Commit graph

735 commits

Author SHA1 Message Date
Luca
a4047c5a1c Implements flow callbacks and alerts in C++
Scaffolding code of the host scripts

Scaffolding code for host alerts

Adds host_callbacks/ for .cpp files

Implements all classes for host callbacks

Removes pro/enterprise host callbacks

Adds typedefs with callback deltas

Compilation fix

Creates instances of host callbacks in loader

Link fix

Removes redundant/non-necessary host alerts

Merges Scan and Flood callbacks together

Removes outdated API files

Refactors alert keys into entity|id

Refactors all flow alert_{...} into flow_alert_{...}

Refactors C++ flow alert_{...} into flow_alert_{...}

Reworks alert ids to include an entity type

Cleanup and merge alertTypeRaw with getAlertType

Minor fix

Refactors alert definitions and keys into sub directories

Implement host alert callback execution and trigger/release logic

Update callbacks API

Adds base CallbacksLoader for {Host,Flow}CallbacksLoader

Implements load of host user scripts with periodicities

Implements runtime reload of host callbacks

Add logic for periodic callbacks

Add 'expired' flag to host alerts

Implements execution of host callbacks and SYN flood checks

Adds triggerAlertAsync calls to SYNFlood

Implements JSON host alert generation info

Handle callback getPeriod. Optimize callback lookup.

Implements host recipients in C++

Add callback status

Define destructor

Iterator fixes

Cleanup host Lua calls (now performed in C++)

Changes to show new host alerts in SQLite

Adds release/engage action on alert JSON

Move AlertableEntity to OtherAlertableEntity, inheriting from a new AlertableEntity. Add HostAlertableEntity.

Implements SYN Flood Attacker with params

Uses parametrized thresholds to trigger syn flood alerts

Implements build alert of both attacker and victim

Implement HostAlertableEntity

Implements SYN scan attacker/victim alerts

Implements flow flood attacker/victim alerts

Removes a debug flag

Add virtual allocStatus

Add HostAlert disableAutoRelease()

Add Ãexplicit releaseAlert()

Implements SYNFloodHostCallbackStatus

Implements SYNScanHostCallbackStatus

Implements FlowFloodHostCallbackStatus

Change trigger API to handle cli/src score

Implements {DNS,SMTP,NTP}ServerContactsAlert

Reworks ServerContacts host alerts

Implement exclusion bitmaps for host alerts

Implements {SMTP,DNS,NTP}ServerContactsAlert

Adds host_info to the generated alert JSON

Minor cleanup

Optimize access to callback status

Move RepliesRequestsRatio to pro

Rework triggerAlert on host to avoid multiple call and unneeded status data

Compilation fix

Reworked host alerts API (wip)

Cleanup unused host callbacks

Compilation fixes

Finishes backend implementation of host alerts exclusions

Rework host callbacks executor

Implements disable of host alerts

Port SYNFlood to the new api

Cleanup

Reduce duplicated code

Comments

Port ServerContacts to the new api

Clenaup

Adds parsing of configuration for host callbacks

Port SYNScanAlert to the new API

Port FlowFlood to the new API

Cleanup unused HostAlert getName

Reworks DNSRequestsErrorsRatioAlert

Adds JSON for DNSTrafficAlert

Adds FlowsAlert

Adds P2PTrafficAlert

Add RepliesRequestsRatioAlert

Adds ScoreAlert

Adds ThroughputAlert

Adds TrafficAlert

Fixes for scan/flood alerts

DNS ratio alert support

Add HTTP stats getters

Implements deltas for many host callbacks

Host score inc

Adds missing Alert params to host alerts

Release all host alerts on idle

Refactors score classes

Implements class Score to contain scores for hosts, flows, etc

Adds scores to VLANs, Networks, ASes and Countries

Host callbacks can trigger a single alert now

FlowFlood, SYNFloo, SYNScan now inherit from FlowHits

Move severity and score to constructor

Add else branch to hits callbacks

Alert definition update for flows_flood, syn_flood, syn_scan

Update field name

Engaged alert init

Adds score incs/decs for AS, VLAN, country, os and network

Restore network scripts

Restored other alert definitions for floods

Handle decreasing alert score

Removes include

Rename flows_flood to flow_flood for consistency

Restored alert_tcp_syn_flood_victim alert_tcp_syn_scan_victim definitions

Fixes for non-host engaged/release alerts

Cleanup LuaEngineFlow and LuaEngineHost classes

Fixes old calls to host lua during shutdown

Removes AlertCheckLuaEngine instance

Fixes purging of flows

Fixes alerts release upon shutdown causing wrong uses

Removes a debug flag

Fix getNumEngagedAlerts

Cleanup unnecessary host callbacks

Removes array of callback statuses inside host

Bitmap fixes

Refactors Bitmap into Bitmap128

Implements 16-bits bitmaps for host alerts

Adds class HostCallbacksStatus

Moves callback status p2p and DNS inside HostCallbacksStatus

Removes unused callbacks in typedefs

Minor cleanup

Adds trigger/release for DNS/p2p alerts

Reworks UI of hosts user scripts

Rename HostCallbackType to HostCallbackID, getType to getID, others
2021-04-03 09:53:15 +02:00
Simone Mainardi
f61ffc045b Merge branch 'c-user-scripts' into dev 2021-03-22 10:36:13 +01:00
Simone Mainardi
aea9138bfb Implements flow callbacks and alerts in C++ 2021-03-22 09:51:36 +01:00
Luca Deri
d4ba1154c0 Improved flow label in alerts 2021-03-20 19:49:24 +01:00
Luca Deri
9a0893bb8d Simplified flow rendering in alerts 2021-03-18 16:49:17 +01:00
gabryon99
a948cbea0f add toggle columns dropdown for the new datatables 2021-03-18 12:24:01 +01:00
Matteo Biscosi
c6ad556640 Rework flow alert lens into the description 2021-03-17 18:45:32 +01:00
Matteo Biscosi
4a5f8f8a08 Fixes alert utils nil value 2021-03-09 09:43:50 +01:00
Matteo Biscosi
efde09707d Temporarily disabled Purge Alerts button from Flow Explorer 2021-03-03 12:45:35 +01:00
Simone Mainardi
174cedcb95 extends get/alert/ts.lua to retrieve per-host counters 2021-03-02 09:03:05 +01:00
Alfredo Cardigliano
fa311e3ade Rework user script working sets (a single configset is supported now) 2021-03-01 15:37:45 +01:00
Matteo Biscosi
4be03c9627 Reviewed alert description and alert table width 2021-02-26 16:22:11 +01:00
Simone Mainardi
def8cadbca Fixes some ip reassignment alerts not triggering 2021-02-26 11:34:40 +01:00
Alfredo Cardigliano
d90fb8f8a5 Fix html tag stripping 2021-02-26 11:32:29 +01:00
gabryon99
0df58e5a2f nowrap for protocol and type columns in alert table (#5065) 2021-02-25 16:34:48 +01:00
Simone Mainardi
696bcb33e5 Implements alert exclusions for hosts, interfaces, local networks 2021-02-23 15:36:14 +01:00
Matteo Biscosi
04841af7b8 Implements delete for filtered alerts 2021-02-18 18:01:55 +01:00
Matteo Biscosi
eac59ae1d5 Fixes date/time len and disabled ex list for flow alerts
Fixed len of date/time column to 5% and disable exclusion list
for the alerts already disabled
2021-02-18 11:42:23 +01:00
Matteo Biscosi
6a5c5fe32b Added csrf to get when adding a new alert filter 2021-02-17 18:38:22 +01:00
Matteo Biscosi
6a32b6ca6d Changed exclude alert path 2021-02-17 18:25:21 +01:00
Matteo Biscosi
8b890a4411 Implemented filter alert params check done in Ajax 2021-02-17 18:14:33 +01:00
Simone Mainardi
59380ecd39 Implements matching of filters on alerts stored in SQLite 2021-02-17 17:31:00 +01:00
Simone Mainardi
b70383ac49 Fixes alert filter links and js
Fixes #5040
2021-02-15 16:36:52 +01:00
Matteo Biscosi
1c3c8d8cea Removed application print from flow table and shortened info's len
Info lenght reduced to 24 like in the other pages
2021-02-15 10:41:09 +01:00
Matteo Biscosi
d6d0780507 Implements add the ability to suppress specific alerts
Implements #4942
2021-02-11 17:13:07 +01:00
Matteo Biscosi
769658268f Implements add the ability to suppress specific alerts
Implements #4942

Partially implemented alerts exclusion list

Added User Script exclusion list to settings

Implements add the ability to suppress specific alerts
Implements #4942
2021-02-10 15:35:54 +01:00
Matteo Biscosi
cf3a64d2c9 Implements #4938 missing button hover on flow alerts 2021-02-10 09:42:44 +01:00
Matteo Biscosi
4f8c4ec4c4 Fixes alert page error after purging alerts 2021-02-04 10:20:21 +01:00
Matteo Biscosi
041a5de8b9 Implements #4941 Flow Alerts: Add L7 Column and Filter Menu 2021-01-29 09:45:01 +01:00
Matteo Biscosi
10fb8bbecc Implements #4919 custom alert severity 2021-01-27 12:29:19 +01:00
gabryon99
6a88d07747 add missing tooltip for explorer button (#4938) 2021-01-25 20:04:38 +01:00
Matteo Biscosi
3c6674e32d Fixed #2611 automatically delete alert older than 2021-01-18 18:12:53 +01:00
Matteo Biscosi
377f2e6064 Fixed alert release broken 2021-01-13 10:09:57 +01:00
Simone Mainardi
c7db8b0083 Fixes bad argument when generating broadcast domain alerts 2021-01-11 18:25:37 +01:00
Luca Deri
a1178a0791 Updated (C) 2021-01-02 12:08:23 +01:00
gabryon99
9f1615f818 removed nowrap from type alerts column 2020-12-31 18:16:14 +01:00
Simone Mainardi
9e7340c16a Implements alerts export to file
Implements #4769
2020-12-31 14:01:18 +01:00
gabryon99
e35100f25c removed table responsive wrapper (#4798) 2020-12-28 18:41:21 +01:00
Simone Mainardi
9e5c153b7f Fixes remote-to-remote alerts (leaves flow r2r alerts) 2020-12-24 10:59:51 +01:00
Simone Mainardi
4829d3089c Fixes alert generation for C-generated alerts 2020-12-24 10:42:56 +01:00
Matteo Biscosi
101c53336e Migrates alerts to an object-oriented implementation 2020-12-23 11:46:26 +01:00
Simone Mainardi
16e2c9efe2 Cleanup to remove flow_consts no longer needed 2020-12-22 17:59:51 +01:00
Matteo Biscosi
bcf2c2c1ed Migrates alerts to an object-oriented implementation 2020-12-22 14:48:00 +01:00
matteo
e24ef4ef35 Revert "Migrates alerts to an object-oriented implementation"
This reverts commit fbc283f12f.
2020-12-22 13:13:57 +01:00
matteo
fbc283f12f Migrates alerts to an object-oriented implementation 2020-12-22 13:00:25 +01:00
Simone Mainardi
58b982d3fb Prevents alert flow info from being shown in the flow alert page 2020-12-15 17:31:52 +01:00
Simone Mainardi
33342abc54 Additional work towards new unified alerts/flow status API 2020-12-14 19:01:33 +01:00
Simone Mainardi
c7c3a1af17 Minor fix 2020-12-04 17:45:04 +01:00
Simone Mainardi
8d6dafc897 Unifies new alerts and flow alerts API 2020-12-04 17:03:23 +01:00
Simone Mainardi
8e57382525 Fixes alpha ordering of alerts
Partially addresses #4778
2020-12-02 18:02:48 +01:00