Alerts
Kismet uses alerts to communicate wireless intrusion events and critical Kismet server events.
Alerts are generated both as text messages on the messagebus and as dedicated alert records.
For real-time monitoring of alerts, see the eventbus API.
Alert severities
Alert severities are categorized by numerical value; a higher number is more severe.
| Severity | Definition | Use |
|---|---|---|
| 0 | INFO | Informational alerts, such as datasource errors, Kismet state changes, etc |
| 5 | LOW | Low-risk events such as probe fingerprints |
| 10 | MEDIUM | Medium-risk events such as denial of service attempts |
| 15 | HIGH | High-risk events such as fingerprinted watched devices, denial of service attacks, and similar |
| 20 | CRITICAL | Critical errors such as fingerprinted known exploits |
Alert types
Alerts are categorized by type; alert types are free-form strings, but include:
| Type | Use |
|---|---|
| DENIAL | Possible denial of service attack |
| EXPLOIT | Known fingerprinted exploit attempt against a vulnerability |
| OTHER | General category for alerts which don’t fit in any existing bucket |
| PROBE | Probe by known tools |
| SPOOF | Attempt to spoof an existing device |
| SYSTEM | System events, such as log changes, datasource errors, etc |
Alert configuration
readonly/alerts/definitions.json/alerts/definitions.ekjson/alerts/definitions.prettyjsonGETAll alerts
Kismet retains the past N alerts, as defiend by alertbacklog in kismet_memory.conf.
By default, Kismet retains 50 alert records.
readonly/alerts/all_alerts.json/alerts/all_alerts.ekjson/alerts/all_alerts.prettyjsonGETRecent alerts
This endpoint returns alerts since the exact timestamp of seconds and milliseconds.
A more efficient and reliable method is to use the eventbus websocket.
readonly/alerts/last-time/{TIMESTAMP}/alerts.json/alerts/last-time/{TIMESTAMP}/alerts.ekjson/alerts/last-time/{TIMESTAMP}/alerts.prettyjsonGETPARAMETERS
TIMESTAMP
number (double)
REQUIREDTIMESTAMP.UTIMESTAMPRecent alerts (wrapped)
This endpoint functions identically to the recent alerts endpoint, but wraps the return in a JSON object including the timestamp when the server generated the report.
This can be used for polling UI implementations to know the exact time pass in the next alert query.
A more efficient and reliable method is to use the eventbus websocket.
readonly/alerts/wrapped/last-time/{TIMESTAMP}/alerts.json/alerts/wrapped/last-time/{TIMESTAMP}/alerts.ekjson/alerts/wrapped/last-time/{TIMESTAMP}/alerts.prettyjsonGETPARAMETERS
TIMESTAMP
number (double)
REQUIREDTIMESTAMP.UTIMESTAMP and the exact timestamp
of the return generation.Alert table view
Alerts, with server-side paging, sorting, and searching, for displaying alerts in a table. This is the endpoint used by the alerts table in the Kismet web UI.
The paging parameters (page, length, sort, sort_dir, and search) are read from the
URL query string or from form-encoded POST variables, while fields is read from the JSON
request.
Only alerts in the alert backlog (the last N alerts, set by alertbacklog in
kismet_memory.conf) are available.
readonly/alerts/alerts_view.json/alerts/alerts_view.ekjson/alerts/alerts_view.prettyjsonGET
POSTPARAMETERS
page
number
OPTIONALPage number to return, starting at 0. Setting page enables pagination, sorting, and
searching, and wraps the results in a paging container.
length
number
OPTIONALNumber of alerts per page. size is accepted as an alias. If no length is given, all
matching alerts are returned in a single page.
sort
string
OPTIONALField to sort by, such as kismet.alert.timestamp. Only used when page is set.
sort_dir
string
OPTIONALSort direction; asc sorts ascending, any other value sorts descending. Only used when
page is set.
search
string
OPTIONALCase-insensitive text to search for. The search is performed on every field listed in
fields; if no fields are given, no searching is done. Alert severities match by name
(INFO, LOW, MEDIUM, HIGH, and CRITICAL). Only used when page is set.
PARAMETERS
This endpoint takes additional parameters by using a `POST` request and supplying a
JSON document or json form variable.
You can find more information about API parameters here.
fields
field simplification
OPTIONALKismet can reduce the amount of information being processed and returned by an API by simplifying the fields to only return the data needed by the caller.
You can read more about the field simplification API and how to use it here.
Without page, a JSON list of alert records.
With page, a JSON object:
{
"data": [ ... alert records ... ],
"last_page": 4,
"last_row": 200,
"total_row": 250
}
last_page is the number of pages, last_row is the number of alerts matching the search,
and total_row is the total number of alerts in the backlog.
Alert by ID
Fetch a single alert by ID.
Only alerts in the alert backlog are available.
readonly/alerts/by-id/{ALERTID}/alert.json/alerts/by-id/{ALERTID}/alert.ekjson/alerts/by-id/{ALERTID}/alert.prettyjsonGET
POSTPARAMETERS
ALERTID
number
REQUIREDAlert ID, the kismet.alert.hash value of the alert record.
PARAMETERS
This endpoint takes additional parameters by using a `POST` request and supplying a
JSON document or json form variable.
You can find more information about API parameters here.
fields
field simplification
OPTIONALKismet can reduce the amount of information being processed and returned by an API by simplifying the fields to only return the data needed by the caller.
You can read more about the field simplification API and how to use it here.
Define an alert
Define a new alert type, so that it can be raised with the raise alerts endpoint.
Alerts can only be defined once; an alert which is already defined (including alerts defined in the Kismet config files) can not be redefined.
admin/alerts/definitions/define_alert.cmdPOSTPARAMETERS
This endpoint takes additional parameters by using a `POST` request and supplying a
JSON document or json form variable.
You can find more information about API parameters here.
name
string
REQUIREDName of the alert. Alert names are converted to upper case.
description
string
REQUIREDDescription of the alert, shown in the alert definitions.
class
string
REQUIREDClass of the alert, such as SYSTEM, DENIAL, SPOOF, or EXPLOIT; see the
alert types above.
throttle
string
REQUIREDMaximum rate of the alert, as count/unit, such as 10/min. Units are sec, min,
hour, and day; with no unit, the rate is per minute. A rate of 0 disables the alert.
burst
string
REQUIREDMaximum burst rate of the alert, in the same format as throttle, such as 1/sec. The
burst unit must be shorter than the throttle unit.
phyname
string
OPTIONALPhy the alert applies to. If omitted, or any, the alert applies to all phys.
Raise alerts
Raise an alert from an external tool. The alert must already be defined, either in the Kismet configuration or with the define an alert endpoint.
Raised alerts are rate limited by the alert throttle and burst rates, include the current GPS location when available, are added to the alert backlog, logged, and sent to the eventbus and messagebus like alerts generated by Kismet.
admin/alerts/raise_alerts.cmdPOSTPARAMETERS
This endpoint takes additional parameters by using a `POST` request and supplying a
JSON document or json form variable.
You can find more information about API parameters here.
name
string
REQUIREDName of a defined alert type, in upper case.
text
string
REQUIREDAlert text.
bssid
string
OPTIONALMAC address of the network (or transmitter) associated with the alert.
source
string
OPTIONALSource MAC address associated with the alert.
dest
string
OPTIONALDestination MAC address associated with the alert.
other
string
OPTIONALOther MAC address associated with the alert.
channel
string
OPTIONALChannel associated with the alert.