Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create Suricata Alert View #2740

Merged
merged 2 commits into from
Mar 31, 2023
Merged

Create Suricata Alert View #2740

merged 2 commits into from
Mar 31, 2023

Conversation

jameskerr
Copy link
Member

@jameskerr jameskerr commented Mar 30, 2023

I don't have sample data where we have alert-2 and alert-1s, but the colors should change from yellow to orange to red based on the severity.

I didn't re-order the columns like we used to. It's not clear how to do it in a clean way. Maybe we can revisit if the need comes up again.

fixes: #2738

Screenshot 2023-03-30 at 11 32 40 AM

Screenshot 2023-03-30 at 11 32 43 AM

Screenshot 2023-03-30 at 11 32 47 AM

@jameskerr jameskerr requested a review from philrz March 30, 2023 18:36
@philrz
Copy link
Contributor

philrz commented Mar 30, 2023

I've tested out the branch with a wrccdc pcap and have attached a video with it showing alerts at all three numeric levels with different colors. Looks good to me.

Alerts.mp4

I think it's ok with the columns in the order you have them now. The event_type field is far enough "leftward" in the shaped records that they still show up in the main events view without scrolling right, which helps a lot. It could be moved by changing the field order in the shaper that Brimcap applies to the Suricata data, so I'll look at doing that as a separate effort.

I see that CI has some grump about lint, so I'll hold off on clicking Approve until that's green.

@jameskerr jameskerr merged commit b5816f3 into main Mar 31, 2023
@jameskerr jameskerr deleted the alert-tiles branch March 31, 2023 03:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Tile for Suricata alerts
2 participants