IPS UI

[gsanchietti]

Create a UI for Snort IPS.

---

Issue progress:

• Settings page: snort: settings page #1010
• Event list page: snort: Event list page #1016
• Bypass IPS page: snort: Bypass IPS page #1015
• Disabled rules page: snort: Disabled rules page #1017
• Suppressed alerts page: snort: Suppressed alerts page #1018

---

PRs:

• feat: added IPS management nethsecurity-ui#498
• feat: added IPS APIs #1041

---

Settings page:

• Enable/disable service
• Select rule policy: "connectivity", "balanced", "security"
• Manage oinkcode (subscription key)
• List of disabled rules

Bypass IPS page:

• Add local IPv4/IPv6 addresses to bypass IPS
• Options: direction (source/destination), type (IPv4/IPv6), address

Event list page:

• Display current day's events
• Disable or suppress rule by clicking:
  • Disable: add to disabled list (SID, optional description)
  • Suppress: add to suppression list (SID, direction, IP/CIDR, optional description)

Monitoring:

• Add charts to local monitoring page and controller monitoring page
• Show: number of rules, last download time
• Dashboard: show IPS status

References:

• CLI implementation
• Mockup details

[Tbaile]

• TODO: DOCS

QA Image: 23.05.5-ns.1.4.1-35-gf37cff24a

• Dashboard: Check that IPS status is correctly displayed in the dashboard card
• IPS -> Event List: when disabled, ensure there's a link that sends you to the settings page
• IPS -> Settings: Enable the service, save and commit changes, check that the file /var/ns-snort/snort3-community-rules.tar.gz exists (download might take a few seconds)
• IPS -> Settings: Add a oinkcode, save and commit changes, check that the file /var/ns-snort/snortrules-snapshot-31470.tar.gz exists (download also might take a few seconds)
• IPS -> * : Check that in the tables that show GID:SID, a link will send you to snort documentation (just one is enough)
• IPS -> Filter Bypass: Check that adding a bypass is possible, and both IPv4 and IPv6 validate addresses correctly.
• IPS -> Filter Bypass: Delete a bypass is possible.
• IPS -> Disable Rule: Check that disabling a rule is possible
• IPS -> Disable Rule: Check that deleting a rule is possible
• IPS -> Suppress Alert: check that it's possible to suppress an alert, and can be deleted.

---

Next testing is being provided if you have the tools and the environment ready to test actually that snort alerts and drops packets.

• IPS -> Event List: check that you can trigger a drop or alert, and it's correctly displayed in the table
• IPS -> Event List: check that it's possible to disable a rule and create a suppression from the event table

[gsanchietti]

Whole the general features works well, there are some minor issues: not verified.

Issues found:

• the title of the page is way to large, please use the same dimension of other pages
• even tab: it's not clear that it displays events only from today. At least the message of the empty state must be improved. Current one is: "No events, all good"
• The dashboard does not display the number of current alerts, it always displays 0

The event list does not highlight correctly the alerts:

From this screenshot, everything seems good but the entries are actually alerts and need attention

Note: remember to bump snort package release

[Tbaile]

Image is on it's way, however I need to check what are the possible log possibilities for Snort, so this might come back as unverified as some events are not displayed properly on the UI.