mirror of
https://github.com/ntop/ntopng.git
synced 2026-05-03 09:20:10 +00:00
a4047c5a1c
Scaffolding code of the host scripts
Scaffolding code for host alerts
Adds host_callbacks/ for .cpp files
Implements all classes for host callbacks
Removes pro/enterprise host callbacks
Adds typedefs with callback deltas
Compilation fix
Creates instances of host callbacks in loader
Link fix
Removes redundant/non-necessary host alerts
Merges Scan and Flood callbacks together
Removes outdated API files
Refactors alert keys into entity|id
Refactors all flow alert_{...} into flow_alert_{...}
Refactors C++ flow alert_{...} into flow_alert_{...}
Reworks alert ids to include an entity type
Cleanup and merge alertTypeRaw with getAlertType
Minor fix
Refactors alert definitions and keys into sub directories
Implement host alert callback execution and trigger/release logic
Update callbacks API
Adds base CallbacksLoader for {Host,Flow}CallbacksLoader
Implements load of host user scripts with periodicities
Implements runtime reload of host callbacks
Add logic for periodic callbacks
Add 'expired' flag to host alerts
Implements execution of host callbacks and SYN flood checks
Adds triggerAlertAsync calls to SYNFlood
Implements JSON host alert generation info
Handle callback getPeriod. Optimize callback lookup.
Implements host recipients in C++
Add callback status
Define destructor
Iterator fixes
Cleanup host Lua calls (now performed in C++)
Changes to show new host alerts in SQLite
Adds release/engage action on alert JSON
Move AlertableEntity to OtherAlertableEntity, inheriting from a new AlertableEntity. Add HostAlertableEntity.
Implements SYN Flood Attacker with params
Uses parametrized thresholds to trigger syn flood alerts
Implements build alert of both attacker and victim
Implement HostAlertableEntity
Implements SYN scan attacker/victim alerts
Implements flow flood attacker/victim alerts
Removes a debug flag
Add virtual allocStatus
Add HostAlert disableAutoRelease()
Add Ãexplicit releaseAlert()
Implements SYNFloodHostCallbackStatus
Implements SYNScanHostCallbackStatus
Implements FlowFloodHostCallbackStatus
Change trigger API to handle cli/src score
Implements {DNS,SMTP,NTP}ServerContactsAlert
Reworks ServerContacts host alerts
Implement exclusion bitmaps for host alerts
Implements {SMTP,DNS,NTP}ServerContactsAlert
Adds host_info to the generated alert JSON
Minor cleanup
Optimize access to callback status
Move RepliesRequestsRatio to pro
Rework triggerAlert on host to avoid multiple call and unneeded status data
Compilation fix
Reworked host alerts API (wip)
Cleanup unused host callbacks
Compilation fixes
Finishes backend implementation of host alerts exclusions
Rework host callbacks executor
Implements disable of host alerts
Port SYNFlood to the new api
Cleanup
Reduce duplicated code
Comments
Port ServerContacts to the new api
Clenaup
Adds parsing of configuration for host callbacks
Port SYNScanAlert to the new API
Port FlowFlood to the new API
Cleanup unused HostAlert getName
Reworks DNSRequestsErrorsRatioAlert
Adds JSON for DNSTrafficAlert
Adds FlowsAlert
Adds P2PTrafficAlert
Add RepliesRequestsRatioAlert
Adds ScoreAlert
Adds ThroughputAlert
Adds TrafficAlert
Fixes for scan/flood alerts
DNS ratio alert support
Add HTTP stats getters
Implements deltas for many host callbacks
Host score inc
Adds missing Alert params to host alerts
Release all host alerts on idle
Refactors score classes
Implements class Score to contain scores for hosts, flows, etc
Adds scores to VLANs, Networks, ASes and Countries
Host callbacks can trigger a single alert now
FlowFlood, SYNFloo, SYNScan now inherit from FlowHits
Move severity and score to constructor
Add else branch to hits callbacks
Alert definition update for flows_flood, syn_flood, syn_scan
Update field name
Engaged alert init
Adds score incs/decs for AS, VLAN, country, os and network
Restore network scripts
Restored other alert definitions for floods
Handle decreasing alert score
Removes include
Rename flows_flood to flow_flood for consistency
Restored alert_tcp_syn_flood_victim alert_tcp_syn_scan_victim definitions
Fixes for non-host engaged/release alerts
Cleanup LuaEngineFlow and LuaEngineHost classes
Fixes old calls to host lua during shutdown
Removes AlertCheckLuaEngine instance
Fixes purging of flows
Fixes alerts release upon shutdown causing wrong uses
Removes a debug flag
Fix getNumEngagedAlerts
Cleanup unnecessary host callbacks
Removes array of callback statuses inside host
Bitmap fixes
Refactors Bitmap into Bitmap128
Implements 16-bits bitmaps for host alerts
Adds class HostCallbacksStatus
Moves callback status p2p and DNS inside HostCallbacksStatus
Removes unused callbacks in typedefs
Minor cleanup
Adds trigger/release for DNS/p2p alerts
Reworks UI of hosts user scripts
Rename HostCallbackType to HostCallbackID, getType to getID, others
116 lines
3.1 KiB
Lua
116 lines
3.1 KiB
Lua
--
|
|
-- (C) 2013-21 - ntop.org
|
|
--
|
|
|
|
dirs = ntop.getDirs()
|
|
package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path
|
|
|
|
require "lua_utils"
|
|
local alert_utils = require "alert_utils"
|
|
require "flow_utils"
|
|
local alert_consts = require "alert_consts"
|
|
local format_utils = require "format_utils"
|
|
local json = require "dkjson"
|
|
local rest_utils = require("rest_utils")
|
|
local graph_utils = nil
|
|
|
|
|
|
if ntop.isPro() then
|
|
graph_utils = require "graph_utils"
|
|
end
|
|
|
|
--
|
|
-- Read alerts data
|
|
-- Example: curl -u admin:admin -H "Content-Type: application/json" -d '{"ifid": "1", "status": "historical"}' http://localhost:3000/lua/rest/v1/get/alert/data.lua
|
|
--
|
|
-- NOTE: in case of invalid login, no error is returned but redirected to login
|
|
--
|
|
|
|
local rc = rest_utils.consts.success.ok
|
|
local res = {}
|
|
|
|
local ifid = _GET["ifid"]
|
|
local what = _GET["status"]
|
|
local epoch_begin = _GET["epoch_begin"]
|
|
local epoch_end = _GET["epoch_end"]
|
|
local alert_type = _GET["alert_type"]
|
|
local alert_severity = _GET["alert_severity"]
|
|
|
|
if isEmptyString(ifid) then
|
|
rc = rest_utils.consts.err.invalid_interface
|
|
rest_utils.answer(rc)
|
|
return
|
|
end
|
|
|
|
interface.select(ifid)
|
|
|
|
if isEmptyString(what) then
|
|
rc = rest_utils.consts.err.invalid_args
|
|
rest_utils.answer(rc)
|
|
return
|
|
end
|
|
|
|
local engaged = false
|
|
if what == "engaged" then
|
|
engaged = true
|
|
end
|
|
|
|
local alert_options = _GET
|
|
|
|
local alerts = alert_utils.getAlerts(what, alert_options)
|
|
|
|
if alerts == nil then alerts = {} end
|
|
|
|
for _key,_value in ipairs(alerts) do
|
|
local record = {}
|
|
local alert_entity
|
|
local alert_entity_val
|
|
|
|
if _value["alert_entity"] ~= nil then
|
|
alert_entity = alert_consts.alertEntityLabel(_value["alert_entity"], true)
|
|
else
|
|
alert_entity = "flow" -- flow alerts page doesn't have an entity
|
|
end
|
|
|
|
if _value["alert_entity_val"] ~= nil then
|
|
alert_entity_val = _value["alert_entity_val"]
|
|
else
|
|
alert_entity_val = ""
|
|
end
|
|
|
|
local duration
|
|
if engaged == true then
|
|
duration = os.time() - tonumber(_value["alert_tstamp"])
|
|
elseif tonumber(_value["alert_tstamp_end"]) ~= nil then
|
|
duration = tonumber(_value["alert_tstamp_end"]) - tonumber(_value["alert_tstamp"])
|
|
end
|
|
|
|
local severity = alert_consts.alertSeverityRaw(tonumber(_value["alert_severity"]))
|
|
local atype = alert_consts.getAlertType(tonumber(_value["alert_type"]), tonumber(_value["alert_entity"]))
|
|
local count = tonumber(_value["alert_counter"])
|
|
local score = tonumber(_value["score"])
|
|
local alert_info = alert_utils.getAlertInfo(_value)
|
|
local msg = alert_utils.formatAlertMessage(ifid, _value, alert_info)
|
|
local date = _value["alert_tstamp"]
|
|
|
|
record["date"] = date
|
|
record["duration"] = duration
|
|
record["severity"] = severity
|
|
record["type"] = atype
|
|
record["count"] = count
|
|
record["score"] = score
|
|
record["msg"] = msg
|
|
record["entity"] = alert_entity
|
|
record["entity_val"] = alert_entity_val
|
|
|
|
if(graph_utils and graph_utils.getAlertGraphLink) then
|
|
record["drilldown"] = graph_utils.getAlertGraphLink(ifid, _value, alert_info, engaged)
|
|
end
|
|
-- record["value"] = _value
|
|
|
|
res[#res + 1] = record
|
|
|
|
end -- for
|
|
|
|
rest_utils.answer(rc, res)
|
|
|