Add Flowtriq DDoS Attack Status check script

[jacob-masse]

Summary

• Adds Linux_Flowtriq_DDoS_Status.sh, a TacticalRMM check script for nodes running ftagent (Flowtriq's DDoS detection agent)
• Queries the local ftagent health endpoint (default 127.0.0.1:9100) and returns exit 1 if a DDoS attack is active or if the agent is unreachable; exit 0 when clear
• Registers the script in community_scripts.json under TRMM (Linux):Checks
• No external dependencies beyond curl; parses the JSON health response with standard shell tools (no jq required)

Script behaviour

Condition	Exit code
No attack, agent healthy	0
Attack active	1
Agent unreachable	1
Baseline not ready (when warn_no_baseline=1)	1

Arguments

• port=9100 - ftagent health port (default 9100)
• timeout=5 - curl timeout in seconds
• warn_no_baseline=0 - set to 1 to alert when baseline detection is not yet ready

Test plan

• Run against a node with ftagent running and no attack - should exit 0
• Run with ftagent stopped - should exit 1 with "unreachable" message
• Run python3 -m json.tool community_scripts.json passes (JSON valid)

[CLAassistant]

All committers have signed the CLA.

[silversword411]

Thanks for the contribution! Need to sign the CLA to allow merging.

I have no way to test this, would be nice to have a 2nd party validate functionality

[jacob-masse]

Tested on a live node running ftagent v1.9.33 (Ubuntu 24.04, eth0). All three scenarios pass:

========================================
  Flowtriq DDoS Status Check - Test Log
  Server: ftagent-test-server
  Date: 2026-07-16 18:21:43 UTC
========================================

=== TEST 1: Agent running, no attack ===
--- Raw health endpoint response ---
{
    "status": "ok",
    "version": "1.9.33",
    "uptime_seconds": 67852.4,
    "interface": "eth0",
    "current_pps": 16.0,
    "current_bps": 82709.5,
    "baseline_ready": true,
    "attack_active": false,
    "incident_uuid": null
}

--- Script output ---
ftagent v1.9.33 | interface: eth0 | uptime: 67852.5s | pps: 16.0 | 82.7 Kbps
OK: No attack detected. Baseline ready: true.
Exit code: 0

=== TEST 2: warn_no_baseline=1 argument ===
ftagent v1.9.33 | interface: eth0 | uptime: 67852.6s | pps: 16.0 | 82.7 Kbps
OK: No attack detected. Baseline ready: true.
Exit code: 0

=== TEST 3: Agent stopped (unreachable) ===
CRITICAL: ftagent health endpoint unreachable at http://127.0.0.1:9100/ (curl exit 7)
Ensure ftagent is running: systemctl status ftagent
Exit code: 1

=== ALL TESTS COMPLETE ===

Scenario	Expected	Actual	Result
Agent healthy, no attack	exit 0	exit 0	Pass
warn_no_baseline=1 (baseline ready)	exit 0	exit 0	Pass
Agent stopped	exit 1	exit 1	Pass

[jacob-masse]

CLA should be signed too