Simone Mainardi
42b7d8e7e9
Implements facility to add pool info to alerts
2020-07-21 13:09:27 +02:00
Simone Mainardi
72f4772ada
Migrates alert_consts.lua to use the new lua host pools class
2020-07-16 17:11:42 +02:00
Simone Mainardi
5ade224d85
Implements global host pools
...
Implements #4086
Refactors host pools to global
Implements host pools migration
Migration fixes
nEdge changes for host pools migration
Create README.host_pools_migration.md
2020-07-01 12:02:09 +02:00
Simone Mainardi
d714528fa0
Minor cleanup
2020-06-09 11:50:07 +02:00
Simone Mainardi
8609e0bc2e
Avoids adding URLs for SNMP device interfaces no longer existing
2020-06-09 11:48:28 +02:00
Simone Mainardi
f33b46842a
Avoids adding URLs for SNMP devices no longer existing
2020-06-09 10:24:53 +02:00
Simone Mainardi
db43a57c3b
Implements better JSON comparison in tests and allows for custom dir and redis
2020-05-27 15:25:38 +02:00
Simone Mainardi
bd0c594433
Check host_details.lua link existance in alerts
2020-05-26 17:36:35 +02:00
Simone Mainardi
49e49e0ed6
Unifies host_details.lua generation
...
Addresses #3977
2020-05-26 12:50:47 +02:00
Alfredo Cardigliano
21e274e933
alert_consts optimizations
2020-05-20 11:18:05 +02:00
Alfredo Cardigliano
5a753d8727
Add v1/get/alert/data rest API, alert_consts optimization
2020-05-20 11:02:44 +02:00
Alfredo Cardigliano
963cff670f
Cleanup severity for external alerts
2020-04-27 18:04:41 +02:00
Simone Mainardi
290175b16f
Refactors alrt builders into creators
...
Refactors builders into creators: calls
2020-04-27 15:53:56 +02:00
Simone Mainardi
ab1690ad9e
Implements builders for each flow status definition
...
[FlowsK] alert_blacklisted_country.lua
[FlowsK] alert_flow_blacklisted.lua
[FlowsK] alert_device_protocol_not_allowed.lua
[FlowsK] external_alert.lua
[FlowsK] alert_potentially_dangerous_protocol.lua
[FlowsK] tls_certificate_mismatch.lua
[FlowsK] tls_certificate_expired.lua
[FlowsK] tls_malicious_signature.lua
[FlowsK] elephant_flows.lua
[FlowsK] not_purged.lua
[FlowsK] web_mining.lua
[FlowsK] potentially_dangerous.lua
[FlowsK] alert_flow_blocked.lua
2020-04-27 12:43:37 +02:00
Simone Mainardi
2739aac076
Implements alert builders for each alert definition
...
[AlertsK] Implements alert consts builder
[AlertsK] alert_threshold_cross.lua
[AlertsK] too_many_drops.lua
[AlertsK] alert_test_failed.lua
[AlertsK] alert_flows_flood.lua alert_tcp_syn_flood.lua lert_tcp_syn_scan.lua
[AlertsK] alert_snmp_topology_changed.lua
[AlertsK] snmp_device_reset.lua
[AlertsK] alert_slow_periodic_activity.lua
[AlertsK] alert_port_status_change.lua
[AlertsK] alert_port_status_change.lua
[AlertsK] alert_port_load_threshold_exceeded.lua
[AlertsK] alert_port_errors.lua
[AlertsK] alert_port_duplexstatus_change.lua
[AlertsK] alert_periodic_activity_not_executed.lua
[AlertsK] alert_misbehaving_flows_ratio.lua
[AlertsK] alert_influxdb_error.lua
[AlertsK] alert_influxdb_dropped_points.lua
[AlertsK] alert_dropped_alerts.lua
[AlertsK] alert_am_threshold_cross.lua
[AlertsK] alert_broadcast_domain_too_large.lua
[AlertsK] alert_device_connection.lua
[AlertsK] alert_device_connection.lua
[AlertsK] alert_host_pool_connection.lua alert_host_pool_disconnection.lua
[AlertsK] alert_ghost_network.lua
[AlertsK] alert_ip_outsite_dhcp_range.lua
[AlertsK] alert_list_download_failed.lua
[AlertsK] alert_login_failed.lua
[AlertsK] alert_mac_ip_association_change.lua
[AlertsK] alert_slow_purge.lua
[AlertsK] alert_request_reply_ratio.lua
[AlertsK] alert_quota_exceeded.lua
[AlertsK] alert_process_notification.lua
[AlertsK] alert_nfq_flushed.lua
[AlertsK] alert_misconfigured_app.lua alert_new_device.lua
[AlertsK] alert_influxdb_export_failure.lua
[AlertsK] alert_unresponsive_device.lua
[AlertsK] alert_user_activity.lua
[AlertsK] alert_user_script_calls_drops.lua
[AlertsK] minor fix
2020-04-24 15:35:44 +02:00
Simone Mainardi
ac8bd534ea
Implents PEN for alert keys
...
Implements #3823
2020-04-22 13:21:40 +02:00
Simone Mainardi
78b334e4eb
Refactors alerts and flow statuses in builtin and plugins
...
Implements #3811
Implements #3812
Refactors builtin alerts
Refactors builtin flow statuses
2020-04-21 22:27:49 +02:00
emanuele-f
0be2da4f57
Cleanup remaining references to RTT
2020-04-20 12:21:39 +02:00
Simone Mainardi
1eb02b2c2b
Unifies alert_id and alert_key
2020-04-15 14:29:03 +02:00
Simone Mainardi
4177ee61ab
Implements constant flow and alert ids
...
Enlarges AlertType size
Changes alerts database
2020-04-14 22:20:44 +02:00
Simone Mainardi
e487427aab
Refactors alert_utils and enterprise_alert_utils
...
Addresses #3720
Alerts Refactor: alert_utils as module
Alerts Refactor: notify_ntopng_start and notify_ntopng_stop
Alerts Refactor: processAlertNotifications
Alerts Refactor: checkStoreAlertsFromC
Alerts Refactor: formatAlertNotification
Alerts Refactor: notification_timestamp_rev
Alerts Refactor: formatAlertMessage
Alerts Refactor: getConfigsetAlertLink
Alerts Refactor: alertNotificationActionToLabel
Alerts Refactor: flushAlertsData
Alerts Refactor: disableAlertsGeneration
Alerts Refactor: newAlertsWorkingStatus and other
Alerts Refactor: drawAlerts
Alerts Refactor: drawAlertTables
Alerts Refactor: printAlertTables
Alerts Refactor: checkDeleteStoredAlerts
Alerts Refactor: getUnpagedAlertOptions
Alerts Refactor: getTabParameters
Alerts Refactor: getAlerts
Alerts Refactor: getNumAlerts
Alerts Refactor: performAlertsQuery
Alerts Refactor: sec2granularity
Alerts Refactor: granularity2id
Alerts Refactor: granularity2sec
Alerts Refactor: alertEngineLabel
Alerts Refactor: alertEngine
Alerts Refactor: alertEngineRaw
Alerts Refactor: alertTypeDescription
Alerts Refactor: alertType
Alerts Refactor: alertTypeLabel
Alerts Refactor: alertTypeRaw
Alerts Refactor: alertSeverity
Alerts Refactor: alertSeverityLabel
Alerts Refactor: alertSeverityRaw
Alerts Refactor: get_make_room_keys
Alerts Refactor: enterprise_alert_utils
2020-04-10 14:03:20 +02:00
emanuele-f
e390951a97
Add SNMP topology changed (via LLDP monitoring) alert
2020-04-08 11:44:30 +02:00
emanuele-f
15c013922d
Improve plugins reload to avoid transient errors
...
A "shadow directory" is now populated when the reload occurs and then swapped as the active directory.
This avoids breaking the directory structure or changing files when other threads are possibly working
on them.
Fixes #3595
2020-03-26 14:21:11 +01:00
emanuele-f
a214510baa
Add RTT user friendly information
...
Closes #3567
2020-03-20 16:41:00 +01:00
Alfredo Cardigliano
0d4927f89a
Fix error string
2020-01-30 09:52:39 +01:00
Simone Mainardi
48910b9f87
Implements auto assignment of user script alert and status ids
2020-01-15 13:08:58 +01:00
emanuele-f
8883a5321a
Fix plugins errors due to demo expiration
2019-12-12 17:26:56 +01:00
emanuele-f
e9a081903c
More robust plugins loading and error reporting
...
This prevents malformed scripts in plugins from breaking ntopng
2019-12-11 13:20:11 +01:00
emanuele-f
a3432e00e8
Implement ntopng plugins
...
Plugins are a convenient way to group together related lua scripts.
Their primary use case is to group user scripts and their alert/status
definition.
The builtin ntopng user scripts and definitions are now
packed into plugins directories. In future, we will support loading of
user created plugins.
Plugins are loaded at startup into some runtime directories and then
used. Other changes provided by this commit include:
- Add sample flow logger plugin
- Initial support for system user scripts
- Rename edge to threshold
- Migrate system probes to user scripts/plugins
- Migrate scripts to more explicit alerts_api.checkThresholdAlert api
2019-12-10 09:25:57 +01:00
Simone Mainardi
2639d49e4a
Bootstrap migration progress bars
2019-12-05 09:27:47 +01:00
emanuele-f
df0556cb87
Optimize flow alerts generation
...
This provides a ~10x speedup by performing the JSON serialization work in C
(and thus avoiding Lua->C overhead). This also implements two in-memory alerts
queues (one for sqlite and one for the notifications) in order to reduce Redis load.
Alerts queue are now global instead of per-interface as there is only 1 dequeing thread.
2019-11-14 11:54:13 +01:00
emanuele-f
af1dc8a05e
Limit alerts insertions if the queues are full
2019-11-08 11:26:49 +01:00
Alfredo Cardigliano
acdab024da
Enqueueing flow alerts to be stored/notified from Lua, removed DB select to notiy alert (using the alert object directly)
2019-11-05 15:53:10 +01:00
emanuele-f
29e5b10e6f
Fix network interface alias not used in alerts configuration
2019-10-29 16:47:22 +01:00
emanuele-f
10aa5542f8
Rework alertEntity functions to avoid modules circular dependencies
...
Fixes #2975
2019-10-23 13:01:57 +02:00
emanuele-f
ab0875155e
Remove AlertType typedef from C
2019-10-22 14:43:21 +02:00
emanuele-f
6533175336
Add flow/alerts definitions directories
2019-10-16 17:45:55 +02:00
emanuele-f
9386fdd2b1
Add status/alerts definitions overview page and documentation
2019-10-16 17:23:54 +02:00
emanuele-f
873b96c20a
Split alert types definitions in multiple files
2019-10-16 12:04:07 +02:00
emanuele-f
7a14a9cf11
Improvements in status definition API
2019-10-16 10:33:19 +02:00
Luca Deri
3b5e56d802
Added script for detecting unidirectional UDP flows
2019-10-15 21:56:48 +02:00
emanuele-f
b217909966
Split flow status definitions in multiple files
2019-10-15 17:28:45 +02:00
emanuele-f
2fdc860ed2
Add support for custom flow alerts in user scripts
2019-10-11 19:48:11 +02:00
emanuele-f
ffd3b4c1ee
Users scripts api changes and initial documentation
2019-10-09 15:12:28 +02:00
Alfredo Cardigliano
7e9678de37
IDS alert -> External alert
2019-10-09 11:35:51 +02:00
emanuele-f
d32b979368
Remove Alert Endpoint preference
...
Fixes #2859
2019-09-23 10:48:21 +02:00
emanuele-f
ef7d8614d9
Misconfigured DHCP range message fixes
2019-09-16 19:18:04 +02:00
emanuele-f
6e14f978d6
Flow alerts status cleanup
2019-09-10 13:12:11 +02:00
emanuele-f
8d7331e519
Improve ghost network alert message
2019-09-06 10:45:59 +02:00
Alfredo Cardigliano
38a53ec1fa
Transferring flows status bitmap to the client/server host. Added anomalous flows reasons to the host details page.
2019-09-05 17:55:00 +02:00
