1、适配部署环境变量自动注入

2、适配南网达梦数据库安全版SQL语句Group by 不支持自定义函数
3、达梦数据库驱动改为达梦提供的指定版本
4、修改syslog-consumer模块yaml 文件kafka 变量名称
5、修改访问日志告警表新增4个字段，完善异常行为详情页面显示字段

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AlarmVisit.java

@@ -75,4 +75,8 @@ public class AlarmVisit {
     private String[] httpReqBody;
     private String[] httpRespHeader;
     private String[] httpRespBody;
+    private String reason;
+    private String dtype;
+    private String originField;
+    private String originLog;
 }

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceCollectTask.java

@@ -20,6 +20,10 @@ public class DeviceCollectTask {
     private Integer taskCount;
     private OffsetDateTime recentDiscoverTime;
     private Integer epmUpperLimit;
+    private OffsetDateTime expireTime;
+    private String remark;
+    private String deviceIp;
+    private Long organizationId;
 
     // Getter and Setter 方法
     public Integer getId() { return id; }
@@ -73,6 +77,18 @@ public class DeviceCollectTask {
     public Integer getEpmUpperLimit() { return epmUpperLimit; }
     public void setEpmUpperLimit(Integer epmUpperLimit) { this.epmUpperLimit = epmUpperLimit; }
 
+    public OffsetDateTime getExpireTime() { return expireTime; }
+    public void setExpireTime(OffsetDateTime expireTime) { this.expireTime = expireTime; }
+
+    public String getRemark() { return remark; }
+    public void setRemark(String remark) { this.remark = remark; }
+
+    public String getDeviceIp() { return deviceIp; }
+    public void setDeviceIp(String deviceIp) { this.deviceIp = deviceIp; }
+
+    public Long getOrganizationId() { return organizationId; }
+    public void setOrganizationId(Long organizationId) { this.organizationId = organizationId; }
+
     @Override
     public String toString() {
         return "DeviceCollectTask{" +
@@ -93,6 +109,10 @@ public class DeviceCollectTask {
                 ", taskCount=" + taskCount +
                 ", recentDiscoverTime=" + recentDiscoverTime +
                 ", epmUpperLimit=" + epmUpperLimit +
+                ", expireTime=" + expireTime +
+                ", remark='" + remark + '\'' +
+                ", deviceIp='" + deviceIp + '\'' +
+                ", organizationId=" + organizationId +
                 '}';
     }
 }

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/AlarmVisitMapper.java

@@ -23,7 +23,8 @@ public interface AlarmVisitMapper {
             "attack_port, victim_port, attack_method, etl_time, log_count, ",
             "attack_chain_phase, disposition_advice, attack_direction, ",
             "judged_state, disposed_state, attack_result, fall, payload, dns_info, engine_type,  " ,
-            "http_req_header  , http_req_body,http_resp_header , http_resp_body ",
+            "http_req_header  , http_req_body,http_resp_header , http_resp_body, ",
+            "reason, dtype, origin_field, origin_log ",
             ") VALUES ",
             "<foreach collection='list' item='item' separator=','>",
             "(#{item.id}, #{item.createdAt}, #{item.alarmName}, #{item.alarmLevel}, ",
@@ -34,7 +35,7 @@ public interface AlarmVisitMapper {
             "#{item.deviceId, typeHandler=com.Modules.etl.handler.ArrayIntegerTypeHandler}, ",
             "#{item.comment}, " ,
             "#{item.originLogIds, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, ",
-            "#{item.logStartAt}, #{item.logEndAt},, #{item.windowTime} #{item.httpStatus}, ",
+            "#{item.logStartAt}, #{item.logEndAt}, #{item.windowTime}, #{item.httpStatus}, ",
             "#{item.attackPort, typeHandler=com.Modules.etl.handler.ArrayIntegerTypeHandler}, ",
             "#{item.victimPort, typeHandler=com.Modules.etl.handler.ArrayIntegerTypeHandler}, ",
             "#{item.attackMethod}, #{item.etlTime}, #{item.logCount}, ",
@@ -45,7 +46,8 @@ public interface AlarmVisitMapper {
             "#{item.httpReqHeader, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, ",
             "#{item.httpReqBody, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, ",
             "#{item.httpRespHeader, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, ",
-            "#{item.httpRespBody, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}) ",
+            "#{item.httpRespBody, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, ",
+            "#{item.reason}, #{item.dtype}, #{item.originField}, #{item.originLog}) ",
             "</foreach>",
             "</script>"})
     void batchInsert(@Param("list") List<AlarmVisit> alarmList);
@@ -60,7 +62,8 @@ public interface AlarmVisitMapper {
             "attack_port, victim_port, attack_method, etl_time, log_count, " +
             "attack_chain_phase, disposition_advice, attack_direction, " +
             "judged_state, disposed_state, attack_result, fall, payload, dns_info,engine_type, " +
-            "http_req_header  , http_req_body,http_resp_header , http_resp_body " +
+            "http_req_header  , http_req_body,http_resp_header , http_resp_body, " +
+            "reason, dtype, origin_field, origin_log " +
             ") VALUES (" +
             "#{id}, #{createdAt}, #{alarmName}, #{alarmLevel}, " +
             "#{alarmType}, #{alarmMajorType}, #{alarmMinorType}, #{alarmAreaId}, " +
@@ -80,7 +83,8 @@ public interface AlarmVisitMapper {
             "#{httpReqHeader, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, " +
             "#{httpReqBody, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, " +
             "#{httpRespHeader, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, " +
-            "#{httpRespBody, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}   " +
+            "#{httpRespBody, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, " +
+            "#{reason}, #{dtype}, #{originField}, #{originLog} " +
             ")")
     void insert(AlarmVisit alarm);
 }

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/DeviceCollectTaskMapper.java

@@ -66,10 +66,12 @@ public interface DeviceCollectTaskMapper extends BaseMapper<DeviceCollectTask>{
      */
     @Insert("INSERT INTO device_collect_task (created_at, updated_at, device_id, method, task_name, " +
             "first_time, last_success_time, last_failed_time, detail_id, epm, epm_peak, " +
-            "process_architecture, task_count, recent_discover_time, epm_upper_limit) " +
+            "process_architecture, task_count, recent_discover_time, epm_upper_limit, " +
+            "expire_time, remark, device_ip, organization_id) " +
             "VALUES (NOW(), NOW(), #{deviceId}, #{method}, #{taskName}, #{firstTime}, " +
             "#{lastSuccessTime}, #{lastFailedTime}, #{detailId}, #{epm}, #{epmPeak}, " +
-            "#{processArchitecture}, #{taskCount}, #{recentDiscoverTime}, #{epmUpperLimit})")
+            "#{processArchitecture}, #{taskCount}, #{recentDiscoverTime}, #{epmUpperLimit}, " +
+            "#{expireTime}, #{remark}, #{deviceIp}, #{organizationId})")
     @Options(useGeneratedKeys = true, keyProperty = "id")
     int insert(DeviceCollectTask task);
 
@@ -90,7 +92,11 @@ public interface DeviceCollectTaskMapper extends BaseMapper<DeviceCollectTask>{
             "process_architecture = #{processArchitecture}, " +
             "task_count = #{taskCount}, " +
             "recent_discover_time = #{recentDiscoverTime}, " +
-            "epm_upper_limit = #{epmUpperLimit} " +
+            "epm_upper_limit = #{epmUpperLimit}, " +
+            "expire_time = #{expireTime}, " +
+            "remark = #{remark}, " +
+            "device_ip = #{deviceIp}, " +
+            "organization_id = #{organizationId} " +
             "WHERE id = #{id}")
     int update(DeviceCollectTask task);
 

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/service/DataTransformer.java

@@ -194,6 +194,10 @@ public class DataTransformer {
                     .httpReqBody(groupedData.getHttpReqBodys())
                     .httpRespHeader(groupedData.getHttpRespHeaders())
                     .httpRespBody(groupedData.getHttpRespBodys())
+                    .reason(null)
+                    .dtype(null)
+                    .originField(null)
+                    .originLog(null)
                     .build();
 
         } catch (Exception e) {

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/service/InfluxSyslogService.java

@@ -20,11 +20,8 @@ import java.util.Map;
 @Service
 public class InfluxSyslogService {
 
-    //@Autowired
-    //private InfluxDBClient influxDBClient;
-    // 初始化 InfluxDB 客户端
-    //@Autowired
-    private final com.influx.InfluxDBClient influxDBClient  = new InfluxDBClient();
+    @Autowired
+    private com.influx.InfluxDBClient influxDBClient;
 
     private static final DateTimeFormatter TABLE_DATE_FORMATTER = DateTimeFormatter.ofPattern("yyyyMMdd");
     private static final DateTimeFormatter INPUT_DATE_FORMATTER = DateTimeFormatter.ISO_DATE_TIME;