Simone Mainardi
|
8d6dafc897
|
Unifies new alerts and flow alerts API
|
2020-12-04 17:03:23 +01:00 |
|
Simone Mainardi
|
5c0c23feb6
|
Fixes execution of periodicUpdate flow callback
Fixes #4687
|
2020-11-06 18:17:54 +01:00 |
|
Simone Mainardi
|
d7f1ce0d8c
|
Reworks and optimizes flow alerted status
|
2020-10-19 16:50:22 +02:00 |
|
Alfredo Cardigliano
|
a5a8030e35
|
Cleanup trigger flow external alert
|
2020-10-19 13:12:31 +02:00 |
|
Simone Mainardi
|
d3dda0bb82
|
Unifies misbehaving with alerted flows
Implements #4596
|
2020-10-16 18:58:20 +02:00 |
|
Simone Mainardi
|
b7bdd1edaf
|
Massive cleanup of alerts (disabled/suppressed)
Fixes #4504
|
2020-10-01 18:40:11 +02:00 |
|
Simone Mainardi
|
0db456c0cf
|
Reworks flow user scripts execution in C++
|
2020-09-30 18:41:36 +02:00 |
|
Simone Mainardi
|
8392e126f8
|
Simplifies and reduces the number of threads for purging idle entries
|
2020-09-29 18:51:44 +02:00 |
|
Simone Mainardi
|
5133af720f
|
Reworks view interfaces with queues; rework idling and flow hooks exec
|
2020-09-29 18:30:10 +02:00 |
|
Simone Mainardi
|
90a5a57b36
|
Implements user script queues (avoids 5-sec HT walk)
|
2020-09-28 11:45:00 +02:00 |
|
Simone Mainardi
|
814ee67cf9
|
Reworks nDPI Risks flow plugins to handle all risks and scores
Fixes #4432
|
2020-09-23 17:58:51 +02:00 |
|
Simone Mainardi
|
6c1280a8e5
|
Reworks recipients.lua as static rather than (useless) instance
|
2020-09-23 15:03:07 +02:00 |
|
Alfredo Cardigliano
|
7bda229e8f
|
Use score to filter flow alerts when supported (Enterprise)
|
2020-09-22 04:22:58 +02:00 |
|
Simone Mainardi
|
db0d7730a8
|
Implements per-category host score
Implements #4413
|
2020-09-18 18:34:28 +02:00 |
|
Simone Mainardi
|
b7341506f7
|
Implements checks for script type and alert severity in dispatch_notification
|
2020-09-16 13:08:07 +02:00 |
|
Simone Mainardi
|
9e99fa1403
|
Uses new in-memory queues for alert recipients (avoid Redis)
|
2020-09-08 18:36:18 +02:00 |
|
Simone Mainardi
|
85f555a908
|
Removes intermediate alert queues - only leaves recipient queues
Implements #4366
|
2020-09-04 17:41:55 +02:00 |
|
Simone Mainardi
|
7f241d71d5
|
Implements attack mitigation via SNMP
Implements #3833 along with companion pro commit
|
2020-08-24 15:05:35 +02:00 |
|
Luca Deri
|
f5e572cb5e
|
Split pruge of idled entries from hashtable ste transition
|
2020-08-13 10:21:59 +02:00 |
|
Luca Deri
|
f7bddc7e0a
|
Improved low-threshold script skip
|
2020-08-12 11:36:51 +02:00 |
|
Luca Deri
|
10b27b12c8
|
Added check for reducing load pressure when too many idle flow instances are present in the system
|
2020-08-12 10:54:57 +02:00 |
|
Simone Mainardi
|
dc980bef0a
|
Adds anti-stall checks on host user scripts
|
2020-08-05 11:18:10 +02:00 |
|
Simone Mainardi
|
330234e3f7
|
Optimized hosts scripts using direct pool_id to retrieve config
|
2020-07-30 19:57:16 +02:00 |
|
Simone Mainardi
|
516451aa6c
|
Uses actual host pool id when executing host scripts
|
2020-07-30 11:39:15 +02:00 |
|
Simone Mainardi
|
4e96ae7e26
|
Refactors user_scripts method names
|
2020-07-29 15:17:31 +02:00 |
|
Simone Mainardi
|
c291fe91c9
|
Adds periodic_user_scripts.lua for the execution of periodic scripts
|
2020-07-29 14:47:11 +02:00 |
|
Simone Mainardi
|
8418d932ec
|
Avoids spawning num_interfaces + threads to update stats
|
2020-07-27 15:50:11 +02:00 |
|
Alfredo Cardigliano
|
f038baf804
|
Alerts are no longer enqueued if disabled
|
2020-07-23 00:49:28 +02:00 |
|
Simone Mainardi
|
92c88c7924
|
Migrates interface user scripts to the new interface pools configuration
|
2020-07-10 19:32:03 +02:00 |
|
Simone Mainardi
|
cf400216e2
|
Implements caching of member-to-confiset_id as Lua pool class member
|
2020-07-10 19:22:47 +02:00 |
|
Simone Mainardi
|
bd4921df55
|
Migrates local network user scripts to the new host pools configuration
|
2020-07-10 18:45:19 +02:00 |
|
Simone Mainardi
|
09c69edb22
|
Major rework of user_scripts.lua to use new pools
|
2020-07-10 13:01:29 +02:00 |
|
emanuele-f
|
340462ad73
|
Cleanup of the timeseries ring and NetworkInterfaceTsPoint
|
2020-05-20 15:18:03 +02:00 |
|
Simone Mainardi
|
b6447bbfb0
|
Implements ordering for flow Lua callbacks
|
2020-05-17 14:12:08 +02:00 |
|
Simone Mainardi
|
f3a5d7b10e
|
Fixes external suricata alerts
|
2020-04-28 20:37:50 +02:00 |
|
Alfredo Cardigliano
|
c22f3b00e1
|
Fix alert ids source match
|
2020-04-28 16:12:03 +02:00 |
|
Alfredo Cardigliano
|
963cff670f
|
Cleanup severity for external alerts
|
2020-04-27 18:04:41 +02:00 |
|
Simone Mainardi
|
83c4d36e34
|
Simplifies flow.triggerStatus using internal flow status reference
|
2020-04-27 17:48:56 +02:00 |
|
Simone Mainardi
|
efe4f9a8be
|
Unifies alerts generation format with flow statuses
|
2020-04-27 14:37:04 +02:00 |
|
Simone Mainardi
|
ab1690ad9e
|
Implements builders for each flow status definition
[FlowsK] alert_blacklisted_country.lua
[FlowsK] alert_flow_blacklisted.lua
[FlowsK] alert_device_protocol_not_allowed.lua
[FlowsK] external_alert.lua
[FlowsK] alert_potentially_dangerous_protocol.lua
[FlowsK] tls_certificate_mismatch.lua
[FlowsK] tls_certificate_expired.lua
[FlowsK] tls_malicious_signature.lua
[FlowsK] elephant_flows.lua
[FlowsK] not_purged.lua
[FlowsK] web_mining.lua
[FlowsK] potentially_dangerous.lua
[FlowsK] alert_flow_blocked.lua
|
2020-04-27 12:43:37 +02:00 |
|
Simone Mainardi
|
0a9a7015e0
|
Unifies status_id and status_key
|
2020-04-15 14:29:03 +02:00 |
|
Simone Mainardi
|
1eb02b2c2b
|
Unifies alert_id and alert_key
|
2020-04-15 14:29:03 +02:00 |
|
Simone Mainardi
|
e487427aab
|
Refactors alert_utils and enterprise_alert_utils
Addresses #3720
Alerts Refactor: alert_utils as module
Alerts Refactor: notify_ntopng_start and notify_ntopng_stop
Alerts Refactor: processAlertNotifications
Alerts Refactor: checkStoreAlertsFromC
Alerts Refactor: formatAlertNotification
Alerts Refactor: notification_timestamp_rev
Alerts Refactor: formatAlertMessage
Alerts Refactor: getConfigsetAlertLink
Alerts Refactor: alertNotificationActionToLabel
Alerts Refactor: flushAlertsData
Alerts Refactor: disableAlertsGeneration
Alerts Refactor: newAlertsWorkingStatus and other
Alerts Refactor: drawAlerts
Alerts Refactor: drawAlertTables
Alerts Refactor: printAlertTables
Alerts Refactor: checkDeleteStoredAlerts
Alerts Refactor: getUnpagedAlertOptions
Alerts Refactor: getTabParameters
Alerts Refactor: getAlerts
Alerts Refactor: getNumAlerts
Alerts Refactor: performAlertsQuery
Alerts Refactor: sec2granularity
Alerts Refactor: granularity2id
Alerts Refactor: granularity2sec
Alerts Refactor: alertEngineLabel
Alerts Refactor: alertEngine
Alerts Refactor: alertEngineRaw
Alerts Refactor: alertTypeDescription
Alerts Refactor: alertType
Alerts Refactor: alertTypeLabel
Alerts Refactor: alertTypeRaw
Alerts Refactor: alertSeverity
Alerts Refactor: alertSeverityLabel
Alerts Refactor: alertSeverityRaw
Alerts Refactor: get_make_room_keys
Alerts Refactor: enterprise_alert_utils
|
2020-04-10 14:03:20 +02:00 |
|
emanuele-f
|
c848ea2395
|
Fix script failure due to removed host.getLocalhostInfo
|
2020-04-02 18:42:52 +02:00 |
|
Alfredo Cardigliano
|
2425134f05
|
Replace isEnterprise with isEnterpriseM
|
2020-04-02 12:36:34 +00:00 |
|
Simone Mainardi
|
daf7f0a05c
|
Minor Fix
|
2020-04-01 13:12:55 +02:00 |
|
Simone Mainardi
|
a9776b5013
|
Documents internals periodic activities
|
2020-04-01 13:03:13 +02:00 |
|
Simone Mainardi
|
3144bc8bdf
|
Renames alert_config to user_script_config
|
2020-03-26 14:51:53 +01:00 |
|
emanuele-f
|
0facf0e27d
|
Implement host timeseries off/light/mode selection
Closes #3466
|
2020-03-03 15:52:04 +01:00 |
|
Alfredo Cardigliano
|
b3ceaf9db4
|
Moved external alert score computation (fix #3447)
|
2020-02-24 15:01:21 +01:00 |
|