mirror of
https://github.com/ntop/ntopng.git
synced 2026-04-29 15:39:33 +00:00
ab1690ad9e
[FlowsK] alert_blacklisted_country.lua [FlowsK] alert_flow_blacklisted.lua [FlowsK] alert_device_protocol_not_allowed.lua [FlowsK] external_alert.lua [FlowsK] alert_potentially_dangerous_protocol.lua [FlowsK] tls_certificate_mismatch.lua [FlowsK] tls_certificate_expired.lua [FlowsK] tls_malicious_signature.lua [FlowsK] elephant_flows.lua [FlowsK] not_purged.lua [FlowsK] web_mining.lua [FlowsK] potentially_dangerous.lua [FlowsK] alert_flow_blocked.lua
31 lines
1 KiB
Lua
31 lines
1 KiB
Lua
--
|
|
-- (C) 2019-20 - ntop.org
|
|
--
|
|
|
|
local alert_keys = require "alert_keys"
|
|
|
|
-- #######################################################
|
|
|
|
-- @brief Prepare an alert table used to generate the alert
|
|
-- @param alert_severity A severity as defined in `alert_consts.alert_severities`
|
|
-- @param l2r_threshold Local-to-Remote threshold, in bytes, for a flow to be considered an elephant
|
|
-- @param r2l_threshold Remote-to-Local threshold, in bytes, for a flow to be considered an elephant
|
|
-- @return A table with the alert built
|
|
local function buildFlowMisbehaviour(alert_severity, l2r_threshold, r2l_threshold)
|
|
local built = {
|
|
alert_severity = alert_severity,
|
|
["elephant.l2r_threshold"] = l2r_threshold,
|
|
["elephant.r2l_threshold"] = r2l_threshold,
|
|
}
|
|
|
|
return built
|
|
end
|
|
|
|
-- #######################################################
|
|
|
|
return {
|
|
alert_key = alert_keys.ntopng.alert_flow_misbehaviour,
|
|
i18n_title = "alerts_dashboard.flow_misbehaviour",
|
|
icon = "fas fa-exclamation",
|
|
builder = buildFlowMisbehaviour,
|
|
}
|