Luca Deri
ac6788a311
Bug fix
2024-12-23 21:01:01 +01:00
Luca Deri
4b160de275
Improved host policy alert
2024-12-23 10:32:04 +01:00
Matteo Biscosi
133f5339b3
Added host policy alert in lua
2024-12-19 10:23:46 +01:00
Matteo Biscosi
a514dc9cdb
Fixes periodicity changed description ( #8853 )
2024-12-17 11:06:52 +01:00
Matteo Biscosi
e89f07f238
Merged score threshold and dangerous hosts alerts ( #8827 )
2024-12-12 16:45:43 +01:00
YellowMan
c712750200
Remote to local insecure flow ( #8871 )
...
* Fixed domain names contact alert behaviour
* enanched remote to local insecure flow alert description
* minor fix
2024-12-11 16:54:01 +01:00
Luca Deri
76e47112e8
Fixes invalid format error
2024-12-05 12:22:23 +01:00
Matteo Biscosi
0ebe2b9e88
Fixes missing blacklist ( #8841 )
2024-12-02 18:34:00 +01:00
Matteo Biscosi
2a47b8667f
Fixes mac addresses alerts
2024-12-02 17:32:55 +01:00
Matteo Biscosi
07ef54c7cc
Added ACL violation ARP alert ( #8696 )
2024-12-02 13:07:56 +01:00
Matteo Biscosi
819f39830b
Added ACL Violation alert ( #8696 )
2024-11-28 18:02:53 +01:00
Luca Deri
fb06400fe2
Changed alert serialization
2024-11-28 09:34:57 +01:00
Luca Deri
084e295af8
Minor fixes
2024-11-27 15:26:31 +01:00
Matteo Biscosi
b2a37ea016
Fixes missing protocol mapping ( #8805 )
2024-11-12 11:07:47 +01:00
Matteo Biscosi
4fffe8b449
Fixes host alert score treshold description
2024-10-23 16:11:31 +02:00
Luca
1117e71d18
Removed SYN flood check that was partially overlapping with SYN scan
2024-10-22 15:46:50 +02:00
Matteo Biscosi
952e136080
Moved unexpected gateway check from flows to hosts
2024-10-07 16:58:31 +02:00
Matteo Biscosi
5314a61f7c
Added gateway alert and configuration ( #8687 ); Fixes nedge compilation issue
2024-10-02 11:07:19 +02:00
Alfredo Cardigliano
3b0b60c422
Remove JA3 leftovers. Update alert keys. Rename malivious JA3 to malicious Fingerprint.
2024-09-02 18:34:17 +02:00
Luca Deri
1477437b7c
Improvements for no exporter/probe activity
2024-08-07 18:06:51 +02:00
Luca Deri
16b5a8ccc1
Implemented no exporter/probe activity ( #8608 )
2024-08-07 18:06:51 +02:00
Alfredo Cardigliano
b09688beee
Add new alert no_exporter_activity
2024-08-07 13:05:48 +02:00
Alfredo Cardigliano
206b86544f
Fix corner cases in alert_elephant_flow.format
2024-08-05 18:00:22 +02:00
Matteo Biscosi
63ebb9071a
Removed same info stored
2024-08-02 12:10:23 +02:00
Matteo Biscosi
ffa80bb51a
Added blacklist info to alert_json
2024-08-02 12:10:06 +02:00
Alfredo Cardigliano
47e293b2df
Difine new alert type snmp_trap. Add ability to trigger snmp_trap from C.
2024-07-25 08:16:33 +00:00
Luca Ferretti
7cceb656c0
fixed typo ( #8565 )
...
* added netbox documentation
* Update asset_inventory.rst
* added ndpi-protocols ipv6 rules
* updated ipv6 check for custom rule
* fix typo
* implemented mitre_table_info inside database
* fixed typo
* changed tecnique to technique typo
* Update host_alert_scan_detected.lua
2024-07-24 18:23:47 +02:00
Luca Ferretti
61628b55c0
fixed mitre_id typo ( #8562 )
...
* added netbox documentation
* Update asset_inventory.rst
* added ndpi-protocols ipv6 rules
* updated ipv6 check for custom rule
* fix typo
* implemented mitre_table_info inside database
* fixed typo
2024-07-24 16:19:33 +02:00
Matteo Biscosi
13287d609e
Added alert when dropping flows due to flow exporters limit exceeded
2024-07-15 18:58:36 +02:00
Alfredo Cardigliano
01de4b646f
Add missing return
2024-07-04 16:44:38 +00:00
Alfredo Cardigliano
39494e3002
Add cloud broker host in case of disconnection and reconnection
2024-07-04 16:42:46 +00:00
Alfredo Cardigliano
8d326f2718
Define new alert cloud_reconnected
2024-06-21 17:59:14 +02:00
Alfredo Cardigliano
dab5aeba99
Define new alert cloud_disconnected
2024-06-21 17:33:05 +02:00
Luca Deri
de0325d22a
Added SNMP alert in case of unresposive devices
...
Modifie InfluxDB 1.x -> 1.x/2.x string
2024-06-20 23:56:12 +02:00
Luca Ferretti
1b3a0ec19a
initial mitre att&ck standardization ( #8446 )
...
* added feature sorting flows by protocol
* changed protocols comparison order
* initial commit for bitmap of server ports
* bitmap added to redis
* added debug string, bitmap not working
* Update alerts_list_per_license.rst
* Update alerts_list_per_license.rst
* initial mitre att&ck standardization
* Update ServerPortsBitmap.h
* updated mitre standardization
2024-06-12 15:55:10 +02:00
Luca Deri
c53b79e302
Definition of SNMP polling error
2024-06-02 17:55:37 +02:00
Luca Ferretti
edef411ebc
added contacted_server_port alert ( #8408 )
...
* initial integretion of server port check
* update learning period and received packet time
* updated host initial time
* Update Flow.cpp
* fixed reported issues
* added server_ports_contacts alert
* minor changes
2024-05-28 12:52:36 +02:00
Matteo Biscosi
9b8695eb05
Possible fix for dga domain alert description ( #8325 )
2024-05-08 12:28:13 -04:00
Matteo Biscosi
57eb0c7207
Started fixing issue #8325
2024-05-03 09:30:17 -04:00
Luca Deri
8f49ce0f4b
Cleaned up bkaclisted flow label (removed UID)
2024-04-25 11:04:12 +02:00
Nicolò Maio
59075f5e10
Splitting blacklisted flow alert and creating two new alerts. ( #8354 ) ( #8355 )
...
* Splitting blacklisted flow alert and creating two new alerts. (#8354 )
* Renaming to 'Blacklisted Client Contact' and 'Blacklisted Server Contact'. (#8354 )
2024-04-24 17:37:30 +02:00
Nicolò Maio
636ba2975c
Add Flow Reset Alert and counter. ( #8264 ) ( #8348 )
...
* Add Flow Reset Alert and counter. (#8264 )
* Renaming to TCP Flow Reset. (#8264 )
* Renaming the value retrieved by the getName method. (#8264 )
2024-04-24 17:15:20 +02:00
Nicolò Maio
fd6b0958c3
Rename the alert to "Remote to Local Insecure Flow". ( #8257 ) ( #8339 )
2024-04-18 12:45:54 +02:00
Nicolo Maio
2caddb8b04
Add absolute percentage as a metric in SNMP rules.
2024-04-16 14:47:19 +02:00
Matteo Biscosi
0cfd1246c1
Fixes some alerts description
2024-04-12 11:03:33 -04:00
Matteo Biscosi
0fecdee1e4
Reworked blacklists page
2024-04-11 12:48:59 -04:00
Matteo Biscosi
1460eda751
Fixes SQL injection description
2024-04-10 07:16:13 -04:00
Luca Deri
f26d56959c
Renamed HostBlackHoleContactsAlert to HostScannerAlert
2024-04-08 18:35:49 +02:00
Matteo Biscosi
436bf03e56
Removed html when not requested and fixed some alerts description( #8304 )
2024-04-08 10:45:11 -04:00
Matteo Biscosi
cbec26e3b4
Fixes missing alert descriptions ( #8314 #8313 )
2024-04-08 07:02:17 -04:00
