
Matteo Biscosi
eba1aaa359
Implements #4984 core Internet resources misuse script
2021-02-03 12:41:18 +01:00
Alfredo Cardigliano
570bce94f7
Add missing default values. Format bytes with the proper unit.
2021-02-02 16:38:31 +01:00
Simone Mainardi
4f717649e1
Removes multiple score increases for TCP zero window alerts
...
Fixes #4993
2021-02-02 10:34:37 +01:00
Simone Mainardi
38d31a474a
Makes multiple score increments status-dependent
...
Implements #4993
2021-01-30 12:45:04 +01:00
Matteo Biscosi
76765da78b
Implements #4984 core Internet resources misuse script
2021-01-29 18:15:06 +01:00
Alfredo Cardigliano
b3cf18d821
Rename alert_tls_old_version -> alert_tls_old_protocol_version everywhere for consistency
2021-01-29 11:10:43 +01:00
Matteo Biscosi
0fbe214a60
Removed default severity from some alerts
2021-01-29 10:51:31 +01:00
Matteo Biscosi
da9dc17f25
Fixed remote to local alert wrong parameter
2021-01-28 23:34:46 +01:00
Matteo Biscosi
b1134b611f
Added to double severity alert, single default alert
...
Implements #4919
2021-01-28 18:18:22 +01:00
Matteo Biscosi
10fb8bbecc
Implements #4919 custom alert severity
2021-01-27 12:29:19 +01:00
Matteo Biscosi
cdc420dd68
Fixed #2977 alert for remote->local insecure protocols
2021-01-20 11:56:56 +01:00
Matteo Biscosi
8a232fec62
Fixed #4914 Alert/Error In home system screen
2021-01-14 16:50:22 +01:00
Simone Mainardi
46e3c10c36
Typos
2021-01-11 14:38:02 +01:00
Simone Mainardi
2cdaeb13e7
Fixes external alerts (incl. Suricata) not working after migration
...
Fixes #4895
2021-01-11 11:11:31 +01:00
Simone Mainardi
ad59b61245
Implements dropdown search for interfaces
...
Partially addresses #4800
2021-01-08 17:45:41 +01:00
Simone Mainardi
1aaf92e843
Reworks attacker/victim in alerts
2021-01-07 19:03:42 +01:00
