sendnrw/siem-backend
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update to META-Data Only
release-tag / release-image (push) Successful in 3m4s
Details

Browse Source
This commit is contained in:
jbergner
2026-07-18 17:16:10 +02:00
parent f1d88e8fb3
commit 10541fb22d
6 changed files with 584 additions and 321 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/mariadb/init/001-schema.sql
+67 -2
View File
@@ -22,6 +22,8 @@ SET FOREIGN_KEY_CHECKS = 0;
DROP PROCEDURE IF EXISTS ensure_siem_partitions;
DROP TABLE IF EXISTS event_catalog;
DROP TABLE IF EXISTS event_occurrences;
DROP TABLE IF EXISTS event_count_buckets;
DROP TABLE IF EXISTS ueba_context_buckets;
DROP TABLE IF EXISTS host_risk_scores;
@@ -181,6 +183,63 @@ PARTITION BY RANGE COLUMNS(ts) (
PARTITION pmax VALUES LESS THAN (MAXVALUE)
);
-- ---------------------------------------------------------------------
-- Kleine Event-Landkarte: erstes/letztes Auftreten pro Host/Channel/EventID.
-- Verhindert teure NOT EXISTS-Scans über die Hot-Event-Tabelle.
-- ---------------------------------------------------------------------
CREATE TABLE event_catalog (
hostname VARCHAR(191) NOT NULL,
channel_name VARCHAR(128) NOT NULL,
event_id INT UNSIGNED NOT NULL,
first_seen DATETIME(6) NOT NULL,
last_seen DATETIME(6) NOT NULL,
total_count BIGINT UNSIGNED NOT NULL DEFAULT 0,
updated_at DATETIME(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
PRIMARY KEY (hostname, channel_name, event_id),
KEY idx_event_catalog_first_seen (first_seen),
KEY idx_event_catalog_last_seen (last_seen)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-- ---------------------------------------------------------------------
-- Langfristige, kompakte Event-Metadaten
-- Eine Zeile pro Zeit-Bucket und Dimensionskombination statt einer Zeile pro XML.
-- ---------------------------------------------------------------------
CREATE TABLE event_occurrences (
bucket_start DATETIME(6) NOT NULL,
bucket_end DATETIME(6) NOT NULL,
dimension_key BINARY(16) NOT NULL,
hostname VARCHAR(191) NOT NULL,
channel_name VARCHAR(128) NOT NULL,
event_id INT UNSIGNED NOT NULL,
provider_name VARCHAR(191) NOT NULL DEFAULT '',
target_user VARCHAR(191) NOT NULL DEFAULT '',
subject_user VARCHAR(191) NOT NULL DEFAULT '',
src_ip VARCHAR(64) NOT NULL DEFAULT '',
workstation VARCHAR(191) NOT NULL DEFAULT '',
logon_type VARCHAR(32) NOT NULL DEFAULT '',
status_text VARCHAR(128) NOT NULL DEFAULT '',
failure_reason VARCHAR(255) NOT NULL DEFAULT '',
cnt BIGINT UNSIGNED NOT NULL DEFAULT 0,
first_event_ts DATETIME(6) NOT NULL,
last_event_ts DATETIME(6) NOT NULL,
updated_at DATETIME(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
PRIMARY KEY (bucket_start, dimension_key),
KEY idx_occurrences_time_host_event (bucket_start, hostname, channel_name, event_id),
KEY idx_occurrences_host_event_time (hostname, channel_name, event_id, bucket_start),
KEY idx_occurrences_target_user_time (target_user, bucket_start),
KEY idx_occurrences_subject_user_time (subject_user, bucket_start),
KEY idx_occurrences_src_ip_time (src_ip, bucket_start)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
PARTITION BY RANGE COLUMNS(bucket_start) (
PARTITION pmax VALUES LESS THAN (MAXVALUE)
);
-- ---------------------------------------------------------------------
-- Detection-Regeln
-- ---------------------------------------------------------------------
@@ -361,7 +420,10 @@ CREATE TABLE event_count_buckets (
bucket_start,
bucket_end
)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
PARTITION BY RANGE COLUMNS(bucket_start) (
PARTITION pmax VALUES LESS THAN (MAXVALUE)
);
-- ---------------------------------------------------------------------
-- Baseline Stats
@@ -518,7 +580,10 @@ CREATE TABLE ueba_context_buckets (
workstation,
bucket_start
)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
PARTITION BY RANGE COLUMNS(bucket_start) (
PARTITION pmax VALUES LESS THAN (MAXVALUE)
);
-- ---------------------------------------------------------------------
-- Privileged Users