Simone Mainardi
9c0f7499e7
Reduces redis traffic for alerts checks
2017-05-03 13:23:28 +02:00
Simone Mainardi
0586a814ea
Optimizes oldest alerts cleanup
2017-05-03 12:41:36 +02:00
Simone Mainardi
4eeae18cef
Adds alert notes and descriptions
2017-05-02 22:13:43 +02:00
Simone Mainardi
d85302d80f
Fixes host activity alert
2017-05-02 17:19:06 +02:00
emanuele-f
a5e528047d
Use a single redis key to read all host anomalies configuration
2017-05-02 15:38:39 +02:00
emanuele-f
21594b834d
Separate syn/flow attacker and victim alert thresholds
2017-04-30 20:07:58 +02:00
Emanuele Faranda
8b8974e56c
Alerts improvements ( #1204 )
...
* Implement flow flood alert
* Remove alerts general settings
* Implement global threshold alerts for hosts, networks and interfaces
* Implement global anomaly alert configuration, lua side
* Make the global thresholds not bound to the interface
* Implement global anomaly alert configuration, C side
* Make the engaged alerts cache per interface to avoid conflics
2017-04-29 12:19:49 +02:00
emanuele-f
a53ec8b131
Force the release of expired alerts
2017-04-28 16:30:23 +02:00
emanuele-f
cc3191bc4f
Remove flapping-checking code in alert counter
2017-04-27 11:13:40 +02:00
emanuele-f
8b72607c38
Migrate interface alerts to lua logic
2017-04-27 11:07:04 +02:00
emanuele-f
63402a848d
Invalidate cache on alerts delete
2017-04-26 18:04:11 +02:00
emanuele-f
22d9d3ad2c
Fix single alert delete
2017-04-26 17:10:05 +02:00
emanuele-f
5e663675f2
Fix flows shown in interface alert configuration
2017-04-26 16:16:12 +02:00
Simone Mainardi
57b592c905
Fixes invalid use of alert engine
2017-04-26 16:09:55 +02:00
emanuele-f
1545dcb73e
Host Flows alert becomes a threshold alert
2017-04-26 15:50:54 +02:00
emanuele-f
4afe4328eb
Enable SYN flood/victim alert generation
2017-04-26 11:23:23 +02:00
emanuele-f
bae63434c1
Implement engaged alerts cache
2017-04-24 17:24:31 +02:00
Simone Mainardi
7b13e2e6a1
Adds an engine id to the engaged alerts
2017-04-24 12:22:47 +02:00
emanuele-f
43b3a7f078
Fix AlertCounter based host alerts
2017-04-22 19:48:09 +02:00
emanuele-f
04e01c24b0
Re-enable alerts generation. Use structured format functions.
2017-04-22 18:58:32 +02:00
emanuele-f
bfd2759eeb
Move global status to local status
2017-04-22 17:09:23 +02:00
emanuele-f
a4a7f0d12f
Restructure code to use the upcoming alerts cache
2017-04-22 15:20:43 +02:00
emanuele-f
5892319880
Update in-memory hosts alert configuration when the configuration changes
...
Also fixes invalid redis key used to check host alerts trigger
2017-04-20 19:09:52 +02:00
Simone Mainardi
9fb24219e4
Passes host detected anomalies to lua
2017-04-20 18:50:05 +02:00
emanuele-f
0a1a6c0a2b
Remove alert rearming logic
2017-04-20 12:08:13 +02:00
emanuele-f
40828f2b66
Improve alert edges description and fix configuration fields width
2017-04-04 11:52:28 +02:00
emanuele-f
a0a767abbc
Add host activity duration alert
2017-03-27 18:46:58 +02:00
Luca Deri
d358712f59
Optimized purging
...
Minor lua code cleanup
2017-03-13 22:47:30 +01:00
Josh Soref
78e78c018c
Fixes spellings and typos
...
Thank goes to
Josh Soref <jsoref@users.noreply.github.com>
2017-03-06 17:54:48 +01:00
emanuele-f
88d2a3796c
Fix parameter
2017-02-22 01:18:07 +01:00
emanuele-f
4a5f0cf8a3
Fix wrong quote in alerts
2017-02-17 12:11:49 +01:00
emanuele-f
5995ab536a
Unify alert configuration code and place settings under alert icon
2017-02-13 21:17:59 +01:00
Emanuele Faranda
afdfac1c9c
Lua scripts parameters validation ( #970 )
...
* partial work
* Migrate 'mode' parameters
* Migrate alerts types
* Fix some interface ids
* Partial work
* Partial work
* End of work for _GET parameters
* Work in progress
* Add support for special parameters
* Preferences validation
* Fixes and improvements
* Enforce interger validation
2017-02-08 12:25:35 +01:00
emanuele-f
05d4956fbd
Adds missing quotes to href attributes
2017-02-02 15:52:09 +01:00
Simone Mainardi
3322cfe576
Prevents housekeeping alerts extra redis reads
2017-01-24 10:46:57 +01:00
Simone Mainardi
e8cffe9227
Implements periodic alerts rotation
...
Oldest alerts are periodically overwritten by newest ones
when a certain (user-configurable) threshold has been exceeded.
Rotation is performed periodically in a housekeeping.lua
2017-01-17 15:15:23 +01:00
emanuele-f
397d525d85
Use POST requests when required
2017-01-14 20:31:01 +01:00
Luca
30e1a75f98
(C) update
2017-01-10 15:03:16 -08:00
Simone Mainardi
f349ca344e
Reworks alerts menu
2016-12-28 19:54:05 +01:00
Simone Mainardi
eca2c41049
Reworks alert counters (WIP)
...
Alert counters are now kept in sync only for engaged alerts.
Each host will show the current number of engaged alerts.
This alleviates the complexity of constantly keep the numbers
synchronized with the database.
Todo: see how to handle counters for flow alerts and past alerts.
2016-12-24 16:21:50 +01:00
Luca Deri
3443b76b06
Refined alert generation
...
Added refresh button in alert page
2016-12-17 12:33:34 +01:00
Luca Deri
7f8065d90b
Fixed missing csrf field in alerts pages that caused flow deletion to fail
...
Improved flock checks heuristics to limit cgeneration of false positives
Added TCP flow alert generation in case of OOO/retransmission... > 10% of packets
2016-12-17 10:42:06 +01:00
emanuele-f
98e7f9e31f
Change default retrigger time
2016-12-16 10:57:42 +01:00
emanuele-f
06872bd949
Fix tab being hidden after deleting all the alerts when a filter is set
2016-12-15 10:50:29 +01:00
Simone Mainardi
c4cd6200f9
Minor fixes for the alerts browser
2016-12-14 11:54:50 +01:00
emanuele-f
db01d1b211
Parameters pass simplification
2016-12-14 11:54:50 +01:00
emanuele-f
ecca16e402
Fix other tabs being filtered
2016-12-14 11:54:50 +01:00
emanuele-f
0f448fffc7
Flow alerts explorer integration and LUA alerts query unification
2016-12-14 11:54:50 +01:00
Luca
25185ce028
While the network interface has at least one engaged interface alert, expired flows are now triggering a flow alert
2016-12-13 01:19:50 +01:00
emanuele-f
ade100f190
Alert fixes
2016-12-09 11:45:28 +01:00
