Update Datenbankproblem

deploy/mariadb/init/001-schema.sql

@@ -62,7 +62,7 @@ CREATE TABLE agents (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
 -- ---------------------------------------------------------------------
--- Event Logs, normalisierte Haupttabelle
+-- Event Logs, optionaler kurzlebiger Full-Event-Hotstore (STORE_EVENT_ROWS=true)
 -- ---------------------------------------------------------------------
 
 CREATE TABLE event_logs (
@@ -202,8 +202,9 @@ CREATE TABLE event_catalog (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
 -- ---------------------------------------------------------------------
--- Langfristige, kompakte Event-Metadaten
--- Eine Zeile pro Zeit-Bucket und Dimensionskombination statt einer Zeile pro XML.
+-- Kompakte Security-Kontext-Metadaten für eine kleine Event-ID-Allowlist.
+-- Alle Events werden universell in event_count_buckets gezählt; diese Tabelle
+-- speichert nur Benutzer/IP/Workstation-Kontext für ausgewählte Security-Events.
 -- ---------------------------------------------------------------------
 
 CREATE TABLE event_occurrences (
@@ -234,7 +235,15 @@ CREATE TABLE event_occurrences (
     KEY idx_occurrences_host_event_time (hostname, channel_name, event_id, bucket_start),
     KEY idx_occurrences_target_user_time (target_user, bucket_start),
     KEY idx_occurrences_subject_user_time (subject_user, bucket_start),
-    KEY idx_occurrences_src_ip_time (src_ip, bucket_start)
+    KEY idx_occurrences_src_ip_time (src_ip, bucket_start),
+    KEY idx_occurrences_security_event_time (
+        channel_name,
+        event_id,
+        bucket_start,
+        hostname,
+        target_user,
+        src_ip
+    )
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
 PARTITION BY RANGE COLUMNS(bucket_start) (
     PARTITION pmax VALUES LESS THAN (MAXVALUE)
@@ -419,6 +428,13 @@ CREATE TABLE event_count_buckets (
     KEY idx_event_count_buckets_time (
         bucket_start,
         bucket_end
+    ),
+
+    KEY idx_event_count_buckets_event_time (
+        channel_name,
+        event_id,
+        bucket_start,
+        hostname
     )
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
 PARTITION BY RANGE COLUMNS(bucket_start) (