Simone Mainardi
4177ee61ab
Implements constant flow and alert ids
...
Enlarges AlertType size
Changes alerts database
2020-04-14 22:20:44 +02:00
Luca Deri
fcd8b0bedc
Implements #3517
2020-03-08 11:55:41 +01:00
Simone Mainardi
354a5ed404
Rewrites deleted alerts which are cached
...
Implement#3483
2020-03-06 18:10:34 +01:00
Simone Mainardi
48056f23c5
Handles errors and retries when executing sqlite statements
...
Fixes #3518
2020-03-06 16:04:50 +01:00
Simone Mainardi
62e6800eea
Ignores errors when updating alerts (they could have been deleted)
2020-03-05 19:50:06 +01:00
Simone Mainardi
6887b924fe
Implements caching of alerts (avoids a sqlite lookup)
...
Implements #3483
2020-03-05 19:06:39 +01:00
Simone Mainardi
0099c9ea40
Fixes possible loops upon certain sqlite3 errors
...
Fixes #3511
2020-03-05 15:32:26 +01:00
emanuele-f
297195abab
Add dropped/stored/queries system stats for alerts
2020-02-27 13:27:47 +01:00
Simone Mainardi
4ed8cfecc3
Implements merge of multiple identical alerts
...
Implements #3430
2020-02-25 18:14:28 +01:00
emanuele-f
099190570c
Fix alert counters when alert is replaced
2020-02-10 12:19:09 +01:00
emanuele-f
e3d3d3992f
Replace an existing flow alert if a more critical problem is found
...
Also add the flow score into the database
2020-02-07 19:20:57 +01:00
emanuele-f
00b4fe17a6
Implement multitenant alerts support for in-memory alerts
2020-02-06 15:18:50 +01:00
emanuele-f
b4fe14e38c
Set the raw ip field also for non-flow alerts
2020-02-06 14:27:34 +01:00
emanuele-f
f2baada758
Initial multitenant alerts support
...
Now the user allowed networks are honored when retrieving alerts. Non-flow alerts still need to be fixed.
2020-02-05 23:10:37 +01:00
emanuele-f
70b13aeb99
Split query filter and aggregation
2020-02-05 23:10:37 +01:00
Simone Mainardi
48910b9f87
Implements auto assignment of user script alert and status ids
2020-01-15 13:08:58 +01:00
Simone Mainardi
7960bdfa38
Adds ports information to flow alerts
...
Implements #3216
2020-01-13 12:18:43 +01:00
Luca Deri
57e6a93065
Improved scheduling algorithm to guarantee minimum service time when number of entries allow
...
Updated (C)
2020-01-06 23:36:36 +01:00
Luca Deri
941c017ac1
Compilation fixes
2019-12-20 12:06:57 +01:00
Alfredo Cardigliano
cb2f37529e
Reworked storeFlowAlert (using Lua table instead of many params now)
2019-11-06 10:02:15 +01:00
Alfredo Cardigliano
acdab024da
Enqueueing flow alerts to be stored/notified from Lua, removed DB select to notiy alert (using the alert object directly)
2019-11-05 15:53:10 +01:00
Alfredo Cardigliano
280213e148
Enqueueing alerts as soon as they are detected, instead of using 2-steps ( #3038 )
2019-11-05 11:04:44 +01:00
Alfredo Cardigliano
d10dfc7762
Deferred flow alerts insertion through a redis queue. Removed alerts DB select when printing flow details.
2019-10-31 12:53:23 +01:00
Alfredo Cardigliano
551963a5ed
Redis flag to debug alerts db performance
2019-10-25 11:15:30 +02:00
emanuele-f
b3a8c6d49a
Migrate C flow status alerts to Lua user scripts
...
- Alerts and flow status cleanup
- Community flow user scripts migration
- Implement scripts filters by l7 proto and packet interface only
- Migrate flow2statusinfojson
- Lower flow periodic update to 30 seconds if there is flow activity
- Display flow scripts without a gui section
2019-10-22 10:42:22 +02:00
Simone Mainardi
6fd7386c03
Fixes possible collisions when looking up flows by key
2019-10-16 19:04:10 +02:00
Luca
d1417519ec
Reworked bitmap handling
2019-10-11 11:41:20 +02:00
Alfredo Cardigliano
7e9678de37
IDS alert -> External alert
2019-10-09 11:35:51 +02:00
Simone Mainardi
0bbda384c9
Adds alerted flow flag
2019-09-24 16:00:51 +02:00
emanuele-f
d32b979368
Remove Alert Endpoint preference
...
Fixes #2859
2019-09-23 10:48:21 +02:00
emanuele-f
f735749716
Add flow alert information into the flow defails
2019-09-18 15:10:41 +02:00
Simone Mainardi
b3d595653e
Initial implementation of lua flow callback scripts and blacklisted alerts
...
Partially implements #2842
2019-09-16 18:27:46 +02:00
emanuele-f
4d62d68655
Add active alerted flows filter and count
...
Closes #2821
2019-09-10 17:52:22 +02:00
Simone Mainardi
9fe404772d
Handles flow alerts and alert queues in view interfaces
...
Implements #2828
2019-09-10 15:48:39 +02:00
emanuele-f
6e14f978d6
Flow alerts status cleanup
2019-09-10 13:12:11 +02:00
Alfredo Cardigliano
4ea64d4275
Flow::getFlowStatus is now setting a bitmap to handle multiple statuses to be exposed in the flowinfo
2019-09-04 18:27:32 +02:00
emanuele-f
8bb12c3ede
Fix missing alert icon when only flow alerts are present
2019-09-03 16:57:07 +02:00
Alfredo Cardigliano
2c81afd678
Setting severity for IDS alerts
2019-08-28 03:38:01 +02:00
Simone Mainardi
c8fb20bed9
Makes alert database tables rowid as autoincrement
2019-08-23 10:31:56 +02:00
Emanuele Faranda
c829c4c3c3
Unify os ( #2755 )
...
* Unify OS information.
Now OS information is only stored into the Host. The lua uses numeric IDs to handle OS.
* Fix network discovery OS
* Show OS detail into the host details page
2019-08-08 12:09:51 +00:00
emanuele-f
959b60705d
Increase alerts database version after the latest changes which break compatibility
2019-07-31 12:36:08 +02:00
emanuele-f
ee9e5ec9de
Unify alerts and alerts notifications format
2019-07-30 18:12:58 +02:00
emanuele-f
c715bb36f3
Implement per-alert-type host counters
...
Such counters will be used in the future to generate alert timeseries.
Counters are not currently serialized as internally discussed.
Closes #2728
2019-07-19 17:27:23 +02:00
emanuele-f
5444f027ed
Remove engaged alerts from sqlite
2019-07-17 16:29:55 +02:00
emanuele-f
0d7195d6e3
Fix db index
2019-07-15 15:51:47 +02:00
emanuele-f
15879e635d
Fix stored alerts
2019-07-15 14:54:11 +02:00
emanuele-f
5e40e47cce
Implement expired alerts release
...
This is necessary to handle the case where a previously configured alert config is deleted
2019-07-15 13:09:18 +02:00
emanuele-f
a2d1e6eda4
Fix interface alert counters and bugged release
2019-07-12 16:08:26 +02:00
emanuele-f
f73810de6c
Implement engaged alerts release during shutdown/startup
...
This is necessary to sync the C state with the database state after startup
2019-07-12 13:37:56 +02:00
emanuele-f
5e0b8b496e
Remove autorelease logic based on periodicity and update database schema
2019-07-12 12:46:21 +02:00
