nanChen/ai-security-xdr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1、适配部署环境变量自动注入

Browse Source 
2、适配南网达梦数据库安全版SQL语句Group by 不支持自定义函数
3、达梦数据库驱动改为达梦提供的指定版本
4、修改syslog-consumer模块yaml 文件kafka 变量名称
5、修改访问日志告警表新增4个字段，完善异常行为详情页面显示字段
This commit is contained in:
nanChen
2026-07-22 18:50:44 +08:00
parent 5fe0e124bb
commit 16b73dffee
89 changed files with 4507 additions and 2186 deletions
Download Patch File Download Diff File Expand all files Collapse all files
haobang-security-dm/syslog-serve/src/main/java/com/Modules/Device/DeviceProcess.java
+9 -5
View File
@@ -2,7 +2,7 @@ package com.Modules.Device;
import com.common.entity.DeviceDevice;
import com.haobang.config.AppConfig;
import com.haobang.config.AppProperties;
import com.kafka.kafkaProducer;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -85,7 +85,8 @@ public class DeviceProcess {
//当前判断是否归属
if(deviceDevice!=null )
{
int deviceCollectId =AppConfig.getDeviceCollectId();
AppProperties props = SpringContextUtil.getBean(AppProperties.class);
int deviceCollectId = props.getAppServiceDeviceCollectId();
if(deviceDevice.getDeviceCollectId()!=deviceCollectId)
{
logger.error("设备请求的Host IP不属于当前采集探针任务,请联系管理员核实！");
@@ -110,8 +111,10 @@ public class DeviceProcess {
}
else {
//创建未知设备记录
DeviceCollectTask deviceCollectTask= deviceCollectTaskService.getById(AppConfig.getDeviceCollectId());
deviceUnknown.setDeviceCollectId( AppConfig.getDeviceCollectId());
AppProperties props = SpringContextUtil.getBean(AppProperties.class);
int deviceCollectId = props.getAppServiceDeviceCollectId();
DeviceCollectTask deviceCollectTask= deviceCollectTaskService.getById(deviceCollectId);
deviceUnknown.setDeviceCollectId(deviceCollectId);
deviceUnknown.setDeviceIp( this.sourceIP);
deviceUnknown.setFirstTime(currentTime);
if(deviceCollectTask!=null) deviceUnknown.setDeviceCollectName(deviceCollectTask.getTaskName());
@@ -141,9 +144,10 @@ public class DeviceProcess {
try {
// 创建设备接收日志对象
AppProperties props = SpringContextUtil.getBean(AppProperties.class);
devicelog= DeviceReceiveLog.builder()
.deviceId(deviceDevice.getId())
.deviceCollectId(AppConfig.getDeviceCollectId())
.deviceCollectId(props.getAppServiceDeviceCollectId())
.deviceIp(deviceDevice.getIp())
.receiveTime(now)
.receiveTimeStr(timeString)
haobang-security-dm/syslog-serve/src/main/java/com/SyslogServeMainApp.java
+10 -6
View File
@@ -1,4 +1,6 @@
package com;
import com.haobang.config.AppProperties;
import com.haobang.config.SyslogConfig;
import com.kafka.kafkaProducer;
import org.mybatis.spring.annotation.MapperScan;
@@ -7,8 +9,9 @@ import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.ConfigurableApplicationContext;
import org.springframework.core.env.Environment;
import com.netty.SyslogServer;
import com.haobang.config.AppConfig;
import org.springframework.cache.annotation.EnableCaching;
import org.springframework.context.annotation.Configuration;
import org.springframework.scheduling.annotation.EnableScheduling;
@@ -23,12 +26,13 @@ public class SyslogServeMainApp {
private static final Logger logger = LoggerFactory.getLogger(SyslogServeMainApp.class);
public static void main(String[] args) {
SpringApplication.run(SyslogServeMainApp.class, args);
ConfigurableApplicationContext context = SpringApplication.run(SyslogServeMainApp.class, args);
Environment env = context.getEnvironment();
try {
//System.out.println("syslogConfig TcpPort: "+ AppConfig.getSyslogTcpPort());
int tcpPort = args.length > 0 ? Integer.parseInt(args[0]) : AppConfig.getSyslogTcpPort() ;
int udpPort = args.length > 1 ? Integer.parseInt(args[1]) : AppConfig.getSyslogUdpPort();
//SyslogServer server = new SyslogServer(tcpPort, udpPort);
int tcpPort = args.length > 0 ? Integer.parseInt(args[0])
: Integer.parseInt(env.getProperty("syslog.tcp.port", "514"));
int udpPort = args.length > 1 ? Integer.parseInt(args[1])
: Integer.parseInt(env.getProperty("syslog.udp.port", "515"));
SyslogServerBoth server = new SyslogServerBoth(tcpPort, udpPort);
logger.info("Application SyslogServer start !");
server.start();
haobang-security-dm/syslog-serve/src/main/java/com/common/entity/DeviceCollectTask.java
+20
View File
@@ -21,6 +21,10 @@ public class DeviceCollectTask {
private Integer taskCount;
private OffsetDateTime recentDiscoverTime;
private Integer epmUpperLimit;
private OffsetDateTime expireTime;
private String remark;
private String deviceIp;
private Long organizationId;
// Getter and Setter 方法
public Integer getId() { return id; }
@@ -74,6 +78,18 @@ public class DeviceCollectTask {
public Integer getEpmUpperLimit() { return epmUpperLimit; }
public void setEpmUpperLimit(Integer epmUpperLimit) { this.epmUpperLimit = epmUpperLimit; }
public OffsetDateTime getExpireTime() { return expireTime; }
public void setExpireTime(OffsetDateTime expireTime) { this.expireTime = expireTime; }
public String getRemark() { return remark; }
public void setRemark(String remark) { this.remark = remark; }
public String getDeviceIp() { return deviceIp; }
public void setDeviceIp(String deviceIp) { this.deviceIp = deviceIp; }
public Long getOrganizationId() { return organizationId; }
public void setOrganizationId(Long organizationId) { this.organizationId = organizationId; }
@Override
public String toString() {
return "DeviceCollectTask{" +
@@ -94,6 +110,10 @@ public class DeviceCollectTask {
", taskCount=" + taskCount +
", recentDiscoverTime=" + recentDiscoverTime +
", epmUpperLimit=" + epmUpperLimit +
", expireTime=" + expireTime +
", remark='" + remark + '\'' +
", deviceIp='" + deviceIp + '\'' +
", organizationId=" + organizationId +
'}';
}
}
haobang-security-dm/syslog-serve/src/main/java/com/common/mapper/DeviceCollectTaskMapper.java
+9 -3
View File
@@ -60,10 +60,12 @@ public interface DeviceCollectTaskMapper {
*/
@Insert("INSERT INTO device_collect_task (created_at, updated_at, device_id, method, task_name, " +
"first_time, last_success_time, last_failed_time, detail_id, epm, epm_peak, " +
"process_architecture, task_count, recent_discover_time, epm_upper_limit) " +
"process_architecture, task_count, recent_discover_time, epm_upper_limit, " +
"expire_time, remark, device_ip, organization_id) " +
"VALUES (NOW(), NOW(), #{deviceId}, #{method}, #{taskName}, #{firstTime}, " +
"#{lastSuccessTime}, #{lastFailedTime}, #{detailId}, #{epm}, #{epmPeak}, " +
"#{processArchitecture}, #{taskCount}, #{recentDiscoverTime}, #{epmUpperLimit})")
"#{processArchitecture}, #{taskCount}, #{recentDiscoverTime}, #{epmUpperLimit}, " +
"#{expireTime}, #{remark}, #{deviceIp}, #{organizationId})")
@Options(useGeneratedKeys = true, keyProperty = "id")
int insert(DeviceCollectTask task);
@@ -84,7 +86,11 @@ public interface DeviceCollectTaskMapper {
"process_architecture = #{processArchitecture}, " +
"task_count = #{taskCount}, " +
"recent_discover_time = #{recentDiscoverTime}, " +
"epm_upper_limit = #{epmUpperLimit} " +
"epm_upper_limit = #{epmUpperLimit}, " +
"expire_time = #{expireTime}, " +
"remark = #{remark}, " +
"device_ip = #{deviceIp}, " +
"organization_id = #{organizationId} " +
"WHERE id = #{id}")
int update(DeviceCollectTask task);
haobang-security-dm/syslog-serve/src/main/java/com/haobang/config/AppProperties.java
+60
View File
@@ -0,0 +1,60 @@
package com.haobang.config;
import lombok.Data;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
/**
* 应用配置属性 - 替代静态 AppConfig（syslog-serve 模块）
* 使用 Spring Boot 标准 @Value 机制，支持 docker-compose 环境变量覆盖
*/
@Data
@Component
public class AppProperties {
// ========== Syslog 配置 ==========
@Value("${syslog.tcp.port:514}")
private int syslogTcpPort;
@Value("${syslog.udp.port:515}")
private int syslogUdpPort;
@Value("${syslog.max.frame.length:65536}")
private int syslogMaxFrameLength;
@Value("${syslog.buffer.size:1024}")
private int syslogBufferSize;
@Value("${syslog.charset:GBK}")
private String syslogCharset;
// ========== App Service 配置（探针设备信息）==========
@Value("${app.service.device_id:}")
private String appServiceDeviceId;
@Value("${app.service.device_name:}")
private String appServiceDeviceName;
@Value("${app.service.vendor:}")
private String appServiceVendor;
@Value("${app.service.product_name:}")
private String appServiceProductName;
@Value("${app.service.data_type:json}")
private String appServiceDataType;
@Value("${app.service.device_collect_id:1}")
private int appServiceDeviceCollectId;
// ========== Kafka Producer 配置 ==========
@Value("${spring.kafka.producer.bootstrap-servers:localhost:9092}")
private String kafkaProducerBootstrap;
@Value("${spring.kafka.producer.topic:agent-syslog-topic}")
private String kafkaProducerTopic;
// ========== SM4 加密配置 ==========
@Value("${syslog.sm4.generateKey:}")
private String sm4Key;
}
haobang-security-dm/syslog-serve/src/main/java/com/haobang/util/DeviceInfoUtil.java
+18 -10
View File
@@ -3,7 +3,8 @@ package com.haobang.util;
import com.common.entity.DeviceDevice;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.haobang.config.AppConfig;
import com.haobang.config.AppProperties;
import com.haobang.util.SpringContextUtil;
import java.util.LinkedHashMap;
import java.util.Map;
@@ -11,6 +12,10 @@ import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
public class DeviceInfoUtil {
private static AppProperties getProps() {
return SpringContextUtil.getBean(AppProperties.class);
}
/**
* 补充设备配置信息 key value值
* @param strSyslog
@@ -18,6 +23,7 @@ public class DeviceInfoUtil {
*/
public static String getFullLogString(String strSyslog)
{
AppProperties appProps = getProps();
ObjectMapper objectMapper = new ObjectMapper();
// 创建设备配置信息MAP
// 获取当前时间（精度到毫秒）
@@ -29,11 +35,11 @@ public class DeviceInfoUtil {
Map<String, String> map = new LinkedHashMap<>();
map.put("receive_time",timeString);
map.put("device_id", AppConfig.getAppServieDeviceId());
map.put("device_name", AppConfig.getAppServieDeviceName());
map.put("vendor", AppConfig.getAppServieVendor());
map.put("data_type", AppConfig.getAppServieDataType());
map.put("device_collect_id", Long.toString(AppConfig.getDeviceCollectId()));
map.put("device_id", appProps.getAppServiceDeviceId());
map.put("device_name", appProps.getAppServiceDeviceName());
map.put("vendor", appProps.getAppServiceVendor());
map.put("data_type", appProps.getAppServiceDataType());
map.put("device_collect_id", Long.toString(appProps.getAppServiceDeviceCollectId()));
String formattedString = formatDeviceInfo(map);
//return formattedString + "" + strSyslog.substring(34);
@@ -48,6 +54,7 @@ public class DeviceInfoUtil {
*/
public static String getFullLogString(DeviceDevice deviceDevice,String strSyslog)
{
AppProperties appProps = getProps();
ObjectMapper objectMapper = new ObjectMapper();
// 创建设备配置信息MAP
// 获取当前时间（精度到毫秒）
@@ -61,8 +68,8 @@ public class DeviceInfoUtil {
map.put("device_id",deviceDevice.getId().toString());
map.put("device_name", deviceDevice.getName());
map.put("vendor", deviceDevice.getVendor());
map.put("data_type", AppConfig.getAppServieDataType());
map.put("device_collect_id", Long.toString(AppConfig.getDeviceCollectId()));
map.put("data_type", appProps.getAppServiceDataType());
map.put("device_collect_id", Long.toString(appProps.getAppServiceDeviceCollectId()));
String formattedString = formatDeviceInfo(map);
//return formattedString + "" + strSyslog.substring(34);
//测试环境截取34位之后字符串
@@ -71,6 +78,7 @@ public class DeviceInfoUtil {
public static String getFullLogString(DeviceDevice deviceDevice,String strSyslog,String receive_time)
{
AppProperties appProps = getProps();
ObjectMapper objectMapper = new ObjectMapper();
// 创建设备配置信息MAP
// 获取当前时间（精度到毫秒）
@@ -84,8 +92,8 @@ public class DeviceInfoUtil {
map.put("device_id",deviceDevice.getId().toString());
map.put("device_name", deviceDevice.getName());
map.put("vendor", deviceDevice.getVendor());
map.put("data_type", AppConfig.getAppServieDataType());
map.put("device_collect_id", Long.toString(AppConfig.getDeviceCollectId()));
map.put("data_type", appProps.getAppServiceDataType());
map.put("device_collect_id", Long.toString(appProps.getAppServiceDeviceCollectId()));
String formattedString = formatDeviceInfo(map);
//return formattedString + "" + strSyslog.substring(34);
//测试环境截取34位之后字符串
haobang-security-dm/syslog-serve/src/main/java/com/kafka/kafkaProducer.java
+19 -17
View File
@@ -1,5 +1,6 @@
package com.kafka;
import com.common.entity.DeviceDevice;
import com.haobang.config.AppProperties;
import com.haobang.util.Sm4Util;
import org.apache.kafka.clients.producer.*;
import org.apache.kafka.common.serialization.StringSerializer;
@@ -13,21 +14,20 @@ import java.util.Map;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.haobang.util.DeviceInfoUtil;
import com.haobang.util.SpringContextUtil;
public class kafkaProducer {
private static final Logger logger = LoggerFactory.getLogger(kafkaProducer.class);
private static String strhexKey=AppConfig.getSM4Key();
private static AppProperties getProps() {
return SpringContextUtil.getBean(AppProperties.class);
}
public static void main(String[] args) {
// System.out.println(getFullLogString("syslogmessage"));
AppProperties appProps = getProps();
// 配置生产者属性
Properties props = new Properties();
//props.put(ProducerConfig.BOOTSTRAP_SERVERS_CONFIG, "192.168.222.130:9092");
props.put(ProducerConfig.BOOTSTRAP_SERVERS_CONFIG, AppConfig.getKafkaProducerBootstrap());
props.put(ProducerConfig.BOOTSTRAP_SERVERS_CONFIG, appProps.getKafkaProducerBootstrap());
props.put(ProducerConfig.KEY_SERIALIZER_CLASS_CONFIG, StringSerializer.class.getName());
props.put(ProducerConfig.VALUE_SERIALIZER_CLASS_CONFIG, StringSerializer.class.getName());
@@ -47,7 +47,7 @@ public class kafkaProducer {
// 创建生产者记录
ProducerRecord<String, String> record =
new ProducerRecord<>(AppConfig.getKafkaProducerTopic(), key, value);
new ProducerRecord<>(appProps.getKafkaProducerTopic(), key, value);
// 发送消息（异步方式）
producer.send(record, new Callback() {
@@ -82,9 +82,10 @@ public class kafkaProducer {
public static void messagePush(DeviceDevice deviceDevice, String strSyslog,String strReceiveTime)
{
AppProperties appProps = getProps();
// 配置生产者属性
Properties props = new Properties();
props.put(ProducerConfig.BOOTSTRAP_SERVERS_CONFIG, AppConfig.getKafkaProducerBootstrap());
props.put(ProducerConfig.BOOTSTRAP_SERVERS_CONFIG, appProps.getKafkaProducerBootstrap());
props.put(ProducerConfig.KEY_SERIALIZER_CLASS_CONFIG, StringSerializer.class.getName());
props.put(ProducerConfig.VALUE_SERIALIZER_CLASS_CONFIG, StringSerializer.class.getName());
@@ -103,12 +104,12 @@ public class kafkaProducer {
String value = DeviceInfoUtil.getFullLogString(deviceDevice,strSyslog,strReceiveTime);
//Message进行SM4加密写入kafka
String Sm4message= Sm4Util.encryptCbc(value, strhexKey);
System.out.println("Sm4message:"+Sm4message);
String Sm4message= Sm4Util.encryptCbc(value, appProps.getSm4Key());
//System.out.println("Sm4message:"+Sm4message);
// 创建生产者记录
ProducerRecord<String, String> record =
new ProducerRecord<>(AppConfig.getKafkaProducerTopic(), key, Sm4message);
new ProducerRecord<>(appProps.getKafkaProducerTopic(), key, Sm4message);
// 发送消息（异步方式）
producer.send(record, new Callback() {
@@ -148,10 +149,11 @@ public class kafkaProducer {
ObjectMapper objectMapper = new ObjectMapper();
// 创建设备配置信息MAP
Map<String, Object> map = new LinkedHashMap<>();
map.put("device_id",AppConfig.getAppServieDeviceId() );
map.put("device_name", AppConfig.getAppServieDeviceName());
map.put("vendor", AppConfig.getAppServieVendor());
map.put("data_type", AppConfig.getAppServieDataType());
AppProperties appProps = getProps();
map.put("device_id", appProps.getAppServiceDeviceId());
map.put("device_name", appProps.getAppServiceDeviceName());
map.put("vendor", appProps.getAppServiceVendor());
map.put("data_type", appProps.getAppServiceDataType());
// 添加syslogMessage
map.put("syslogMessage", strSyslog);
try {