Bugfix 2.0

deploy/clickhouse/init.sql

@@ -1,82 +0,0 @@
-CREATE DATABASE IF NOT EXISTS siem;
-
-CREATE TABLE IF NOT EXISTS siem.events
-(
-    event_uid String,
-    queue_partition Int32,
-    queue_offset Int64,
-    tenant_id LowCardinality(String),
-    event_time DateTime64(3, 'UTC'),
-    ingest_time DateTime64(3, 'UTC'),
-    event_date Date MATERIALIZED toDate(event_time),
-    agent_id String,
-    host_name LowCardinality(String),
-    source_type LowCardinality(String),
-    channel LowCardinality(String),
-    provider LowCardinality(String),
-    event_code UInt32,
-    category LowCardinality(String),
-    action LowCardinality(String),
-    outcome LowCardinality(String),
-    severity UInt8,
-    user_name String,
-    user_domain LowCardinality(String),
-    subject_user String,
-    subject_domain LowCardinality(String),
-    target_user String,
-    target_domain LowCardinality(String),
-    source_ip String,
-    source_port UInt16,
-    destination_ip String,
-    destination_port UInt16,
-    workstation String,
-    logon_type LowCardinality(String),
-    authentication_package LowCardinality(String),
-    logon_process LowCardinality(String),
-    status_code LowCardinality(String),
-    sub_status_code LowCardinality(String),
-    failure_reason LowCardinality(String),
-    process_path String,
-    parent_process_path String,
-    command_line String CODEC(ZSTD(3)),
-    message String CODEC(ZSTD(3)),
-    attributes Map(String, String) CODEC(ZSTD(3)),
-    raw_object_key String,
-    raw_index UInt32,
-    payload_hash FixedString(64),
-    schema_version UInt16,
-    parser_version UInt16,
-    ingest_delay_ms Int64,
-    INDEX idx_host host_name TYPE set(10000) GRANULARITY 4,
-    INDEX idx_event_code event_code TYPE set(256) GRANULARITY 4,
-    INDEX idx_user user_name TYPE bloom_filter(0.01) GRANULARITY 4,
-    INDEX idx_target target_user TYPE bloom_filter(0.01) GRANULARITY 4,
-    INDEX idx_source_ip source_ip TYPE bloom_filter(0.01) GRANULARITY 4,
-    INDEX idx_process process_path TYPE bloom_filter(0.01) GRANULARITY 8
-)
-ENGINE = ReplacingMergeTree(ingest_time)
-PARTITION BY toYYYYMM(event_time)
-ORDER BY (tenant_id, event_time, host_name, event_code, event_uid)
-TTL event_time + INTERVAL 90 DAY DELETE
-SETTINGS index_granularity = 8192;
-
-CREATE TABLE IF NOT EXISTS siem.events_5m
-(
-    tenant_id LowCardinality(String),
-    bucket DateTime('UTC'),
-    host_name LowCardinality(String),
-    event_code UInt32,
-    category LowCardinality(String),
-    action LowCardinality(String),
-    outcome LowCardinality(String),
-    cnt_state AggregateFunction(uniqExact, String)
-)
-ENGINE = AggregatingMergeTree
-PARTITION BY toYYYYMM(bucket)
-ORDER BY (tenant_id, bucket, host_name, event_code, category, action, outcome)
-TTL bucket + INTERVAL 730 DAY DELETE;
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS siem.events_5m_mv TO siem.events_5m AS
-SELECT tenant_id, toStartOfInterval(event_time, INTERVAL 5 MINUTE) AS bucket, host_name, event_code, category, action, outcome, uniqExactState(event_uid) AS cnt_state
-FROM siem.events
-GROUP BY tenant_id, bucket, host_name, event_code, category, action, outcome;

deploy/clickhouse/init.sql.template

@@ -1,6 +1,6 @@
-CREATE DATABASE IF NOT EXISTS siem;
+CREATE DATABASE IF NOT EXISTS __CLICKHOUSE_DB__;
 
-CREATE TABLE IF NOT EXISTS siem.events
+CREATE TABLE IF NOT EXISTS __CLICKHOUSE_DB__.events
 (
     event_uid String,
     queue_partition Int32,
@@ -60,7 +60,7 @@ ORDER BY (tenant_id, event_time, host_name, event_code, event_uid)
 TTL event_time + INTERVAL __EVENT_RETENTION_DAYS__ DAY DELETE
 SETTINGS index_granularity = 8192;
 
-CREATE TABLE IF NOT EXISTS siem.events_5m
+CREATE TABLE IF NOT EXISTS __CLICKHOUSE_DB__.events_5m
 (
     tenant_id LowCardinality(String),
     bucket DateTime('UTC'),
@@ -76,7 +76,7 @@ PARTITION BY toYYYYMM(bucket)
 ORDER BY (tenant_id, bucket, host_name, event_code, category, action, outcome)
 TTL bucket + INTERVAL __ROLLUP_RETENTION_DAYS__ DAY DELETE;
 
-CREATE MATERIALIZED VIEW IF NOT EXISTS siem.events_5m_mv TO siem.events_5m AS
+CREATE MATERIALIZED VIEW IF NOT EXISTS __CLICKHOUSE_DB__.events_5m_mv TO __CLICKHOUSE_DB__.events_5m AS
 SELECT tenant_id, toStartOfInterval(event_time, INTERVAL 5 MINUTE) AS bucket, host_name, event_code, category, action, outcome, uniqExactState(event_uid) AS cnt_state
-FROM siem.events
+FROM __CLICKHOUSE_DB__.events
 GROUP BY tenant_id, bucket, host_name, event_code, category, action, outcome;

deploy/garage/garage.toml.template

@@ -1,17 +0,0 @@
-metadata_dir = "/var/lib/garage/meta"
-data_dir = "/var/lib/garage/data"
-db_engine = "sqlite"
-replication_factor = 1
-rpc_bind_addr = "[::]:3901"
-rpc_public_addr = "garage:3901"
-rpc_secret = "__GARAGE_RPC_SECRET__"
-
-[s3_api]
-s3_region = "garage"
-api_bind_addr = "[::]:3900"
-root_domain = ".s3.garage.localhost"
-
-[admin]
-api_bind_addr = "[::]:3903"
-admin_token = "__GARAGE_ADMIN_TOKEN__"
-metrics_token = "__GARAGE_METRICS_TOKEN__"