Open solarexpedition opened 2 years ago
2- I can see the comment field on some checks, but in the checks where I put a list of IPs, comments are not possible. 5- Yes I did. Actually 156 behavioural checks are implemented in ntop. In the users guide from nDPI I can find only documentation for 45 checks. It would be very helpful if there are also more examples, like what kind of network-traffic, sample of a packet and thresholds triggers such an alert. I miss here useful informations and somehow education how to use and configure these checks.
As we are working with ntopng for some monthes now, we think more flexible exclude lists in ntopng would massively help to narrow down the amount of alarms. At the moment, in a network with a lot of traffic, it is almost impossible to configure an alarming system which does not produce thousands of alarms, every day.
Some ideas: