189 lines
20 KiB
Plaintext
189 lines
20 KiB
Plaintext
|
Êþº¾ 4Ê
|
|||
|
|
É
|
|||
|
|
.Ê
|
|||
|
|
Ë .ÌÍÎ
|
|||
|
|
yÏ
|
|||
|
|
yÐ ÑÒ
|
|||
|
|
.Ó
|
|||
|
|
.Ô
|
|||
|
|
Õ
|
|||
|
|
Ö×
|
|||
|
|
ØÙ
|
|||
|
|
ÚÛ
|
|||
|
|
ÜÝ
|
|||
|
|
ÜÞ
|
|||
|
|
Üßà
|
|||
|
|
Üá
|
|||
|
|
â
|
|||
|
|
Üã
|
|||
|
|
Üä
|
|||
|
|
Üåæ
|
|||
|
|
Üç
|
|||
|
|
Üè
|
|||
|
|
Üéê
|
|||
|
|
Üëì
|
|||
|
|
Éí
|
|||
|
|
î
|
|||
|
|
ï
|
|||
|
|
Üð
|
|||
|
|
Üñ .ò óôõ
|
|||
|
|
(É“ �ö÷øùúikl .ûü ýþ .ÿ . . . . .
|
|||
|
|
|
|||
|
|
|
|||
|
|
D .
|
|||
|
|
Ú . .
|
|||
|
|
Ñ .
|
|||
|
|
_
|
|||
|
|
. œ . !" #
|
|||
|
|
$%
|
|||
|
|
$&
|
|||
|
|
Ö'
|
|||
|
|
Ö(
|
|||
|
|
Ö)
|
|||
|
|
Ö*
|
|||
|
|
Ö+,
|
|||
|
|
Ö-
|
|||
|
|
Ö. ó/0`123456 Ñ789
|
|||
|
|
h:
|
|||
|
|
;
|
|||
|
|
<
|
|||
|
|
Ö=>?@A
|
|||
|
|
tÉ B CD CEF
|
|||
|
|
.G HIJKL
|
|||
|
|
MNO
|
|||
|
|
PQ
|
|||
|
|
RS
|
|||
|
|
Rï
|
|||
|
|
TU
|
|||
|
|
TV
|
|||
|
|
TW
|
|||
|
|
TX
|
|||
|
|
TY
|
|||
|
|
TZ
|
|||
|
|
[\
|
|||
|
|
T]
|
|||
|
|
T^_
|
|||
|
|
T`
|
|||
|
|
Ta
|
|||
|
|
Tb
|
|||
|
|
Tcd
|
|||
|
|
Te
|
|||
|
|
Tfg
|
|||
|
|
Th
|
|||
|
|
Ti
|
|||
|
|
Tj
|
|||
|
|
Tkl �m �n
|
|||
|
|
.o
|
|||
|
|
Ppq
|
|||
|
|
Prs
|
|||
|
|
.t
|
|||
|
|
Puvw
|
|||
|
|
.x
|
|||
|
|
.y
|
|||
|
|
Pz{
|
|||
|
|
.|
|
|||
|
|
P}~
|
|||
|
|
P€
|
|||
|
|
P�‚
|
|||
|
|
.ƒ
|
|||
|
|
P„…
|
|||
|
|
P†‡
|
|||
|
|
Pˆ‰Š
|
|||
|
|
P‹Œ
|
|||
|
|
P�Ž
|
|||
|
|
P��
|
|||
|
|
P‘’
|
|||
|
|
.“
|
|||
|
|
P”•
|
|||
|
|
P–—
|
|||
|
|
P˜™
|
|||
|
|
Pš›
|
|||
|
|
Pœ�
|
|||
|
|
PžŸ
|
|||
|
|
P ¡
|
|||
|
|
P¢£
|
|||
|
|
P¤¥
|
|||
|
|
P¦§
|
|||
|
|
P¨©
|
|||
|
|
Pª«
|
|||
|
|
P¬
|
|||
|
|
P®¯
|
|||
|
|
P°±
|
|||
|
|
P²³
|
|||
|
|
P´µ
|
|||
|
|
P¶·
|
|||
|
|
P¸¹
|
|||
|
|
Pº»
|
|||
|
|
P¼½
|
|||
|
|
P¾¿
|
|||
|
|
PÀÁ
|
|||
|
|
PÂÃ
|
|||
|
|
PÄÅ
|
|||
|
|
PÆÇ
|
|||
|
|
PÈÉ
|
|||
|
|
PÊË
|
|||
|
|
PÌÍ
|
|||
|
|
PÎÏ
|
|||
|
|
PÐÑ
|
|||
|
|
PÒÓ
|
|||
|
|
PÔÕ
|
|||
|
|
PÖ×
|
|||
|
|
PØÙ
|
|||
|
|
ï
|
|||
|
|
ÚÛ
|
|||
|
|
Ü
|
|||
|
|
ÚÝ
|
|||
|
|
|
|||
|
|
Þß
|
|||
|
|
àá³²â
|
|||
|
|
ãä
|
|||
|
|
åæ
|
|||
|
|
çèé¿
|
|||
|
|
êëìíî
|
|||
|
|
ïðñò log Lorg/slf4j/Logger; sqlGeneratorService (Lcom/common/service/SqlGeneratorService; RuntimeVisibleAnnotations 8Lorg/springframework/beans/factory/annotation/Autowired;
|
|||
|
|
ruleMapper .Lcom/common/mapper/AnalysisAnalysisRuleMapper; fieldMapper 'Lcom/common/mapper/AnalysisFieldMapper; whereConditionMapper 0Lcom/common/mapper/AnalysisWhereConditionMapper; groupByColumnMapper /Lcom/common/mapper/AnalysisGroupByColumnMapper; filterMapper (Lcom/common/mapper/AnalysisFilterMapper; groupByHavingMapper /Lcom/common/mapper/AnalysisGroupByHavingMapper;
|
|||
|
|
groupByMapper )Lcom/common/mapper/AnalysisGroupByMapper; groupByWindowMapper /Lcom/common/mapper/AnalysisGroupByWindowMapper; taskHistoryMapper -Lcom/common/mapper/AnalysisTaskHistoryMapper; alarmMapper Lcom/common/mapper/AlarmMapper; jdbcTemplate ,Lorg/springframework/jdbc/core/JdbcTemplate; RUN_MODE Ljava/lang/String;
|
|||
|
|
ConstantValue DATE_FORMATTER $Ljava/time/format/DateTimeFormatter; <init> ()V Code LineNumberTable LocalVariableTable this /Lcom/common/service/impl/OfflineAnalysisEngine; executeRule 9(Lcom/common/entity/AnalysisAnalysisRule;)Ljava/util/Map; groupBy #Lcom/common/entity/AnalysisGroupBy; tableName alarms Ljava/util/List; fields whereConditions filters groupByColumns havingConditions
|
|||
|
|
groupByWindow )Lcom/common/entity/AnalysisGroupByWindow; groupByList sql queryResult
|
|||
|
|
alarmCount J endTime Ljava/time/LocalDateTime; durationSeconds e Ljava/lang/Exception; rule (Lcom/common/entity/AnalysisAnalysisRule; batchNo startTime
|
|||
|
|
dataStartTime dataEndTime history 'Lcom/common/entity/AnalysisTaskHistory; result Ljava/util/Map; LocalVariableTypeTable +Ljava/util/List<Lcom/common/entity/Alarm;>; 3Ljava/util/List<Lcom/common/entity/AnalysisField;>; <Ljava/util/List<Lcom/common/entity/AnalysisWhereCondition;>; 4Ljava/util/List<Lcom/common/entity/AnalysisFilter;>; ;Ljava/util/List<Lcom/common/entity/AnalysisGroupByColumn;>; ;Ljava/util/List<Lcom/common/entity/AnalysisGroupByHaving;>; 5Ljava/util/List<Lcom/common/entity/AnalysisGroupBy;>; GLjava/util/List<Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;>; 5Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;
|
|||
|
|
StackMapTableùFáßóOôõ5ì MethodParameters Signature _(Lcom/common/entity/AnalysisAnalysisRule;)Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>; executeRules "(Ljava/util/List;)Ljava/util/List; errorResult rules results :Ljava/util/List<Lcom/common/entity/AnalysisAnalysisRule;>;ö ƒ(Ljava/util/List<Lcom/common/entity/AnalysisAnalysisRule;>;)Ljava/util/List<Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;>; stopRule (Ljava/lang/String;)V ruleId
|
|||
|
|
getRunMode ()Ljava/lang/String; generateBatchNo parseDataStartTime C(Lcom/common/entity/AnalysisAnalysisRule;)Ljava/time/LocalDateTime; parseDataEndTime convertToAlarms J(Lcom/common/entity/AnalysisAnalysisRule;Ljava/util/List;)Ljava/util/List; alarm Lcom/common/entity/Alarm; row÷ œ(Lcom/common/entity/AnalysisAnalysisRule;Ljava/util/List<Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;>;)Ljava/util/List<Lcom/common/entity/Alarm;>;
|
|||
|
|
getBytesValue (Ljava/lang/Object;)[B value Ljava/lang/Object; getStringValue &(Ljava/lang/Object;)Ljava/lang/String; getLongValue $(Ljava/lang/Object;)Ljava/lang/Long; getIntegerValue '(Ljava/lang/Object;)Ljava/lang/Integer; getTimestampValue -(Ljava/lang/Object;)Ljava/time/LocalDateTime; getStringArray '(Ljava/lang/Object;)[Ljava/lang/String; i I arr [Ljava/lang/Object; [Ljava/lang/String; strÎ getIntegerArray ((Ljava/lang/Object;)[Ljava/lang/Integer; !Ljava/lang/NumberFormatException; strArray [Ljava/lang/Integer;ºé getByteArrayArray (Ljava/lang/Object;)[[B [[B convertAlarmLevel '(Ljava/lang/Integer;)Ljava/lang/String;
|
|||
|
|
eventLevel Ljava/lang/Integer; <clinit>
|
|||
|
|
SourceFile OfflineAnalysisEngine.java (Lorg/springframework/stereotype/Service; offlineAnalysisEngine HI –• øù '( <开始执行离线规则: ruleId={}, ruleName={}, batchNo={} java/lang/Object ú• û•ü ýþ —˜ ™˜ ÿ ó
|
|||
|
|
|
|||
|
|
“ j RUNNING 1
|
|||
|
|
|
|||
|
|
0 000000 java/lang/StringBuilder 离线分æž�任务 - • => ! java/util/HashMap "# ruleName runMode -com/common/service/impl/OfflineAnalysisEngine offline -. running$ %& /0' () 12* 56+ 34, 78- 9:.ô /0 12 !com/common/entity/AnalysisGroupBy 34 ;< 567 89 )* FG :;< => 生æˆ�çš„SQL: {} ý? AB@ A) š› ?@B CD E6F GH I JK LM NO PM QM COMPLETED R’ SK T! processedCount status success waiting ?规则执行æˆ�功: ruleId={}, processedCount={}, alarmCount={} java/lang/Exception 规则执行失败: ruleId={} UV FAILED 执行失败: W• X6 YZ [’ stopped failed errorMsg java/util/ArrayList \]ö ^0 _` &com/common/entity/AnalysisAnalysisRule OP ab 执行规则失败: ruleId={} å·²å�œæ¢è§„则: ruleId={} å�œæ¢è§„则失败: ruleId={} yyyyMMddHHmmssSSSc de
|
|||
|
|
java/util/Map÷ gh ijk l mn on pl ql rst u vw �s 未知 xl yw zw {| ç ”åˆ¤å�Žå¤„ç½® }l ~s other l €n �s ‚ log_start_at ƒb 1„ «¬ …K
|
|||
|
|
log_end_at †K
|
|||
|
|
alarm_name ¥¦ ‡’
|
|||
|
|
alarm_type alarm_level ©ª ÀÁ ˆ’ attack_ip ® ‰Š victim_ip ‹Š victim_web_url ŒŠ attack_chain_phase ¶· �Ž device_id �Ž tag �Š comment origin_log_ids ‘Š query_id ’’
|
|||
|
|
attack_result “O fall ”O payload ¡¢ •–
|
|||
|
|
operate_event —Ž attack_port ˜Ž victim_port ™Ž
|
|||
|
|
attack_method š’ business_ext ›’ http_status œ’ dns_info �’ account_info ž’
|
|||
|
|
attacker_info Ÿ’ victim_info ’ suspicious_action ¡’ vuln_info ¢’ weak_pwd £’ compliance_baseline ¤’ file_info ¥’ file_tags ¦’
|
|||
|
|
endpoint_info §’ origin_info ¨’
|
|||
|
|
protocol_info ©’
|
|||
|
|
email_info ª’ sensitive_data «’ hit_intelligence ¬O window_time ’
|
|||
|
|
attack_ip_pic ®’
|
|||
|
|
victim_ip_pic ¯’ operation_at °K attack_direction ±’ etl_time ²K log_count ³O is_asset_hit ´O http_req_header µŠ
|
|||
|
|
http_req_body ¶Š http_resp_header ·Š http_resp_body ¸Š [B ¹º java/lang/Number » ¼½ ¾¿ java/time/LocalDateTime ÀÁ java/lang/String { Âà } Äà , ÅÆ java/lang/Integer java/lang/NumberFormatException 安全(æ— å¨�èƒ�) 低å�± ä¸å�± 高å�± 超å�±Ç ÈÉ yyyy-MM-dd HH:mm:ss !com/common/service/AnalysisEngine %com/common/entity/AnalysisTaskHistory java/util/List 'com/common/entity/AnalysisGroupByWindow java/util/Iterator com/common/entity/Alarm now ()Ljava/time/LocalDateTime; getRuleId getRuleName org/slf4j/Logger info ((Ljava/lang/String;[Ljava/lang/Object;)V
|
|||
|
|
minusHours (J)Ljava/time/LocalDateTime; builder AnalysisTaskHistoryBuilder InnerClasses D()Lcom/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder; java/lang/System currentTimeMillis ()J java/lang/Long valueOf (J)Ljava/lang/Long; @com/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder id T(Ljava/lang/Long;)Lcom/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder; V(Ljava/lang/String;)Lcom/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder; ](Ljava/time/LocalDateTime;)Lcom/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder; (I)Ljava/lang/Integer; progressPercent W(Ljava/lang/Integer;)Lcom/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder;
|
|||
|
|
inputCount outputCount delFlag
|
|||
|
|
createTime
|
|||
|
|
updateTime tenantId append -(Ljava/lang/String;)Ljava/lang/StringBuilder; toString remark build )()Lcom/common/entity/AnalysisTaskHistory; +com/common/mapper/AnalysisTaskHistoryMapper insert *(Lcom/common/entity/AnalysisTaskHistory;)I put 8(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; ,com/common/mapper/AnalysisAnalysisRuleMapper updateTaskStatus 7(Ljava/lang/String;Ljava/lang/String;Ljava/lang/Long;)I %com/common/mapper/AnalysisFieldMapper selectByRuleId $(Ljava/lang/String;)Ljava/util/List; .com/common/mapper/AnalysisWhereConditionMapper &com/common/mapper/AnalysisFilterMapper -com/common/mapper/AnalysisGroupByColumnMapper -com/common/mapper/AnalysisGroupByHavingMapper 'com/common/mapper/AnalysisGroupByMapper isEmpty ()Z get (I)Ljava/lang/Object; getId ()Ljava/lang/Long; intValue ()I -com/common/mapper/AnalysisGroupByWindowMapper selectByGroupById >(Ljava/lang/Integer;)Lcom/common/entity/AnalysisGroupByWindow; format 8(Ljava/time/format/DateTimeFormatter;)Ljava/lang/String; &com/common/service/SqlGeneratorService generateSql Ù(Lcom/common/entity/AnalysisAnalysisRule;Ljava/util/List;Ljava/util/List;Ljava/util/List;Ljava/util/List;Ljava/util/List;Lcom/common/entity/AnalysisGroupByWindow;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; '(Ljava/lang/String;Ljava/lang/Object;)V *org/springframework/jdbc/core/JdbcTemplate queryForList com/common/mapper/AlarmMapper batchInsert (Ljava/util/List;)V size java/time/Duration between P(Ljava/time/temporal/Temporal;Ljava/time/temporal/Temporal;)Ljava/time/Duration;
|
|||
|
|
getSeconds
|
|||
|
|
setEndTime (Ljava/time/LocalDateTime;)V setDurationTime (Ljava/lang/Long;)V setProgressPercent (Ljava/lang/Integer;)V
|
|||
|
|
setInputCount setOutputCount setStatus
|
|||
|
|
setUpdateTime update error 9(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V
|
|||
|
|
getMessage length substring (II)Ljava/lang/String; setRemark iterator ()Ljava/util/Iterator; hasNext next ()Ljava/lang/Object; add (Ljava/lang/Object;)Z "java/time/format/DateTimeFormatter ofPattern 8(Ljava/lang/String;)Ljava/time/format/DateTimeFormatter; AlarmBuilder (()Lcom/common/entity/Alarm$AlarmBuilder; java/util/UUID
|
|||
|
|
randomUUID ()Ljava/util/UUID; $com/common/entity/Alarm$AlarmBuilder :(Ljava/lang/String;)Lcom/common/entity/Alarm$AlarmBuilder; createdAt A(Ljava/time/LocalDateTime;)Lcom/common/entity/Alarm$AlarmBuilder; updatedAt alarmName
|
|||
|
|
engineType attackResult ;(Ljava/lang/Integer;)Lcom/common/entity/Alarm$AlarmBuilder; java/lang/Boolean (Z)Ljava/lang/Boolean; focused ;(Ljava/lang/Boolean;)Lcom/common/entity/Alarm$AlarmBuilder;
|
|||
|
|
alarmLevel baseFocused isUpdated alarmSource )(I)Lcom/common/entity/Alarm$AlarmBuilder; dispositionAdvice
|
|||
|
|
disposedState attackDirection etlTime alarmAreaId ()Lcom/common/entity/Alarm; containsKey &(Ljava/lang/Object;)Ljava/lang/Object;
|
|||
|
|
setLogStartAt setLogEndAt
|
|||
|
|
setComment
|
|||
|
|
setAlarmLevel setAttackIp ([Ljava/lang/String;)V setVictimIp setVictimWebUrl setAttackChainPhase ([Ljava/lang/Integer;)V setDeviceId setTag setOriginLogIds
|
|||
|
|
setQueryId setAttackResult setFall
|