574 commits

Author	SHA1	Message	Date
GabrieleDeri	f73a547a76	Added blacklisted icon to IP addr on mysql alert details #9438 (#9443) ... * Added ch flows export to file before ttl delete. Need to add pref for path getter * Added clickhouse ttl export path pref * Fixed naming in clickhouse flow archive * Updated naming in clickhouse flow archive pref * Removed clickhouse archive path pref * Added IXP mode pref #9421 * Removed unused prefs ch flows archive * Added blacklisted icon to IP addr on mysql alert details	2025-07-28 11:46:36 +02:00
Luca Deri	0a60f0d4b2	Fixes packets math #9438	2025-07-25 17:52:38 +02:00
Alfredo Cardigliano	6f9d7cd14f	Major code rework to fully use the clickhouse API in place of Mysql	2025-06-09 15:33:57 +02:00
Alfredo Cardigliano	c68027248f	Extend alerts_api.addAlertGenerationInfo with host attributes (#9220)	2025-05-27 13:15:01 +02:00
Alfredo Cardigliano	bb810adeff	Add native clickhouse support for queries	2025-05-16 11:14:18 +02:00
Matteo Biscosi	2ba9fcda17	Fixes suspicious DGA domain alert (#8978)	2025-03-06 15:45:20 +01:00
Matteo Biscosi	a251974b21	Fixes misstyping	2025-02-28 11:18:23 +01:00
Matteo Biscosi	fb44f88f34	Fixes missing where and query not working (#8999)	2025-02-28 11:15:41 +01:00
Alfredo Cardigliano	cc71465273	Fix example	2025-02-26 14:46:27 +01:00
GabrieleDeri	117b6e3f0c	Added documentation for duplicate alerts silencing logic (#8992)	2025-02-25 09:26:46 +01:00
Alfredo Cardigliano	d0d724ac80	Do not add is_engaged field for flow alerts as it is not required	2025-01-03 12:20:34 +01:00
Alfredo Cardigliano	24c3745810	Fix engaged alerts rendering for all families	2024-12-30 12:24:23 +01:00
Alfredo Cardigliano	25ee73bbe3	Fix alerts chart for alerts engaged before the time interval (#8795)	2024-12-30 12:02:54 +01:00
Alfredo Cardigliano	a5c59a2c48	Check max alert engage time to optimize queries (#8795)	2024-12-27 18:45:55 +01:00
Alfredo Cardigliano	e242395dd2	Show engaged time interval in alerts	2024-12-20 12:44:21 +01:00
Matteo Biscosi	02760c9303	Unified alert details page for ch and not (#8825)	2024-12-18 16:12:00 +01:00
Alfredo Cardigliano	d8d7330f11	Rework alert serialization. Change alert info format (info for all triggered alerts are now generated)	2024-12-10 13:27:57 +01:00
Matteo Biscosi	2a47b8667f	Fixes mac addresses alerts	2024-12-02 17:32:55 +01:00
Matteo Biscosi	f160e11007	Added is in memory parameter and removed port 0 (#8843)	2024-11-29 12:02:58 +01:00
Alfredo Cardigliano	8c0094f354	Fix flow alerts lookup for non predominant alerts (alerts_map_h/alerts_map_l integer columns)	2024-11-20 11:44:06 +01:00
Alfredo Cardigliano	a8cb1a3359	Fix network print	2024-11-19 09:46:14 +01:00
Alfredo Cardigliano	3d5a351508	Fix typo	2024-11-13 16:38:15 +01:00
Alfredo Cardigliano	2aa46f98ac	Implement aggregated page for all alert families	2024-11-12 16:22:06 +01:00
Alfredo Cardigliano	2da5925181	Fix all alerts page. Fix require attention results.	2024-11-11 15:59:58 +01:00
Alfredo Cardigliano	f3963c9eb1	Split alert_status (engaged, historical, acknowledged) and require_attention flag	2024-11-11 12:46:25 +01:00
Alfredo Cardigliano	6bde30030d	Check engaged alerts up to 1 day before to avoid full db scan	2024-11-11 10:50:58 +01:00
Alfredo Cardigliano	959f8b25cb	Remove useless condition for engaged alerts on flow alerts	2024-11-11 09:46:49 +01:00
Alfredo Cardigliano	7f8fd301aa	Show engaged alerts also in the Require Attention tab	2024-11-08 17:10:13 +01:00
Alfredo Cardigliano	04d2649911	Add comment on chart function	2024-11-08 17:00:41 +01:00
Alfredo Cardigliano	299057f119	Add ability to filter on alert status (#8795)	2024-11-08 16:16:56 +01:00
Alfredo Cardigliano	42dc80aa06	Fix tstamp condition to handle engaged alerts	2024-11-08 15:35:41 +01:00
Alfredo Cardigliano	7dedfa1a8c	Add schema for in-memory engaged_host_alerts table and host_alerts_view aggregated view on ClickHouse	2024-11-08 12:46:41 +01:00
Alfredo Cardigliano	ac48c01f57	Fix query count in case of no result	2024-11-08 09:52:48 +01:00
Alfredo Cardigliano	64028e3f8b	Add/remove engaged alerts from the in-memory db (currently working on SQLite)	2024-11-08 09:07:56 +01:00
Matteo Biscosi	88e9608e13	Added is engaged icon	2024-11-07 17:22:12 +01:00
Alfredo Cardigliano	b235b2412a	Add stub for insert/delete engaged	2024-11-07 12:16:28 +01:00
Alfredo Cardigliano	b48c0e0d1d	Add schema for in-memory mem_db.engaged_host_alerts table and host_alerts_view aggregated view on SQLite	2024-11-07 10:58:48 +01:00
Alfredo Cardigliano	89f59cde5a	Migrate local networks type from 16 to 32 bit	2024-10-29 15:31:37 +01:00
GabrieleDeri	f45644bd2e	Fixed telemetry response format, no impact on base ntopng, different endpoint (#8653) ... * Fixed telemetry response format, no impact on base ntopng, different endpoint * Fixed error * Added toboolean instead of string compare	2024-08-21 16:55:04 +02:00
Alfredo Cardigliano	bc26f3f5eb	Exclude no (empty or zero) mitre from results	2024-08-12 15:19:31 +02:00
Luca Deri	7928a423bf	Fixed invalid formatting	2024-08-09 21:27:18 +02:00
Alfredo Cardigliano	548c9aeec5	Remove obsolete JA3 support	2024-08-09 09:08:32 +02:00
Alfredo Cardigliano	a4d28d59f2	Fix #8589	2024-08-07 16:03:53 +02:00
Alfredo Cardigliano	939df53237	Add Top Mitre in flow and host alerts. Optimize alert Tops computation. Add Security report.	2024-08-07 11:17:06 +02:00
Alfredo Cardigliano	0b16d384b6	Fix mitre info in flow alerts custom queries	2024-08-06 17:45:17 +02:00
Alfredo Cardigliano	287c3e1806	Handle mitre filters in queries	2024-08-06 16:58:52 +02:00
Alfredo Cardigliano	6d7e24e06a	Add list of filters for mitre ids and categories	2024-08-06 16:44:50 +02:00
Alfredo Cardigliano	abee29d8d7	Add mitre tables by id. Fix host alerts format in case of aggragations	2024-08-06 16:20:09 +02:00
Alfredo Cardigliano	d141cc86e8	Read i18n for mitre even with no alert id (in case of aggregations)	2024-08-06 15:25:36 +02:00
DGabri	fb9d305fde	Added mitre info in flow alerts page	2024-08-06 12:46:44 +02:00