Commit graph

776 commits

Author SHA1 Message Date
Luca Deri
f4c512d552 Code cleanup and stubs for supporting ClickHouse (via -F clickhouse) 2021-10-21 11:58:08 +02:00
Luca Deri
d91d69f2a7 Encapsulated traffic is accounted for the lenght of the encapsulated packet and not of the original packet 2021-10-11 21:42:02 +02:00
Luca Deri
aff1723fcb Removes shared nDPI instance that leades to crashes when multiple interfaces are used 2021-10-07 10:50:26 +02:00
MatteoBiscosi
4e693dc9f1 Added probes filter to host page (#5157) 2021-09-30 12:15:25 +02:00
Luca
df906622eb Typo 2021-09-30 12:01:05 +02:00
Simone Mainardi
a1b31b054e Adds {periodicity,service} maps and alerts to nEdge
Addresses #5917
2021-09-28 11:44:07 +02:00
Simone Mainardi
e9c26b79f8 Implements UI badges color-coded using engaged alert severities
Addresses #5881
2021-09-24 17:25:34 +02:00
Simone Mainardi
3ab14250b8 Implements per-severity breakdown of engaged alerts in C++
Addresses the backend of #5881
2021-09-24 16:25:12 +02:00
MatteoBiscosi
6c4720e4fa Reworked top sites and removed duplicated code 2021-08-23 17:03:30 +02:00
MatteoBiscosi
90c9e556af Removed duplicated code 2021-08-20 16:39:54 +02:00
MatteoBiscosi
af26dbfa36 Fixes segv due to top sites corrupted pointer (#5772) 2021-08-20 10:54:35 +02:00
Simone Mainardi
d7edcfeaf2 Cleanup MDNS resolution
Addresses #5730
2021-08-12 17:26:01 +02:00
Simone Mainardi
9cc80dfd78 Fixes to handle the learning status phase in map stats 2021-08-10 15:42:44 +02:00
Simone Mainardi
18ddef32ae Implements limit switch for service and periodicity maps 2021-08-09 15:12:45 +02:00
Simone Mainardi
d0d8b49da2 Refactors periodicity map lua name 2021-08-09 14:58:11 +02:00
MatteoBiscosi
73be980960 Fixes lateral movement alert 2021-08-05 20:29:38 +02:00
Simone Mainardi
ab80e3b4ee Allows service/periodicity maps search by MAC
Addresses #5625
2021-07-27 17:31:17 +02:00
Simone Mainardi
1a552d24ec Cleanup excessive traffic check (to be implemented as host check) 2021-07-27 11:39:40 +02:00
Simone Mainardi
6f79dc4341 Fixes hanging shutdown when interfaces init. is not complete 2021-07-21 11:48:12 +02:00
Simone Mainardi
c5d876207c Fixes nEdge interface stats inc 2021-07-13 16:50:20 +02:00
Simone Mainardi
65769a7f42 Parses sflow samples via ZMQ, determines interfs. w/ sampled traff. 2021-07-09 15:57:26 +02:00
Simone Mainardi
2790f29f6e Fixes alerted flows counters for view interfaces 2021-07-07 15:17:18 +02:00
Luca Deri
620823cf33 Cleaned up code for ZMQ collectors (some extra cleanup is necessary however) 2021-07-07 01:38:45 +02:00
Luca
112c931226 Observation point code cleanup (WIP) 2021-07-01 23:26:15 +02:00
Luca
336f1f3d9f Adding observationPoint support (WIP) 2021-06-30 20:03:37 +02:00
Luca
fa5271b4d7 Implemented observationPoint menu support 2021-06-29 21:18:51 +02:00
MatteoBiscosi
be198c2a99 Added L7 iface proto behavior analysis and alert (#5499 #5474) 2021-06-29 16:50:56 +02:00
Luca
b43ea2c78e Initial work towards support of observation points 2021-06-28 14:56:25 +02:00
MatteoBiscosi
c3a85560a7 Fixes wrongly formatter used for behavior anomaly alert 2021-06-28 11:38:39 +02:00
Luca
ff3f9a43a1 Introduced traffic direction in ZMQ when %DIRECTION information
element is set in the nProbe template (-T)
2021-06-28 09:13:58 +02:00
Simone Mainardi
03b1633d1a Adds extra tracing for alert drops
Addresses #5558
2021-06-23 16:13:47 +02:00
MatteoBiscosi
5a02d2a0d7 Fixed lateral movement not triggering 2021-06-18 11:08:44 +02:00
Simone Mainardi
ee58f52c51 Refactors user_scripts to checks (c++) 2021-06-16 19:06:29 +02:00
Simone Mainardi
40f5c4e821 Refactors {flow,host}callbacks into {flow,host}checks (C++) 2021-06-16 15:27:38 +02:00
Luca Deri
846d24c5e9 Initial VLANid rework 2021-06-15 23:01:59 +02:00
Matteo Biscosi
0e1f16c9b9 Fixes #5492 behavior code rework 2021-06-14 16:46:12 +02:00
Matteo Biscosi
f12934ef9e Implements Traffic TX/RX and Score Behavior analysis (#5473) (#5472) 2021-06-10 17:31:29 +02:00
Luca Deri
944747fe94 Implemented multi-stacked MPLS/PPPoE/PPP dissection 2021-06-10 10:59:26 +02:00
Simone Mainardi
08fb295be9 Implements support for roles (attacker/victim) filtering of alerts
Implements #5425
2021-05-31 12:32:56 +02:00
Simone Mainardi
8f6ad08f27 Reworks host pools reload without sleeps
Addresses #5412
2021-05-26 17:23:41 +02:00
Simone Mainardi
bb3f8ed168 Implements efficient unexpected_new_device alert 2021-05-11 19:03:40 +02:00
Alfredo Cardigliano
450b6c4575 Remove AlertsManager (no longer used). Add back entity value or 5-tuple to exported alerts (fix #5285) 2021-05-10 10:57:43 +02:00
Simone Mainardi
ec5a92514d Fixes and simplifies getters of engaged alert counters 2021-05-07 15:06:55 +02:00
Simone Mainardi
7dea0f7f35 Implements alert badges on top of the alerts page 2021-05-07 11:16:05 +02:00
Simone Mainardi
ec06e6568f Simplifies and keeps per-family alert counters 2021-05-07 10:21:32 +02:00
Simone Mainardi
b54e46ad14 Fixes crash upon use of unsupported function 2021-05-06 17:44:50 +02:00
Alfredo Cardigliano
adc665c847 Cleanup get proto name functions. Add master proto to flow alerts. 2021-05-06 10:31:16 +02:00
Simone Mainardi
2e8a854d63 Refactors OtherAlertableEntity into individual classes 2021-04-28 18:14:04 +02:00
Simone Mainardi
2278926da4 Merge branch 'alerts-store' into dev 2021-04-26 19:59:30 +02:00
Simone Mainardi
c7082a4647 Implements new alerts database and drilldown
alert store skeleton

Alert database type changes

Implement alert store for host alerts. All alert store skeletons.

Fix class method access

Enable tracing

Implements simple queries for host alerts

Implement flow alert store

Fixes escaping of INSERT queries

Flow alerts database schema fixes

Adds escaping for alert JSON in flows and hosts

Implements queries .select() for alerts store

Adds limit and offset to perform paginated queries

Adds new REST getter for flow alerts

Name changes alert_severity to severity, alert_json to json

Fixes alert message not shown

Implement active monitoring alerts store

Implements sort of queries in the new dataabase

Changes alert_type to alert_id

Implement mac alerts store

Fixes flow alert messages

Implement system alerts store

Implement snmp alert store

Add missing items to the flow alerts

Add missing items to the host alerts

Add missing items to the mac alerts

Implements COUNT aplerts api

Add device_name to snmp alerts

add flow alerts templates

updated gitignore

fix for missing order field

add families defined in `alert_store_schema.sql`

Reworks and simplifies alert store subclasses

Implements REST API to fetch alert timeseries

Fixes date in flow REST api

Host alert json fix

Add get/host/alert/list.lua

Move alert/list.lua to alert/past/list.lua

Add alert/past/list.lua for all alert families

Add entity_id to system table to identify the alert type based on <alert_id, entity_id>

Add missing field

Implements facilities to query engaged alerts via REST

Handle both historical and past alerts in alert/list.lua

Fix count

Update params of select_historical

Implement method to add family-specific filters

Add alert/ts.lua for all alert families

Implements facilities and REST endpoints to delete alerts

Implements ordering of alert queries

Fix add_order_by group_by

Rest API tests update

Tests output update

Remove debug trace

Use alert_id instead of type. Add more flow alert info.

Update http lint

Format obsolete tlv version alerts. Add more host info.

Add row_id to list of alerts

Fix selection of engaged alerts

Add test for mac alerts (bcast domains)

Removes attempt to format alerts as flow alerts

Fixes interface selection for active monitoring

Update test output with rest changes

Add more fields to be ignores

Set alert count to 1 for the time being

add bar timeseries chart

add apexcharts

improvements on timeseries bar chart

registered chart callbakcs

working on alert page

fix for date format

Fixes acrive monitoring REST API

Fixes alignment of grouped alert data

Additional fix for alert histogram

remove useless if

formatting alerts page

fixes on flows alert stats table

rename local networks to device

format host pagie in alert_stats

add tag support for hosts and flow

implemented single delete action

add release modal

Fixes format of threshold cross interface alerts

Fixes wrong increase of dropped alerts

Implements exclusion list for invalid dns queries

Reworks exclusions lists for hosts and flows

Addresses #5212
Addresses #5113

Adds host alert keys in host callbacks definitions

Adds alert ids to flow callbacks

fix for not working button (#5215)

Fixes reported timeseries name

removed any additional button inside chart's toolbar (#5200)

Add tables for interfaces, networks, users to the schema. Skeleton alert_store classes

fixed broken range picker layout in firefox (#5199)

Alert insert fixes

Add more info to network alerts

Add rest endpoint for interface, network, user alerts

Fix endpoint selection in alerts_stats

Unifies columns between engaged and past alerts

Fixes Missing mandatory 'alert_granularity'

Minor fixes for missing alert_severity

Fixes arithmetic on a nil value (field 'last_seen')

Fixes get/system/alert/list.lua

use tstamp for column names (#5221)

Implements host alert formatter

Add alerts_store format_record_common

Use common format_record for am, system alerts

Use common format_record for all alerts

Fixes formatting of alerts of all types

Fixes nil in function 'hostinfo2label'

fixes on disable modal

add pages for network, user and interface endpoint (#5224)

Set alert_entity in all classes

Unifies influxdb alerts into system alerts

Addresses #5224

Unifies process alerts into system alerts

Addresses #5224

Cleanup unused periodicActivityEntity

Unifies category lists alerts into system alerts

Addresses #5224

Aligns new alert enums

Addresses #5224

Fixes alert page links

Fixes insertion of interface alerts

Implement filters for Host alerts

Fixes active monitoring alerts not triggering

Implement filters on flow alerts

Fixes for internal alerts timestamp and subtype

implements disable for the alerts

formatted alert disable label

Add address and device type to mac alert records

fix for delete alert toggle

Fix access to entity_val in alert_unexpected_new_device

add mac address and device type inside table

Fixes for new alert fields not handled

Fixes alert_definitions to handle new fields

Add ip/port to snmp alert records

Implements deletion of stored flow alerts

Add alert_name to all alert records via rest. Fix duration.

fixes for snmp tab

Implements delete of past host alerts

Add name to snmp alert records

fixes on system tab

Fix Date column

fixes link

Update menu

Fixes bad argument #3 to 'format' in snmp alerts

updated interface link

new alerts url for host (#5228)

Fixes sort of engaged alert

Minor cleanup

Fixes data returned for local network alerts

Fix duration for one shot. Note.

Fix duration override

Fixes interface selection for system alerts

Move host alert page

fixes for local network tab

Minor fix

Fix engaged host alerts

fixes on user tab

Fix alert_user_activity message
2021-04-26 19:41:34 +02:00