emanuele-f
340462ad73
Cleanup of the timeseries ring and NetworkInterfaceTsPoint
2020-05-20 15:18:03 +02:00
Simone Mainardi
b6447bbfb0
Implements ordering for flow Lua callbacks
2020-05-17 14:12:08 +02:00
Simone Mainardi
f3a5d7b10e
Fixes external suricata alerts
2020-04-28 20:37:50 +02:00
Alfredo Cardigliano
c22f3b00e1
Fix alert ids source match
2020-04-28 16:12:03 +02:00
Alfredo Cardigliano
963cff670f
Cleanup severity for external alerts
2020-04-27 18:04:41 +02:00
Simone Mainardi
83c4d36e34
Simplifies flow.triggerStatus using internal flow status reference
2020-04-27 17:48:56 +02:00
Simone Mainardi
efe4f9a8be
Unifies alerts generation format with flow statuses
2020-04-27 14:37:04 +02:00
Simone Mainardi
ab1690ad9e
Implements builders for each flow status definition
...
[FlowsK] alert_blacklisted_country.lua
[FlowsK] alert_flow_blacklisted.lua
[FlowsK] alert_device_protocol_not_allowed.lua
[FlowsK] external_alert.lua
[FlowsK] alert_potentially_dangerous_protocol.lua
[FlowsK] tls_certificate_mismatch.lua
[FlowsK] tls_certificate_expired.lua
[FlowsK] tls_malicious_signature.lua
[FlowsK] elephant_flows.lua
[FlowsK] not_purged.lua
[FlowsK] web_mining.lua
[FlowsK] potentially_dangerous.lua
[FlowsK] alert_flow_blocked.lua
2020-04-27 12:43:37 +02:00
Simone Mainardi
0a9a7015e0
Unifies status_id and status_key
2020-04-15 14:29:03 +02:00
Simone Mainardi
1eb02b2c2b
Unifies alert_id and alert_key
2020-04-15 14:29:03 +02:00
Simone Mainardi
e487427aab
Refactors alert_utils and enterprise_alert_utils
...
Addresses #3720
Alerts Refactor: alert_utils as module
Alerts Refactor: notify_ntopng_start and notify_ntopng_stop
Alerts Refactor: processAlertNotifications
Alerts Refactor: checkStoreAlertsFromC
Alerts Refactor: formatAlertNotification
Alerts Refactor: notification_timestamp_rev
Alerts Refactor: formatAlertMessage
Alerts Refactor: getConfigsetAlertLink
Alerts Refactor: alertNotificationActionToLabel
Alerts Refactor: flushAlertsData
Alerts Refactor: disableAlertsGeneration
Alerts Refactor: newAlertsWorkingStatus and other
Alerts Refactor: drawAlerts
Alerts Refactor: drawAlertTables
Alerts Refactor: printAlertTables
Alerts Refactor: checkDeleteStoredAlerts
Alerts Refactor: getUnpagedAlertOptions
Alerts Refactor: getTabParameters
Alerts Refactor: getAlerts
Alerts Refactor: getNumAlerts
Alerts Refactor: performAlertsQuery
Alerts Refactor: sec2granularity
Alerts Refactor: granularity2id
Alerts Refactor: granularity2sec
Alerts Refactor: alertEngineLabel
Alerts Refactor: alertEngine
Alerts Refactor: alertEngineRaw
Alerts Refactor: alertTypeDescription
Alerts Refactor: alertType
Alerts Refactor: alertTypeLabel
Alerts Refactor: alertTypeRaw
Alerts Refactor: alertSeverity
Alerts Refactor: alertSeverityLabel
Alerts Refactor: alertSeverityRaw
Alerts Refactor: get_make_room_keys
Alerts Refactor: enterprise_alert_utils
2020-04-10 14:03:20 +02:00
emanuele-f
c848ea2395
Fix script failure due to removed host.getLocalhostInfo
2020-04-02 18:42:52 +02:00
Alfredo Cardigliano
2425134f05
Replace isEnterprise with isEnterpriseM
2020-04-02 12:36:34 +00:00
Simone Mainardi
daf7f0a05c
Minor Fix
2020-04-01 13:12:55 +02:00
Simone Mainardi
a9776b5013
Documents internals periodic activities
2020-04-01 13:03:13 +02:00
Simone Mainardi
3144bc8bdf
Renames alert_config to user_script_config
2020-03-26 14:51:53 +01:00
emanuele-f
0facf0e27d
Implement host timeseries off/light/mode selection
...
Closes #3466
2020-03-03 15:52:04 +01:00
Alfredo Cardigliano
b3ceaf9db4
Moved external alert score computation ( fix #3447 )
2020-02-24 15:01:21 +01:00
Alfredo Cardigliano
dbe07bbfcd
Score computation fix (external alerts)
2020-02-24 12:27:48 +01:00
Simone Mainardi
a0612895fe
Implements slow rrd checks and updates in C
2020-02-19 19:28:07 +01:00
Simone Mainardi
a7ea7f76ed
Implements detection of slow timeseries append
2020-02-19 18:45:36 +01:00
Simone Mainardi
5b70db90ad
Handles deadlines for flow user scripts
2020-02-19 10:46:44 +01:00
Simone Mainardi
0e64fd94d6
Implements deadlines for periodic and user scripts
2020-02-18 18:44:41 +01:00
emanuele-f
58b3d42d22
Set max score on hosts contacting blacklisted hosts
2020-02-17 15:16:01 +01:00
emanuele-f
e3d3d3992f
Replace an existing flow alert if a more critical problem is found
...
Also add the flow score into the database
2020-02-07 19:20:57 +01:00
emanuele-f
0a0a3c4537
Rework flow status accounting
2020-02-07 19:17:07 +01:00
emanuele-f
13ec0d2f44
Use the flow score to determine the status priority
2020-02-07 19:17:07 +01:00
emanuele-f
96925a7e03
Fix invalid flow.triggerStatus calls
2020-02-06 10:31:22 +01:00
emanuele-f
c791fc1246
Add check to avoid nil config
2020-01-24 11:35:59 +01:00
Simone Mainardi
1cbdbbd339
Hides status_id from flow.{trigger,set,clear}Status
...
Fixes #3266
2020-01-21 12:27:33 +01:00
emanuele-f
dd8643ad79
Add missing community check
2020-01-20 13:21:38 +01:00
emanuele-f
aca088ea13
Add hyperlink to jump to the alert configuration
...
Closes #2936
2020-01-17 19:11:15 +01:00
emanuele-f
508d040a49
Fix updateScore not called in flow.setStatus
2020-01-17 11:11:02 +01:00
emanuele-f
23f7d90ee4
Move interface.computeHostsScore in the Score script
2020-01-17 10:44:38 +01:00
emanuele-f
892c779fb7
Fix score ts written when host timeseries are disabled
2020-01-16 19:08:57 +01:00
emanuele-f
a97dbd013b
Remove score global preference
2020-01-16 18:21:35 +01:00
emanuele-f
566b9ece0b
Score changes
...
- Move score from status definition to user scripts
- Separate flow score counter from the peers score
- Create a new HostScore class to hold the score data
2020-01-16 18:11:14 +01:00
emanuele-f
c336cca0e7
Improve host score calculation
2020-01-15 18:42:48 +01:00
Simone Mainardi
03a4b14dda
User scripts now read view configsets for viewed interfaces
...
Implements #3225
2020-01-15 15:40:44 +01:00
emanuele-f
6edecb12cb
Score visualization improvements
2020-01-15 15:27:45 +01:00
emanuele-f
d7528e1628
Score improvements
...
The score is now calculated differently on the client and on the server of the flow.
The hosts flow is updated every minute and charted.
It's now possible to trigger an alert when the score threshold is exceeded
2020-01-15 12:34:16 +01:00
Luca Deri
170bc60f19
Updated (C)
2020-01-08 23:52:51 +01:00
Simone Mainardi
724f1da5ea
Fixes use of interface names in flow alerts
2020-01-08 19:03:08 +01:00
Simone Mainardi
76391ff6a5
Resores flow alerts for view interfaces
2020-01-08 18:18:00 +01:00
emanuele-f
d037f9a9a4
Use new user scripts config and gui
...
The user scripts configuration can now be configured from the "User Scripts" entry under the cog
icon. It allows the creation of multiple configuration presets to be applied to hosts, networks and
interfaces.
2020-01-03 13:03:34 +01:00
emanuele-f
4621a8f409
Reload the periodic scripts when the configuration changes
2019-12-31 19:31:03 +01:00
Simone Mainardi
2abb8cfde5
Reworks flow scripts deadlines
2019-12-27 20:50:53 +01:00
Simone Mainardi
c873aee41b
Implement counter and chart for new flows per second
2019-12-27 12:29:55 +01:00
emanuele-f
8b7d711a36
Add option to disable flow user scripts invocation
2019-12-23 18:03:19 +01:00
emanuele-f
c665bc78d7
Make configsets global
2019-12-23 13:25:35 +01:00
