108 commits

Author	SHA1	Message	Date
Simone Mainardi	3950c3ddc8	Support for 5-min timeseries resolution in InfluxDB	2019-10-15 15:06:20 +02:00
emanuele-f	90cadaf560	Fix periodic scripts being called every minute with hasHighResolutionTs	2019-10-15 11:18:00 +02:00
Luca Deri	0a64d694a1	Warning fix	2019-10-14 11:20:33 +02:00
emanuele-f	2fdc860ed2	Add support for custom flow alerts in user scripts	2019-10-11 19:48:11 +02:00
emanuele-f	0ddc82d7db	Port blacklisted flow alerts to new api	2019-10-11 16:32:37 +02:00
emanuele-f	cbfcff9633	Fix missing performed_lua_calls initialization	2019-10-11 14:36:34 +02:00
emanuele-f	7bd6feb622	Rename check_module -> user_script	2019-10-10 18:14:53 +02:00
emanuele-f	b8f1a039fb	Fix always_enabled required for non-alert scripts	2019-10-10 18:03:36 +02:00
emanuele-f	75cf795521	Unify teardown function	2019-10-10 17:24:24 +02:00
emanuele-f	e7e2f43646	Fix Flow::isLuaCallPerformed	2019-10-10 15:17:41 +02:00
emanuele-f	09dcf4e7c6	Improve L4 protocol filter	2019-10-10 15:04:58 +02:00
emanuele-f	4c715c7d73	Implement L4 protocol filter in flow user scripts	2019-10-10 13:37:01 +02:00
Simone Mainardi	4ef7d35296	Benchmarks for hosts interface and network scripts	2019-10-10 11:54:31 +02:00
emanuele-f	ab0094c1c3	Unify syslog with user scripts API	2019-10-09 18:53:19 +02:00
Simone Mainardi	b9fa26174c	Implements generalized benchmarks for any user_script	2019-10-09 18:48:01 +02:00
emanuele-f	e66889154c	Migrate flow script documentation and document traffic element scripts	2019-10-09 17:23:51 +02:00
Simone Mainardi	a49e934570	Removes a debug print	2019-10-09 15:19:21 +02:00
Simone Mainardi	816f3819cc	Removes overridden metatable in flow.lua	2019-10-09 15:17:43 +02:00
emanuele-f	ffd3b4c1ee	Users scripts api changes and initial documentation	2019-10-09 15:12:28 +02:00
emanuele-f	ede9a7940a	Generalize periodic and flows callbacks ... Now periodic callbacks are properly called even when alerts are disabled The granularity filter and check_function has been replaced with a more generic hooks list	2019-10-07 19:05:43 +02:00
Simone Mainardi	aa652145d0	Unifies flows, timeseries and top-talkers data retention ... Implements #2897	2019-10-07 16:35:32 +02:00
Simone Mainardi	359599c4eb	Removes static Flow::lua_method_id_to_name map moving it in a flow method	2019-10-07 12:32:50 +02:00
Simone Mainardi	3749ffea04	Adds extra comments to flow.lua	2019-10-07 12:23:31 +02:00
emanuele-f	bee1efdded	Move callbacks scripts into separate tab	2019-10-04 10:48:13 +02:00
Simone Mainardi	6db2c6392f	Stores flow lua scripts benchmarks and shows them in the ui	2019-10-01 17:06:29 +02:00
Simone Mainardi	fa17aab9db	Implements lua flow method calls using ids to be more efficient	2019-09-30 17:29:01 +02:00
emanuele-f	35e3a2f20c	Do not compute DNS ratio in nEdge ... nEdge does not see the DNS replies so DNS ratio is incorrect	2019-09-30 11:28:15 +02:00
Simone Mainardi	79b69c2e6f	Flattens out the structure of lua flow callbacks	2019-09-17 18:22:55 +02:00
Simone Mainardi	661f897898	Implements instrumentation to monitor lua flow callbacks	2019-09-17 17:42:54 +02:00
Simone Mainardi	909408168b	Improves flow check lua scripts loading efficiency	2019-09-17 14:24:29 +02:00
Simone Mainardi	e2c9e729a4	Implements flow check modules enable/disable prefs	2019-09-17 11:57:29 +02:00
Simone Mainardi	b3d595653e	Initial implementation of lua flow callback scripts and blacklisted alerts ... Partially implements #2842	2019-09-16 18:27:46 +02:00
Simone Mainardi	83f5e68239	Reworks flow.lua callback code	2019-09-12 16:15:04 +02:00
Simone Mainardi	288d3a51ec	Optimizes flow lua by avoiding unnecessary calls	2019-09-12 16:02:13 +02:00
Simone Mainardi	968e21d984	Implements flow lua callbacks in the periodic activities thread	2019-09-12 15:36:41 +02:00
emanuele-f	e4f1d1f5d3	Avoid flow.lua overhead if all the modules are disabled	2019-09-11 14:52:26 +02:00
emanuele-f	5a57be4879	Fix invalid granularity filter	2019-09-06 10:29:10 +02:00
emanuele-f	d9a44d615a	Implement generic flow callbacks	2019-09-05 19:11:11 +02:00
emanuele-f	a8cb972e7d	Implement ghost networks alerts	2019-08-28 16:42:18 +02:00
emanuele-f	3bf6ed1ecd	Add syn-vs-rst and misbehaving-vs-total-flows alerts	2019-08-27 16:33:53 +02:00
emanuele-f	01c586119e	Remove ICMP ratio alert and enable ratio alerts by default in 5mins	2019-08-27 14:32:24 +02:00
emanuele-f	b3bdfcff32	Cleanup of the too-many-drops interface alert	2019-08-27 13:04:53 +02:00
emanuele-f	eb3542d7e7	Address too much ratio alerts generated after host deserialization	2019-08-27 11:02:28 +02:00
emanuele-f	57e623da04	Implement ICMP and HTTP requests vs replies ratio alert	2019-08-27 10:33:08 +02:00
emanuele-f	5dd88985f4	Improve and fix DNS replies/requests ratio	2019-08-27 09:57:59 +02:00
emanuele-f	d1caa6fbf1	Temporary disable request_reply_ratio to prevent too much alerts generation	2019-08-26 18:52:41 +02:00
emanuele-f	a0761db1e8	Implement replies/requests ratio alert	2019-08-26 18:38:34 +02:00
emanuele-f	b0ba13f0bc	Syn/flow flood alerts now use their own alert type	2019-08-26 17:36:27 +02:00
emanuele-f	e92641920d	Implement syn/flow flood victim alerts on local networks	2019-08-26 16:42:23 +02:00
emanuele-f	abdc3d54a3	Handle alert config default values ... Closes #2747	2019-08-23 19:23:05 +02:00