282 commits

Author	SHA1	Message	Date
Simone Mainardi	b3f50c6b21	Fixes DNS resolution leaks and wrong ping addresses	2019-09-23 14:54:19 +02:00
Simone Mainardi	b3d595653e	Initial implementation of lua flow callback scripts and blacklisted alerts ... Partially implements #2842	2019-09-16 18:27:46 +02:00
Simone Mainardi	968e21d984	Implements flow lua callbacks in the periodic activities thread	2019-09-12 15:36:41 +02:00
Simone Mainardi	9fe404772d	Handles flow alerts and alert queues in view interfaces ... Implements #2828	2019-09-10 15:48:39 +02:00
emanuele-f	c3fa094e99	Improve MUD prefs handling ... Also implement a non-inline reloadPrefs Host method to avoid slowing down packet capture	2019-09-10 11:10:33 +02:00
emanuele-f	48d688d501	Add support for MAC MUD	2019-09-06 15:53:15 +02:00
emanuele-f	e9aa6b1703	Add flow.lua duration trace	2019-09-06 11:15:12 +02:00
Simone Mainardi	5d380c39d0	Exposes interface stats update freq to lua	2019-09-05 10:27:25 +02:00
emanuele-f	c97ef3d908	Implement host MUD recording and dump	2019-09-04 21:20:52 +02:00
emanuele-f	5c3a063fae	Fix startup with sticky hosts ... interface.restoreHost was improperly removed in ef4f98a5a5	2019-09-04 14:10:24 +02:00
emanuele-f	b62e4183f0	Add ability to manually release an alert	2019-09-04 12:29:13 +02:00
emanuele-f	74f761d18b	Allow calls to alerts_api.trigger/alerts_api.release outside periodic scripts	2019-09-03 19:20:50 +02:00
emanuele-f	8e6cd5962a	Fix blacklisted host alerts not generated when reading from PCAP dump	2019-09-03 17:50:08 +02:00
emanuele-f	fbb66951b5	Add alert score on hosts	2019-09-03 13:36:27 +02:00
Simone Mainardi	e1d911a052	Adds lua_pcall check when loading scripts to prevent silent failures	2019-09-02 11:25:39 +02:00
Simone Mainardi	91163ed4e2	Fixes Lua script failures when loading alerts/flow.lua	2019-09-02 10:53:36 +02:00
emanuele-f	2d02de6cc1	Implement initial flow score support	2019-08-30 17:16:11 +02:00
Simone Mainardi	2e67a69cb7	Implements redis health and keys used monitoring	2019-08-30 16:19:33 +02:00
Simone Mainardi	6ae30f0604	Initial implementation of the Redis monitoring probe	2019-08-28 19:30:52 +02:00
emanuele-f	b66b71fd7e	Implement alert on JA3 malicious signatures ... Closes #2788	2019-08-28 18:33:13 +02:00
emanuele-f	b3bdfcff32	Cleanup of the too-many-drops interface alert	2019-08-27 13:04:53 +02:00
emanuele-f	f43f4b7dd9	Add engaged alerts type exclusion filter ... Fixes #2780	2019-08-22 16:30:45 +02:00
emanuele-f	87ba28195b	Add support to engage/release on external alerts	2019-08-20 19:02:58 +02:00
emanuele-f	d1c5275302	Move suppressed alerts flag to C to reduce Redis load	2019-08-20 11:54:25 +02:00
Simone Mainardi	3413a6afd0	Implements stats rather than grouped hosts data for host pools stats	2019-08-20 11:45:11 +02:00
Simone Mainardi	74c545d079	Uses stats rather than grouped hosts data for network stats	2019-08-19 17:39:51 +02:00
Simone Mainardi	485d398826	Resets host pool stats at midnight only for nEdge	2019-08-16 10:32:14 +02:00
Emanuele Faranda	c829c4c3c3	Unify os (#2755) ... * Unify OS information. Now OS information is only stored into the Host. The lua uses numeric IDs to handle OS. * Fix network discovery OS * Show OS detail into the host details page	2019-08-08 12:09:51 +00:00
emanuele-f	ee9e5ec9de	Unify alerts and alerts notifications format	2019-07-30 18:12:58 +02:00
emanuele-f	2243cabcf1	Fix alert release time and gui enhancements	2019-07-25 14:25:27 +02:00
emanuele-f	a3942831b8	Fix issues with engaged alert counters and other improvements	2019-07-24 15:40:43 +02:00
emanuele-f	09fb8667e2	Add ability to disable specific alert types on alertables	2019-07-22 23:37:23 +02:00
emanuele-f	6a6cedc899	Add ability to disable host alerts on specific flow status	2019-07-22 12:16:12 +02:00
emanuele-f	c715bb36f3	Implement per-alert-type host counters ... Such counters will be used in the future to generate alert timeseries. Counters are not currently serialized as internally discussed. Closes #2728	2019-07-19 17:27:23 +02:00
emanuele-f	c9bf1e78cc	Implement alerts release on shutdown	2019-07-19 13:58:10 +02:00
emanuele-f	749a64e789	Release alerts on idle hosts	2019-07-19 10:54:05 +02:00
emanuele-f	3383ac0913	Implement dropped alerts per-interface counter	2019-07-18 17:29:05 +02:00
emanuele-f	6ea7055761	Fix engaged alerts on remote hosts	2019-07-17 18:46:19 +02:00
emanuele-f	5444f027ed	Remove engaged alerts from sqlite	2019-07-17 16:29:55 +02:00
emanuele-f	2e537a0c94	Alert changes after review	2019-07-17 12:51:47 +02:00
emanuele-f	c117f20e19	Initial rework for in-memory alerts	2019-07-16 19:25:09 +02:00
emanuele-f	7b1190f24f	Fix host alerts counter	2019-07-16 11:33:51 +02:00
Luca Deri	3b3af9bb9f	Implemented local hosts services hashes	2019-07-15 23:36:45 +02:00
emanuele-f	5e40e47cce	Implement expired alerts release ... This is necessary to handle the case where a previously configured alert config is deleted	2019-07-15 13:09:18 +02:00
Alfredo Cardigliano	c63831bfa3	Computing L4 protocol statistics for flows	2019-07-12 16:27:34 +02:00
emanuele-f	a2d1e6eda4	Fix interface alert counters and bugged release	2019-07-12 16:08:26 +02:00
emanuele-f	5e0b8b496e	Remove autorelease logic based on periodicity and update database schema	2019-07-12 12:46:21 +02:00
emanuele-f	737295bd93	Fix missing network entity link	2019-07-10 14:50:25 +02:00
Simone Mainardi	11fa6b5212	Implements network alerts	2019-07-10 12:43:17 +02:00
Simone Mainardi	fbc74bf423	Initial implementation of network alerts (wip)	2019-07-09 19:33:27 +02:00