Simone Mainardi
|
b7341506f7
|
Implements checks for script type and alert severity in dispatch_notification
|
2020-09-16 13:08:07 +02:00 |
|
Simone Mainardi
|
9e99fa1403
|
Uses new in-memory queues for alert recipients (avoid Redis)
|
2020-09-08 18:36:18 +02:00 |
|
Simone Mainardi
|
85f555a908
|
Removes intermediate alert queues - only leaves recipient queues
Implements #4366
|
2020-09-04 17:41:55 +02:00 |
|
Simone Mainardi
|
7f241d71d5
|
Implements attack mitigation via SNMP
Implements #3833 along with companion pro commit
|
2020-08-24 15:05:35 +02:00 |
|
Luca Deri
|
f5e572cb5e
|
Split pruge of idled entries from hashtable ste transition
|
2020-08-13 10:21:59 +02:00 |
|
Luca Deri
|
f7bddc7e0a
|
Improved low-threshold script skip
|
2020-08-12 11:36:51 +02:00 |
|
Luca Deri
|
10b27b12c8
|
Added check for reducing load pressure when too many idle flow instances are present in the system
|
2020-08-12 10:54:57 +02:00 |
|
Simone Mainardi
|
dc980bef0a
|
Adds anti-stall checks on host user scripts
|
2020-08-05 11:18:10 +02:00 |
|
Simone Mainardi
|
330234e3f7
|
Optimized hosts scripts using direct pool_id to retrieve config
|
2020-07-30 19:57:16 +02:00 |
|
Simone Mainardi
|
516451aa6c
|
Uses actual host pool id when executing host scripts
|
2020-07-30 11:39:15 +02:00 |
|
Simone Mainardi
|
4e96ae7e26
|
Refactors user_scripts method names
|
2020-07-29 15:17:31 +02:00 |
|
Simone Mainardi
|
c291fe91c9
|
Adds periodic_user_scripts.lua for the execution of periodic scripts
|
2020-07-29 14:47:11 +02:00 |
|
Simone Mainardi
|
8418d932ec
|
Avoids spawning num_interfaces + threads to update stats
|
2020-07-27 15:50:11 +02:00 |
|
Alfredo Cardigliano
|
f038baf804
|
Alerts are no longer enqueued if disabled
|
2020-07-23 00:49:28 +02:00 |
|
Simone Mainardi
|
92c88c7924
|
Migrates interface user scripts to the new interface pools configuration
|
2020-07-10 19:32:03 +02:00 |
|
Simone Mainardi
|
cf400216e2
|
Implements caching of member-to-confiset_id as Lua pool class member
|
2020-07-10 19:22:47 +02:00 |
|
Simone Mainardi
|
bd4921df55
|
Migrates local network user scripts to the new host pools configuration
|
2020-07-10 18:45:19 +02:00 |
|
Simone Mainardi
|
09c69edb22
|
Major rework of user_scripts.lua to use new pools
|
2020-07-10 13:01:29 +02:00 |
|
emanuele-f
|
340462ad73
|
Cleanup of the timeseries ring and NetworkInterfaceTsPoint
|
2020-05-20 15:18:03 +02:00 |
|
Simone Mainardi
|
b6447bbfb0
|
Implements ordering for flow Lua callbacks
|
2020-05-17 14:12:08 +02:00 |
|
Simone Mainardi
|
f3a5d7b10e
|
Fixes external suricata alerts
|
2020-04-28 20:37:50 +02:00 |
|
Alfredo Cardigliano
|
c22f3b00e1
|
Fix alert ids source match
|
2020-04-28 16:12:03 +02:00 |
|
Alfredo Cardigliano
|
963cff670f
|
Cleanup severity for external alerts
|
2020-04-27 18:04:41 +02:00 |
|
Simone Mainardi
|
83c4d36e34
|
Simplifies flow.triggerStatus using internal flow status reference
|
2020-04-27 17:48:56 +02:00 |
|
Simone Mainardi
|
efe4f9a8be
|
Unifies alerts generation format with flow statuses
|
2020-04-27 14:37:04 +02:00 |
|
Simone Mainardi
|
ab1690ad9e
|
Implements builders for each flow status definition
[FlowsK] alert_blacklisted_country.lua
[FlowsK] alert_flow_blacklisted.lua
[FlowsK] alert_device_protocol_not_allowed.lua
[FlowsK] external_alert.lua
[FlowsK] alert_potentially_dangerous_protocol.lua
[FlowsK] tls_certificate_mismatch.lua
[FlowsK] tls_certificate_expired.lua
[FlowsK] tls_malicious_signature.lua
[FlowsK] elephant_flows.lua
[FlowsK] not_purged.lua
[FlowsK] web_mining.lua
[FlowsK] potentially_dangerous.lua
[FlowsK] alert_flow_blocked.lua
|
2020-04-27 12:43:37 +02:00 |
|
Simone Mainardi
|
0a9a7015e0
|
Unifies status_id and status_key
|
2020-04-15 14:29:03 +02:00 |
|
Simone Mainardi
|
1eb02b2c2b
|
Unifies alert_id and alert_key
|
2020-04-15 14:29:03 +02:00 |
|
Simone Mainardi
|
e487427aab
|
Refactors alert_utils and enterprise_alert_utils
Addresses #3720
Alerts Refactor: alert_utils as module
Alerts Refactor: notify_ntopng_start and notify_ntopng_stop
Alerts Refactor: processAlertNotifications
Alerts Refactor: checkStoreAlertsFromC
Alerts Refactor: formatAlertNotification
Alerts Refactor: notification_timestamp_rev
Alerts Refactor: formatAlertMessage
Alerts Refactor: getConfigsetAlertLink
Alerts Refactor: alertNotificationActionToLabel
Alerts Refactor: flushAlertsData
Alerts Refactor: disableAlertsGeneration
Alerts Refactor: newAlertsWorkingStatus and other
Alerts Refactor: drawAlerts
Alerts Refactor: drawAlertTables
Alerts Refactor: printAlertTables
Alerts Refactor: checkDeleteStoredAlerts
Alerts Refactor: getUnpagedAlertOptions
Alerts Refactor: getTabParameters
Alerts Refactor: getAlerts
Alerts Refactor: getNumAlerts
Alerts Refactor: performAlertsQuery
Alerts Refactor: sec2granularity
Alerts Refactor: granularity2id
Alerts Refactor: granularity2sec
Alerts Refactor: alertEngineLabel
Alerts Refactor: alertEngine
Alerts Refactor: alertEngineRaw
Alerts Refactor: alertTypeDescription
Alerts Refactor: alertType
Alerts Refactor: alertTypeLabel
Alerts Refactor: alertTypeRaw
Alerts Refactor: alertSeverity
Alerts Refactor: alertSeverityLabel
Alerts Refactor: alertSeverityRaw
Alerts Refactor: get_make_room_keys
Alerts Refactor: enterprise_alert_utils
|
2020-04-10 14:03:20 +02:00 |
|
emanuele-f
|
c848ea2395
|
Fix script failure due to removed host.getLocalhostInfo
|
2020-04-02 18:42:52 +02:00 |
|
Alfredo Cardigliano
|
2425134f05
|
Replace isEnterprise with isEnterpriseM
|
2020-04-02 12:36:34 +00:00 |
|
Simone Mainardi
|
daf7f0a05c
|
Minor Fix
|
2020-04-01 13:12:55 +02:00 |
|
Simone Mainardi
|
a9776b5013
|
Documents internals periodic activities
|
2020-04-01 13:03:13 +02:00 |
|
Simone Mainardi
|
3144bc8bdf
|
Renames alert_config to user_script_config
|
2020-03-26 14:51:53 +01:00 |
|
emanuele-f
|
0facf0e27d
|
Implement host timeseries off/light/mode selection
Closes #3466
|
2020-03-03 15:52:04 +01:00 |
|
Alfredo Cardigliano
|
b3ceaf9db4
|
Moved external alert score computation (fix #3447)
|
2020-02-24 15:01:21 +01:00 |
|
Alfredo Cardigliano
|
dbe07bbfcd
|
Score computation fix (external alerts)
|
2020-02-24 12:27:48 +01:00 |
|
Simone Mainardi
|
a0612895fe
|
Implements slow rrd checks and updates in C
|
2020-02-19 19:28:07 +01:00 |
|
Simone Mainardi
|
a7ea7f76ed
|
Implements detection of slow timeseries append
|
2020-02-19 18:45:36 +01:00 |
|
Simone Mainardi
|
5b70db90ad
|
Handles deadlines for flow user scripts
|
2020-02-19 10:46:44 +01:00 |
|
Simone Mainardi
|
0e64fd94d6
|
Implements deadlines for periodic and user scripts
|
2020-02-18 18:44:41 +01:00 |
|
emanuele-f
|
58b3d42d22
|
Set max score on hosts contacting blacklisted hosts
|
2020-02-17 15:16:01 +01:00 |
|
emanuele-f
|
e3d3d3992f
|
Replace an existing flow alert if a more critical problem is found
Also add the flow score into the database
|
2020-02-07 19:20:57 +01:00 |
|
emanuele-f
|
0a0a3c4537
|
Rework flow status accounting
|
2020-02-07 19:17:07 +01:00 |
|
emanuele-f
|
13ec0d2f44
|
Use the flow score to determine the status priority
|
2020-02-07 19:17:07 +01:00 |
|
emanuele-f
|
96925a7e03
|
Fix invalid flow.triggerStatus calls
|
2020-02-06 10:31:22 +01:00 |
|
emanuele-f
|
c791fc1246
|
Add check to avoid nil config
|
2020-01-24 11:35:59 +01:00 |
|
Simone Mainardi
|
1cbdbbd339
|
Hides status_id from flow.{trigger,set,clear}Status
Fixes #3266
|
2020-01-21 12:27:33 +01:00 |
|
emanuele-f
|
dd8643ad79
|
Add missing community check
|
2020-01-20 13:21:38 +01:00 |
|
emanuele-f
|
aca088ea13
|
Add hyperlink to jump to the alert configuration
Closes #2936
|
2020-01-17 19:11:15 +01:00 |
|