Commit graph

498 commits

Author SHA1 Message Date
emanuele-f
9ea7ff01b8 Improve flow alert trigger logic and fix support for custom message 2019-10-15 18:36:41 +02:00
Simone Mainardi
3950c3ddc8 Support for 5-min timeseries resolution in InfluxDB 2019-10-15 15:06:20 +02:00
Simone Mainardi
002f1e7176 InfluxDB writes are now done with second precision
Implements #2935
2019-10-14 09:44:15 +02:00
emanuele-f
0ddc82d7db Port blacklisted flow alerts to new api 2019-10-11 16:32:37 +02:00
Alfredo Cardigliano
e3f7979add nEdge compilation fix 2019-10-11 09:51:10 +02:00
emanuele-f
2da2bdf7f6 Initial flow api documentation 2019-10-10 17:16:39 +02:00
Alfredo Cardigliano
a2e74e16a3 New Lua interface.processFlow API, moved processFlow from NetworkInterface to ParserInterface, code cleanup 2019-10-10 12:49:32 +02:00
Simone Mainardi
179d24e268 Removes unused Mutex rrd_lock 2019-10-09 11:54:44 +02:00
Simone Mainardi
27444ec067 Reworks lua method calls in flow context 2019-10-09 11:51:53 +02:00
Simone Mainardi
79ec20d6df Re-uses getFlows filters for the getActiveFlowsStats
Fixes #2891
2019-10-08 00:23:35 +02:00
emanuele-f
ede9a7940a Generalize periodic and flows callbacks
Now periodic callbacks are properly called even when alerts are disabled
The granularity filter and check_function has been replaced with a more generic hooks list
2019-10-07 19:05:43 +02:00
emanuele-f
d74e4b4aa6 Compilation fix 2019-10-04 12:09:30 +02:00
Simone Mainardi
fa17aab9db Implements lua flow method calls using ids to be more efficient 2019-09-30 17:29:01 +02:00
Simone Mainardi
60c5de9c7f Waits an extra time for interfaces to reload custom categories 2019-09-25 12:39:54 +02:00
Alfredo Cardigliano
1b45f800f9 Sub-interfaces backend improvements for the GUI 2019-09-24 20:50:58 +02:00
emanuele-f
beddb433b7 Add a message when POST form submission fails 2019-09-23 16:00:25 +02:00
Simone Mainardi
b3f50c6b21 Fixes DNS resolution leaks and wrong ping addresses 2019-09-23 14:54:19 +02:00
Simone Mainardi
b3d595653e Initial implementation of lua flow callback scripts and blacklisted alerts
Partially implements #2842
2019-09-16 18:27:46 +02:00
Simone Mainardi
968e21d984 Implements flow lua callbacks in the periodic activities thread 2019-09-12 15:36:41 +02:00
Simone Mainardi
9fe404772d Handles flow alerts and alert queues in view interfaces
Implements #2828
2019-09-10 15:48:39 +02:00
emanuele-f
c3fa094e99 Improve MUD prefs handling
Also implement a non-inline reloadPrefs Host method to avoid slowing down packet capture
2019-09-10 11:10:33 +02:00
emanuele-f
48d688d501 Add support for MAC MUD 2019-09-06 15:53:15 +02:00
emanuele-f
e9aa6b1703 Add flow.lua duration trace 2019-09-06 11:15:12 +02:00
Simone Mainardi
5d380c39d0 Exposes interface stats update freq to lua 2019-09-05 10:27:25 +02:00
emanuele-f
c97ef3d908 Implement host MUD recording and dump 2019-09-04 21:20:52 +02:00
emanuele-f
5c3a063fae Fix startup with sticky hosts
interface.restoreHost was improperly removed in ef4f98a5a5
2019-09-04 14:10:24 +02:00
emanuele-f
b62e4183f0 Add ability to manually release an alert 2019-09-04 12:29:13 +02:00
emanuele-f
74f761d18b Allow calls to alerts_api.trigger/alerts_api.release outside periodic scripts 2019-09-03 19:20:50 +02:00
emanuele-f
8e6cd5962a Fix blacklisted host alerts not generated when reading from PCAP dump 2019-09-03 17:50:08 +02:00
emanuele-f
fbb66951b5 Add alert score on hosts 2019-09-03 13:36:27 +02:00
Simone Mainardi
e1d911a052 Adds lua_pcall check when loading scripts to prevent silent failures 2019-09-02 11:25:39 +02:00
Simone Mainardi
91163ed4e2 Fixes Lua script failures when loading alerts/flow.lua 2019-09-02 10:53:36 +02:00
emanuele-f
2d02de6cc1 Implement initial flow score support 2019-08-30 17:16:11 +02:00
Simone Mainardi
2e67a69cb7 Implements redis health and keys used monitoring 2019-08-30 16:19:33 +02:00
Simone Mainardi
6ae30f0604 Initial implementation of the Redis monitoring probe 2019-08-28 19:30:52 +02:00
emanuele-f
b66b71fd7e Implement alert on JA3 malicious signatures
Closes #2788
2019-08-28 18:33:13 +02:00
emanuele-f
b3bdfcff32 Cleanup of the too-many-drops interface alert 2019-08-27 13:04:53 +02:00
emanuele-f
f43f4b7dd9 Add engaged alerts type exclusion filter
Fixes #2780
2019-08-22 16:30:45 +02:00
emanuele-f
87ba28195b Add support to engage/release on external alerts 2019-08-20 19:02:58 +02:00
emanuele-f
d1c5275302 Move suppressed alerts flag to C to reduce Redis load 2019-08-20 11:54:25 +02:00
Simone Mainardi
3413a6afd0 Implements stats rather than grouped hosts data for host pools stats 2019-08-20 11:45:11 +02:00
Simone Mainardi
74c545d079 Uses stats rather than grouped hosts data for network stats 2019-08-19 17:39:51 +02:00
Simone Mainardi
485d398826 Resets host pool stats at midnight only for nEdge 2019-08-16 10:32:14 +02:00
Emanuele Faranda
c829c4c3c3
Unify os (#2755)
* Unify OS information.

Now OS information is only stored into the Host. The lua uses numeric IDs to handle OS.

* Fix network discovery OS

* Show OS detail into the host details page
2019-08-08 12:09:51 +00:00
emanuele-f
ee9e5ec9de Unify alerts and alerts notifications format 2019-07-30 18:12:58 +02:00
emanuele-f
2243cabcf1 Fix alert release time and gui enhancements 2019-07-25 14:25:27 +02:00
emanuele-f
a3942831b8 Fix issues with engaged alert counters and other improvements 2019-07-24 15:40:43 +02:00
emanuele-f
09fb8667e2 Add ability to disable specific alert types on alertables 2019-07-22 23:37:23 +02:00
emanuele-f
6a6cedc899 Add ability to disable host alerts on specific flow status 2019-07-22 12:16:12 +02:00
emanuele-f
c715bb36f3 Implement per-alert-type host counters
Such counters will be used in the future to generate alert timeseries.
Counters are not currently serialized as internally discussed.

Closes #2728
2019-07-19 17:27:23 +02:00