Function run_targeted_arp_scan

webapp_modern.py:1905–1923

(ip, interface=DEFAULT_ARP_SCAN_INTERFACE)

# ==========================================================================

_watchtower_lock = threading.Lock()
_watchtower = None            # lazy watchtower.Watchtower instance
_wt_seen = {}                 # pushover dedup: key -> {'rank', 'ts'}
_wt_seen_loaded = False
_wt_summary = {'enabled': False, 'ts': None, 'total': 0}

# Cross-signal correlation: fold the same normalized alert stream into
# attack-chain *incidents* (see incident_engine.py). Paged once per incident when
# it first becomes a named campaign or escalates.
_incident_engine = None
_inc_notified = {}            # incident id -> {'pattern', 'severity'}
_incidents_summary = {'total': 0, 'named': 0}


def _inc_get():
    global _incident_engine
    if _incident_engine is None:
        import incident_engine as _ie
        try:
            window = float(shared_data.config.get('incident_window_s', 600))
        except (TypeError, ValueError):
            window = 600.0