Comments (2)
Create a ClickHouse table used for
- mapping flow_alert_id into mitre info (scripts/lua/modules/alert_definitions/flows/)
dell.ntop.org :) select ALERT_CATEGORY,ALERTS_MAP,STATUS,ALERT_JSON from flows WHERE STATUS =71 limit 1;
SELECT
ALERT_CATEGORY,
ALERTS_MAP,
STATUS,
ALERT_JSON
FROM flows
WHERE STATUS = 71
LIMIT 1
Query id: 533bf866-9d97-45ef-8d76-8afa113f5ec4
┌─ALERT_CATEGORY─┬─ALERTS_MAP─────────┬─STATUS─┬─ALERT_JSON─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
1. │ 3 │ 800000000000000000 │ 71 │ {"ntopng.key":2169569442,"hash_entry_id":833,"alert_generation": {"script_key":"ndpi_error_code_detected","subdir":"flow","flow_risk_info":"{\"43\":\"DNS Error Code NXDOMAIN\"}"},"proto": {"dns": {"last_query_type":1,"last_return_code":3,"last_query":"host.docker.internal"},"l7_error_code":3,"confidence":1},"traffic_stats": {},"alert_score": {"71":10},"risk_id":43} │
└────────────────┴────────────────────┴────────┴────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
STATUS is the flow_alert_id
- mapping host_alert_id into mitre info (scripts/lua/modules/alert_definitions/host/)
These tables are created at (every) startup for both SQLite and ClickHouse.
from ntopng.
Verified as fixed
from ntopng.
Related Issues (20)
- Flow dropped due to limits to the license HOT 6
- Incorrect Filtering of First Network in Hosts -> Networks Page After Update to v6.2.240814 HOT 5
- Timeseries not working
- Alerts Filter not working HOT 3
- Invalid SYN Flood Error
- Invalid FIN can Alert
- Missing Issue Source in Historical Flows HOT 1
- Scan vs Service Down
- Network Discovery is Disabled, Please Enable it in Preferences HOT 3
- mitre_table_info table doesn't exist in clickhouse cluster HOT 2
- The "Speedtest" result of Active Monitoring is much different compared with manual execution HOT 5
- Ntopng offline mode and cloud HOT 1
- Flow dropped due to limits to the license
- Add option to disable nprobes / exporters chart HOT 1
- Sorting not working in flow exporters table HOT 1
- ntopng M license supposed to have up to 16 interface (where up to 8 exporter, 256 exported interfaces)
- Score filter not working in alerts table HOT 1
- Invalid Host Filter when Clicking on ASN 0
- Replace Exporter IP with Exporter UUID in Live Flows
- Extra rows shown when they should not be
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ntopng.