Simone Mainardi
330234e3f7
Optimized hosts scripts using direct pool_id to retrieve config
2020-07-30 19:57:16 +02:00
Simone Mainardi
516451aa6c
Uses actual host pool id when executing host scripts
2020-07-30 11:39:15 +02:00
Simone Mainardi
4e96ae7e26
Refactors user_scripts method names
2020-07-29 15:17:31 +02:00
Simone Mainardi
c291fe91c9
Adds periodic_user_scripts.lua for the execution of periodic scripts
2020-07-29 14:47:11 +02:00
Simone Mainardi
8418d932ec
Avoids spawning num_interfaces + threads to update stats
2020-07-27 15:50:11 +02:00
Alfredo Cardigliano
f038baf804
Alerts are no longer enqueued if disabled
2020-07-23 00:49:28 +02:00
Simone Mainardi
92c88c7924
Migrates interface user scripts to the new interface pools configuration
2020-07-10 19:32:03 +02:00
Simone Mainardi
cf400216e2
Implements caching of member-to-confiset_id as Lua pool class member
2020-07-10 19:22:47 +02:00
Simone Mainardi
bd4921df55
Migrates local network user scripts to the new host pools configuration
2020-07-10 18:45:19 +02:00
Simone Mainardi
09c69edb22
Major rework of user_scripts.lua to use new pools
2020-07-10 13:01:29 +02:00
emanuele-f
340462ad73
Cleanup of the timeseries ring and NetworkInterfaceTsPoint
2020-05-20 15:18:03 +02:00
Simone Mainardi
b6447bbfb0
Implements ordering for flow Lua callbacks
2020-05-17 14:12:08 +02:00
Simone Mainardi
f3a5d7b10e
Fixes external suricata alerts
2020-04-28 20:37:50 +02:00
Alfredo Cardigliano
c22f3b00e1
Fix alert ids source match
2020-04-28 16:12:03 +02:00
Alfredo Cardigliano
963cff670f
Cleanup severity for external alerts
2020-04-27 18:04:41 +02:00
Simone Mainardi
83c4d36e34
Simplifies flow.triggerStatus using internal flow status reference
2020-04-27 17:48:56 +02:00
Simone Mainardi
efe4f9a8be
Unifies alerts generation format with flow statuses
2020-04-27 14:37:04 +02:00
Simone Mainardi
ab1690ad9e
Implements builders for each flow status definition
...
[FlowsK] alert_blacklisted_country.lua
[FlowsK] alert_flow_blacklisted.lua
[FlowsK] alert_device_protocol_not_allowed.lua
[FlowsK] external_alert.lua
[FlowsK] alert_potentially_dangerous_protocol.lua
[FlowsK] tls_certificate_mismatch.lua
[FlowsK] tls_certificate_expired.lua
[FlowsK] tls_malicious_signature.lua
[FlowsK] elephant_flows.lua
[FlowsK] not_purged.lua
[FlowsK] web_mining.lua
[FlowsK] potentially_dangerous.lua
[FlowsK] alert_flow_blocked.lua
2020-04-27 12:43:37 +02:00
Simone Mainardi
0a9a7015e0
Unifies status_id and status_key
2020-04-15 14:29:03 +02:00
Simone Mainardi
1eb02b2c2b
Unifies alert_id and alert_key
2020-04-15 14:29:03 +02:00
Simone Mainardi
e487427aab
Refactors alert_utils and enterprise_alert_utils
...
Addresses #3720
Alerts Refactor: alert_utils as module
Alerts Refactor: notify_ntopng_start and notify_ntopng_stop
Alerts Refactor: processAlertNotifications
Alerts Refactor: checkStoreAlertsFromC
Alerts Refactor: formatAlertNotification
Alerts Refactor: notification_timestamp_rev
Alerts Refactor: formatAlertMessage
Alerts Refactor: getConfigsetAlertLink
Alerts Refactor: alertNotificationActionToLabel
Alerts Refactor: flushAlertsData
Alerts Refactor: disableAlertsGeneration
Alerts Refactor: newAlertsWorkingStatus and other
Alerts Refactor: drawAlerts
Alerts Refactor: drawAlertTables
Alerts Refactor: printAlertTables
Alerts Refactor: checkDeleteStoredAlerts
Alerts Refactor: getUnpagedAlertOptions
Alerts Refactor: getTabParameters
Alerts Refactor: getAlerts
Alerts Refactor: getNumAlerts
Alerts Refactor: performAlertsQuery
Alerts Refactor: sec2granularity
Alerts Refactor: granularity2id
Alerts Refactor: granularity2sec
Alerts Refactor: alertEngineLabel
Alerts Refactor: alertEngine
Alerts Refactor: alertEngineRaw
Alerts Refactor: alertTypeDescription
Alerts Refactor: alertType
Alerts Refactor: alertTypeLabel
Alerts Refactor: alertTypeRaw
Alerts Refactor: alertSeverity
Alerts Refactor: alertSeverityLabel
Alerts Refactor: alertSeverityRaw
Alerts Refactor: get_make_room_keys
Alerts Refactor: enterprise_alert_utils
2020-04-10 14:03:20 +02:00
emanuele-f
c848ea2395
Fix script failure due to removed host.getLocalhostInfo
2020-04-02 18:42:52 +02:00
Alfredo Cardigliano
2425134f05
Replace isEnterprise with isEnterpriseM
2020-04-02 12:36:34 +00:00
Simone Mainardi
daf7f0a05c
Minor Fix
2020-04-01 13:12:55 +02:00
Simone Mainardi
a9776b5013
Documents internals periodic activities
2020-04-01 13:03:13 +02:00
Simone Mainardi
3144bc8bdf
Renames alert_config to user_script_config
2020-03-26 14:51:53 +01:00
emanuele-f
0facf0e27d
Implement host timeseries off/light/mode selection
...
Closes #3466
2020-03-03 15:52:04 +01:00
Alfredo Cardigliano
b3ceaf9db4
Moved external alert score computation ( fix #3447 )
2020-02-24 15:01:21 +01:00
Alfredo Cardigliano
dbe07bbfcd
Score computation fix (external alerts)
2020-02-24 12:27:48 +01:00
Simone Mainardi
a0612895fe
Implements slow rrd checks and updates in C
2020-02-19 19:28:07 +01:00
Simone Mainardi
a7ea7f76ed
Implements detection of slow timeseries append
2020-02-19 18:45:36 +01:00
Simone Mainardi
5b70db90ad
Handles deadlines for flow user scripts
2020-02-19 10:46:44 +01:00
Simone Mainardi
0e64fd94d6
Implements deadlines for periodic and user scripts
2020-02-18 18:44:41 +01:00
emanuele-f
58b3d42d22
Set max score on hosts contacting blacklisted hosts
2020-02-17 15:16:01 +01:00
emanuele-f
e3d3d3992f
Replace an existing flow alert if a more critical problem is found
...
Also add the flow score into the database
2020-02-07 19:20:57 +01:00
emanuele-f
0a0a3c4537
Rework flow status accounting
2020-02-07 19:17:07 +01:00
emanuele-f
13ec0d2f44
Use the flow score to determine the status priority
2020-02-07 19:17:07 +01:00
emanuele-f
96925a7e03
Fix invalid flow.triggerStatus calls
2020-02-06 10:31:22 +01:00
emanuele-f
c791fc1246
Add check to avoid nil config
2020-01-24 11:35:59 +01:00
Simone Mainardi
1cbdbbd339
Hides status_id from flow.{trigger,set,clear}Status
...
Fixes #3266
2020-01-21 12:27:33 +01:00
emanuele-f
dd8643ad79
Add missing community check
2020-01-20 13:21:38 +01:00
emanuele-f
aca088ea13
Add hyperlink to jump to the alert configuration
...
Closes #2936
2020-01-17 19:11:15 +01:00
emanuele-f
508d040a49
Fix updateScore not called in flow.setStatus
2020-01-17 11:11:02 +01:00
emanuele-f
23f7d90ee4
Move interface.computeHostsScore in the Score script
2020-01-17 10:44:38 +01:00
emanuele-f
892c779fb7
Fix score ts written when host timeseries are disabled
2020-01-16 19:08:57 +01:00
emanuele-f
a97dbd013b
Remove score global preference
2020-01-16 18:21:35 +01:00
emanuele-f
566b9ece0b
Score changes
...
- Move score from status definition to user scripts
- Separate flow score counter from the peers score
- Create a new HostScore class to hold the score data
2020-01-16 18:11:14 +01:00
emanuele-f
c336cca0e7
Improve host score calculation
2020-01-15 18:42:48 +01:00
Simone Mainardi
03a4b14dda
User scripts now read view configsets for viewed interfaces
...
Implements #3225
2020-01-15 15:40:44 +01:00
emanuele-f
6edecb12cb
Score visualization improvements
2020-01-15 15:27:45 +01:00
