389 commits

Author	SHA1	Message	Date
Ivan Nardi	5789677916	Assets journal: log of the changes of the assets, with their causes (#11115) ... Add a journal of the assets (Enterprise L): one entry per event (an asset created, deleted, a field changed, a tag added or removed), with when it happened, who caused it (ntopng or the user), the action, what it is about, and a message with its cause. Entries are never deleted. See `doc/developers/README.assets_journal.md` for the design. This repo: - Table assets_journal (ClickHouse, ClickHouse cluster, SQLite). - Causes of the changes seen in the traffic (C++): the hosts keep, for each change not yet dumped with their asset, its cause (the evidence and the flow) and send it with the asset snapshot ("journal" key). The flow is passed explicitly to the setters (Flow* argument); LocalHost grows by 8 bytes (one pointer). - The flow that creates a host is recorded (Flow constructor, and the view walker for the hosts of a view). - Flow destructor (viewed interfaces): the client address is freed after updateView() of both hosts, that can now print the flow. - Asset DNS name stored lowercase, as the host name. - Preference "Enable Assets Journal" (disabled by default). - REST handlers: user actions with the username (tags set/unset on a host, tag deleted). - User documentation (Advanced Features > Assets Journal). The Lua module, the assets code and the tests are in the pro repo.	2026-11-02 20:13:55 +01:00
Matteo Biscosi	3b8c1d2a24	Updated ddetails pages	2026-11-02 18:09:28 +01:00
Matteo Biscosi	b319c861fa	Updated network menu pages	2026-11-02 16:17:12 +01:00
GabrieleDeri	593b0c6434	Updated traffic model query (#11176)	2026-11-02 13:40:49 +01:00
Matteo Biscosi	ca2b1a4531	Reworked notifications page	2026-11-02 10:11:57 +01:00
GabrieleDeri	2edf9216a4	Added syslog page (#11158) ... * Added syslog page * Update dist	2026-10-29 18:16:59 +01:00
Matteo Biscosi	3dd04c04b3	Moved alerts page to router SPA	2026-10-29 12:41:42 +01:00
Matteo Biscosi	841404232a	Updated alerts page to SPA Router	2026-10-29 11:20:50 +01:00
Luca Deri	9c9f044952	Fixed table definition	2026-10-29 11:03:37 +01:00
Luca Deri	e9f9d981c7	Updated db schema (removed is_deleted)	2026-10-28 22:41:27 +01:00
Luca Deri	a829a4f825	Syntax error fix	2026-10-28 19:21:16 +01:00
Matteo Biscosi	05be59c409	Reworked nAnalyst pages	2026-10-28 18:34:35 +01:00
GabrieleDeri	80816ec59d	Fixes to traffic model pages (#11149) ... * Fixes to traffic model pages * Update dist	2026-10-28 18:14:07 +01:00
Matteo Biscosi	34bc991ec9	Moved historical flows into router	2026-10-28 13:18:43 +01:00
Luca Deri	1129009c5f	Fixed syslog table definition	2026-10-28 12:39:19 +01:00
Matteo Biscosi	94aefdbbc2	Fixes wazuh alerts page	2026-10-28 12:03:28 +01:00
Matteo Biscosi	1e254c0ab7	Reworked Live Flows page	2026-10-28 11:16:50 +01:00
Luca Deri	57533cb3c1	Implemented syslog dump to DB	2026-10-27 21:11:19 +01:00
GabrieleDeri	ba903513d3	Added syslog ingestion rules configuration (#11136) ... * Added syslog ingestion rules configuration * Update dist	2026-10-27 18:09:10 +01:00
Matteo Biscosi	969e154477	Optimized REST API and updated documentation	2026-10-27 12:34:49 +01:00
Matteo Biscosi	dbf27c974e	Updated REST API documentation	2026-10-26 17:54:38 +01:00
Luca Deri	ad8ee5b963	Implemented service aggregation	2026-10-21 07:25:33 +02:00
Alfredo Cardigliano	41dba1669b	Move activation support	2026-10-05 15:25:53 +02:00
Luca Deri	c09db977d5	Added INTERFACE_ID and used floats	2026-10-03 08:47:14 +02:00
Luca Deri	af28bdd17c	Experimental model	2026-10-02 21:54:37 +02:00
Alfredo Cardigliano	24ee4c7ff5	Update doc	2026-10-01 15:46:08 +02:00
Manuel Ceroni	3c89afdb6d	Fixed ClickHouse error when loading wazuh alert rules (#11012)	2026-09-29 11:33:45 +02:00
Luca Deri	c97d7e2a0e	Improved wazuh exception rule	2026-09-22 23:55:53 +02:00
Luca Deri	a626403cef	Updated wazuh exception tule for user nobody	2026-09-21 20:12:19 +02:00
Alfredo Cardigliano	f768ec252e	Fix error due to empty query	2026-09-16 17:26:34 +02:00
Luca	30dc07ee9b	Added pattern to wazuh alerts/exceptions	2026-09-16 12:23:59 +02:00
Alfredo Cardigliano	282e37ce68	Add Requested Server Name / SNI column (move the name from the json to the native column)	2026-09-14 17:03:47 +02:00
Alfredo Cardigliano	37a6f39ed5	Handle wazuh schema migration in C++ to check fot TTL presence	2026-09-02 15:21:28 +02:00
GabrieleDeri	5fde035f36	Wazuh retention added (#10885) ... * Updated nanalyst docs * Wazuh retention added * Added policy checks	2026-09-02 10:56:11 +02:00
Alfredo Cardigliano	221b7836b6	Add license activation page, displayed when an offline activation is required	2026-09-01 11:19:32 +02:00
Luca Deri	fcc01ea96d	Renamed wazuh rule	2026-08-27 12:22:45 +02:00
Alfredo Cardigliano	6cb0b4ab8f	Add alert_rule_id to wazuh_alerts table	2026-08-26 12:42:23 +02:00
Alfredo Cardigliano	00613d75f9	Change wazuh_alerts schema to handle retention based on partitions (use partition by day, remove TTL). Add pref to configure retention.	2026-08-26 12:14:57 +02:00
Alfredo Cardigliano	6aa2d5a3b8	Update rest doc	2026-08-21 16:31:01 +02:00
Alfredo Cardigliano	1fc93a8c72	Add application latency column consistent with network latency	2026-08-21 10:17:31 +02:00
Alfredo Cardigliano	7deb869d45	Add next hop and next hop site to CH	2026-08-18 11:16:51 +02:00
Alfredo Cardigliano	7e452ed9f7	Cleanup schemas	2026-08-17 18:36:33 +02:00
Alfredo Cardigliano	0790083e13	Update schemas for Wazuh alerts (standalone, cluster, sample rules)	2026-08-17 18:28:59 +02:00
Alfredo Cardigliano	25b334c786	Batch CH alter tables to boost ntopng startup	2026-08-17 10:06:05 +02:00
Manuel Ceroni	5cde596288	Vulnerability Scan converted to Active Scan (#10774)	2026-08-14 17:43:43 +02:00
Luca Deri	c3c59ba036	Reworked SNMO interface roles in flows	2026-08-14 12:46:26 +02:00
GabrieleDeri	e19d9da819	Removed nanalyst docs from clickhouse (#10760) ... * Removed nanalyst docs from clickhouse * Update dist	2026-08-12 18:34:09 +02:00
Alfredo Cardigliano	66594f5ba8	Replace SELECT * with explicit column names in CREATE VIEW to make union immune to columns order differences	2026-08-12 17:07:00 +02:00
Alfredo Cardigliano	e548dae083	Fix cluster schema (add on cluster in missing tables). Add alter table for NTOPNG_INSTANCE_NAME on all tables.	2026-08-12 11:52:09 +02:00
Alfredo Cardigliano	ebe50b61f4	Speed up ntopng startup by batching clickhouse modify comment statements	2026-08-03 10:57:05 +02:00