Name Family Interface Category Severity Description Values Action
NOTES
  • Categories
    • Active Monitoring: Active monitoring alerting system (e.g., host unreachable).
    • Intrusion Detection and Prevention: Checks that evaluate the behavior of hosts and add them to the jailed hosts pool when deemed to be suspicious. When ntopng is used in combination with nProbe IPS, suspicious hosts are actually blocked and prevented from generating traffic.
    • Internals: Internal functionalities of ntopng (e.g., memory management and host and flows lifecycles)
    • Network: Network behaviors and anomalies (e.g., traffic above a certain threshold, TCP not working as expected)
    • Other: Default category for uncategorized scripts or for those that cannot be included in any of the other categories
    • Cybersecurity: Security behaviors and anomalies (e.g, contacts from or to a blacklisted host, TCP and UDP scans)
    • SNMP: SNMP devices status (e.g., Interface duplex status changes, SNMP device restart).
    • System: Functionalities of the system on top of which ntopng is running (e.g, disk space full, load too high)
  • Interface
    • : Check available for packet interfaces
    • : Check available for ZMQ interfaces