2189 commits

Author	SHA1	Message	Date
emanuele-f	c3fa094e99	Improve MUD prefs handling ... Also implement a non-inline reloadPrefs Host method to avoid slowing down packet capture	2019-09-10 11:10:33 +02:00
emanuele-f	b731ad53f0	Fix MUD port for local connections	2019-09-10 09:24:34 +02:00
emanuele-f	91222ada6b	Add Nooder Networks blacklist	2019-09-09 16:17:52 +02:00
emanuele-f	06f3077da8	Avoid excessive redis lookups for hosts when hosts cache is disabled	2019-09-09 12:42:35 +02:00
Alfredo Cardigliano	0d38479297	Fix formatMaliciousSignature with no flowstatus_info	2019-09-09 11:21:26 +02:00
emanuele-f	48d688d501	Add support for MAC MUD	2019-09-06 15:53:15 +02:00
emanuele-f	249a22e84f	Add support for IPv6 MUD	2019-09-06 15:04:15 +02:00
emanuele-f	8682165b2f	Improve MUD host	2019-09-06 15:04:15 +02:00
emanuele-f	d221475669	Fix MUD source/destination	2019-09-06 12:34:19 +02:00
emanuele-f	e9aa6b1703	Add flow.lua duration trace	2019-09-06 11:15:12 +02:00
emanuele-f	8d7331e519	Improve ghost network alert message	2019-09-06 10:45:59 +02:00
emanuele-f	bd2bf91882	Use server name as MUD peer name when possible	2019-09-05 19:31:42 +02:00
emanuele-f	1029440083	Add MUD delete button	2019-09-05 19:11:11 +02:00
emanuele-f	d9a44d615a	Implement generic flow callbacks	2019-09-05 19:11:11 +02:00
Alfredo Cardigliano	38a53ec1fa	Transferring flows status bitmap to the client/server host. Added anomalous flows reasons to the host details page.	2019-09-05 17:55:00 +02:00
emanuele-f	1d248331f6	Implement optimized exists query in InfluxDB ... This avoids returning too much results when using standard listSeries	2019-09-05 16:02:20 +02:00
Simone Mainardi	f9a8ca8002	Uses getStatsUpdateFreq as min ts step for non-packet interfaces	2019-09-05 14:31:04 +02:00
Alfredo Cardigliano	871bb63b61	Added default relevance per flow status	2019-09-05 11:53:42 +02:00
emanuele-f	1443d46a28	Little fix for commit 7bf8b8b1e5	2019-09-05 11:30:35 +02:00
Alfredo Cardigliano	141622f151	Lua: created flow_consts module, getFlowStatusTypes has been replaced by flow_consts.flow_status_types, added flow.status_map to the Lua flow info	2019-09-04 22:20:51 +02:00
emanuele-f	7bf8b8b1e5	Use insertion_step when creating RRD files	2019-09-05 10:59:10 +02:00
emanuele-f	c97ef3d908	Implement host MUD recording and dump	2019-09-04 21:20:52 +02:00
emanuele-f	d630cce58a	Fix script failures in SNMP message formatters	2019-09-04 15:36:46 +02:00
Alfredo Cardigliano	40bf86a81d	Fix alert_endpoints/{syslog.lua,slack.lua} error 'attempt to index a nil value'	2019-09-04 12:57:57 +02:00
Alfredo Cardigliano	14c0338b64	Fix alert_endpoints_utils.lua error 'attempt to compare number with string' #2795	2019-09-04 12:44:53 +02:00
emanuele-f	b62e4183f0	Add ability to manually release an alert	2019-09-04 12:29:13 +02:00
emanuele-f	74f761d18b	Allow calls to alerts_api.trigger/alerts_api.release outside periodic scripts	2019-09-03 19:20:50 +02:00
emanuele-f	08e616a5d4	Fix "Could not retrieve alert information" on pcap dump interfaces	2019-09-03 18:59:19 +02:00
emanuele-f	8e6cd5962a	Fix blacklisted host alerts not generated when reading from PCAP dump	2019-09-03 17:50:08 +02:00
Luca Deri	ffcfe398cc	Reworked flow stats defining InterarrivalStats ... Fixed ms/timeval diffrence functions	2019-09-02 23:58:34 +02:00
emanuele-f	a0d8cd7595	Add l4_proto_to_id	2019-09-02 20:08:38 +02:00
Alfredo Cardigliano	3c930d0514	Code cleanup	2019-09-02 11:51:44 +02:00
emanuele-f	a58cd6a7d9	Add country flag in flow peers	2019-09-02 10:58:43 +02:00
emanuele-f	2d02de6cc1	Implement initial flow score support	2019-08-30 17:16:11 +02:00
Simone Mainardi	2e67a69cb7	Implements redis health and keys used monitoring	2019-08-30 16:19:33 +02:00
Simone Mainardi	24cf71a70d	Parses and charts UDP socket drops from nProbe	2019-08-30 12:54:41 +02:00
emanuele-f	e3ae0747c8	Properly handle disabled vs hidden graphs menu entries ... Fixes #2710	2019-08-30 12:12:18 +02:00
Alfredo Cardigliano	13d032d185	Formatting IDS alerts	2019-08-29 11:20:41 +02:00
emanuele-f	a37bb425ea	Add JA3 signature link in alerts	2019-08-28 18:41:17 +02:00
emanuele-f	b66b71fd7e	Implement alert on JA3 malicious signatures ... Closes #2788	2019-08-28 18:33:13 +02:00
emanuele-f	a8cb972e7d	Implement ghost networks alerts	2019-08-28 16:42:18 +02:00
emanuele-f	3bf6ed1ecd	Add syn-vs-rst and misbehaving-vs-total-flows alerts	2019-08-27 16:33:53 +02:00
Simone Mainardi	606e681d8e	Fixes flow alerts exploration ... Fixes #2782	2019-08-27 15:42:35 +02:00
emanuele-f	300ea49b10	Little localization fix	2019-08-27 14:37:01 +02:00
emanuele-f	01c586119e	Remove ICMP ratio alert and enable ratio alerts by default in 5mins	2019-08-27 14:32:24 +02:00
emanuele-f	b3bdfcff32	Cleanup of the too-many-drops interface alert	2019-08-27 13:04:53 +02:00
emanuele-f	eb3542d7e7	Address too much ratio alerts generated after host deserialization	2019-08-27 11:02:28 +02:00
emanuele-f	57e623da04	Implement ICMP and HTTP requests vs replies ratio alert	2019-08-27 10:33:08 +02:00
emanuele-f	5dd88985f4	Improve and fix DNS replies/requests ratio	2019-08-27 09:57:59 +02:00
emanuele-f	a0761db1e8	Implement replies/requests ratio alert	2019-08-26 18:38:34 +02:00