Simone Mainardi
38d31a474a
Makes multiple score increments status-dependent
...
Implements #4993
2021-01-30 12:45:04 +01:00
Alfredo Cardigliano
b3cf18d821
Rename alert_tls_old_version -> alert_tls_old_protocol_version everywhere for consistency
2021-01-29 11:10:43 +01:00
Matteo Biscosi
0fbe214a60
Removed default severity from some alerts
2021-01-29 10:51:31 +01:00
Matteo Biscosi
da9dc17f25
Fixed remote to local alert wrong parameter
2021-01-28 23:34:46 +01:00
Matteo Biscosi
b1134b611f
Added to double severity alert, single default alert
...
Implements #4919
2021-01-28 18:18:22 +01:00
Matteo Biscosi
10fb8bbecc
Implements #4919 custom alert severity
2021-01-27 12:29:19 +01:00
Matteo Biscosi
cdc420dd68
Fixed #2977 alert for remote->local insecure protocols
2021-01-20 11:56:56 +01:00
Simone Mainardi
46e3c10c36
Typos
2021-01-11 14:38:02 +01:00
Simone Mainardi
ad59b61245
Implements dropdown search for interfaces
...
Partially addresses #4800
2021-01-08 17:45:41 +01:00
Simone Mainardi
1aaf92e843
Reworks attacker/victim in alerts
2021-01-07 19:03:42 +01:00
Matteo Biscosi
bf12e0c103
Added Victim and Attacker shown into the Developer page
2021-01-07 16:34:45 +01:00
Luca Deri
a1178a0791
Updated (C)
2021-01-02 12:08:23 +01:00
Simone Mainardi
e3eda6e082
Implements ability to trigger flow alerts even if already triggered
2020-12-30 13:08:55 +01:00
Matteo Biscosi
e94f2cb0b4
Fixed #4737 integration with fail2ban
2020-12-30 11:46:10 +01:00
Matteo Biscosi
1ca83df1b7
Fixed alerts error
2020-12-23 12:03:14 +01:00
Simone Mainardi
c1bdfb8722
Unifies flow_keys and status_keys
2020-12-22 19:14:16 +01:00
Simone Mainardi
f839b6ba76
Removes flow_consts requires no longer necessary
2020-12-22 18:06:50 +01:00
Simone Mainardi
c273478b7a
Reworks UI list of defined alert and flow keys
2020-12-22 16:51:26 +01:00
Matteo Biscosi
bcf2c2c1ed
Migrates alerts to an object-oriented implementation
2020-12-22 14:48:00 +01:00
matteo
e24ef4ef35
Revert "Migrates alerts to an object-oriented implementation"
...
This reverts commit fbc283f12f
2020-12-22 13:13:57 +01:00
matteo
fbc283f12f
Migrates alerts to an object-oriented implementation
2020-12-22 13:00:25 +01:00
Simone Mainardi
0ccc3507d0
Implements alert:store class method
2020-12-21 12:09:41 +01:00
matteo
ab4e8e9379
Added REST for top local talkers and top remote destinations
2020-12-14 18:42:23 +01:00
matteo
a8cd70e0e5
Fixed #4730 Reset list of learnt MAC addresses
2020-12-09 17:18:35 +01:00
Simone Mainardi
e12108cfe0
Minor alert_flow_new_api_demo.lua cleanup
2020-12-04 17:16:20 +01:00
Simone Mainardi
7950ca3c55
Adds new alert_flow_new_api_demo.lua example
2020-12-04 17:07:12 +01:00
Simone Mainardi
8d6dafc897
Unifies new alerts and flow alerts API
2020-12-04 17:03:23 +01:00
Simone Mainardi
4533806ce8
Extends the new api with the format function
2020-11-30 17:11:48 +01:00
Simone Mainardi
b3dc39c641
Refactors alert_severities into an independend Lua module
2020-11-30 15:28:17 +01:00
gabryon99
20273758ef
add reset button with confirm ( #4730 )
2020-11-27 17:45:11 +01:00
Simone Mainardi
5d7abd0b53
Alerts API class name change
2020-11-26 18:03:17 +01:00
Simone Mainardi
2cc45f5229
Reworks experimental object-oriented alerts code
2020-11-26 15:56:24 +01:00
Luca Deri
06161556ac
Fixes issues with unexpected XXX alerts where impacted server was not reported
...
Added Lua getFlowProtoClientIP/getFlowProtoServerIP calls in flows
2020-11-25 15:52:03 +01:00
Simone Mainardi
c67d16e701
Disables experimental code
2020-11-23 18:44:36 +01:00
Simone Mainardi
5f2ab30351
Implements experimental object-oriented alert classes
2020-11-23 18:43:24 +01:00
matteo
b1b21ef28d
Fixed nil value of field 'cli' error
2020-11-23 16:21:19 +01:00
Matteo Biscosi
507583db64
Added host category to flow and host alerts ( #4767 )
...
* Fixed shell endpoint bug and added notice when executing the script
* Added victim and attacker to security plugins
* Updated hosts alert with host_category info
* Added host category to hosts alert description
* Added host category to flows
Co-authored-by: matteo <biscosi@ntop.org>
2020-11-20 19:14:07 +01:00
MatteoBiscosi
801bdb6bdc
Fixed unexpected new device plugin visual bugs
2020-11-16 18:46:53 +01:00
Luca Deri
502a85d9a9
Extended description
2020-11-16 12:51:49 +01:00
Matteo Biscosi
a8cf3836d7
Fixes #4709 unexpected new device plugin ( #4728 )
...
* Added unexpected new device plugin, needs review
* Fixes #4709 unexpected new device plugin
Co-authored-by: matteo <biscosi@ntop.org>
2020-11-16 12:41:19 +01:00
Simone Mainardi
b87e641086
Fixes validation of unexpected servers whitelist
2020-11-14 17:39:59 +01:00
Matteo Biscosi
c08707010e
Fixed "attempt to index a nil value (global 'alerts_api')" error
2020-11-13 13:13:00 +01:00
Matteo Biscosi
0e341f3d0b
Modified flow scripts in view of the new trigger_status ( #4710 )
...
* Modified blacklisted script in view of the new flow_script API
* Modified plugins scripting in view of the new API
* Modified flow scripts with the new trigger API
* Fixed creators severity
Co-authored-by: matteo <biscosi@ntop.org>
2020-11-12 13:52:53 +01:00
Simone Mainardi
d16ff997ef
Removes a debug flag
2020-11-10 15:13:24 +01:00
Simone Mainardi
93920ccdce
Implements example of simplified flow alerts
2020-11-10 15:10:54 +01:00
Simone Mainardi
073fd5f6cd
Fixes flow score to low for suspicious file transfer risk
2020-11-06 13:40:36 +00:00
gabryon99
cf16003826
add notification for unexpected plugins ( #4659 )
2020-11-02 11:42:30 +01:00
Luca Deri
966b743e78
Retrasmissions are accunted only when 10 pkts per directions are observed
...
Tiny cosmetic changes
2020-10-25 18:56:00 +01:00
Wallace4
ca88369ef3
New version of retransmission plugin, fixed and tested
2020-10-19 16:40:22 +02:00
Simone Mainardi
00f1ae731a
Keeps configured enabled/disabled flow risks into account inside plugin
2020-10-19 11:56:41 +02:00
