Change "New Device" monitoring defaults

[PureLoneWolf]

Hi there

I may just be blind/stupid or both...so please accept my apologies if I am, but I would like to know if there is a way to change the default notification settings when a new device is picked up?

Basically, I want the alerts to show there is a new device, but I don't want to monitor all events or down events by default. I would also like to set the "Skip repeated notifications for" to 1 hour.

Is this possible anywhere?

Many thanks

[jokob-sk]

Hi there!

As you discovered there is limited control over the type of events that are being notified on. This comes from the original code and e.g. the Plugins system, developed later by me, has more config options.

I might consider this feature request, but it's possible this will be implemented only at a later phase as there is consideration to overhaul the core scanning functionality.

Could you please describe in more detail how you'd like the notifications to work? Please cover as many use-cases as you can think off.

Also, have a look at the configuration option of Plugins (e.g. SNMP Discovery) to see if a similar config would benefit for the main arp-scan.

Thanks,
j

[PureLoneWolf]

Hi

Many thanks for the response. Honestly, the way the notifications themselves work is absolutely spot on from my perspective. The feature I would love to see would be the ability to set a default "New Device" notification profile to change the defaults.

Currently, any new device is set to:

Scan Device: Yes
Alert All Events: Checked
Alert Down: Checked
Skip Repeated Notifications for: 0h (All Events)
New Device: Checked
Archived: Unchecked

I would love to have some control over these options when a New device is detected.

Personally, I would love to just have a single notification to tell me that a New Device has hit the network (that wouldn't repeat more than 1 time per hour) and then have the ability to have everything else turned off (except for the New Device flag)

Other than that, I genuinely like the notification options as it allows me to monitor all of my devices.

Many thanks

[jokob-sk]

Let's see when I get a moment to do some of this work. 😉 #274

[jokob-sk]

Closing as released

[LaurentAtJoes]

Hi there,

sorry to re-open this post, but I'm still having an issue that doesn't seem consistent to me (but then again, I might be missing something, I'm only trying NetAlertX since today) :

if the "Alert Events" is not checked in the "New device" section of the Settings, the new device detection event (created by arpscan) will not trigger any notification.

From my understanding, "events" (as in this setting, and the "Alert all event" checkbox of the device) should have nothing to do with the fact that a new device has been discovered.

Because just like the OP, I'd like to have this "Alert All Events" box unchecked for pretty much all devices.
The only alerts I'm interested in is "new device" (always), and "down" on a selection of devices that should be always up.
(I also saw issue #274 )

Of course, since I always go add details and such on any new device, it's really not much of a hassle to keep the setting on and uncheck the box each time, but still, I think there's something wrong here.

Using latest 24.10.12 / docker.

[jokob-sk]

Hi @LaurentAtJoes ,

Its been a while since working on the notification settings, so I might be wrong.Also feel free to check the code itself here:

https://github.com/jokob-sk/NetAlertX/blob/main/server/reporting.py

Did you read the Notification guide? https://github.com/jokob-sk/NetAlertX/blob/main/docs/NOTIFICATIONS.md

If I remember correctly, Alert Events needs to be ticked in order to receive notifications, including new device notifications. You can then individually remove notification types from plugins (update to watched, new, missing...) and globally in the Notification processing plugin.

Let me know if docs or descriptions can be improve to reflect the above behavior and share your testing results.

Thanks,
j

[LaurentAtJoes]

Well yes, I did read the guides, and indeed, the fact that this box must be checked is far from obvious, let alone "logical" (imho, that is)

For the checkbox on the device page, the guide says : "Alert all events - Enables extensive alerts of connections, disconnections, IP changes (noisy, usually not recommended)"
No mention of discovery of this device as "new", so there is no obvious connection between the 2 concepts.

Then a bit later, under the "Global Settings" section, it clearly says :
"Usual setups will have new_devices, down_devices, and possibly events set."
Which further makes one think that "new_devices" + "down_devices" , and removing "events" is an acceptable combination.

And the "notification_processing" guide page says :
• new_devices - if a new device is detected
[...]
• events - if an event for a device that has Alert All Events enabled, is triggered

Here also, the two items seem pretty distinct and unrelated.

So as far as I understand this, "new device discovery" has nothing to do with subsequent "events" (down, disconnected etc.)

Again, it's not much of a hassle to leave the "New device" default checked value in Settings, then uncheck the box on any new device

[jokob-sk]

Hummm, here are proposed changes:

• excluding New Devices from being ignored if dev_AlertEvents is unchecked

• changing the descriptions the following way:

  • Alert All Events -> Alert Events
  • NEWDEV_dev_AlertEvents description change to: Indicates whether events related to the device should trigger alerts. The default value of the <code>Alert Events</code> checkbox. Down and New Device notifications are always sent unless unselected in <code>NTFPRCS_INCLUDED_SECTIONS</code>.
  • Updated Notifications.md docs

• Updated the notification processing readme:

If you have suggestions, please provide your wording for these instead or submit a PR. Thanks in advance!