Commit graph

98 commits

Author SHA1 Message Date
Luca Deri
6f2096d1cc timeseries dump changes for introducing custom callback 2022-09-28 23:49:13 +02:00
MatteoBiscosi
bf8fba8cf0 Removed no more used require 2022-09-13 17:57:40 +02:00
Luca Deri
7992446d9e Implements Local Hosts BlackList Check #6858 2022-09-09 22:51:12 +02:00
Luca Deri
704d4c31fe Fixed typo 2022-08-16 18:00:22 +02:00
Luca Deri
ac90e492a0 Added Stratosphere Labs Blacklist support 2022-08-16 17:56:24 +02:00
Alfredo Cardigliano
db99adaebe Set a dummy list name __gui__ for categories configured via GUI 2022-07-18 18:08:34 +02:00
Alfredo Cardigliano
fb8e748679 Handle ndpi failures loading host lists. Print failing entries 2022-07-18 15:23:45 +02:00
Luca
5e8769b1b5 Reworked builtin lists
- they are now defined in httpdocs/misc/lists in JSON formt
- built-in lists (ntop maintained) are stored in httpdocs/misc/lists/nultin
- custom lists go into httpdocs/misc/lists/custom
2022-07-11 19:18:16 +02:00
MatteoBiscosi
ffa48647ef Added ThreatFox malware list (#6341) 2022-05-20 17:54:21 +02:00
MatteoBiscosi
b2094f32eb Fixes nil name given to loading category 2022-05-06 09:56:29 +02:00
MatteoBiscosi
71cb504bac Added check to empty category list 2022-05-04 22:11:45 +02:00
Luca Deri
4397fae2e3 Added nDPI custom category file for IP-based categories 2022-04-26 14:44:03 +02:00
Luca Deri
f8c06f82f5 Removed firehol level 1 as it puts in the blacklist private and bogon addresses 2022-03-06 18:43:05 +01:00
Luca Deri
14b68e2568 Updated the malware/domain lists with new entries from abuse.ch and firehol 2022-03-02 12:40:35 +01:00
Alfredo Cardigliano
c8f879ee0c Add offline check setting up lists 2022-02-18 15:53:28 +01:00
Luca Deri
47b04d557e Disabled JA3 checkas it leads to false positivies 2022-01-20 22:24:48 +01:00
Alfredo Cardigliano
257ece18c0 Copyright update (Lua) 2022-01-03 09:42:33 +01:00
Luca Deri
b8206953a4 Feodo Tracker Botnet C2 IP Blocklist is not reloaded 4 times/day 2021-12-02 14:42:20 +01:00
Luca Deri
f98c2abba7 Disabling 'Snort IP Block List' download by default 2021-10-21 08:29:36 +02:00
Alfredo Cardigliano
bb297048c7 Add connectivity check at startup. If offline, check hourly. 2021-07-09 15:45:04 +02:00
Simone Mainardi
536423553f Fixes load of custom categories
Fixes #5578
2021-06-29 11:38:28 +02:00
Simone Mainardi
a160ccf2d6 Refactors callback to check #defines (c++) 2021-06-16 15:56:07 +02:00
Simone Mainardi
40f5c4e821 Refactors {flow,host}callbacks into {flow,host}checks (C++) 2021-06-16 15:27:38 +02:00
lucapruneti
fc7efc2a0c
issue_5404_download_alert_format-inconsistent (#5433)
* Change host alert function name to json

* Refactored *_alert_store function with format_json, added csv format tohost alert

* Added .vscode directory to gitignore

* Refactor alert_store:to_csv function to single loop format

* Removed no_data value for no records in alert csv download

* Implemented csv export for alerts

* Merge with dev

* Removed row_id alert field to be exported in csv

* Refactored alert/*/list.lua with simple decision value format construct

* Refactored alerts csv export

* Fix removed output test files

* Added alert csv export for subdocuments

* Modified gitignore
2021-06-04 08:49:31 +02:00
Simone Mainardi
49d28ccb44 Removes a debug flag 2021-06-03 14:21:11 +02:00
Simone Mainardi
27d6f53c4b Moves items_list.template to standard user_script_templates/ 2021-06-03 11:40:56 +02:00
Simone Mainardi
ccb61a7444 Harmonizes remaining hardcoded Lua scores 2021-05-15 11:00:20 +02:00
Simone Mainardi
d45ab54934 Harmonizes scores for Lua-triggered alerts
Addresses #5315
2021-05-12 12:56:12 +02:00
Simone Mainardi
bbe6a3de37 Changes set_severity to set_score 2021-05-05 09:59:04 +02:00
Simone Mainardi
c7082a4647 Implements new alerts database and drilldown
alert store skeleton

Alert database type changes

Implement alert store for host alerts. All alert store skeletons.

Fix class method access

Enable tracing

Implements simple queries for host alerts

Implement flow alert store

Fixes escaping of INSERT queries

Flow alerts database schema fixes

Adds escaping for alert JSON in flows and hosts

Implements queries .select() for alerts store

Adds limit and offset to perform paginated queries

Adds new REST getter for flow alerts

Name changes alert_severity to severity, alert_json to json

Fixes alert message not shown

Implement active monitoring alerts store

Implements sort of queries in the new dataabase

Changes alert_type to alert_id

Implement mac alerts store

Fixes flow alert messages

Implement system alerts store

Implement snmp alert store

Add missing items to the flow alerts

Add missing items to the host alerts

Add missing items to the mac alerts

Implements COUNT aplerts api

Add device_name to snmp alerts

add flow alerts templates

updated gitignore

fix for missing order field

add families defined in `alert_store_schema.sql`

Reworks and simplifies alert store subclasses

Implements REST API to fetch alert timeseries

Fixes date in flow REST api

Host alert json fix

Add get/host/alert/list.lua

Move alert/list.lua to alert/past/list.lua

Add alert/past/list.lua for all alert families

Add entity_id to system table to identify the alert type based on <alert_id, entity_id>

Add missing field

Implements facilities to query engaged alerts via REST

Handle both historical and past alerts in alert/list.lua

Fix count

Update params of select_historical

Implement method to add family-specific filters

Add alert/ts.lua for all alert families

Implements facilities and REST endpoints to delete alerts

Implements ordering of alert queries

Fix add_order_by group_by

Rest API tests update

Tests output update

Remove debug trace

Use alert_id instead of type. Add more flow alert info.

Update http lint

Format obsolete tlv version alerts. Add more host info.

Add row_id to list of alerts

Fix selection of engaged alerts

Add test for mac alerts (bcast domains)

Removes attempt to format alerts as flow alerts

Fixes interface selection for active monitoring

Update test output with rest changes

Add more fields to be ignores

Set alert count to 1 for the time being

add bar timeseries chart

add apexcharts

improvements on timeseries bar chart

registered chart callbakcs

working on alert page

fix for date format

Fixes acrive monitoring REST API

Fixes alignment of grouped alert data

Additional fix for alert histogram

remove useless if

formatting alerts page

fixes on flows alert stats table

rename local networks to device

format host pagie in alert_stats

add tag support for hosts and flow

implemented single delete action

add release modal

Fixes format of threshold cross interface alerts

Fixes wrong increase of dropped alerts

Implements exclusion list for invalid dns queries

Reworks exclusions lists for hosts and flows

Addresses #5212
Addresses #5113

Adds host alert keys in host callbacks definitions

Adds alert ids to flow callbacks

fix for not working button (#5215)

Fixes reported timeseries name

removed any additional button inside chart's toolbar (#5200)

Add tables for interfaces, networks, users to the schema. Skeleton alert_store classes

fixed broken range picker layout in firefox (#5199)

Alert insert fixes

Add more info to network alerts

Add rest endpoint for interface, network, user alerts

Fix endpoint selection in alerts_stats

Unifies columns between engaged and past alerts

Fixes Missing mandatory 'alert_granularity'

Minor fixes for missing alert_severity

Fixes arithmetic on a nil value (field 'last_seen')

Fixes get/system/alert/list.lua

use tstamp for column names (#5221)

Implements host alert formatter

Add alerts_store format_record_common

Use common format_record for am, system alerts

Use common format_record for all alerts

Fixes formatting of alerts of all types

Fixes nil in function 'hostinfo2label'

fixes on disable modal

add pages for network, user and interface endpoint (#5224)

Set alert_entity in all classes

Unifies influxdb alerts into system alerts

Addresses #5224

Unifies process alerts into system alerts

Addresses #5224

Cleanup unused periodicActivityEntity

Unifies category lists alerts into system alerts

Addresses #5224

Aligns new alert enums

Addresses #5224

Fixes alert page links

Fixes insertion of interface alerts

Implement filters for Host alerts

Fixes active monitoring alerts not triggering

Implement filters on flow alerts

Fixes for internal alerts timestamp and subtype

implements disable for the alerts

formatted alert disable label

Add address and device type to mac alert records

fix for delete alert toggle

Fix access to entity_val in alert_unexpected_new_device

add mac address and device type inside table

Fixes for new alert fields not handled

Fixes alert_definitions to handle new fields

Add ip/port to snmp alert records

Implements deletion of stored flow alerts

Add alert_name to all alert records via rest. Fix duration.

fixes for snmp tab

Implements delete of past host alerts

Add name to snmp alert records

fixes on system tab

Fix Date column

fixes link

Update menu

Fixes bad argument #3 to 'format' in snmp alerts

updated interface link

new alerts url for host (#5228)

Fixes sort of engaged alert

Minor cleanup

Fixes data returned for local network alerts

Fix duration for one shot. Note.

Fix duration override

Fixes interface selection for system alerts

Move host alert page

fixes for local network tab

Minor fix

Fix engaged host alerts

fixes on user tab

Fix alert_user_activity message
2021-04-26 19:41:34 +02:00
Luca Deri
eaa4cbd1e8 Updated changed URL for snort IP block list 2021-03-27 08:56:11 +01:00
Luca Deri
146a4b8c9a Added warning 2021-03-18 10:09:48 +01:00
Alfredo Cardigliano
3e2a1943c1 Printing as standard message bad domain occurrences in imported lists 2021-03-16 09:52:55 +01:00
Alfredo Cardigliano
db9adb9060 Add support for Malicious JA3 signature using nDPI (#5045) 2021-02-23 18:35:19 +01:00
Matteo Biscosi
04e4ab425f Implements correctly manual category list update
Implements #4953
2021-02-15 11:44:23 +01:00
Luca Deri
c7bd604a19 Added URLhaus to category lists 2021-02-03 22:18:29 +01:00
Matteo Biscosi
9c741916c9 Implements #4953 disable auto update blocklists and perform manually 2021-02-02 17:52:48 +01:00
Luca Deri
a1178a0791 Updated (C) 2021-01-02 12:08:23 +01:00
Simone Mainardi
19ceb22095 Fixes broken list download succeeded alert 2020-12-24 10:26:29 +01:00
Simone Mainardi
6bb8a1cd68 Fixes list download succeeded alerts 2020-12-24 10:20:05 +01:00
Matteo Biscosi
101c53336e Migrates alerts to an object-oriented implementation 2020-12-23 11:46:26 +01:00
Simone Mainardi
b3dc39c641 Refactors alert_severities into an independend Lua module 2020-11-30 15:28:17 +01:00
Luca Deri
a2e436213e Removed list https://hosts-file.net/ad_servers.txt as it is no longer existing 2020-11-06 23:15:35 +01:00
Luca Deri
ea83944609 Cosmetic message changes 2020-10-29 09:46:29 +01:00
Simone Mainardi
d3dda0bb82 Unifies misbehaving with alerted flows
Implements #4596
2020-10-16 18:58:20 +02:00
Luca Deri
77ab1e3a8a Added fix for #4534
- in case of startup crash and automtic restart, ntopng would reload lists resetting errors. This caused the storm of updates
- updated the URL to https://snort.org/downloads/ip-block-list
- in case of failure we retry the URL only once (it used to be twice) after one hour.
2020-10-15 17:17:35 +02:00
Simone Mainardi
4b1329c7c0 Fixes list download failed alert message 2020-10-14 15:12:32 +02:00
Simone Mainardi
5d80b67327 Adds info-level alerts upon successful lists download
Addresses #4554
2020-10-14 15:08:01 +02:00
Simone Mainardi
0a7b0214ea Fixes format of list hosts and adds debug 2020-10-08 15:46:31 +02:00
Simone Mainardi
0353ac7985 Fixes attempt to index a nil value (local 'list') 2020-06-22 19:22:52 +02:00