189 lines
20 KiB
Plaintext
189 lines
20 KiB
Plaintext
|
Êþº¾ 4É
|
|||
|
|
È
|
|||
|
|
.É
|
|||
|
|
Ê .ËÌÍ
|
|||
|
|
yÎ
|
|||
|
|
yÏ ÐÑ
|
|||
|
|
.Ò
|
|||
|
|
.Ó
|
|||
|
|
Ô
|
|||
|
|
ÕÖ
|
|||
|
|
×Ø
|
|||
|
|
ÙÚ
|
|||
|
|
ÛÜ
|
|||
|
|
ÛÝ
|
|||
|
|
ÛÞß
|
|||
|
|
Ûà
|
|||
|
|
á
|
|||
|
|
Ûâ
|
|||
|
|
Ûã
|
|||
|
|
Ûäå
|
|||
|
|
Ûæ
|
|||
|
|
Ûç
|
|||
|
|
Ûèé
|
|||
|
|
Ûêë
|
|||
|
|
Èì
|
|||
|
|
í
|
|||
|
|
î
|
|||
|
|
Ûï
|
|||
|
|
Ûð .ñ òóô
|
|||
|
|
(È’ �õö÷øùikl .úû üý .þ ÿ . . . . .
|
|||
|
|
|
|||
|
|
|
|||
|
|
D .
|
|||
|
|
Ù . .
|
|||
|
|
Ð .
|
|||
|
|
_
|
|||
|
|
. › . ! "
|
|||
|
|
#$
|
|||
|
|
#%
|
|||
|
|
Õ&
|
|||
|
|
Õ'
|
|||
|
|
Õ(
|
|||
|
|
Õ)
|
|||
|
|
Õ*+
|
|||
|
|
Õ,
|
|||
|
|
Õ- ò./`012345 Ð678
|
|||
|
|
h9
|
|||
|
|
:
|
|||
|
|
;
|
|||
|
|
Õ<=>?@
|
|||
|
|
tÈ A BC BDE
|
|||
|
|
.F GHIJK
|
|||
|
|
LMN
|
|||
|
|
OP
|
|||
|
|
QR
|
|||
|
|
Qî
|
|||
|
|
ST
|
|||
|
|
SU
|
|||
|
|
SV
|
|||
|
|
SW
|
|||
|
|
SX
|
|||
|
|
SY
|
|||
|
|
Z[
|
|||
|
|
S\
|
|||
|
|
S]^
|
|||
|
|
S_
|
|||
|
|
S`
|
|||
|
|
Sa
|
|||
|
|
Sbc
|
|||
|
|
Sd
|
|||
|
|
Sef
|
|||
|
|
Sg
|
|||
|
|
Sh
|
|||
|
|
Si
|
|||
|
|
Sjk �l �m
|
|||
|
|
.n
|
|||
|
|
Oop
|
|||
|
|
Oqr
|
|||
|
|
.s
|
|||
|
|
Otuv
|
|||
|
|
.w
|
|||
|
|
.x
|
|||
|
|
Oyz
|
|||
|
|
.{
|
|||
|
|
O|}
|
|||
|
|
O~
|
|||
|
|
O€�
|
|||
|
|
.‚
|
|||
|
|
Oƒ„
|
|||
|
|
O…†
|
|||
|
|
O‡ˆ‰
|
|||
|
|
OŠ‹
|
|||
|
|
OŒ�
|
|||
|
|
OŽ�
|
|||
|
|
O�‘
|
|||
|
|
.’
|
|||
|
|
O“”
|
|||
|
|
O•–
|
|||
|
|
O—˜
|
|||
|
|
O™š
|
|||
|
|
O›œ
|
|||
|
|
O�ž
|
|||
|
|
OŸ
|
|||
|
|
O¡¢
|
|||
|
|
O£¤
|
|||
|
|
O¥¦
|
|||
|
|
O§¨
|
|||
|
|
O©ª
|
|||
|
|
O«¬
|
|||
|
|
O®
|
|||
|
|
O¯°
|
|||
|
|
O±²
|
|||
|
|
O³´
|
|||
|
|
Oµ¶
|
|||
|
|
O·¸
|
|||
|
|
O¹º
|
|||
|
|
O»¼
|
|||
|
|
O½¾
|
|||
|
|
O¿À
|
|||
|
|
OÁÂ
|
|||
|
|
OÃÄ
|
|||
|
|
OÅÆ
|
|||
|
|
OÇÈ
|
|||
|
|
OÉÊ
|
|||
|
|
OËÌ
|
|||
|
|
OÍÎ
|
|||
|
|
OÏÐ
|
|||
|
|
OÑÒ
|
|||
|
|
OÓÔ
|
|||
|
|
OÕÖ
|
|||
|
|
O×Ø
|
|||
|
|
î
|
|||
|
|
ÙÚ
|
|||
|
|
Û
|
|||
|
|
ÙÜ
|
|||
|
|
|
|||
|
|
ÝÞ
|
|||
|
|
ßಱá
|
|||
|
|
âã
|
|||
|
|
äå
|
|||
|
|
æçè¾
|
|||
|
|
éêëìí
|
|||
|
|
îïðñ log Lorg/slf4j/Logger; sqlGeneratorService (Lcom/common/service/SqlGeneratorService; RuntimeVisibleAnnotations 8Lorg/springframework/beans/factory/annotation/Autowired;
|
|||
|
|
ruleMapper .Lcom/common/mapper/AnalysisAnalysisRuleMapper; fieldMapper 'Lcom/common/mapper/AnalysisFieldMapper; whereConditionMapper 0Lcom/common/mapper/AnalysisWhereConditionMapper; groupByColumnMapper /Lcom/common/mapper/AnalysisGroupByColumnMapper; filterMapper (Lcom/common/mapper/AnalysisFilterMapper; groupByHavingMapper /Lcom/common/mapper/AnalysisGroupByHavingMapper;
|
|||
|
|
groupByMapper )Lcom/common/mapper/AnalysisGroupByMapper; groupByWindowMapper /Lcom/common/mapper/AnalysisGroupByWindowMapper; taskHistoryMapper -Lcom/common/mapper/AnalysisTaskHistoryMapper; alarmMapper Lcom/common/mapper/AlarmMapper; jdbcTemplate ,Lorg/springframework/jdbc/core/JdbcTemplate; RUN_MODE Ljava/lang/String;
|
|||
|
|
ConstantValue DATE_FORMATTER $Ljava/time/format/DateTimeFormatter; <init> ()V Code LineNumberTable LocalVariableTable this /Lcom/common/service/impl/OfflineAnalysisEngine; executeRule 9(Lcom/common/entity/AnalysisAnalysisRule;)Ljava/util/Map; groupBy #Lcom/common/entity/AnalysisGroupBy; tableName alarms Ljava/util/List; fields whereConditions filters groupByColumns havingConditions
|
|||
|
|
groupByWindow )Lcom/common/entity/AnalysisGroupByWindow; groupByList sql queryResult
|
|||
|
|
alarmCount J endTime Ljava/time/LocalDateTime; durationSeconds e Ljava/lang/Exception; rule (Lcom/common/entity/AnalysisAnalysisRule; batchNo startTime
|
|||
|
|
dataStartTime dataEndTime history 'Lcom/common/entity/AnalysisTaskHistory; result Ljava/util/Map; LocalVariableTypeTable +Ljava/util/List<Lcom/common/entity/Alarm;>; 3Ljava/util/List<Lcom/common/entity/AnalysisField;>; <Ljava/util/List<Lcom/common/entity/AnalysisWhereCondition;>; 4Ljava/util/List<Lcom/common/entity/AnalysisFilter;>; ;Ljava/util/List<Lcom/common/entity/AnalysisGroupByColumn;>; ;Ljava/util/List<Lcom/common/entity/AnalysisGroupByHaving;>; 5Ljava/util/List<Lcom/common/entity/AnalysisGroupBy;>; GLjava/util/List<Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;>; 5Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;
|
|||
|
|
StackMapTableøEàÞòNóô4ë Signature _(Lcom/common/entity/AnalysisAnalysisRule;)Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>; executeRules "(Ljava/util/List;)Ljava/util/List; errorResult rules results :Ljava/util/List<Lcom/common/entity/AnalysisAnalysisRule;>;õ ƒ(Ljava/util/List<Lcom/common/entity/AnalysisAnalysisRule;>;)Ljava/util/List<Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;>; stopRule (Ljava/lang/String;)V ruleId
|
|||
|
|
getRunMode ()Ljava/lang/String; generateBatchNo parseDataStartTime C(Lcom/common/entity/AnalysisAnalysisRule;)Ljava/time/LocalDateTime; parseDataEndTime convertToAlarms J(Lcom/common/entity/AnalysisAnalysisRule;Ljava/util/List;)Ljava/util/List; alarm Lcom/common/entity/Alarm; rowö œ(Lcom/common/entity/AnalysisAnalysisRule;Ljava/util/List<Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;>;)Ljava/util/List<Lcom/common/entity/Alarm;>;
|
|||
|
|
getBytesValue (Ljava/lang/Object;)[B value Ljava/lang/Object; getStringValue &(Ljava/lang/Object;)Ljava/lang/String; getLongValue $(Ljava/lang/Object;)Ljava/lang/Long; getIntegerValue '(Ljava/lang/Object;)Ljava/lang/Integer; getTimestampValue -(Ljava/lang/Object;)Ljava/time/LocalDateTime; getStringArray '(Ljava/lang/Object;)[Ljava/lang/String; i I arr [Ljava/lang/Object; [Ljava/lang/String; strÍ getIntegerArray ((Ljava/lang/Object;)[Ljava/lang/Integer; !Ljava/lang/NumberFormatException; strArray [Ljava/lang/Integer;¹è getByteArrayArray (Ljava/lang/Object;)[[B [[B convertAlarmLevel '(Ljava/lang/Integer;)Ljava/lang/String;
|
|||
|
|
eventLevel Ljava/lang/Integer; <clinit>
|
|||
|
|
SourceFile OfflineAnalysisEngine.java (Lorg/springframework/stereotype/Service; offlineAnalysisEngine HI •” ÷ø '( <开始执行离线规则: ruleId={}, ruleName={}, batchNo={} java/lang/Object ù” ú”û üý –— ˜— þÿò
|
|||
|
|
’
|
|||
|
|
j RUNNING 0
|
|||
|
|
0
|
|||
|
|
000000
|
|||
|
|
java/lang/StringBuilder 离线分æž�任务 - ”
|
|||
|
|
=> java/util/HashMap !" ruleName runMode -com/common/service/impl/OfflineAnalysisEngine offline -. running# $% /0& '( 12) 56* 34+ 78, 9:-ó ./ 01 !com/common/entity/AnalysisGroupBy 23 ;< 456 78 )* FG 9:; <= 生æˆ�çš„SQL: {} ü> AB? @( ™š ?@A BC D5E FG H IJ KL MN OL PL COMPLETED Q‘ RJ S processedCount status success waiting ?规则执行æˆ�功: ruleId={}, processedCount={}, alarmCount={} java/lang/Exception 规则执行失败: ruleId={} TU FAILED 执行失败: V” W5 XY Z‘ stopped failed errorMsg java/util/ArrayList [\õ ]/ ^_ &com/common/entity/AnalysisAnalysisRule OP `a 执行规则失败: ruleId={} å·²å�œæ¢è§„则: ruleId={} å�œæ¢è§„则失败: ruleId={} yyyyMMddHHmmssSSSb cd
|
|||
|
|
java/util/Mapö fg hij k lm nm ok pk qrs t uv �r 未知 wk xv yv z{ ç ”åˆ¤å�Žå¤„ç½® |k }r other ~k m €r � log_start_at ‚a 0ƒ ª« „J
|
|||
|
|
log_end_at …J
|
|||
|
|
alarm_name ¤¥ †‘
|
|||
|
|
alarm_type alarm_level ¨© ¿À ‡‘ attack_ip ¬ ˆ‰ victim_ip Š‰ victim_web_url ‹‰ attack_chain_phase µ¶ Œ� device_id Ž� tag �‰ comment origin_log_ids �‰ query_id ‘‘
|
|||
|
|
attack_result ’N fall “N payload ¡ ”•
|
|||
|
|
operate_event –� attack_port —� victim_port ˜�
|
|||
|
|
attack_method ™‘ business_ext š‘ http_status ›‘ dns_info œ‘ account_info �‘
|
|||
|
|
attacker_info ž‘ victim_info Ÿ‘ suspicious_action ‘ vuln_info ¡‘ weak_pwd ¢‘ compliance_baseline £‘ file_info ¤‘ file_tags ¥‘
|
|||
|
|
endpoint_info ¦‘ origin_info §‘
|
|||
|
|
protocol_info ¨‘
|
|||
|
|
email_info ©‘ sensitive_data ª‘ hit_intelligence «N window_time ¬‘
|
|||
|
|
attack_ip_pic ‘
|
|||
|
|
victim_ip_pic ®‘ operation_at ¯J attack_direction °‘ etl_time ±J log_count ²N is_asset_hit ³N http_req_header ´‰
|
|||
|
|
http_req_body µ‰ http_resp_header ¶‰ http_resp_body ·‰ [B ¸¹ java/lang/Number º »¼ ½¾ java/time/LocalDateTime ¿À java/lang/String { Á } à, ÄÅ java/lang/Integer java/lang/NumberFormatException 安全(æ— å¨�èƒ�) 低å�± ä¸å�± 高å�± 超å�±Æ ÇÈ yyyy-MM-dd HH:mm:ss !com/common/service/AnalysisEngine %com/common/entity/AnalysisTaskHistory java/util/List 'com/common/entity/AnalysisGroupByWindow java/util/Iterator com/common/entity/Alarm now ()Ljava/time/LocalDateTime; getRuleId getRuleName org/slf4j/Logger info ((Ljava/lang/String;[Ljava/lang/Object;)V
|
|||
|
|
minusHours (J)Ljava/time/LocalDateTime; builder AnalysisTaskHistoryBuilder InnerClasses D()Lcom/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder; java/lang/System currentTimeMillis ()J java/lang/Long valueOf (J)Ljava/lang/Long; @com/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder id T(Ljava/lang/Long;)Lcom/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder; V(Ljava/lang/String;)Lcom/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder; ](Ljava/time/LocalDateTime;)Lcom/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder; (I)Ljava/lang/Integer; progressPercent W(Ljava/lang/Integer;)Lcom/common/entity/AnalysisTaskHistory$AnalysisTaskHistoryBuilder;
|
|||
|
|
inputCount outputCount delFlag
|
|||
|
|
createTime
|
|||
|
|
updateTime tenantId append -(Ljava/lang/String;)Ljava/lang/StringBuilder; toString remark build )()Lcom/common/entity/AnalysisTaskHistory; +com/common/mapper/AnalysisTaskHistoryMapper insert *(Lcom/common/entity/AnalysisTaskHistory;)I put 8(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; ,com/common/mapper/AnalysisAnalysisRuleMapper updateTaskStatus 7(Ljava/lang/String;Ljava/lang/String;Ljava/lang/Long;)I %com/common/mapper/AnalysisFieldMapper selectByRuleId $(Ljava/lang/String;)Ljava/util/List; .com/common/mapper/AnalysisWhereConditionMapper &com/common/mapper/AnalysisFilterMapper -com/common/mapper/AnalysisGroupByColumnMapper -com/common/mapper/AnalysisGroupByHavingMapper 'com/common/mapper/AnalysisGroupByMapper isEmpty ()Z get (I)Ljava/lang/Object; getId ()Ljava/lang/Long; intValue ()I -com/common/mapper/AnalysisGroupByWindowMapper selectByGroupById >(Ljava/lang/Integer;)Lcom/common/entity/AnalysisGroupByWindow; format 8(Ljava/time/format/DateTimeFormatter;)Ljava/lang/String; &com/common/service/SqlGeneratorService generateSql Ù(Lcom/common/entity/AnalysisAnalysisRule;Ljava/util/List;Ljava/util/List;Ljava/util/List;Ljava/util/List;Ljava/util/List;Lcom/common/entity/AnalysisGroupByWindow;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; '(Ljava/lang/String;Ljava/lang/Object;)V *org/springframework/jdbc/core/JdbcTemplate queryForList com/common/mapper/AlarmMapper batchInsert (Ljava/util/List;)V size java/time/Duration between P(Ljava/time/temporal/Temporal;Ljava/time/temporal/Temporal;)Ljava/time/Duration;
|
|||
|
|
getSeconds
|
|||
|
|
setEndTime (Ljava/time/LocalDateTime;)V setDurationTime (Ljava/lang/Long;)V setProgressPercent (Ljava/lang/Integer;)V
|
|||
|
|
setInputCount setOutputCount setStatus
|
|||
|
|
setUpdateTime update error 9(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V
|
|||
|
|
getMessage length substring (II)Ljava/lang/String; setRemark iterator ()Ljava/util/Iterator; hasNext next ()Ljava/lang/Object; add (Ljava/lang/Object;)Z "java/time/format/DateTimeFormatter ofPattern 8(Ljava/lang/String;)Ljava/time/format/DateTimeFormatter; AlarmBuilder (()Lcom/common/entity/Alarm$AlarmBuilder; java/util/UUID
|
|||
|
|
randomUUID ()Ljava/util/UUID; $com/common/entity/Alarm$AlarmBuilder :(Ljava/lang/String;)Lcom/common/entity/Alarm$AlarmBuilder; createdAt A(Ljava/time/LocalDateTime;)Lcom/common/entity/Alarm$AlarmBuilder; updatedAt alarmName
|
|||
|
|
engineType attackResult ;(Ljava/lang/Integer;)Lcom/common/entity/Alarm$AlarmBuilder; java/lang/Boolean (Z)Ljava/lang/Boolean; focused ;(Ljava/lang/Boolean;)Lcom/common/entity/Alarm$AlarmBuilder;
|
|||
|
|
alarmLevel baseFocused isUpdated alarmSource )(I)Lcom/common/entity/Alarm$AlarmBuilder; dispositionAdvice
|
|||
|
|
disposedState attackDirection etlTime alarmAreaId ()Lcom/common/entity/Alarm; containsKey &(Ljava/lang/Object;)Ljava/lang/Object;
|
|||
|
|
setLogStartAt setLogEndAt
|
|||
|
|
setComment
|