mirror of
https://github.com/ntop/ntopng.git
synced 2026-04-29 07:29:32 +00:00
44 lines
1.6 KiB
Lua
44 lines
1.6 KiB
Lua
--
|
|
-- (C) 2019-20 - ntop.org
|
|
--
|
|
|
|
local alert_keys = require "alert_keys"
|
|
|
|
-- #######################################################
|
|
|
|
-- @brief Prepare an alert table used to generate the alert
|
|
-- @param alert_severity A severity as defined in `alert_consts.alert_severities`
|
|
-- @param tls_version A string indicating the TLS version detected, or nil when version is not available
|
|
-- @param tls_info A lua table with TLS info gererated calling `flow.getTLSInfo()`
|
|
-- @return A table with the alert built
|
|
local function createPotentiallyDangerous(alert_severity, tls_version, tls_info)
|
|
tls_info = tls_info or {}
|
|
local server_cn = tls_info["protos.tls.server_names"] or ""
|
|
local client_cn = tls_info["protos.tls.client_requested_server_name"] or ""
|
|
|
|
local built = {
|
|
alert_severity = alert_severity,
|
|
alert_type_params = {
|
|
tls_version = tls_version,
|
|
["tls_crt.cli"] = client_cn,
|
|
["tls_crt.srv"] = server_cn,
|
|
["tls_crt.notBefore"] = tls_info["protos.tls.notBefore"],
|
|
["tls_crt.notAfter"] = tls_info["protos.tls.notAfter"],
|
|
["tls_crt.issuerDN"] = tls_info["protos.tls.issuerDN"] or "",
|
|
["tls_crt.now"] = os.time(),
|
|
["cli_ja3_signature"] = tls_info["protos.tls.ja3.client_hash"],
|
|
}
|
|
}
|
|
|
|
return built
|
|
end
|
|
|
|
-- #######################################################
|
|
|
|
return {
|
|
alert_key = alert_keys.ntopng.alert_potentially_dangerous_protocol,
|
|
i18n_title = "alerts_dashboard.potentially_dangerous_protocol",
|
|
i18n_description = "alert_messages.potentially_dangerous_protocol_description",
|
|
icon = "fas fa-exclamation",
|
|
creator = createPotentiallyDangerous,
|
|
}
|