Alert and Flow Status Definitions

Alert Key Alert Key String Alert Name Known Attacker Known Victim Flow Status Key
1 alert_flow_blacklisted Blacklisted Flow ✓ ✓
2 alert_blacklisted_country Blacklisted Country ✓ ✓
3 alert_flow_blocked Flow blocked due to configured policies
4 alert_data_exfiltration Data Exfiltration ✓
5 alert_device_protocol_not_allowed Suspicious Device Protocol ✓
6 alert_dns_data_exfiltration DNS Data Exfiltration ✓
7 alert_dns_invalid_query Invalid DNS query ✓
8 alert_elephant_flow Elephant Flow
10 alert_external External Alert
11 alert_longlived Long-Lived Flow
12 alert_flow_low_goodput Low Goodput Ratio
13 alert_malicious_signature Possibly Client Malicious JA3 Signature ✓ ✓
14 alert_internals Not Purged
15 alert_potentially_dangerous_protocol Potentially Dangerous Protocol ✓ ✓
16 alert_remote_to_remote Remote to Remote
19 alert_connection_issues TCP Issues
20 alert_tcp_connection_refused TCP Connection Refused
22 alert_tls_certificate_expired TLS Certificate Expired
23 alert_tls_certificate_mismatch TLS Certificate Mismatch
24 alert_tls_old_protocol_version Obsolete TLS Version
25 alert_tls_unsafe_ciphers Unsafe TLS Ciphers
26 alert_udp_unidirectional Unidirectional UDP Traffic
27 alert_web_mining Web Mining
28 alert_tls_certificate_selfsigned TLS Certificate Self-signed
29 alert_binary_application_transfer Binary Application Transfer ✓ ✓
30 alert_known_proto_on_non_std_port Application on Non-Standard Port ✓
32 alert_unexpected_dhcp_server Unexpected DHCP server found ✓
33 alert_unexpected_dns_server Unexpected DNS server found ✓
34 alert_unexpected_smtp_server Unexpected SMTP server found ✓
35 alert_unexpected_ntp_server Unexpected NTP server found ✓
36 alert_zero_tcp_window TCP Zero Window
37 alert_iec_invalid_transition IEC104 Invalid Transition
38 alert_remote_to_local_insecure_proto Remote to Local Insecure Protocol ✓ ✓
39 alert_ndpi_url_possible_xss Possible XSS ✓ ✓
40 alert_ndpi_url_possible_sql_injection Possible SQL Injection ✓ ✓
41 alert_ndpi_url_possible_rce_injection Possible RCE ✓ ✓
42 alert_ndpi_http_suspicious_user_agent HTTP Suspicious User-Agent ✓ ✓
43 alert_ndpi_http_numeric_ip_host HTTP Numeric IP Host ✓ ✓
44 alert_ndpi_http_suspicious_url HTTP Suspicious URL ✓ ✓
45 alert_ndpi_http_suspicious_header HTTP Suspicious Header ✓ ✓
46 alert_ndpi_tls_not_carrying_https TLS not carrying HTTPS
47 alert_ndpi_suspicious_dga_domain Suspicious DGA Domain ✓
48 alert_ndpi_malformed_packet Malformed packet
49 alert_ndpi_ssh_obsolete_server Obsolete Server SSH
50 alert_ndpi_smb_insecure_version Insecure SMB Version
51 alert_ndpi_tls_suspicious_esni_usage Suspicious TLS ESNI Usage ✓
52 alert_ndpi_unsafe_protocol Unsafe Protocol ✓
53 alert_ndpi_dns_suspicious_traffic Suspicious DNS Traffic ✓ ✓
54 alert_ndpi_tls_missing_sni Missing TLS SNI
55 alert_iec_unexpected_type_id IEC104 Unexpected TypeId
56 alert_flow_tcp_no_data_exchanged No Data Exchanged
57 alert_remote_access Remote Access
58 alert_lateral_movement Lateral Movement
59 alert_periodicity_changed Periodicity Changed
60 alert_ndpi_tls_cert_validity_too_long Too Long TLS Certificate Validity
61 alert_ndpi_ssh_obsolete_client Obsolete Client SSH
62 ndpi_clear_text_credentials Clear-Text Credentials
63 ndpi_http_suspicious_content HTTP Suspicious Content
64 ndpi_dns_large_packet DNS Packet Larger Than 512 bytes
65 ndpi_dns_fragmented Fragmented DNS Message
66 ndpi_invalid_characters Text Contains Non-Printable Characters
67 alert_broadcast_non_udp_traffic Broadcast Non-UDP Traffic ✓
68 ndpi_possible_exploit Possible Exploit Detected
69 ndpi_tls_certificate_about_to_expire TLS Certificate About To Expire
4097 alert_device_connection Device Connection
4098 alert_device_disconnection Device Disconnection
4099 alert_dropped_alerts Dropped Alerts
4102 alert_ghost_network Ghost Network Detected
4103 alert_host_pool_connection Host Pool Connection
4104 alert_host_pool_disconnection Host Pool Disconnection
4106 alert_influxdb_error InfluxDB Error
4107 alert_influxdb_export_failure InfluxDB Export Failure
4109 alert_ip_outsite_dhcp_range Misconfigured DHCP Range
4110 alert_list_download_failed List Download Failed
4111 alert_login_failed Login Failed
4112 alert_mac_ip_association_change IP/MAC Change
4114 alert_misconfigured_app Misconfigured App
4116 alert_nfq_flushed Packets Queue Flushed
4118 alert_periodic_activity_not_executed Periodic Activity Not Executed
4119 alert_am_threshold_cross Active Monitoring
4120 alert_port_duplexstatus_change Interface Duplex Status Change
4121 alert_port_errors Interface Errors
4122 alert_port_load_threshold_exceeded Interface Load Threshold Exceeded
4123 alert_port_mac_changed SNMP Interface MAC Changed
4124 alert_port_status_change Interface Operational Status Change
4125 alert_process_notification Process
4126 alert_quota_exceeded Quota Exceeded
4128 alert_slow_periodic_activity Slow Periodic Activity
4129 alert_slow_purge Slow Idle Purging
4130 alert_snmp_device_reset SNMP Device Restart
4131 alert_snmp_topology_changed LLDP/CDP Topology changed
4136 alert_threshold_cross Threshold Cross
4137 alert_too_many_drops Packet Drops
4139 alert_user_activity User Activity
4142 alert_attack_mitigation_via_snmp Attack Mitigation via SNMP
4145 alert_list_download_succeeded List Download Succeeded
4146 alert_no_if_activity No activity on interface
4147 alert_unexpected_new_device Unexpected Device Connected
4148 alert_shell_script_executed Endpoint Shell Script Executed
4151 alert_fail2ban_executed Fail2Ban command executed
4153 alert_flow_flood_victim Flows Flood Victim ✓
4155 alert_tcp_syn_flood_victim TCP SYN Flood Victim ✓
4157 alert_tcp_syn_scan_victim TCP SYN Scan Victim ✓
4159 alert_contacts_anomaly Unexpected Host Contacts Behaviour
4164 alert_broadcast_domain_too_large Broadcast domain
4165 alert_ngi_trust_event NGI Trust Event
4167 alert_behavior_anomaly Unexpected nil Behavior
4168 alert_ids_ips_jail_add Jailed Host Added
4169 alert_ids_ips_jail_remove Jailed Host Removed
4170 alert_port_too_many_macs Too Many MACs on Non-Trunk
4171 alert_network_discovery_executed Network Discovery Detected