Files
Zane C. Bowers-HadleyandGitHub 572258e0c2 add Suricata 7 support to Suricata (#16044)
* breakout handling of suricata extend v. 1 returns

* initial work for suricata 7.0.0

* add shared file for various Suricata related variables

* update handling for new Suricata stuff

* fix suricata rrd name bits

* update suricata app page a bit

* misc

* add a new v2 suricata graph

* more suricata v2 graphs

* fix app data for suricata

* more graph work

* fix initial graphs

* the page selector for suricata v2

* more cleanup for suricata stuff

* add more graphs

* add suricata_v2_pkt_drop.inc.php

* add suricata_v2_error_delta.inc.php

* add suricata app layer flows graph

* add app layer tx

* start work on bypassed

* add flow bypass stuff

* add suricata error stuff

* add more graphs

* more suricata v2 work

* ...

* add packets overview

* cleanup suricata_packets_overview.inc.php

* more work on the overview graphs

* error delta is now per second

* cleanup suricata_v2_app_layer_error_alloc.inc.php

* add new flow proto stuff

* add suricata_v2_flow_proto

* add new overview graph

* update v2 app layer flows graph

* more v2 graph cleanup

* suricata graph cleanup

* suricata_dec_proto_overview now works

* more graph work for suricata

* more graph work

* add another overview graph

* snmp fix

* add a new overview graph

* add a new over view

* more graph stuff

* more memory graphs

* tidy pages bit

* more work on decoder stuff

* more decoder work

* decoder stuff done

* cleanup suricata_packets_overview.inc.php

* appl layer tx work

* add app flow stuff

* fix suricata_v2_decoder__event__ethernet.inc.php

* fix suricata_v2_decoder__event__ipv4.inc.php

* fix suricata_v2_decoder__event__ipv6.inc.php

* add alloc error stuff

* more error related work

* more error stuff

* start work on internal errors

* add internal error graphs

* parser error stuff done

* more decoder work

* decoder icmpv4

* more decoder work

* ltnull done

* mpls decoder stuff

* nsh decoder work

* decoder ppp done

* more decoder work

* more decoder work

* more vlan work

* vntag decoder stuff done

* descr_len auto set for generic stats

* ipv6 decoder stuff done

* style fix

* style fix

* more style cleanup

* more suricata graph work

* fix require usage

* tweak drop info a bit

* add some checks for for with suricata 7.0.4

* more suricata tweaks

* fix sagan instance handling

* another minor fix

* fix improper munging

* rever something accidentally added to this repo

* add linux_suricata-v2.snmprex

* rename the metrics for instances from instance_ to instances_

* add linux_suricata-v2.json test data

* style fix

* minor munging tweak

* style cleanup

* some app data fixes

* remove a typo from test data

* add deleted_at and make sure discovered is numeric and not a string 1

* derp... json fix

* remove something accidentally added

* fix a small erorr in the test data

* add a missing variable to the test data

* try another tweak for suricata json test stuff

* derp... fix a type in the suricata poller

* revert a test data change

* re-order some the metrics in the test

* some more metric re-ordering

* add a missing status

* remove something that was accidentally added to this branch instead of another

* strcmp cleanup

* style fix
2024-06-09 19:47:15 -05:00

413 lines
14 KiB
PHP

<?php
$name = 'suricata';
$unit_text = 'packets/sec';
$colours = 'psychedelic';
$dostack = 0;
$printtotal = 1;
$addarea = 0;
$transparency = 15;
$rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id]);
$app_layer__tx__bittorrent_dht_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__bittorrent-dht']);
$app_layer__tx__dcerpc_tcp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__dcerpc_tcp']);
$app_layer__tx__dcerpc_udp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__dcerpc_udp']);
$app_layer__tx__dhcp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__dhcp']);
$app_layer__tx__dnp3_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__dnp3']);
$app_layer__tx__dns_tcp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__dns_tcp']);
$app_layer__tx__dns_udp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__dns_udp']);
$app_layer__tx__enip_tcp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__enip_tcp']);
$app_layer__tx__enip_udp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__enip_udp']);
$app_layer__tx__ftp_data_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__ftp-data']);
$app_layer__tx__ftp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__ftp']);
$app_layer__tx__http_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__http']);
$app_layer__tx__http2_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__http2']);
$app_layer__tx__ike_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__ike']);
$app_layer__tx__imap_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__imap']);
$app_layer__tx__krb5_tcp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__krb5_tcp']);
$app_layer__tx__krb5_udp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__krb5_udp']);
$app_layer__tx__modbus_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__modbus']);
$app_layer__tx__mqtt_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__mqtt']);
$app_layer__tx__nfs_tcp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__nfs_tcp']);
$app_layer__tx__nfs_udp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__nfs_udp']);
$app_layer__tx__ntp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__ntp']);
$app_layer__tx__pgsql_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__pgsql']);
$app_layer__tx__quic_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__quic']);
$app_layer__tx__rdp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__rdp']);
$app_layer__tx__rfb_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__rfb']);
$app_layer__tx__sip_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__sip']);
$app_layer__tx__smb_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__smb']);
$app_layer__tx__smtp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__smtp']);
$app_layer__tx__snmp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__snmp']);
$app_layer__tx__ssh_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__ssh']);
$app_layer__tx__telnet_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__telnet']);
$app_layer__tx__tftp_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__tftp']);
$app_layer__tx__tls_rrd_filename = Rrd::name($device['hostname'], ['app', $name, $app->app_id, 'totals___app_layer__tx__tls']);
$rrd_list = [];
if (Rrd::checkRrdExists($app_layer__tx__bittorrent_dht_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__bittorrent_dht_rrd_filename,
'descr' => 'BT DHT',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__dcerpc_tcp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__dcerpc_tcp_rrd_filename,
'descr' => 'DCERPC, TCP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__dcerpc_udp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__dcerpc_udp_rrd_filename,
'descr' => 'DCERPC, UDP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__dhcp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__dhcp_rrd_filename,
'descr' => 'DHCP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__dnp3_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__dnp3_rrd_filename,
'descr' => 'DNP3',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__dns_tcp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__dns_tcp_rrd_filename,
'descr' => 'DNS, TCP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__dns_udp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__dns_udp_rrd_filename,
'descr' => 'DNS, UDP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__enip_tcp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__enip_tcp_rrd_filename,
'descr' => 'ENIP, TCP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__enip_udp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__enip_udp_rrd_filename,
'descr' => 'ENIP, UDP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__ftp_data_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__ftp_data_rrd_filename,
'descr' => 'FTP-Data',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__ftp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__ftp_rrd_filename,
'descr' => 'FTP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__http_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__http_rrd_filename,
'descr' => 'HTTP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__http2_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__http2_rrd_filename,
'descr' => 'HTTP2',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__ike_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__ike_rrd_filename,
'descr' => 'IKE',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__imap_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__imap_rrd_filename,
'descr' => 'IMAP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__krb5_tcp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__krb5_tcp_rrd_filename,
'descr' => 'KRB5, TCP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__krb5_udp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__krb5_udp_rrd_filename,
'descr' => 'KRB5, UDP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__modbus_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__modbus_rrd_filename,
'descr' => 'Modbus',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__mqtt_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__mqtt_rrd_filename,
'descr' => 'MQTT',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__nfs_tcp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__nfs_tcp_rrd_filename,
'descr' => 'NFS, TCP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__nfs_udp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__nfs_udp_rrd_filename,
'descr' => 'NFS, UDP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__ntp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__ntp_rrd_filename,
'descr' => 'NTP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__pgsql_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__pgsql_rrd_filename,
'descr' => 'PostgreSQL',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__quic_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__quic_rrd_filename,
'descr' => 'QUIC',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__rdp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__rdp_rrd_filename,
'descr' => 'RDP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__rfb_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__rfb_rrd_filename,
'descr' => 'RFB',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__sip_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__sip_rrd_filename,
'descr' => 'SIP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__smb_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__smb_rrd_filename,
'descr' => 'SMB',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__smtp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__smtp_rrd_filename,
'descr' => 'SMTP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__snmp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__snmp_rrd_filename,
'descr' => 'SNMP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__ssh_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__ssh_rrd_filename,
'descr' => 'SSH',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__telnet_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__telnet_rrd_filename,
'descr' => 'Telnet',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__tftp_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__tftp_rrd_filename,
'descr' => 'TFTP',
'ds' => 'data',
];
}
if (Rrd::checkRrdExists($app_layer__tx__tls_rrd_filename)) {
$rrd_list[] = [
'filename' => $app_layer__tx__tls_rrd_filename,
'descr' => 'TLS',
'ds' => 'data',
];
}
if (! isset($rrd_list[0]) && Rrd::checkRrdExists($rrd_filename)) {
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'DCERPC TCP',
'ds' => 'at_dcerpc_tcp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'DCERPC UDP',
'ds' => 'at_dcerpc_udp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'DHCP',
'ds' => 'at_dhcp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'DNS TCP',
'ds' => 'at_dns_tcp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'DNS UDP',
'ds' => 'at_dns_udp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'FTP',
'ds' => 'at_ftp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'FTP-DATA',
'ds' => 'at_ftp_data',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'HTTP',
'ds' => 'at_http',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'IKEv2',
'ds' => 'at_ikev2',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'IMAP',
'ds' => 'at_imap',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'Krb5 TCP',
'ds' => 'at_krb5_tcp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'Krb5 UDP',
'ds' => 'at_krb5_udp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'MQTT',
'ds' => 'at_mqtt',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'NFS TCP',
'ds' => 'at_nfs_tcp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'NFS UDP',
'ds' => 'at_nfs_udp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'RDP',
'ds' => 'at_rdp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'RFB',
'ds' => 'at_rfb',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'SIP',
'ds' => 'at_sip',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'SMB',
'ds' => 'at_smb',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'SMTP',
'ds' => 'at_smtp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'SNMP',
'ds' => 'at_snmp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'ssh',
'ds' => 'at_ssh',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'TFTP',
'ds' => 'at_tftp',
];
$rrd_list[] = [
'filename' => $rrd_filename,
'descr' => 'TLS',
'ds' => 'at_tls',
];
}
if (! isset($rrd_list[0])) {
d_echo('RRD "' . $app_layer__tx__tls_rrd_filename . '" not found');
}
require 'includes/html/graphs/generic_multi_line.inc.php';