39 lines
1.5 KiB
SQL
39 lines
1.5 KiB
SQL
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
CREATE TABLE IF NOT EXISTS agents (
|
|
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
tenant_id text NOT NULL,
|
|
hostname text NOT NULL,
|
|
api_key_hash char(64) NOT NULL,
|
|
enabled boolean NOT NULL DEFAULT true,
|
|
last_ip text NOT NULL DEFAULT '',
|
|
first_seen timestamptz NOT NULL DEFAULT now(),
|
|
last_seen timestamptz NOT NULL DEFAULT now(),
|
|
UNIQUE (tenant_id, hostname)
|
|
);
|
|
CREATE INDEX IF NOT EXISTS agents_last_seen_idx ON agents(tenant_id,last_seen DESC);
|
|
|
|
CREATE TABLE IF NOT EXISTS detections (
|
|
id bigserial PRIMARY KEY,
|
|
tenant_id text NOT NULL,
|
|
fingerprint char(64) NOT NULL,
|
|
rule_name text NOT NULL,
|
|
severity text NOT NULL,
|
|
status text NOT NULL DEFAULT 'open',
|
|
hostname text NOT NULL DEFAULT '',
|
|
user_name text NOT NULL DEFAULT '',
|
|
source_ip text NOT NULL DEFAULT '',
|
|
workstation text NOT NULL DEFAULT '',
|
|
event_code integer NOT NULL DEFAULT 0,
|
|
score double precision NOT NULL DEFAULT 0,
|
|
window_start timestamptz NOT NULL,
|
|
window_end timestamptz NOT NULL,
|
|
summary text NOT NULL,
|
|
hit_count bigint NOT NULL DEFAULT 1,
|
|
first_seen timestamptz NOT NULL DEFAULT now(),
|
|
last_seen timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now(),
|
|
UNIQUE (tenant_id, fingerprint)
|
|
);
|
|
CREATE INDEX IF NOT EXISTS detections_open_idx ON detections(tenant_id,status,last_seen DESC);
|
|
CREATE INDEX IF NOT EXISTS detections_rule_idx ON detections(tenant_id,rule_name,last_seen DESC);
|