OpenAttackDefenseTools / tulip

Network analysis tool for Attack Defence CTF
GNU General Public License v3.0
264 stars 36 forks source link

Add option to frontend to exclude flows based on a tag #26

Closed MaxGroot closed 1 year ago

MaxGroot commented 1 year ago

Thanks for open-sourcing this project. We have used Tulip during a CTF with a few patches of our own that we'd now like to contribute back into the original project.

This pull request adds the option to 'exclude' traffic in the flowlist based on tags. In the intersection filter, users can click a tag once to alter it from a disabled to an included state (where traffic must have this tag to be listed in the flowlist), and again to alter it to an excluded state. For a tag in excluded state, a flow must not have this tag in order to be eligible for the flowlist.

This is especially useful in conjunction with pull request #25 that allows one to more easily tag traffic that might not be interesting. See the included screenshots for an example. Moreover, if you're using Suricata as an IPS, you can also exclude based on the 'Blocked' tag and ignore all the traffic that you're rejecting anyway.

Screenshots No tags included or excluded: flowlist_no_intersection Including some tags while excluding others: flowlist_exclusion_and_inclusion_intersection

Sijisu commented 1 year ago

Looks good, thank you for contributing to Tulip!