Vollständiges Redesign

deploy/postgres/init.sql

@@ -0,0 +1,38 @@
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+CREATE TABLE IF NOT EXISTS agents (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id text NOT NULL,
+    hostname text NOT NULL,
+    api_key_hash char(64) NOT NULL,
+    enabled boolean NOT NULL DEFAULT true,
+    last_ip text NOT NULL DEFAULT '',
+    first_seen timestamptz NOT NULL DEFAULT now(),
+    last_seen timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (tenant_id, hostname)
+);
+CREATE INDEX IF NOT EXISTS agents_last_seen_idx ON agents(tenant_id,last_seen DESC);
+
+CREATE TABLE IF NOT EXISTS detections (
+    id bigserial PRIMARY KEY,
+    tenant_id text NOT NULL,
+    fingerprint char(64) NOT NULL,
+    rule_name text NOT NULL,
+    severity text NOT NULL,
+    status text NOT NULL DEFAULT 'open',
+    hostname text NOT NULL DEFAULT '',
+    user_name text NOT NULL DEFAULT '',
+    source_ip text NOT NULL DEFAULT '',
+    workstation text NOT NULL DEFAULT '',
+    event_code integer NOT NULL DEFAULT 0,
+    score double precision NOT NULL DEFAULT 0,
+    window_start timestamptz NOT NULL,
+    window_end timestamptz NOT NULL,
+    summary text NOT NULL,
+    hit_count bigint NOT NULL DEFAULT 1,
+    first_seen timestamptz NOT NULL DEFAULT now(),
+    last_seen timestamptz NOT NULL DEFAULT now(),
+    updated_at timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (tenant_id, fingerprint)
+);
+CREATE INDEX IF NOT EXISTS detections_open_idx ON detections(tenant_id,status,last_seen DESC);
+CREATE INDEX IF NOT EXISTS detections_rule_idx ON detections(tenant_id,rule_name,last_seen DESC);