Collect Attackers Data on a Datalake

ntop / ntopng

Web-based Traffic and Security Network Traffic Monitoring

http://www.ntop.org

GNU General Public License v3.0

6.16k stars 648 forks source link

Collect Attackers Data on a Datalake #5235

Open lucaderi opened 3 years ago

lucaderi commented 3 years ago

In case an alert where an attacker is defined, it is requested to send this data to a central collector. Example if you have 5 ntopng instances, it would be nice to collapse into a single place all attackers information limited to attackers with public IP address.

It is requested to implement this functionality by defining a packet format containing

attacker IP
attacker score
checksum/authentication digest
version

The format should be JSON for future extension, and data delivered via UDP

giorgiozoppi commented 2 years ago

Would be nice if might be configured to send to a public cloud using a data lake there, so an external tool could fetch data and do analytics, also an external app could send the alarm via twilio to the network owner if the severity is high. i.e https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/storage/azure-storage-files-datalake/samples/datalake_getting_started.cpp