1、新增功能探针联动处置、心跳在线检测

2、syslog-consumer模块拆分 syslog-consumer-rule模块实现日志数据消费、解析、泛化入库。

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/Alarm.java

@@ -0,0 +1,78 @@
+package com.common.entity;
+
+
+import lombok.Builder;
+import lombok.Data;
+import java.time.LocalDateTime;
+
+@Data
+@Builder
+public class Alarm {
+    private String id;
+    private LocalDateTime createdAt;
+    private String alarmName;
+    private String alarmLevel;
+    private String alarmType;
+    private String alarmMajorType;
+    private String alarmMinorType;
+    private Integer alarmAreaId;
+    private String[] attackIp;
+    private String[] victimIp;
+    private String[] victimWebUrl;
+    private Integer[] attackChainPhase;
+    private Integer[] deviceId;
+    private String[] tag;
+    private String comment;
+    private String[] originLogIds;
+    private String queryId;
+    private Integer judgedState;
+    private Integer disposedState;
+    private String dispositionAdvice;
+    private Integer attackResult;
+    private Integer fall;
+    private byte[] payload;
+    private Integer[] operateEvent;
+    private Integer[] attackPort;
+    private Integer[] victimPort;
+    private String attackMethod;
+    private String businessExt;
+    private LocalDateTime logStartAt;
+    private LocalDateTime logEndAt;
+    private String httpStatus;
+    private String dnsInfo;
+    private String accountInfo;
+    private String attackerInfo;
+    private String victimInfo;
+    private String suspiciousAction;
+    private String vulnInfo;
+    private String weakPwd;
+    private String complianceBaseline;
+    private String fileInfo;
+    private String fileTags;
+    private String endpointInfo;
+    private String endpointProtection;
+    private String originInfo;
+    private String protocolInfo;
+    private String emailInfo;
+    private String sensitiveData;
+    private Integer hitIntelligence;
+    private String windowTime;
+    private LocalDateTime updatedAt;
+    private String engineType;
+    private String attackIpPic;
+    private String victimIpPic;
+    private LocalDateTime operationAt;
+    private String attackDirection;
+    private LocalDateTime etlTime;
+    private Integer logCount;
+    private Integer isAssetHit;
+    private Boolean focused;
+    private Boolean baseFocused;
+    private Boolean isUpdated;
+    private int alarmSource;
+    private String[] httpReqHeader;
+    private String[] httpReqBody;
+    private String[] httpRespHeader;
+    private String[] httpRespBody;
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AlarmVisit.java

@@ -0,0 +1,78 @@
+package com.common.entity;
+
+
+import lombok.Builder;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@Builder
+public class AlarmVisit {
+    private String id;
+    private LocalDateTime createdAt;
+    private String alarmName;
+    private String alarmLevel;
+    private String alarmType;
+    private String alarmMajorType;
+    private String alarmMinorType;
+    private Integer alarmAreaId;
+    private String[] attackIp;
+    private String[] victimIp;
+    private String[] victimWebUrl;
+    private Integer[] attackChainPhase;
+    private Integer[] deviceId;
+    private String[] tag;
+    private String comment;
+    private String[] originLogIds;
+    private String queryId;
+    private Integer judgedState;
+    private Integer disposedState;
+    private String dispositionAdvice;
+    private Integer attackResult;
+    private Integer fall;
+    private byte[] payload;
+    private Integer[] operateEvent;
+    private Integer[] attackPort;
+    private Integer[] victimPort;
+    private String attackMethod;
+    private String businessExt;
+    private LocalDateTime logStartAt;
+    private LocalDateTime logEndAt;
+    private String httpStatus;
+    private String dnsInfo;
+    private String accountInfo;
+    private String attackerInfo;
+    private String victimInfo;
+    private String suspiciousAction;
+    private String vulnInfo;
+    private String weakPwd;
+    private String complianceBaseline;
+    private String fileInfo;
+    private String fileTags;
+    private String endpointInfo;
+    private String endpointProtection;
+    private String originInfo;
+    private String protocolInfo;
+    private String emailInfo;
+    private String sensitiveData;
+    private Integer hitIntelligence;
+    private String windowTime;
+    private LocalDateTime updatedAt;
+    private String engineType;
+    private String attackIpPic;
+    private String victimIpPic;
+    private LocalDateTime operationAt;
+    private String attackDirection;
+    private LocalDateTime etlTime;
+    private Integer logCount;
+    private Integer isAssetHit;
+    private Boolean focused;
+    private Boolean baseFocused;
+    private Boolean isUpdated;
+    private int alarmSource;
+    private String[] httpReqHeader;
+    private String[] httpReqBody;
+    private String[] httpRespHeader;
+    private String[] httpRespBody;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AnalysisAnalysisRule.java

@@ -0,0 +1,144 @@
+package com.common.entity;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.time.LocalDateTime;
+import java.util.UUID;
+
+/**
+ * 分析规则实体类
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class AnalysisAnalysisRule {
+    
+    /**
+     * 规则唯一标识（UUID）
+     */
+    private String  ruleId;
+    
+    /**
+     * 创建用户账号
+     */
+    private String createUser;
+    
+    /**
+     * 规则名称（界面显示用）
+     */
+    private String ruleName;
+    
+    /**
+     * 分析方式：高级版/基础版
+     */
+    private String analysisMethod;
+    
+    /**
+     * 运行模式：realtime-实时流式/offline-离线批处理
+     */
+    private String runMode;
+    
+    /**
+     * 规则输出类型：risk_alarm-风险告警/statistics-统计报表
+     */
+    private String ruleOutput;
+    
+    /**
+     * 所属组织机构编码
+     */
+    private String organization;
+    
+    /**
+     * 任务状态：running-正在执行/stopped-已停止/waiting-等待中
+     */
+    private String taskStatus;
+    
+    /**
+     * 创建部门ID
+     */
+    private Long createDept;
+    
+    /**
+     * 删除标志：0-未删除 1-已删除
+     */
+    private String delFlag;
+    
+    /**
+     * 记录创建时间（带时区）
+     */
+    private LocalDateTime createTime;
+    
+    /**
+     * 记录更新时间（带时区）
+     */
+    private LocalDateTime updateTime;
+    
+    /**
+     * 创建人ID
+     */
+    private Long createBy;
+    
+    /**
+     * 更新人ID
+     */
+    private Long updateBy;
+    
+    /**
+     * 规则备注说明文本
+     */
+    private String remark;
+    
+    /**
+     * 多租户隔离ID
+     */
+    private String tenantId;
+    
+    /**
+     * 规则详细描述
+     */
+    private String ruleDesc;
+    
+    /**
+     * 规则分类编码（预留扩展用）
+     */
+    private Integer ruleType;
+    
+    /**
+     * 规则启用状态（0-禁用/1-启用等）
+     */
+    private Integer ruleStatus;
+    
+    /**
+     * 规则配置内容（JSON或结构化文本）
+     */
+    private String ruleContent;
+    
+    /**
+     * 规则计算表达式（如SQL片段或自定义脚本）
+     */
+    private String ruleExpression;
+    
+    /**
+     * 规则执行优先级（数值越大优先级越高）
+     */
+    private Long priority;
+    
+    /**
+     * 规则标签，多个标签用逗号分隔
+     */
+    private String tags;
+    
+    /**
+     * 规则版本号，用于版本管理
+     */
+    private Integer version;
+    
+    /**
+     * 分组ID
+     */
+    private Integer subsetId;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AnalysisField.java

@@ -0,0 +1,144 @@
+package com.common.entity;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.time.LocalDateTime;
+
+/**
+ * 分析字段配置实体类
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class AnalysisField {
+
+    /**
+     * 主键ID，自增序列
+     */
+    private Integer id;
+
+    /**
+     * 关联的规则配置UUID
+     */
+    private String ruleId;
+
+    /**
+     * 字段类型（如维度/指标/计算字段等）
+     */
+    private String type;
+
+    /**
+     * 数据源名称，如数据库连接名或数据流标识
+     */
+    private String dataSource;
+
+    /**
+     * 数据库名称
+     */
+    private String database;
+
+    /**
+     * 表名
+     */
+    private String tableName;
+
+    /**
+     * 表别名，用于SQL语句中的表引用
+     */
+    private String tableAlias;
+
+    /**
+     * 字段名
+     */
+    private String columnName;
+
+    /**
+     * 字段描述
+     */
+    private String columnDesc;
+
+    /**
+     * 字段数据类型（如int/varchar/decimal等）
+     */
+    private String dataType;
+
+    /**
+     * 计算函数名（如SUM/COUNT/自定义函数，NULL表示原始字段）
+     */
+    private String fn;
+
+    /**
+     * 函数参数列表，JSON数组格式（即使无参数也保留空数组）
+     */
+    private String arguments;
+
+    /**
+     * 字段显示占位符（用于前端展示的默认文本）
+     */
+    private String placeholder;
+
+    /**
+     * 基础类型编码（预留分类扩展用）
+     */
+    private Integer baseType;
+
+    /**
+     * 字段分类ID
+     */
+    private Integer categoryId;
+
+    /**
+     * 创建部门ID
+     */
+    private Long createDept;
+
+    /**
+     * 删除标志（0-未删除/1-已删除）
+     */
+    private String delFlag;
+
+    /**
+     * 记录创建时间
+     */
+    private LocalDateTime createTime;
+
+    /**
+     * 记录更新时间
+     */
+    private LocalDateTime updateTime;
+
+    /**
+     * 创建人ID
+     */
+    private Long createBy;
+
+    /**
+     * 更新人ID
+     */
+    private Long updateBy;
+
+    /**
+     * 备注说明
+     */
+    private String remark;
+
+    /**
+     * 租户ID，默认000000表示系统级配置
+     */
+    private String tenantId;
+
+    /**
+     * 告警字段名（别名）
+     */
+    private String alarmColumnName;
+
+    /**
+     * 告警字段描述
+     */
+    private String alarmColumnDesc;
+}
+

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AnalysisFilter.java

@@ -0,0 +1,147 @@
+package com.common.entity;
+
+import com.baomidou.mybatisplus.annotation.*;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.time.LocalDateTime;
+
+/**
+ * 分析过滤条件实体类
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@TableName("analysis_filter")
+public class AnalysisFilter {
+
+    /**
+     * 主键ID
+     */
+    @TableId(value = "id", type = IdType.AUTO)
+    private Integer id;
+
+    /**
+     * 规则ID
+     */
+    private String ruleId;
+
+    /**
+     * 数据源
+     */
+    private String dataSource;
+
+    /**
+     * 数据库名
+     */
+    private String database;
+
+    /**
+     * 表名
+     */
+    private String tableName;
+
+    /**
+     * 表别名
+     */
+    private String tableAlias;
+
+    /**
+     * 列名
+     */
+    private String columnName;
+
+    /**
+     * 列描述
+     */
+    private String columnDesc;
+
+    /**
+     * 数据类型
+     */
+    private String dataType;
+
+    /**
+     * 函数名
+     */
+    private String fn;
+
+    /**
+     * 函数参数
+     */
+    private Object arguments;
+
+    /**
+     * 操作符
+     */
+    private String operator;
+
+    /**
+     * 筛选值
+     */
+    private Object value;
+
+    /**
+     * 基础类型
+     */
+    private Integer baseType;
+
+    /**
+     * 分类ID
+     */
+    private Integer categoryId;
+
+    /**
+     * 创建部门ID
+     */
+    private Long createDept;
+
+    /**
+     * 删除标志：0-正常 1-删除
+     */
+    @TableLogic
+    private String delFlag;
+
+    /**
+     * 创建时间
+     */
+    private LocalDateTime createTime;
+
+    /**
+     * 更新时间
+     */
+    private LocalDateTime updateTime;
+
+    /**
+     * 创建人ID
+     */
+    private Long createBy;
+
+    /**
+     * 更新人ID
+     */
+    private Long updateBy;
+
+    /**
+     * 备注信息
+     */
+    private String remark;
+
+    /**
+     * 租户ID
+     */
+    private String tenantId;
+
+    /**
+     * 关联条件逻辑表ID
+     */
+    private Integer condId;
+
+    /**
+     * 表达式执行顺序号
+     */
+    private Integer seqNum;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AnalysisGroupBy.java

@@ -0,0 +1,81 @@
+package com.common.entity;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * 分组规则配置实体类
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class AnalysisGroupBy {
+
+    /**
+     * 主键ID
+     */
+    private Long id;
+
+    /**
+     * 规则ID
+     */
+    private String ruleId;
+
+    /**
+     * 分组类型：1-标准分组 2-窗口分组
+     */
+    private Integer groupType;
+
+    /**
+     * 窗口类型：tumble/hop/session
+     */
+    private String windowType;
+
+    /**
+     * 窗口配置（关联AnalysisGroupByWindow）
+     */
+    private AnalysisGroupByWindow window;
+
+    /**
+     * 创建部门
+     */
+    private Long createDept;
+
+    /**
+     * 删除标志：0-未删除，1-已删除
+     */
+    private String delFlag;
+
+    /**
+     * 创建时间
+     */
+    private String createTime;
+
+    /**
+     * 更新时间
+     */
+    private String updateTime;
+
+    /**
+     * 创建人
+     */
+    private Long createBy;
+
+    /**
+     * 更新人
+     */
+    private Long updateBy;
+
+    /**
+     * 备注
+     */
+    private String remark;
+
+    /**
+     * 租户ID
+     */
+    private String tenantId;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AnalysisGroupByColumn.java

@@ -0,0 +1,133 @@
+package com.common.entity;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.time.LocalDateTime;
+
+/**
+ * 分析分组字段配置实体类
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class AnalysisGroupByColumn {
+    
+    /**
+     * 主键ID：自增唯一标识符
+     */
+    private Integer id;
+    
+    /**
+     * 分组ID：关联分析分组的外键
+     */
+    private Integer groupById;
+    
+    /**
+     * 数据源名称：数据来源系统标识
+     */
+    private String dataSource;
+    
+    /**
+     * 数据库名称：字段所在的数据库
+     */
+    private String database;
+    
+    /**
+     * 表名：字段所在的物理表名
+     */
+    private String tableName;
+    
+    /**
+     * 表别名：查询时使用的表别名
+     */
+    private String tableAlias;
+    
+    /**
+     * 字段名：物理字段名称
+     */
+    private String columnName;
+    
+    /**
+     * 字段描述：业务层面的字段说明
+     */
+    private String columnDesc;
+    
+    /**
+     * 数据类型：字段的数据类型（如varchar、int4）
+     */
+    private String dataType;
+    
+    /**
+     * 基础类型：字段的业务基础类型编码
+     */
+    private Integer baseType;
+    
+    /**
+     * 分类ID：字段所属的业务分类ID
+     */
+    private Integer categoryId;
+    
+    /**
+     * 创建部门：创建记录的部门ID
+     */
+    private Long createDept;
+    
+    /**
+     * 删除标志：0-未删除，1-已删除
+     */
+    private String delFlag;
+    
+    /**
+     * 创建时间：记录创建时间戳
+     */
+    private LocalDateTime createTime;
+    
+    /**
+     * 更新时间：记录最后更新时间戳
+     */
+    private LocalDateTime updateTime;
+    
+    /**
+     * 创建人：记录创建者ID
+     */
+    private Long createBy;
+    
+    /**
+     * 更新人：记录最后更新者ID
+     */
+    private Long updateBy;
+    
+    /**
+     * 备注：扩展说明信息
+     */
+    private String remark;
+    
+    /**
+     * 租户ID：多租户环境下的租户标识
+     */
+    private String tenantId;
+    
+    /**
+     * 规则ID：关联的业务规则UUID
+     */
+    private String ruleId;
+    
+    /**
+     * 用户组ID：关联的权限用户组ID
+     */
+    private Long groupId;
+    
+    /**
+     * 字段唯一ID：跨表唯一的字段标识符
+     */
+    private Long fieldId;
+    
+    /**
+     * 排序号：字段展示顺序
+     */
+    private Integer sort;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AnalysisGroupByHaving.java

@@ -0,0 +1,138 @@
+package com.common.entity;
+
+import com.baomidou.mybatisplus.annotation.*;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.time.LocalDateTime;
+
+/**
+ * 分析分组聚合条件配置实体类
+ * 存储GROUP BY后的HAVING筛选条件定义
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@TableName("analysis_group_by_having")
+public class AnalysisGroupByHaving {
+
+    /**
+     * 主键ID
+     */
+    @TableId(value = "id", type = IdType.AUTO)
+    private Integer id;
+
+    /**
+     * 分组ID
+     */
+    private Integer groupById;
+
+    /**
+     * 数据源名称
+     */
+    private String dataSource;
+
+    /**
+     * 数据库名称
+     */
+    private String database;
+
+    /**
+     * 表名
+     */
+    private String tableName;
+
+    /**
+     * 表别名
+     */
+    private String tableAlias;
+
+    /**
+     * 字段名
+     */
+    private String columnName;
+
+    /**
+     * 字段描述
+     */
+    private String columnDesc;
+
+    /**
+     * 字段数据类型
+     */
+    private String dataType;
+
+    /**
+     * 聚合函数名（如SUM/COUNT/AVG等）
+     */
+    private String fn;
+
+    /**
+     * 聚合函数参数列表，JSON数组格式
+     */
+    private Object arguments;
+
+    /**
+     * 比较运算符（如>、<、=、>=、<=、IN、LIKE等）
+     */
+    private String operator;
+
+    /**
+     * 比较值，JSON格式存储
+     */
+    private Object value;
+
+    /**
+     * 基础类型标识
+     */
+    private Integer baseType;
+
+    /**
+     * 分类ID，用于条件分组归类
+     */
+    private Integer categoryId;
+
+    /**
+     * 创建部门ID
+     */
+    private Long createDept;
+
+    /**
+     * 删除标志：0-未删除 1-已删除
+     */
+    @TableLogic
+    private String delFlag;
+
+    /**
+     * 记录创建时间
+     */
+    private LocalDateTime createTime;
+
+    /**
+     * 记录更新时间
+     */
+    private LocalDateTime updateTime;
+
+    /**
+     * 创建人ID
+     */
+    private Long createBy;
+
+    /**
+     * 更新人ID
+     */
+    private Long updateBy;
+
+    /**
+     * 备注说明
+     */
+    private String remark;
+
+    /**
+     * 租户ID
+     */
+    private String tenantId;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AnalysisGroupByWindow.java

@@ -0,0 +1,139 @@
+package com.common.entity;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * 分析时间窗口配置实体类
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class AnalysisGroupByWindow {
+
+    /**
+     * 主键ID
+     */
+    private Integer id;
+
+    /**
+     * 分组ID
+     */
+    private Integer groupById;
+
+    /**
+     * 窗口类型：tumble/hop/session
+     */
+    private String windowType;
+
+    // ============ 滚动窗口配置 ============
+
+    /**
+     * 滚动窗口时间类型：second/minute/hour
+     */
+    private String tumbleWindowTimeType;
+
+    /**
+     * 滚动窗口大小
+     */
+    private Integer tumbleWindowSize;
+
+    /**
+     * 滚动窗口单位：s/m/h/d
+     */
+    private String tumbleWindowSizeUnit;
+
+    // ============ 滑动窗口配置 ============
+
+    /**
+     * 滑动窗口时间类型
+     */
+    private String hopWindowTimeType;
+
+    /**
+     * 滑动窗口大小
+     */
+    private Integer hopWindowSize;
+
+    /**
+     * 滑动窗口单位：s/m/h/d
+     */
+    private String hopWindowSizeUnit;
+
+    /**
+     * 滑动窗口步长
+     */
+    private Integer hopWindowSlide;
+
+    /**
+     * 滑动窗口步长单位：s/m/h/d
+     */
+    private String hopWindowSlideUnit;
+
+    /**
+     * 滑动窗口告警频率：是否每个窗口仅告警一次
+     */
+    private Boolean hopWindowAlarmOncePerWindow;
+
+    // ============ 会话窗口配置 ============
+
+    /**
+     * 会话窗口时间类型
+     */
+    private String sessionWindowTimeType;
+
+    /**
+     * 会话窗口超时时间
+     */
+    private Integer sessionWindowSize;
+
+    /**
+     * 会话窗口单位：s/m/h/d
+     */
+    private String sessionWindowSizeUnit;
+
+    // ============ 公共字段 ============
+
+    /**
+     * 创建部门
+     */
+    private Long createDept;
+
+    /**
+     * 删除标志：0-未删除，1-已删除
+     */
+    private String delFlag;
+
+    /**
+     * 创建时间
+     */
+    private String createTime;
+
+    /**
+     * 更新时间
+     */
+    private String updateTime;
+
+    /**
+     * 创建人
+     */
+    private Long createBy;
+
+    /**
+     * 更新人
+     */
+    private Long updateBy;
+
+    /**
+     * 备注
+     */
+    private String remark;
+
+    /**
+     * 租户ID
+     */
+    private String tenantId;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AnalysisTaskHistory.java

@@ -0,0 +1,103 @@
+package com.common.entity;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+import java.util.UUID;
+import java.time.LocalDateTime;
+
+/**
+ * 分析规则任务运行历史及状态记录
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class AnalysisTaskHistory {
+
+    /**
+     * 记录ID
+     */
+    private Long id;
+
+    /**
+     * 规则ID
+     */
+    private String  ruleId;
+
+    /**
+     * 开始时间
+     */
+    private LocalDateTime startTime;
+
+    /**
+     * 结束时间
+     */
+    private LocalDateTime endTime;
+
+    /**
+     * 持续时间(秒)
+     */
+    private Long durationTime;
+
+    /**
+     * 进度百分比
+     */
+    private Integer progressPercent;
+
+    /**
+     * 输入数据量
+     */
+    private Long inputCount;
+
+    /**
+     * 输出数据量
+     */
+    private Long outputCount;
+
+    /**
+     * 状态(RUNNING/CANCELED/KILLED/COMPLETED/FAILED)
+     */
+    private String status;
+
+    /**
+     * 创建部门ID
+     */
+    private Long createDept;
+
+    /**
+     * 删除标志(0-正常,1-删除)
+     */
+    private String delFlag;
+
+    /**
+     * 创建时间
+     */
+    private LocalDateTime createTime;
+
+    /**
+     * 更新时间
+     */
+    private LocalDateTime updateTime;
+
+    /**
+     * 创建人ID
+     */
+    private Long createBy;
+
+    /**
+     * 更新人ID
+     */
+    private Long updateBy;
+
+    /**
+     * 备注信息
+     */
+    private String remark;
+
+    /**
+     * 租户ID
+     */
+    private String tenantId;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AnalysisUserDefinedFunction.java

@@ -0,0 +1,66 @@
+package com.common.entity;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * 用户自定义函数实体类
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class AnalysisUserDefinedFunction {
+    
+    /**
+     * 函数ID
+     */
+    private String functionId;
+    
+    /**
+     * 规则ID
+     */
+    private String ruleId;
+    
+    /**
+     * 函数名称
+     */
+    private String functionName;
+    
+    /**
+     * 函数类型：AGGREGATE-聚合函数/SCALAR-标量函数/WINDOW-窗口函数
+     */
+    private String functionType;
+    
+    /**
+     * 函数描述
+     */
+    private String functionDesc;
+    
+    /**
+     * 函数实现SQL
+     */
+    private String functionSql;
+    
+    /**
+     * 返回类型
+     */
+    private String returnType;
+    
+    /**
+     * 参数定义（JSON格式）
+     */
+    private String params;
+    
+    /**
+     * 启用状态
+     */
+    private Boolean enabled;
+    
+    /**
+     * 删除标志：0-未删除 1-已删除
+     */
+    private String delFlag;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AnalysisWhereCondition.java

@@ -0,0 +1,83 @@
+package com.common.entity;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.time.LocalDateTime;
+
+/**
+ * WHERE条件逻辑表实体类（仅存储条件逻辑组信息）
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class AnalysisWhereCondition {
+
+    /**
+     * 条件ID
+     */
+    private Integer condId;
+
+    /**
+     * 规则ID
+     */
+    private String ruleId;
+
+    /**
+     * 逻辑运算符：AND, OR
+     */
+    private String logicalOp;
+
+    /**
+     * 序号
+     */
+    private Integer seqNum;
+
+    /**
+     * 父节点ID
+     */
+    private Integer parentCondId;
+
+    /**
+     * 创建部门ID
+     */
+    private Long createDept;
+
+    /**
+     * 删除标志：0-未删除 1-已删除
+     */
+    private String delFlag;
+
+    /**
+     * 创建时间
+     */
+    private LocalDateTime createTime;
+
+    /**
+     * 更新时间
+     */
+    private LocalDateTime updateTime;
+
+    /**
+     * 创建人ID
+     */
+    private Long createBy;
+
+    /**
+     * 更新人ID
+     */
+    private Long updateBy;
+
+    /**
+     * 备注信息
+     */
+    private String remark;
+
+    /**
+     * 租户ID
+     */
+    private String tenantId;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/ApiResponse.java

@@ -0,0 +1,75 @@
+package com.common.entity;
+
+public class ApiResponse<T> {
+
+    private boolean success;
+    private String message;
+    private T data;
+    private String errorCode;
+
+    // 成功响应
+    public static <T> ApiResponse<T> success(T data) {
+        ApiResponse<T> response = new ApiResponse<>();
+        response.setSuccess(true);
+        response.setMessage("操作成功");
+        response.setData(data);
+        return response;
+    }
+
+    public static <T> ApiResponse<T> success(String message, T data) {
+        ApiResponse<T> response = new ApiResponse<>();
+        response.setSuccess(true);
+        response.setMessage(message);
+        response.setData(data);
+        return response;
+    }
+
+    // 失败响应
+    public static <T> ApiResponse<T> error(String message) {
+        ApiResponse<T> response = new ApiResponse<>();
+        response.setSuccess(false);
+        response.setMessage(message);
+        return response;
+    }
+
+    public static <T> ApiResponse<T> error(String message, String errorCode) {
+        ApiResponse<T> response = new ApiResponse<>();
+        response.setSuccess(false);
+        response.setMessage(message);
+        response.setErrorCode(errorCode);
+        return response;
+    }
+
+    // Getter和Setter方法
+    public boolean isSuccess() {
+        return success;
+    }
+
+    public void setSuccess(boolean success) {
+        this.success = success;
+    }
+
+    public String getMessage() {
+        return message;
+    }
+
+    public void setMessage(String message) {
+        this.message = message;
+    }
+
+    public T getData() {
+        return data;
+    }
+
+    public void setData(T data) {
+        this.data = data;
+    }
+
+    public String getErrorCode() {
+        return errorCode;
+    }
+
+    public void setErrorCode(String errorCode) {
+        this.errorCode = errorCode;
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AppLog.java

@@ -0,0 +1,74 @@
+package com.common.entity;
+
+
+import lombok.Data;
+import org.springframework.data.annotation.Id;
+import org.springframework.data.elasticsearch.annotations.Document;
+import org.springframework.data.elasticsearch.annotations.Field;
+import org.springframework.data.elasticsearch.annotations.FieldType;
+
+import java.util.Date;
+
+@Data
+//@Document(indexName = "applog-#{T(java.time.LocalDate).now().format(T(java.time.format.DateTimeFormatter).ofPattern('yyyyMMdd'))}")
+public class AppLog {
+
+    // ES元数据字段
+    @Id
+    private String id;
+
+    @Field(type = FieldType.Keyword)
+    private String index;
+
+    @Field(type = FieldType.Keyword)
+    private String type = "_doc";
+
+    @Field(type = FieldType.Float)
+    private Float score = 1.0f;
+
+    // 日志内容字段（对应_source）
+    @Field(name = "dtTime", type = FieldType.Long)
+    private Long dtTime;
+
+    @Field(name = "collecttime", type = FieldType.Long)
+    private Long collectTime;
+
+    @Field(name = "logType", type = FieldType.Keyword)
+    private String logType;
+
+    @Field(name = "traceId", type = FieldType.Keyword)
+    private String traceId;
+
+    @Field(name = "method", type = FieldType.Text)
+    private String method;
+
+    @Field(name = "appName", type = FieldType.Keyword)
+    private String appName;
+
+    @Field(name = "ip", type = FieldType.Keyword)
+    private String ip;
+
+    @Field(name = "className", type = FieldType.Text)
+    private String className;
+
+    @Field(name = "env", type = FieldType.Keyword)
+    private String env;
+
+    @Field(name = "content", type = FieldType.Text)
+    private String content;
+
+    @Field(name = "threadName", type = FieldType.Text)
+    private String threadName;
+
+    @Field(name = "logLevel", type = FieldType.Keyword)
+    private String logLevel;
+
+    @Field(name = "seq", type = FieldType.Keyword)
+    private String seq;
+
+    @Field(name = "_indexed_at", type = FieldType.Long)
+    private Long indexedAt;
+
+    // 系统字段
+    private Date createTime = new Date();
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/AppLogEntity.java

@@ -0,0 +1,40 @@
+package com.common.entity;
+
+
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+public class AppLogEntity {
+    private Long id;
+
+    // ES元数据字段
+    private String esIndex;
+    private String esType = "_doc";
+    private String esId;
+    private Float esScore = 1.0f;
+
+    // 日志内容字段
+    private Long dtTime;
+    private Long collectTime;
+    private String logType;
+    private String traceId;
+    private String method;
+    private String appName;
+    private String ip;
+    private String className;
+    private String env;
+    private String content;
+    private String threadName;
+    private String logLevel;
+    private String seq;
+    private Long indexedAt;
+
+    // 分区字段
+    private LocalDateTime logDate;
+
+    // 系统字段
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceCollectHeartbeat.java

@@ -0,0 +1,82 @@
+package com.common.entity;
+
+import lombok.Data;
+import java.time.LocalDateTime;
+
+/**
+ * 探针心跳状态实体类
+ * 对应表: device_collect_heartbeat
+ */
+@Data
+public class DeviceCollectHeartbeat {
+    
+    /** 自增主键 */
+    private Long id;
+    
+    /** 探针唯一标识（由探针上报） */
+    private String collectId;
+    
+    /** 探针名称（可选） */
+    private String collectName;
+    
+    /** 探针IP（支持IPv6） */
+    private String deviceIp;
+    
+    /** 探针版本 */
+    private String appVersion;
+    
+    /** 最后一次心跳时间（毫秒精度） */
+    private LocalDateTime lastHeartbeat;
+    
+    /** 累计心跳次数（可监控丢包率） */
+    private Long heartbeatCount;
+    
+    /** 在线状态：online / offline */
+    private String status;
+    
+    /** 连续心跳失败次数（平台侧计算） */
+    private Integer failCount;
+    
+    /** 最后更新时间 */
+    private LocalDateTime updateTime;
+    
+
+
+    
+    public DeviceCollectHeartbeat() {
+        this.heartbeatCount = 1L;
+        this.status = "online";
+        this.failCount = 0;
+        this.updateTime = LocalDateTime.now();
+
+    }
+    
+    /**
+     * 更新心跳
+     */
+    public void updateHeartbeat() {
+        this.lastHeartbeat = LocalDateTime.now();
+        this.heartbeatCount = (this.heartbeatCount == null ? 1L : this.heartbeatCount + 1);
+        this.status = "online";
+        this.failCount = 0;
+        this.updateTime = LocalDateTime.now();
+    }
+    
+    /**
+     * 标记为离线
+     */
+    public void markOffline() {
+        this.status = "offline";
+        this.failCount = (this.failCount == null ? 1 : this.failCount + 1);
+        this.updateTime = LocalDateTime.now();
+    }
+    
+    /**
+     * 恢复在线
+     */
+    public void markOnline() {
+        this.status = "online";
+        this.failCount = 0;
+        this.updateTime = LocalDateTime.now();
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceCollectHeartbeatHistory.java

@@ -0,0 +1,48 @@
+package com.common.entity;
+
+import lombok.Data;
+import java.time.LocalDateTime;
+
+/**
+ * 探针心跳历史记录实体类
+ * 对应表: device_collect_heartbeat_history
+ */
+@Data
+public class DeviceCollectHeartbeatHistory {
+    
+    /** 自增主键 */
+    private Long id;
+    
+    /** 探针唯一标识 */
+    private String collectId;
+    
+    /** 心跳上报时间 */
+    private LocalDateTime heartbeatTime;
+    
+    /** 探针IP */
+    private String deviceIp;
+    
+    /** 探针版本 */
+    private String appVersion;
+    
+    /** 记录创建时间 */
+    private LocalDateTime createdAt;
+
+    
+    public DeviceCollectHeartbeatHistory() {
+        this.createdAt = LocalDateTime.now();
+    }
+    
+    /**
+     * 从心跳状态创建历史记录
+     */
+    public static DeviceCollectHeartbeatHistory fromHeartbeat(DeviceCollectHeartbeat heartbeat) {
+        DeviceCollectHeartbeatHistory history = new DeviceCollectHeartbeatHistory();
+        history.setCollectId(heartbeat.getCollectId());
+        history.setHeartbeatTime(heartbeat.getLastHeartbeat());
+        history.setDeviceIp(heartbeat.getDeviceIp());
+        history.setAppVersion(heartbeat.getAppVersion());
+        history.setCreatedAt(LocalDateTime.now());
+        return history;
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceCollectTask.java

@@ -0,0 +1,98 @@
+package com.common.entity;
+
+import java.time.OffsetDateTime;
+
+public class DeviceCollectTask {
+    private Integer id;
+    private OffsetDateTime createdAt;
+    private OffsetDateTime updatedAt;
+    private OffsetDateTime deletedAt;
+    private Integer deviceId;
+    private Integer method;
+    private String taskName;
+    private OffsetDateTime firstTime;
+    private OffsetDateTime lastSuccessTime;
+    private OffsetDateTime lastFailedTime;
+    private Integer detailId;
+    private Integer epm;
+    private Integer epmPeak;
+    private Integer processArchitecture;
+    private Integer taskCount;
+    private OffsetDateTime recentDiscoverTime;
+    private Integer epmUpperLimit;
+
+    // Getter and Setter 方法
+    public Integer getId() { return id; }
+    public void setId(Integer id) { this.id = id; }
+
+    public OffsetDateTime getCreatedAt() { return createdAt; }
+    public void setCreatedAt(OffsetDateTime createdAt) { this.createdAt = createdAt; }
+
+    public OffsetDateTime getUpdatedAt() { return updatedAt; }
+    public void setUpdatedAt(OffsetDateTime updatedAt) { this.updatedAt = updatedAt; }
+
+    public OffsetDateTime getDeletedAt() { return deletedAt; }
+    public void setDeletedAt(OffsetDateTime deletedAt) { this.deletedAt = deletedAt; }
+
+    public Integer getDeviceId() { return deviceId; }
+    public void setDeviceId(Integer deviceId) { this.deviceId = deviceId; }
+
+    public Integer getMethod() { return method; }
+    public void setMethod(Integer method) { this.method = method; }
+
+    public String getTaskName() { return taskName; }
+    public void setTaskName(String taskName) { this.taskName = taskName; }
+
+    public OffsetDateTime getFirstTime() { return firstTime; }
+    public void setFirstTime(OffsetDateTime firstTime) { this.firstTime = firstTime; }
+
+    public OffsetDateTime getLastSuccessTime() { return lastSuccessTime; }
+    public void setLastSuccessTime(OffsetDateTime lastSuccessTime) { this.lastSuccessTime = lastSuccessTime; }
+
+    public OffsetDateTime getLastFailedTime() { return lastFailedTime; }
+    public void setLastFailedTime(OffsetDateTime lastFailedTime) { this.lastFailedTime = lastFailedTime; }
+
+    public Integer getDetailId() { return detailId; }
+    public void setDetailId(Integer detailId) { this.detailId = detailId; }
+
+    public Integer getEpm() { return epm; }
+    public void setEpm(Integer epm) { this.epm = epm; }
+
+    public Integer getEpmPeak() { return epmPeak; }
+    public void setEpmPeak(Integer epmPeak) { this.epmPeak = epmPeak; }
+
+    public Integer getProcessArchitecture() { return processArchitecture; }
+    public void setProcessArchitecture(Integer processArchitecture) { this.processArchitecture = processArchitecture; }
+
+    public Integer getTaskCount() { return taskCount; }
+    public void setTaskCount(Integer taskCount) { this.taskCount = taskCount; }
+
+    public OffsetDateTime getRecentDiscoverTime() { return recentDiscoverTime; }
+    public void setRecentDiscoverTime(OffsetDateTime recentDiscoverTime) { this.recentDiscoverTime = recentDiscoverTime; }
+
+    public Integer getEpmUpperLimit() { return epmUpperLimit; }
+    public void setEpmUpperLimit(Integer epmUpperLimit) { this.epmUpperLimit = epmUpperLimit; }
+
+    @Override
+    public String toString() {
+        return "DeviceCollectTask{" +
+                "id=" + id +
+                ", createdAt=" + createdAt +
+                ", updatedAt=" + updatedAt +
+                ", deletedAt=" + deletedAt +
+                ", deviceId=" + deviceId +
+                ", method=" + method +
+                ", taskName='" + taskName + '\'' +
+                ", firstTime=" + firstTime +
+                ", lastSuccessTime=" + lastSuccessTime +
+                ", lastFailedTime=" + lastFailedTime +
+                ", detailId=" + detailId +
+                ", epm=" + epm +
+                ", epmPeak=" + epmPeak +
+                ", processArchitecture=" + processArchitecture +
+                ", taskCount=" + taskCount +
+                ", recentDiscoverTime=" + recentDiscoverTime +
+                ", epmUpperLimit=" + epmUpperLimit +
+                '}';
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceCollectTaskTime.java

@@ -0,0 +1,11 @@
+package com.common.entity;
+
+import lombok.Data;
+import java.time.LocalDateTime;
+@Data
+public class DeviceCollectTaskTime {
+    private String deviceCollectId;
+    private LocalDateTime firstTime;          // 首次成功时间
+    private LocalDateTime lastSuccessTime;    // 最后成功时间
+    private LocalDateTime lastFailTime;       // 最后失败时间
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceDevice.java

@@ -0,0 +1,376 @@
+package com.common.entity;
+
+
+import java.time.LocalDateTime;
+import java.time.OffsetDateTime;
+public class DeviceDevice {
+    public Integer id;
+    public LocalDateTime  createdAt;
+    public LocalDateTime updatedAt;
+    public LocalDateTime deletedAt;
+    public String name;
+    public String ip;
+    public Integer deviceGroup;
+    public Integer deviceType;
+    public String vendor;
+    public String productName;
+    public Integer organizationId;
+    public LocalDateTime lastReceiveTime;
+    public Integer agentId;
+    public Integer detailId;
+    public Integer controlAgentId;
+    public LocalDateTime licenseStartTime;
+    public LocalDateTime licenseEndTime;
+    public Boolean isMonitoring;
+    public Long securityScopeId;
+    public Long ownerId;
+    public Long sshConfigId;
+    public Short status;
+    public Long createdById;
+    public Integer decodeType;
+    public Integer missPolicy;
+    public String tenantId;
+    public LocalDateTime createTime;
+    public LocalDateTime updateTime;
+    public Long createBy;
+    public Long updateBy;
+    public String delFlag;
+    public String managerName;
+    public Integer todayParseCount;
+    public Integer todayNonLogCount;
+    public Long createDept;
+    public Integer deviceCollectId;
+
+
+    // Getter and Setter methods
+    public Integer getId() {
+        return id;
+    }
+
+    public void setId(Integer id) {
+        this.id = id;
+    }
+
+    public LocalDateTime getCreatedAt() {
+        return createdAt;
+    }
+
+    public void setCreatedAt(LocalDateTime createdAt) {
+        this.createdAt = createdAt;
+    }
+
+    public LocalDateTime getUpdatedAt() {
+        return updatedAt;
+    }
+
+    public void setUpdatedAt(LocalDateTime updatedAt) {
+        this.updatedAt = updatedAt;
+    }
+
+    public LocalDateTime getDeletedAt() {
+        return deletedAt;
+    }
+
+    public void setDeletedAt(LocalDateTime deletedAt) {
+        this.deletedAt = deletedAt;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getIp() {
+        return ip;
+    }
+
+    public void setIp(String ip) {
+        this.ip = ip;
+    }
+
+    public Integer getDeviceGroup() {
+        return deviceGroup;
+    }
+
+    public void setDeviceGroup(Integer deviceGroup) {
+        this.deviceGroup = deviceGroup;
+    }
+
+    public Integer getDeviceType() {
+        return deviceType;
+    }
+
+    public void setDeviceType(Integer deviceType) {
+        this.deviceType = deviceType;
+    }
+
+    public String getVendor() {
+        return vendor;
+    }
+
+    public void setVendor(String vendor) {
+        this.vendor = vendor;
+    }
+
+    public String getProductName() {
+        return productName;
+    }
+
+    public void setProductName(String productName) {
+        this.productName = productName;
+    }
+
+    public Integer getOrganizationId() {
+        return organizationId;
+    }
+
+    public void setOrganizationId(Integer organizationId) {
+        this.organizationId = organizationId;
+    }
+
+    public LocalDateTime getLastReceiveTime() {
+        return lastReceiveTime;
+    }
+
+    public void setLastReceiveTime(LocalDateTime lastReceiveTime) {
+        this.lastReceiveTime = lastReceiveTime;
+    }
+
+    public Integer getAgentId() {
+        return agentId;
+    }
+
+    public void setAgentId(Integer agentId) {
+        this.agentId = agentId;
+    }
+
+    public Integer getDetailId() {
+        return detailId;
+    }
+
+    public void setDetailId(Integer detailId) {
+        this.detailId = detailId;
+    }
+
+    public Integer getControlAgentId() {
+        return controlAgentId;
+    }
+
+    public void setControlAgentId(Integer controlAgentId) {
+        this.controlAgentId = controlAgentId;
+    }
+
+    public LocalDateTime getLicenseStartTime() {
+        return licenseStartTime;
+    }
+
+    public void setLicenseStartTime(LocalDateTime licenseStartTime) {
+        this.licenseStartTime = licenseStartTime;
+    }
+
+    public LocalDateTime getLicenseEndTime() {
+        return licenseEndTime;
+    }
+
+    public void setLicenseEndTime(LocalDateTime licenseEndTime) {
+        this.licenseEndTime = licenseEndTime;
+    }
+
+    public Boolean getIsMonitoring() {
+        return isMonitoring;
+    }
+
+    public void setIsMonitoring(Boolean isMonitoring) {
+        this.isMonitoring = isMonitoring;
+    }
+
+    public Long getSecurityScopeId() {
+        return securityScopeId;
+    }
+
+    public void setSecurityScopeId(Long securityScopeId) {
+        this.securityScopeId = securityScopeId;
+    }
+
+    public Long getOwnerId() {
+        return ownerId;
+    }
+
+    public void setOwnerId(Long ownerId) {
+        this.ownerId = ownerId;
+    }
+
+    public Long getSshConfigId() {
+        return sshConfigId;
+    }
+
+    public void setSshConfigId(Long sshConfigId) {
+        this.sshConfigId = sshConfigId;
+    }
+
+    public Short getStatus() {
+        return status;
+    }
+
+    public void setStatus(Short status) {
+        this.status = status;
+    }
+
+    public Long getCreatedById() {
+        return createdById;
+    }
+
+    public void setCreatedById(Long createdById) {
+        this.createdById = createdById;
+    }
+
+    public Integer getDecodeType() {
+        return decodeType;
+    }
+
+    public void setDecodeType(Integer decodeType) {
+        this.decodeType = decodeType;
+    }
+
+    public Integer getMissPolicy() {
+        return missPolicy;
+    }
+
+    public void setMissPolicy(Integer missPolicy) {
+        this.missPolicy = missPolicy;
+    }
+
+    public String getTenantId() {
+        return tenantId;
+    }
+
+    public void setTenantId(String tenantId) {
+        this.tenantId = tenantId;
+    }
+
+    public LocalDateTime getCreateTime() {
+        return createTime;
+    }
+
+    public void setCreateTime(LocalDateTime createTime) {
+        this.createTime = createTime;
+    }
+
+    public LocalDateTime getUpdateTime() {
+        return updateTime;
+    }
+
+    public void setUpdateTime(LocalDateTime updateTime) {
+        this.updateTime = updateTime;
+    }
+
+    public Long getCreateBy() {
+        return createBy;
+    }
+
+    public void setCreateBy(Long createBy) {
+        this.createBy = createBy;
+    }
+
+    public Long getUpdateBy() {
+        return updateBy;
+    }
+
+    public void setUpdateBy(Long updateBy) {
+        this.updateBy = updateBy;
+    }
+
+    public String getDelFlag() {
+        return delFlag;
+    }
+
+    public void setDelFlag(String delFlag) {
+        this.delFlag = delFlag;
+    }
+
+    public String getManagerName() {
+        return managerName;
+    }
+
+    public void setManagerName(String managerName) {
+        this.managerName = managerName;
+    }
+
+    public Integer getTodayParseCount() {
+        return todayParseCount;
+    }
+
+    public void setTodayParseCount(Integer todayParseCount) {
+        this.todayParseCount = todayParseCount;
+    }
+
+    public Integer getTodayNonLogCount() {
+        return todayNonLogCount;
+    }
+
+    public void setTodayNonLogCount(Integer todayNonLogCount) {
+        this.todayNonLogCount = todayNonLogCount;
+    }
+
+    public Long getCreateDept() {
+        return createDept;
+    }
+
+    public void setCreateDept(Long createDept) {
+        this.createDept = createDept;
+    }
+
+    public Integer getDeviceCollectId() {
+        return deviceCollectId;
+    }
+
+    public void setDeviceCollectId(Integer deviceCollectId) {
+        this.deviceCollectId = deviceCollectId;
+    }
+
+    @Override
+    public String toString() {
+        return "DeviceDevice{" +
+                "id=" + id +
+                ", createdAt=" + createdAt +
+                ", updatedAt=" + updatedAt +
+                ", deletedAt=" + deletedAt +
+                ", name='" + name + '\'' +
+                ", ip='" + ip + '\'' +
+                ", deviceGroup=" + deviceGroup +
+                ", deviceType=" + deviceType +
+                ", vendor='" + vendor + '\'' +
+                ", productName='" + productName + '\'' +
+                ", organizationId=" + organizationId +
+                ", lastReceiveTime=" + lastReceiveTime +
+                ", agentId=" + agentId +
+                ", detailId=" + detailId +
+                ", controlAgentId=" + controlAgentId +
+                ", licenseStartTime=" + licenseStartTime +
+                ", licenseEndTime=" + licenseEndTime +
+                ", isMonitoring=" + isMonitoring +
+                ", securityScopeId=" + securityScopeId +
+                ", ownerId=" + ownerId +
+                ", sshConfigId=" + sshConfigId +
+                ", status=" + status +
+                ", createdById=" + createdById +
+                ", decodeType=" + decodeType +
+                ", missPolicy=" + missPolicy +
+                ", tenantId='" + tenantId + '\'' +
+                ", createTime=" + createTime +
+                ", updateTime=" + updateTime +
+                ", createBy=" + createBy +
+                ", updateBy=" + updateBy +
+                ", delFlag='" + delFlag + '\'' +
+                ", managerName='" + managerName + '\'' +
+                ", todayParseCount=" + todayParseCount +
+                ", todayNonLogCount=" + todayNonLogCount +
+                ", createDept=" + createDept +
+                ", deviceCollectId=" + deviceCollectId +
+                '}';
+    }
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceInterlocking.java

@@ -0,0 +1,85 @@
+package com.common.entity;
+
+import java.time.OffsetDateTime;
+
+/**
+ * 联动设备表实体类（防火墙设备信息）
+ * 对应表: device_interlocking
+ */
+public class DeviceInterlocking {
+    private Long id;
+    private String deviceName;                // 联动安全设备名称（防火墙）
+    private String vendor;                    // 厂商
+    private String deptId;                    // 所属组织机构（部门ID）
+    private Integer banLimit;                // 封禁上限
+    private String ip;                        // IP地址
+    private String apiUrl;                    // API地址
+    private String tenantId;
+    private Long createDept;
+    private Long createBy;
+    private OffsetDateTime createTime;
+    private Long updateBy;
+    private OffsetDateTime updateTime;
+    private String remark;
+    private String authUsername;              // 用户名
+    private String authPassword;              // 密码
+
+    // Getter and Setter
+    public Long getId() { return id; }
+    public void setId(Long id) { this.id = id; }
+
+    public String getDeviceName() { return deviceName; }
+    public void setDeviceName(String deviceName) { this.deviceName = deviceName; }
+
+    public String getVendor() { return vendor; }
+    public void setVendor(String vendor) { this.vendor = vendor; }
+
+    public String getDeptId() { return deptId; }
+    public void setDeptId(String deptId) { this.deptId = deptId; }
+
+    public Integer getBanLimit() { return banLimit; }
+    public void setBanLimit(Integer banLimit) { this.banLimit = banLimit; }
+
+    public String getIp() { return ip; }
+    public void setIp(String ip) { this.ip = ip; }
+
+    public String getApiUrl() { return apiUrl; }
+    public void setApiUrl(String apiUrl) { this.apiUrl = apiUrl; }
+
+    public String getTenantId() { return tenantId; }
+    public void setTenantId(String tenantId) { this.tenantId = tenantId; }
+
+    public Long getCreateDept() { return createDept; }
+    public void setCreateDept(Long createDept) { this.createDept = createDept; }
+
+    public Long getCreateBy() { return createBy; }
+    public void setCreateBy(Long createBy) { this.createBy = createBy; }
+
+    public OffsetDateTime getCreateTime() { return createTime; }
+    public void setCreateTime(OffsetDateTime createTime) { this.createTime = createTime; }
+
+    public Long getUpdateBy() { return updateBy; }
+    public void setUpdateBy(Long updateBy) { this.updateBy = updateBy; }
+
+    public OffsetDateTime getUpdateTime() { return updateTime; }
+    public void setUpdateTime(OffsetDateTime updateTime) { this.updateTime = updateTime; }
+
+    public String getRemark() { return remark; }
+    public void setRemark(String remark) { this.remark = remark; }
+
+    public String getAuthUsername() { return authUsername; }
+    public void setAuthUsername(String authUsername) { this.authUsername = authUsername; }
+
+    public String getAuthPassword() { return authPassword; }
+    public void setAuthPassword(String authPassword) { this.authPassword = authPassword; }
+
+    @Override
+    public String toString() {
+        return "DeviceInterlocking{" +
+                "id=" + id +
+                ", deviceName='" + deviceName + '\'' +
+                ", vendor='" + vendor + '\'' +
+                ", ip='" + ip + '\'' +
+                '}';
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceInterlockingCmd.java

@@ -0,0 +1,147 @@
+package com.common.entity;
+
+import com.Modules.etl.handler.ArrayIntegerTypeHandler;
+import com.Modules.etl.handler.ArrayStringTypeHandler;
+import org.apache.ibatis.type.JdbcType;
+import org.apache.ibatis.type.TypeHandler;
+import org.apache.ibatis.type.ArrayTypeHandler;
+
+import java.time.OffsetDateTime;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * 封禁指令表实体类
+ * 对应表: device_interlocking_cmd
+ */
+public class DeviceInterlockingCmd {
+    private Long id;
+    private Long probeId;                      // 探针ID
+    private String probeIp;                    // 探针IP
+    private Integer[] deviceInterlockingId;    // 联动设备ID（数组）
+    private String[] deviceInterlockingIp;      // 联动设备IP（数组）
+    private String[] banIps;                    // 封禁IP（数组）
+    private String banMethod;                   // 封禁方式（0:手工、1:自动）
+    private String banType;                    // 封禁类型（1:白名单、0:黑名单）
+    private String cmdStatus;                  // 指令状态（0:未执行、1:已完成、2:执行中）
+    private Integer banDuration;              // 封禁时长（秒，-1表示永久）
+    private OffsetDateTime createTime;
+    private OffsetDateTime updateTime;
+    private String tenantId;
+    private Long createDept;
+    private Long createBy;
+    private Long updateBy;
+    private String remark;
+    private Integer banOperationType;         // 封禁操作类型（0:新增、1:删除）
+
+    // Getter and Setter
+    public Long getId() { return id; }
+    public void setId(Long id) { this.id = id; }
+
+    public Long getProbeId() { return probeId; }
+    public void setProbeId(Long probeId) { this.probeId = probeId; }
+
+    public String getProbeIp() { return probeIp; }
+    public void setProbeIp(String probeIp) { this.probeIp = probeIp; }
+
+    public Integer[] getDeviceInterlockingId() { return deviceInterlockingId; }
+    public void setDeviceInterlockingId(Integer[] deviceInterlockingId) { this.deviceInterlockingId = deviceInterlockingId; }
+
+    public String[] getDeviceInterlockingIp() { return deviceInterlockingIp; }
+    public void setDeviceInterlockingIp(String[] deviceInterlockingIp) { this.deviceInterlockingIp = deviceInterlockingIp; }
+
+    public String[] getBanIps() { return banIps; }
+    public void setBanIps(String[] banIps) { this.banIps = banIps; }
+
+    public String getBanMethod() { return banMethod; }
+    public void setBanMethod(String banMethod) { this.banMethod = banMethod; }
+
+    public String getBanType() { return banType; }
+    public void setBanType(String banType) { this.banType = banType; }
+
+    public String getCmdStatus() { return cmdStatus; }
+    public void setCmdStatus(String cmdStatus) { this.cmdStatus = cmdStatus; }
+
+    public Integer getBanDuration() { return banDuration; }
+    public void setBanDuration(Integer banDuration) { this.banDuration = banDuration; }
+
+    public OffsetDateTime getCreateTime() { return createTime; }
+    public void setCreateTime(OffsetDateTime createTime) { this.createTime = createTime; }
+
+    public OffsetDateTime getUpdateTime() { return updateTime; }
+    public void setUpdateTime(OffsetDateTime updateTime) { this.updateTime = updateTime; }
+
+    public String getTenantId() { return tenantId; }
+    public void setTenantId(String tenantId) { this.tenantId = tenantId; }
+
+    public Long getCreateDept() { return createDept; }
+    public void setCreateDept(Long createDept) { this.createDept = createDept; }
+
+    public Long getCreateBy() { return createBy; }
+    public void setCreateBy(Long createBy) { this.createBy = createBy; }
+
+    public Long getUpdateBy() { return updateBy; }
+    public void setUpdateBy(Long updateBy) { this.updateBy = updateBy; }
+
+    public String getRemark() { return remark; }
+    public void setRemark(String remark) { this.remark = remark; }
+
+    public Integer getBanOperationType() { return banOperationType; }
+    public void setBanOperationType(Integer banOperationType) { this.banOperationType = banOperationType; }
+
+    // ========== 便利方法：数组与List互转 ==========
+
+    /**
+     * 获取设备联动ID列表
+     */
+    public List<Integer> getDeviceInterlockingIdList() {
+        return deviceInterlockingId != null ? Arrays.asList(deviceInterlockingId) : null;
+    }
+
+    /**
+     * 设置设备联动ID列表
+     */
+    public void setDeviceInterlockingIdList(List<Integer> list) {
+        this.deviceInterlockingId = list != null ? list.toArray(new Integer[0]) : null;
+    }
+
+    /**
+     * 获取设备联动IP列表
+     */
+    public List<String> getDeviceInterlockingIpList() {
+        return deviceInterlockingIp != null ? Arrays.asList(deviceInterlockingIp) : null;
+    }
+
+    /**
+     * 设置设备联动IP列表
+     */
+    public void setDeviceInterlockingIpList(List<String> list) {
+        this.deviceInterlockingIp = list != null ? list.toArray(new String[0]) : null;
+    }
+
+    /**
+     * 获取封禁IP列表
+     */
+    public List<String> getBanIpsList() {
+        return banIps != null ? Arrays.asList(banIps) : null;
+    }
+
+    /**
+     * 设置封禁IP列表
+     */
+    public void setBanIpsList(List<String> list) {
+        this.banIps = list != null ? list.toArray(new String[0]) : null;
+    }
+
+    @Override
+    public String toString() {
+        return "DeviceInterlockingCmd{" +
+                "id=" + id +
+                ", probeId=" + probeId +
+                ", probeIp='" + probeIp + '\'' +
+                ", banType='" + banType + '\'' +
+                ", cmdStatus='" + cmdStatus + '\'' +
+                ", banOperationType=" + banOperationType +
+                '}';
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceInterlockingLog.java

@@ -0,0 +1,90 @@
+package com.common.entity;
+
+import java.time.OffsetDateTime;
+
+/**
+ * 封禁记录表实体类
+ * 对应表: device_interlocking_log
+ */
+public class DeviceInterlockingLog {
+    private Long id;
+    private Long deviceInterlockingCmdId;      // 封禁指令ID
+    private Long deviceInterlockingId;         // 封禁设备ID
+    private String banIp;                     // 封禁IP地址
+    private String deviceName;                 // 封禁设备名称
+    private OffsetDateTime banTime;            // 封禁时间
+    private String banMethod;                  // 封禁方式（0.人工、1.自动化封禁）
+    private Integer banResult;                // 联动结果（成功：1、失败：0）
+    private String tenantId;
+    private Long createDept;
+    private Long createBy;
+    private OffsetDateTime createTime;
+    private Long updateBy;
+    private OffsetDateTime updateTime;
+    private String remark;
+    private String respBody;                 // 响应body
+    private String reqBody;                   // 请求body
+
+    // Getter and Setter
+    public Long getId() { return id; }
+    public void setId(Long id) { this.id = id; }
+
+    public Long getDeviceInterlockingCmdId() { return deviceInterlockingCmdId; }
+    public void setDeviceInterlockingCmdId(Long deviceInterlockingCmdId) { this.deviceInterlockingCmdId = deviceInterlockingCmdId; }
+
+    public Long getDeviceInterlockingId() { return deviceInterlockingId; }
+    public void setDeviceInterlockingId(Long deviceInterlockingId) { this.deviceInterlockingId = deviceInterlockingId; }
+
+    public String getBanIp() { return banIp; }
+    public void setBanIp(String banIp) { this.banIp = banIp; }
+
+    public String getDeviceName() { return deviceName; }
+    public void setDeviceName(String deviceName) { this.deviceName = deviceName; }
+
+    public OffsetDateTime getBanTime() { return banTime; }
+    public void setBanTime(OffsetDateTime banTime) { this.banTime = banTime; }
+
+    public String getBanMethod() { return banMethod; }
+    public void setBanMethod(String banMethod) { this.banMethod = banMethod; }
+
+    public Integer getBanResult() { return banResult; }
+    public void setBanResult(Integer banResult) { this.banResult = banResult; }
+
+    public String getTenantId() { return tenantId; }
+    public void setTenantId(String tenantId) { this.tenantId = tenantId; }
+
+    public Long getCreateDept() { return createDept; }
+    public void setCreateDept(Long createDept) { this.createDept = createDept; }
+
+    public Long getCreateBy() { return createBy; }
+    public void setCreateBy(Long createBy) { this.createBy = createBy; }
+
+    public OffsetDateTime getCreateTime() { return createTime; }
+    public void setCreateTime(OffsetDateTime createTime) { this.createTime = createTime; }
+
+    public Long getUpdateBy() { return updateBy; }
+    public void setUpdateBy(Long updateBy) { this.updateBy = updateBy; }
+
+    public OffsetDateTime getUpdateTime() { return updateTime; }
+    public void setUpdateTime(OffsetDateTime updateTime) { this.updateTime = updateTime; }
+
+    public String getRemark() { return remark; }
+    public void setRemark(String remark) { this.remark = remark; }
+
+    public String getRespBody() { return respBody; }
+    public void setRespBody(String respBody) { this.respBody = respBody; }
+
+    public String getReqBody() { return reqBody; }
+    public void setReqBody(String reqBody) { this.reqBody = reqBody; }
+
+    @Override
+    public String toString() {
+        return "DeviceInterlockingLog{" +
+                "id=" + id +
+                ", deviceInterlockingCmdId=" + deviceInterlockingCmdId +
+                ", banIp='" + banIp + '\'' +
+                ", deviceName='" + deviceName + '\'' +
+                ", banResult=" + banResult +
+                '}';
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceReceiveLog.java

@@ -0,0 +1,65 @@
+package com.common.entity;
+
+import lombok.Data;
+import lombok.AllArgsConstructor;
+import lombok.NoArgsConstructor;
+import lombok.Builder;
+
+import java.time.LocalDateTime;
+import com.fasterxml.jackson.annotation.JsonFormat;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class DeviceReceiveLog {
+    /**
+     * 主键ID
+     */
+    private Long id;
+
+    /**
+     * 记录创建时间（UTC时间）
+     */
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime createdAt;
+
+    /**
+     * 采集探针ID
+     */
+    private Integer deviceCollectId;
+
+    /**
+     * 设备ID
+     */
+    private Integer deviceId;
+
+    /**
+     * 设备IP（PostgreSQL inet类型，用String处理）
+     */
+    private String deviceIp;
+
+    /**
+     * 日志收到时间
+     */
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime receiveTime;
+
+    /**
+     * 接收时间字符串（冗余字段）
+     */
+    private String receiveTimeStr;
+
+    /**
+     * 原始syslog消息
+     */
+    private String syslogMessage;
+
+    // 推送是否成功
+    private Boolean pushSuccess;
+    /**
+     * 分页参数（非表字段）
+     */
+    private Integer pageNum;
+    private Integer pageSize;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceStatsDTO.java

@@ -0,0 +1,14 @@
+package com.common.entity;
+
+
+
+import lombok.Data;
+import java.time.LocalDateTime;
+
+@Data
+public class DeviceStatsDTO {
+    private Long deviceId;
+    private LocalDateTime lastReceiveTime;
+    private Integer parseCount;
+    private Integer nonLogCount;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DmColumn.java

@@ -0,0 +1,131 @@
+package com.common.entity;
+
+
+import java.time.LocalDateTime;
+
+public class DmColumn {
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private LocalDateTime deletedAt;
+    private String name;
+    private String displayName;
+    private Long storageDataType;
+    private Long businessDataType;
+    private Boolean isBuiltIn;
+    private Boolean isHidden;
+    private Boolean isNotNormalizable;
+    private Boolean isRequired;
+    private Integer categoryId;
+    private Integer customAssetCategoryId;
+    private Boolean isVirtual;
+    private Integer tableId;
+    private Integer assetTableId;
+    private Integer columnSetId;
+    private Integer baseType;
+    private Integer userTaskId;
+    private Long createdById;
+    private Long createDept;
+    private Long createBy;
+    private LocalDateTime createTime;
+    private Long updateBy;
+    private LocalDateTime updateTime;
+
+    // 构造方法
+    public DmColumn() {}
+
+    public DmColumn(String name, String displayName) {
+        this.name = name;
+        this.displayName = displayName;
+    }
+
+    // getter 和 setter 方法
+    public Long getId() { return id; }
+    public void setId(Long id) { this.id = id; }
+
+    public LocalDateTime getCreatedAt() { return createdAt; }
+    public void setCreatedAt(LocalDateTime createdAt) { this.createdAt = createdAt; }
+
+    public LocalDateTime getUpdatedAt() { return updatedAt; }
+    public void setUpdatedAt(LocalDateTime updatedAt) { this.updatedAt = updatedAt; }
+
+    public LocalDateTime getDeletedAt() { return deletedAt; }
+    public void setDeletedAt(LocalDateTime deletedAt) { this.deletedAt = deletedAt; }
+
+    public String getName() { return name; }
+    public void setName(String name) { this.name = name; }
+
+    public String getDisplayName() { return displayName; }
+    public void setDisplayName(String displayName) { this.displayName = displayName; }
+
+    public Long getStorageDataType() { return storageDataType; }
+    public void setStorageDataType(Long storageDataType) { this.storageDataType = storageDataType; }
+
+    public Long getBusinessDataType() { return businessDataType; }
+    public void setBusinessDataType(Long businessDataType) { this.businessDataType = businessDataType; }
+
+    public Boolean getIsBuiltIn() { return isBuiltIn; }
+    public void setIsBuiltIn(Boolean isBuiltIn) { this.isBuiltIn = isBuiltIn; }
+
+    public Boolean getIsHidden() { return isHidden; }
+    public void setIsHidden(Boolean isHidden) { this.isHidden = isHidden; }
+
+    public Boolean getIsNotNormalizable() { return isNotNormalizable; }
+    public void setIsNotNormalizable(Boolean isNotNormalizable) { this.isNotNormalizable = isNotNormalizable; }
+
+    public Boolean getIsRequired() { return isRequired; }
+    public void setIsRequired(Boolean isRequired) { this.isRequired = isRequired; }
+
+    public Integer getCategoryId() { return categoryId; }
+    public void setCategoryId(Integer categoryId) { this.categoryId = categoryId; }
+
+    public Integer getCustomAssetCategoryId() { return customAssetCategoryId; }
+    public void setCustomAssetCategoryId(Integer customAssetCategoryId) { this.customAssetCategoryId = customAssetCategoryId; }
+
+    public Boolean getIsVirtual() { return isVirtual; }
+    public void setIsVirtual(Boolean isVirtual) { this.isVirtual = isVirtual; }
+
+    public Integer getTableId() { return tableId; }
+    public void setTableId(Integer tableId) { this.tableId = tableId; }
+
+    public Integer getAssetTableId() { return assetTableId; }
+    public void setAssetTableId(Integer assetTableId) { this.assetTableId = assetTableId; }
+
+    public Integer getColumnSetId() { return columnSetId; }
+    public void setColumnSetId(Integer columnSetId) { this.columnSetId = columnSetId; }
+
+    public Integer getBaseType() { return baseType; }
+    public void setBaseType(Integer baseType) { this.baseType = baseType; }
+
+    public Integer getUserTaskId() { return userTaskId; }
+    public void setUserTaskId(Integer userTaskId) { this.userTaskId = userTaskId; }
+
+    public Long getCreatedById() { return createdById; }
+    public void setCreatedById(Long createdById) { this.createdById = createdById; }
+
+    public Long getCreateDept() { return createDept; }
+    public void setCreateDept(Long createDept) { this.createDept = createDept; }
+
+    public Long getCreateBy() { return createBy; }
+    public void setCreateBy(Long createBy) { this.createBy = createBy; }
+
+    public LocalDateTime getCreateTime() { return createTime; }
+    public void setCreateTime(LocalDateTime createTime) { this.createTime = createTime; }
+
+    public Long getUpdateBy() { return updateBy; }
+    public void setUpdateBy(Long updateBy) { this.updateBy = updateBy; }
+
+    public LocalDateTime getUpdateTime() { return updateTime; }
+    public void setUpdateTime(LocalDateTime updateTime) { this.updateTime = updateTime; }
+
+    @Override
+    public String toString() {
+        return "DmColumn{" +
+                "id=" + id +
+                ", name='" + name + '\'' +
+                ", displayName='" + displayName + '\'' +
+                ", isBuiltIn=" + isBuiltIn +
+                ", isHidden=" + isHidden +
+                '}';
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DmNormalizeRule.java

@@ -0,0 +1,131 @@
+package com.common.entity;
+
+import java.time.LocalDateTime;
+
+public class DmNormalizeRule {
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private LocalDateTime deletedAt;
+    private String name;
+    private String displayName;
+    private String description;
+    private Boolean isBuiltIn;
+    private Boolean isRunning;
+    private LocalDateTime firstDataSavedAt;
+    private String dataType;
+    private Integer fieldCateId;
+    private String logParsed;
+    private String[] sampleLogs;
+    private Boolean isDataMergeEnabled;
+    private Long dataMergeInterval;
+    private String dataMergeTimeUnit;
+    private Long dataMergeRowLimit;
+    private String dataMergeColumns;
+    private Short dataStorageMedium;
+    private Integer createdById;
+    private Integer groupId;
+    private String ruleContent;
+    private String builtInVersion;
+    private String tenantId;
+    private LocalDateTime createTime;
+    private LocalDateTime updateTime;
+    private Long createBy;
+    private Long updateBy;
+    private String delFlag;
+    private Long createDept;
+
+    // getters and setters
+    public Long getId() { return id; }
+    public void setId(Long id) { this.id = id; }
+
+    public LocalDateTime getCreatedAt() { return createdAt; }
+    public void setCreatedAt(LocalDateTime createdAt) { this.createdAt = createdAt; }
+
+    public LocalDateTime getUpdatedAt() { return updatedAt; }
+    public void setUpdatedAt(LocalDateTime updatedAt) { this.updatedAt = updatedAt; }
+
+    public LocalDateTime getDeletedAt() { return deletedAt; }
+    public void setDeletedAt(LocalDateTime deletedAt) { this.deletedAt = deletedAt; }
+
+    public String getName() { return name; }
+    public void setName(String name) { this.name = name; }
+
+    public String getDisplayName() { return displayName; }
+    public void setDisplayName(String displayName) { this.displayName = displayName; }
+
+    public String getDescription() { return description; }
+    public void setDescription(String description) { this.description = description; }
+
+    public Boolean getIsBuiltIn() { return isBuiltIn; }
+    public void setIsBuiltIn(Boolean isBuiltIn) { this.isBuiltIn = isBuiltIn; }
+
+    public Boolean getIsRunning() { return isRunning; }
+    public void setIsRunning(Boolean isRunning) { this.isRunning = isRunning; }
+
+    public LocalDateTime getFirstDataSavedAt() { return firstDataSavedAt; }
+    public void setFirstDataSavedAt(LocalDateTime firstDataSavedAt) { this.firstDataSavedAt = firstDataSavedAt; }
+
+    public String getDataType() { return dataType; }
+    public void setDataType(String dataType) { this.dataType = dataType; }
+
+    public Integer getFieldCateId() { return fieldCateId; }
+    public void setFieldCateId(Integer fieldCateId) { this.fieldCateId = fieldCateId; }
+
+    public String getLogParsed() { return logParsed; }
+    public void setLogParsed(String logParsed) { this.logParsed = logParsed; }
+
+    public String[] getSampleLogs() { return sampleLogs; }
+    public void setSampleLogs(String[] sampleLogs) { this.sampleLogs = sampleLogs; }
+
+    public Boolean getIsDataMergeEnabled() { return isDataMergeEnabled; }
+    public void setIsDataMergeEnabled(Boolean isDataMergeEnabled) { this.isDataMergeEnabled = isDataMergeEnabled; }
+
+    public Long getDataMergeInterval() { return dataMergeInterval; }
+    public void setDataMergeInterval(Long dataMergeInterval) { this.dataMergeInterval = dataMergeInterval; }
+
+    public String getDataMergeTimeUnit() { return dataMergeTimeUnit; }
+    public void setDataMergeTimeUnit(String dataMergeTimeUnit) { this.dataMergeTimeUnit = dataMergeTimeUnit; }
+
+    public Long getDataMergeRowLimit() { return dataMergeRowLimit; }
+    public void setDataMergeRowLimit(Long dataMergeRowLimit) { this.dataMergeRowLimit = dataMergeRowLimit; }
+
+    public String getDataMergeColumns() { return dataMergeColumns; }
+    public void setDataMergeColumns(String dataMergeColumns) { this.dataMergeColumns = dataMergeColumns; }
+
+    public Short getDataStorageMedium() { return dataStorageMedium; }
+    public void setDataStorageMedium(Short dataStorageMedium) { this.dataStorageMedium = dataStorageMedium; }
+
+    public Integer getCreatedById() { return createdById; }
+    public void setCreatedById(Integer createdById) { this.createdById = createdById; }
+
+    public Integer getGroupId() { return groupId; }
+    public void setGroupId(Integer groupId) { this.groupId = groupId; }
+
+    public String getRuleContent() { return ruleContent; }
+    public void setRuleContent(String ruleContent) { this.ruleContent = ruleContent; }
+
+    public String getBuiltInVersion() { return builtInVersion; }
+    public void setBuiltInVersion(String builtInVersion) { this.builtInVersion = builtInVersion; }
+
+    public String getTenantId() { return tenantId; }
+    public void setTenantId(String tenantId) { this.tenantId = tenantId; }
+
+    public LocalDateTime getCreateTime() { return createTime; }
+    public void setCreateTime(LocalDateTime createTime) { this.createTime = createTime; }
+
+    public LocalDateTime getUpdateTime() { return updateTime; }
+    public void setUpdateTime(LocalDateTime updateTime) { this.updateTime = updateTime; }
+
+    public Long getCreateBy() { return createBy; }
+    public void setCreateBy(Long createBy) { this.createBy = createBy; }
+
+    public Long getUpdateBy() { return updateBy; }
+    public void setUpdateBy(Long updateBy) { this.updateBy = updateBy; }
+
+    public String getDelFlag() { return delFlag; }
+    public void setDelFlag(String delFlag) { this.delFlag = delFlag; }
+
+    public Long getCreateDept() { return createDept; }
+    public void setCreateDept(Long createDept) { this.createDept = createDept; }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/GroupedSyslogData.java

@@ -0,0 +1,37 @@
+package com.common.entity;
+import lombok.Data;
+import java.time.LocalDateTime;
+
+@Data
+public class GroupedSyslogData {
+    private String logDate;
+    private String srcIp;
+    private String destIp;
+    private String[] attackIps;
+    private String originEventName;
+    private Integer attackResult;  // 单个attack_result值
+    private LocalDateTime minLogTime;
+    private LocalDateTime maxLogTime;
+    private Long logCount;
+    private String[] victimIps;
+    private String[] victimWebUrls;
+    private Integer[] deviceIds;
+    private String[] originLogIds;
+    private Integer maxEventLevel;
+    private String firstEventType;
+    private String eventType;
+    private String minEventType;
+    private Integer[] attackPorts;
+    private Integer[] victimPorts;
+    private String[] httpStatusCodes;
+    private byte[][] payloadSamples;
+    private String[] httpReqHeaders;
+    private String[] httpReqBodys;
+    private String[] httpRespHeaders;
+    private String[] httpRespBodys;
+    private String dnsInfo;
+    private String victimIpsStr;
+    private Integer[] allAttackResults;  // 所有不同的attack_result值
+    private Integer mostCommonAttackResult;  // 最常见的attack_result值
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RFC3164Message.java

@@ -0,0 +1,16 @@
+package com.common.entity;
+
+public class RFC3164Message extends SyslogMessage {
+    private String tag;
+
+    public String getTag() { return tag; }
+    public void setTag(String tag) { this.tag = tag; }
+
+    @Override
+    public String toString() {
+        return String.format("RFC3164 [Facility: %d, Severity: %d, Host: %s, Tag: %s, Time: %s, Msg: %s]",
+                facility, severity, hostname, tag, timestamp, message);
+    }
+
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RFC5424Message.java

@@ -0,0 +1,29 @@
+package com.common.entity;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public class  RFC5424Message extends SyslogMessage {
+    private int version;
+    private Map<String, Map<String, String>> structuredData;
+
+    public RFC5424Message() {
+        this.structuredData = new HashMap<>();
+    }
+
+    public int getVersion() {
+        return version;
+    }
+
+    public void setVersion(int version) {
+        this.version = version;
+    }
+
+    public Map<String, Map<String, String>> getStructuredData() {
+        return structuredData;
+    }
+
+    public void setStructuredData(Map<String, Map<String, String>> structuredData) {
+        this.structuredData = structuredData;
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleContent/ActionType.java

@@ -0,0 +1,46 @@
+package com.common.entity.RuleContent;
+
+
+public class ActionType {
+    private String type;
+    private String relation_parser_id;
+    private Object sparser_param;
+    private Object param;
+
+    // Constructors
+    public ActionType() {}
+
+    // Getters and Setters
+    public String gettype() {
+        return type;
+    }
+
+    public void settype(String type) {
+        this.type = type;
+    }
+
+    public String getrelation_parser_id() {
+        return relation_parser_id;
+    }
+
+    public void setrelation_parser_id(String relation_parser_id) {
+        this.relation_parser_id = relation_parser_id;
+    }
+
+    public Object getsparser_param() {
+        return sparser_param;
+    }
+
+    public void setsparser_param(Object sparser_param) {
+        this.sparser_param = sparser_param;
+    }
+
+    public Object getparam() {
+        return param;
+    }
+
+    public void setparam(Object param) {
+        this.param = param;
+    }
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleContent/CompleteColumn.java

@@ -0,0 +1,26 @@
+package com.common.entity.RuleContent;
+
+
+import lombok.Data;
+import java.util.List;
+
+@Data
+public class CompleteColumn {
+    private String columnName;           // 要补全的字段名
+    private Object value;                // 补全的值
+    private String filtersRelation;      // 条件关系: "and" 或 "or"
+    private List<Condition> conditions;  // 条件列表
+
+    // 导入数据相关字段（扩展功能）
+    private String importedDataTableName;
+    private String filtersImportedRelation;
+    private List<Condition> importedConditions;
+    private List<CompleteColumn> completeImportedColumns;
+}
+
+@Data
+class Condition {
+    private String columnName;  // 条件字段名
+    private String op;          // 操作符: =, !=, in, zero_len, contain, regexp
+    private Object value;       // 条件值
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleContent/Complete_paramsType.java

@@ -0,0 +1,37 @@
+package com.common.entity.RuleContent;
+
+
+public class Complete_paramsType {
+    private String name;
+    private String value;
+    private FiltersType filters;
+
+    // Constructors
+    public Complete_paramsType() {}
+
+    // Getters and Setters
+    public String getname() {
+        return name;
+    }
+
+    public void setname(String name) {
+        this.name = name;
+    }
+
+    public String getvalue() {
+        return value;
+    }
+
+    public void setvalue(String value) {
+        this.value = value;
+    }
+
+    public FiltersType getfilters() {
+        return filters;
+    }
+
+    public void setfilters(FiltersType filters) {
+        this.filters = filters;
+    }
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleContent/Cropper_paramsType.java

@@ -0,0 +1,46 @@
+package com.common.entity.RuleContent;
+
+
+public class Cropper_paramsType {
+    private String head_key;
+    private Integer head_offset;
+    private String tail_key;
+    private Integer tail_offset;
+
+    // Constructors
+    public Cropper_paramsType() {}
+
+    // Getters and Setters
+    public String gethead_key() {
+        return head_key;
+    }
+
+    public void sethead_key(String head_key) {
+        this.head_key = head_key;
+    }
+
+    public Integer gethead_offset() {
+        return head_offset;
+    }
+
+    public void sethead_offset(Integer head_offset) {
+        this.head_offset = head_offset;
+    }
+
+    public String gettail_key() {
+        return tail_key;
+    }
+
+    public void settail_key(String tail_key) {
+        this.tail_key = tail_key;
+    }
+
+    public Integer gettail_offset() {
+        return tail_offset;
+    }
+
+    public void settail_offset(Integer tail_offset) {
+        this.tail_offset = tail_offset;
+    }
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleContent/FilterParam.java

@@ -0,0 +1,22 @@
+package com.common.entity.RuleContent;
+
+import lombok.Data;
+import java.util.List;
+
+@Data
+public class FilterParam {
+    private List<FilterGroup> filtersParams;
+}
+
+@Data
+class FilterGroup {
+    private List<FilterExpression> expressions;
+    private String filtersRelation;  // "and" 或 "or"
+}
+
+@Data
+class FilterExpression {
+    private String columnName;  // 字段名
+    private String op;          // 操作符: =, !=, in, zero_len, contain, regexp
+    private Object value;       // 值，可能是字符串、数组等
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleContent/FiltersType.java

@@ -0,0 +1,9 @@
+package com.common.entity.RuleContent;
+
+public class FiltersType {
+
+    // Constructors
+    public FiltersType() {}
+
+    // Getters and Setters
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleContent/MappersType.java

@@ -0,0 +1,91 @@
+package com.common.entity.RuleContent;
+
+
+public class MappersType {
+    private Integer capture_group_index;
+    private String origin_field;
+    private String src_field;
+    private String dest_field;
+    private String value;
+    private String assigned_value;
+    private Integer strategy;
+    private String mapping_rule_name;
+    private ActionType action;
+
+    // Constructors
+    public MappersType() {}
+
+    // Getters and Setters
+    public Integer getcapture_group_index() {
+        return capture_group_index;
+    }
+
+    public void setcapture_group_index(Integer capture_group_index) {
+        this.capture_group_index = capture_group_index;
+    }
+
+    public String getorigin_field() {
+        return origin_field;
+    }
+
+    public void setorigin_field(String origin_field) {
+        this.origin_field = origin_field;
+    }
+
+    public String getsrc_field() {
+        return src_field;
+    }
+
+    public void setsrc_field(String src_field) {
+        this.src_field = src_field;
+    }
+
+    public String getdest_field() {
+        return dest_field;
+    }
+
+    public void setdest_field(String dest_field) {
+        this.dest_field = dest_field;
+    }
+
+    public String getvalue() {
+        return value;
+    }
+
+    public void setvalue(String value) {
+        this.value = value;
+    }
+
+    public String getassigned_value() {
+        return assigned_value;
+    }
+
+    public void setassigned_value(String assigned_value) {
+        this.assigned_value = assigned_value;
+    }
+
+    public Integer getstrategy() {
+        return strategy;
+    }
+
+    public void setstrategy(Integer strategy) {
+        this.strategy = strategy;
+    }
+
+    public String getmapping_rule_name() {
+        return mapping_rule_name;
+    }
+
+    public void setmapping_rule_name(String mapping_rule_name) {
+        this.mapping_rule_name = mapping_rule_name;
+    }
+
+    public ActionType getaction() {
+        return action;
+    }
+
+    public void setaction(ActionType action) {
+        this.action = action;
+    }
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleContent/Root.java

@@ -0,0 +1,140 @@
+package com.common.entity.RuleContent;
+import java.util.List;
+import java.util.ArrayList;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.common.entity.RuleContent.*;
+
+
+public class Root {
+    private Integer field_cate_id;
+    private Integer field_cate_table_name;
+    private String rule_name;
+    private String data_type;
+    private String decode;
+    private List<String> keywords;
+    private Cropper_paramsType cropper_params;
+    private Object second_parsers;
+    private Object second_parsers_v2;
+    private List<MappersType> mappers;
+    private String filters_params;
+    private List<Complete_paramsType> complete_params;
+    private String complete_columns;
+    private Integer data_storage_medium;
+
+    // Constructors
+    public Root() {}
+
+    // Getters and Setters
+    public Integer getfield_cate_id() {
+        return field_cate_id;
+    }
+
+    public void setfield_cate_id(Integer field_cate_id) {
+        this.field_cate_id = field_cate_id;
+    }
+
+    public Integer getfield_cate_table_name() {
+        return field_cate_table_name;
+    }
+
+    public void setfield_cate_table_name(Integer field_cate_table_name) {
+        this.field_cate_table_name = field_cate_table_name;
+    }
+
+    public String getrule_name() {
+        return rule_name;
+    }
+
+    public void setrule_name(String rule_name) {
+        this.rule_name = rule_name;
+    }
+
+    public String getdata_type() {
+        return data_type;
+    }
+
+    public void setdata_type(String data_type) {
+        this.data_type = data_type;
+    }
+
+    public String getdecode() {
+        return decode;
+    }
+
+    public void setdecode(String decode) {
+        this.decode = decode;
+    }
+
+    public List<String> getkeywords() {
+        return keywords;
+    }
+
+    public void setkeywords(List<String> keywords) {
+        this.keywords = keywords;
+    }
+
+    public Cropper_paramsType getcropper_params() {
+        return cropper_params;
+    }
+
+    public void setcropper_params(Cropper_paramsType cropper_params) {
+        this.cropper_params = cropper_params;
+    }
+
+    public Object getsecond_parsers() {
+        return second_parsers;
+    }
+
+    public void setsecond_parsers(Object second_parsers) {
+        this.second_parsers = second_parsers;
+    }
+
+    public Object getsecond_parsers_v2() {
+        return second_parsers_v2;
+    }
+
+    public void setsecond_parsers_v2(Object second_parsers_v2) {
+        this.second_parsers_v2 = second_parsers_v2;
+    }
+
+    public List<MappersType> getmappers() {
+        return mappers;
+    }
+
+    public void setmappers(List<MappersType> mappers) {
+        this.mappers = mappers;
+    }
+
+    public String getfilters_params() {
+        return filters_params;
+    }
+
+    public void setfilters_params(String filters_params) {
+        this.filters_params = filters_params;
+    }
+
+    public List<Complete_paramsType> getcomplete_params() {
+        return complete_params;
+    }
+
+    public void setcomplete_params(List<Complete_paramsType> complete_params) {
+        this.complete_params = complete_params;
+    }
+
+    public String getcomplete_columns() {
+        return complete_columns;
+    }
+
+    public void setcomplete_columns(String complete_columns) {
+        this.complete_columns = complete_columns;
+    }
+
+    public Integer getdata_storage_medium() {
+        return data_storage_medium;
+    }
+
+    public void setdata_storage_medium(Integer data_storage_medium) {
+        this.data_storage_medium = data_storage_medium;
+    }
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleContent/RuleContent.java

@@ -0,0 +1,139 @@
+package com.common.entity.RuleContent;
+import java.util.List;
+import java.util.ArrayList;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.common.entity.RuleContent.*;
+public class RuleContent {
+
+    private Integer field_cate_id;
+    private Integer field_cate_table_name;
+    private String rule_name;
+    private String data_type;
+    private String decode;
+    private List<String> keywords;
+    private Cropper_paramsType cropper_params;
+    private Object second_parsers;
+    private Object second_parsers_v2;
+    private List<MappersType> mappers;
+    private String filters_params;
+    private List<Complete_paramsType> complete_params;
+    private String complete_columns;
+    private Integer data_storage_medium;
+
+    // Constructors
+    public RuleContent() {}
+
+    // Getters and Setters
+    public Integer getfield_cate_id() {
+        return field_cate_id;
+    }
+
+    public void setfield_cate_id(Integer field_cate_id) {
+        this.field_cate_id = field_cate_id;
+    }
+
+    public Integer getfield_cate_table_name() {
+        return field_cate_table_name;
+    }
+
+    public void setfield_cate_table_name(Integer field_cate_table_name) {
+        this.field_cate_table_name = field_cate_table_name;
+    }
+
+    public String getrule_name() {
+        return rule_name;
+    }
+
+    public void setrule_name(String rule_name) {
+        this.rule_name = rule_name;
+    }
+
+    public String getdata_type() {
+        return data_type;
+    }
+
+    public void setdata_type(String data_type) {
+        this.data_type = data_type;
+    }
+
+    public String getdecode() {
+        return decode;
+    }
+
+    public void setdecode(String decode) {
+        this.decode = decode;
+    }
+
+    public List<String> getkeywords() {
+        return keywords;
+    }
+
+    public void setkeywords(List<String> keywords) {
+        this.keywords = keywords;
+    }
+
+    public Cropper_paramsType getcropper_params() {
+        return cropper_params;
+    }
+
+    public void setcropper_params(Cropper_paramsType cropper_params) {
+        this.cropper_params = cropper_params;
+    }
+
+    public Object getsecond_parsers() {
+        return second_parsers;
+    }
+
+    public void setsecond_parsers(Object second_parsers) {
+        this.second_parsers = second_parsers;
+    }
+
+    public Object getsecond_parsers_v2() {
+        return second_parsers_v2;
+    }
+
+    public void setsecond_parsers_v2(Object second_parsers_v2) {
+        this.second_parsers_v2 = second_parsers_v2;
+    }
+
+    public List<MappersType> getmappers() {
+        return mappers;
+    }
+
+    public void setmappers(List<MappersType> mappers) {
+        this.mappers = mappers;
+    }
+
+    public String getfilters_params() {
+        return filters_params;
+    }
+
+    public void setfilters_params(String filters_params) {
+        this.filters_params = filters_params;
+    }
+
+    public List<Complete_paramsType> getcomplete_params() {
+        return complete_params;
+    }
+
+    public void setcomplete_params(List<Complete_paramsType> complete_params) {
+        this.complete_params = complete_params;
+    }
+
+    public String getcomplete_columns() {
+        return complete_columns;
+    }
+
+    public void setcomplete_columns(String complete_columns) {
+        this.complete_columns = complete_columns;
+    }
+
+    public Integer getdata_storage_medium() {
+        return data_storage_medium;
+    }
+
+    public void setdata_storage_medium(Integer data_storage_medium) {
+        this.data_storage_medium = data_storage_medium;
+    }
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleContent/kv_paramsType.java

@@ -0,0 +1,11 @@
+package com.common.entity.RuleContent;
+
+import lombok.Data;
+
+@Data
+public class kv_paramsType {
+    private String internal;
+    private String external;
+    private String l_trim;
+    private String r_trim;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/RuleHitTimeDTO.java

@@ -0,0 +1,23 @@
+package com.common.entity;
+
+
+import lombok.Data;
+import java.time.LocalDateTime;
+
+@Data
+public class RuleHitTimeDTO {
+    /**
+     * 泛化规则ID
+     */
+    private Long normalizeRuleId;
+
+    /**
+     * 最大命中时间（从标准化表中统计）
+     */
+    private LocalDateTime maxLogTime;
+
+    /**
+     * 数据来源表
+     */
+    private String sourceTable;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/SecExceptionAlgorithm.java

@@ -0,0 +1,27 @@
+package com.common.entity;
+
+import lombok.Data;
+import java.time.LocalDateTime;
+
+@Data
+public class SecExceptionAlgorithm {
+    private Long id;
+    private String algorithmName;
+    private String exceptionType;
+    private String dataSource;
+    private Integer status; // 1启用
+    private String description;
+    private String configInfo;
+    private String operatorZipUrl;
+    private String remark;
+    private String createBy;
+    private LocalDateTime createTime;
+    private String updateBy;
+    private LocalDateTime updateTime;
+    private String tenantId;
+    private String delFlag;
+    private Long createDept;
+    private String apiUrl; // API URL
+    private String apiMethod; // GET/POST
+    private String respUrl;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/SyslogMessage.java

@@ -0,0 +1,47 @@
+package com.common.entity;
+
+import java.time.OffsetDateTime;
+import java.util.HashMap;
+import java.util.Map;
+
+// 基础 Syslog 消息类
+public abstract class SyslogMessage {
+    protected int priority;
+    protected int facility;
+    protected int severity;
+    protected String hostname;
+    protected String appName;
+    protected String procId;
+    protected String msgId;
+    protected String message;
+    protected OffsetDateTime timestamp;
+
+    // Getters and Setters
+    public int getPriority() { return priority; }
+    public void setPriority(int priority) {
+        this.priority = priority;
+        this.facility = priority / 8;
+        this.severity = priority % 8;
+    }
+
+    public int getFacility() { return facility; }
+    public int getSeverity() { return severity; }
+    public String getHostname() { return hostname; }
+    public void setHostname(String hostname) { this.hostname = hostname; }
+    public String getAppName() { return appName; }
+    public void setAppName(String appName) { this.appName = appName; }
+    public String getProcId() { return procId; }
+    public void setProcId(String procId) { this.procId = procId; }
+    public String getMsgId() { return msgId; }
+    public void setMsgId(String msgId) { this.msgId = msgId; }
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+    public OffsetDateTime getTimestamp() { return timestamp; }
+    public void setTimestamp(OffsetDateTime timestamp) { this.timestamp = timestamp; }
+
+    @Override
+    public String toString() {
+        return String.format("Facility: %d, Severity: %d, Host: %s, App: %s, Time: %s, Msg: %s",
+                facility, severity, hostname, appName, timestamp, message);
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/SyslogNonNormalMessage.java

@@ -0,0 +1,162 @@
+package com.common.entity;
+
+
+import com.baomidou.mybatisplus.annotation.*;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+import java.time.LocalDateTime;
+import java.time.OffsetDateTime;
+
+/**
+ * 非标日志实体类
+ */
+@Data
+@EqualsAndHashCode(callSuper = false)
+@TableName("syslog_non_normal_message")
+public class SyslogNonNormalMessage {
+
+    /**
+     * 非标ID
+     */
+    @TableId(value = "id", type = IdType.INPUT)
+    private String id;
+
+    /**
+     * 记录时间（UTC时区）
+     */
+    @TableField("created_at")
+    private OffsetDateTime createdAt;
+
+    /**
+     * log处理时间
+     */
+    @TableField("log_time")
+    private LocalDateTime logTime;
+
+    /**
+     * 设备ID
+     */
+    @TableField("device_id")
+    private Integer deviceId;
+
+    /**
+     * 原始日志
+     */
+    @TableField("syslog_message")
+    private String syslogMessage;
+
+    /**
+     * 安全日志ID
+     */
+    @TableField("syslog_uuid")
+    private String syslogUuid;
+
+    /**
+     * kafka topic
+     */
+    @TableField("syslog_topic")
+    private String syslogTopic;
+
+    /**
+     * 租户ID
+     */
+    @TableField("tenant_id")
+    private String tenantId;
+
+    /**
+     * 创建时间
+     */
+    @TableField("create_time")
+    private LocalDateTime createTime;
+
+    /**
+     * 更新时间
+     */
+    @TableField("update_time")
+    private LocalDateTime updateTime;
+
+    /**
+     * 创建者
+     */
+    @TableField("create_by")
+    private Long createBy;
+
+    /**
+     * 更新者
+     */
+    @TableField("update_by")
+    private Long updateBy;
+
+    /**
+     * 创建部门
+     */
+    @TableField("create_dept")
+    private Long createDept;
+
+    /**
+     * 采集头部消息
+     */
+    @TableField("header_message")
+    private String headerMessage;
+
+    /**
+     * 接收时间
+     */
+    @TableField("receive_time")
+    private LocalDateTime receiveTime;
+
+    /**
+     * 泛化时间
+     */
+    @TableField("rule_time")
+    private LocalDateTime ruleTime;
+
+    /**
+     * 设备名称
+     */
+    @TableField("device_name")
+    private String deviceName;
+
+    /**
+     * ETL处理节点
+     */
+    @TableField("etl_node")
+    private String etlNode;
+
+    /**
+     * 采集任务ID
+     */
+    @TableField("collect_task_id")
+    private Integer collectTaskId;
+
+    /**
+     * 采集任务名称
+     */
+    @TableField("collect_task_name")
+    private String collectTaskName;
+
+    /**
+     * 非标原因
+     */
+    @TableField("reason")
+    private String reason;
+
+    /**
+     * 详细原因
+     */
+    @TableField("reason_detail")
+    private String reasonDetail;
+
+    /**
+     * 泛化结果
+     */
+    @TableField("rule_result")
+    private String ruleResult;
+
+    /**
+     * 删除标志
+     */
+    @TableField("del_flag")
+    private String delFlag;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/SyslogNormalAlarm.java

@@ -0,0 +1,383 @@
+package com.common.entity;
+
+import lombok.Data;
+
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+
+@Data
+public class SyslogNormalAlarm {
+    private String id;
+    private LocalDateTime createdAt;
+    private LocalDateTime logTime;
+    private Integer deviceId;
+    private String webshellType;
+    private String vuirsType;
+    private String vuirsUrl;
+    private String classFilename;
+    private String classPath;
+    private String parentClass;
+    private String jarPath;
+    private String classMd5;
+    private String classLoader;
+    private String classHashcode;
+    private String classLoaderHashcode;
+    private String tcNameip;
+    private String performSql;
+    private String tcAccount;
+    private String tcAppname;
+    private String processUname;
+    private String pProcessUname;
+    private String containerName;
+    private String containerId;
+    private String httpRespServer;
+    private Long srcipId;
+    private String cdnip;
+    private String natip;
+    private String mailSender;
+    private String mailReceiver;
+    private String vpnMac;
+    private String vpnOs;
+    private String vpnUser;
+    private String vpnGroupname;
+    private String vpnAccessIp;
+    private Boolean destIpApt;
+    private String originAttackResult;
+    private String description;
+    private String solution;
+    private String attackCause;
+    private String username;
+    private String tcFlowId;
+    private String loginResult;
+    private String cmdline;
+    private String originAttackAction;
+    private String victimDomain;
+    private String vpnDeviceid;
+    private String vpnAccessAction;
+    private Long fileAccessTime;
+    private String fileName;
+    private String tcClass;
+    private String tcName2;
+    private Long loginLasttime;
+    private String originPermissions;
+    private String beginPermissions;
+    private Long printTime;
+    private String printer;
+    private String printerType;
+    private Long printPages;
+    private Long printCopies;
+    private String srcDevice;
+    private String dstDevice;
+    private String srcFile;
+    private String srcFileType;
+    private String srcFilePath;
+    private String dstFile;
+    private String dstFileType;
+    private String dstFilePath;
+    private String dlpPolicyName;
+    private String dlpPolicyType;
+    private String dstUploadUrl;
+    private String processUuid;
+    private String pProcessUuid;
+    private String env;
+    private String bruteForceService;
+    private String vuirsName;
+    private Long httpReqLength;
+    private String httpReqContentType;
+    private String tcScanPort;
+    private String tcLabels;
+    private String httpRespContentType;
+    private String dnsMsgType;
+    private String dnsAnswerLength;
+    private Boolean dnsIoc;
+    private BigDecimal txBytes;
+    private BigDecimal rxBytes;
+    private BigDecimal allBytes;
+    private Long durationTime;
+    private String mailAttachName;
+    private String mailSubject;
+    private String mailMessage;
+    private String mailSendServer;
+    private String mailAgent;
+    private String tlsVersion;
+    private String tlsServerCert;
+    private String tlsServerSuite;
+    private String tlsClientSuitesLen;
+    private String tlsJa3;
+    private String tlsJa3s;
+    private String vpnAccessPort;
+    private String logTopic;
+    private Long collectTime;
+    private Boolean srcIsIntranetip;
+    private Boolean srcIpIoc;
+    private Boolean srcIpApt;
+    private String srcipName;
+    private String tcClient;
+    private Long srcipOrganizationId;
+    private Boolean destIpIntranetip;
+    private Boolean destIpIoc;
+    private Long desipId;
+    private String desipName;
+    private String tcHostip;
+    private Long desipOrganizationId;
+    private String originConfidence;
+    private String originMalscore;
+    private String attackerIcampaign;
+    private Long attackerHostAssetId;
+    private Long attackerOrganizationId;
+    private Long victimHostAssetId;
+    private Long victimOrganizationId;
+    private Long logoutTime;
+    private String httpReqLine;
+    private String desipSecurityScopeId;
+    private String srcipSecurityScopeId;
+    private Long httpRespLength;
+    private String tcAttackType;
+    private String tcRealip;
+    private String attackerIpLists;
+    private String loginPassword;
+    private String detail;
+    private String attackerCountryCode;
+    private String attackerRegionCode;
+    private String victimRegionCode;
+    private String payload;
+    private String httpReferer;
+    private String httpUserAgent;
+    private String httpSession;
+    private String httpQueryString;
+    private String filePath;
+    private String filePermission;
+    private String loginAbnormalType;
+    private String fileTag;
+    private String filePlatform;
+    private String targetIp;
+    private String collectDate;
+    private String tcClientIp;
+    private String tcServerIp;
+    private String tcExternalip;
+    private Long httpStatusCode;
+    private String deviceDomian;
+    private String srcIpStr;
+    private String srcPortStr;
+    private String destIpStr;
+    private String destPortStr;
+    private String pcap;
+    private String ioc;
+    private String maliciousFamily;
+    private String vulnCve;
+    private String aliyunType;
+    private String attackerHostAssetName;
+    private String attackerOrganizationName;
+    private String ctId;
+    private String cveList;
+    private String desipOrganizationName;
+    private String destIpGroup;
+    private String fileGid;
+    private String fileOwner;
+    private String fileOwnergroup;
+    private String fileUid;
+    private String httpRespCookie;
+    private String originRuleId;
+    private String originRuleName;
+    private String serviceName;
+    private String srcIpAssetGroup;
+    private String srcipOrganizationName;
+    private String victimHostAssetName;
+    private Long httpRespCodes;
+    private String victimOrganizationName;
+    private String tcType;
+    private String direction;
+    private String httpReqCookie;
+    private String httpReqProtocol;
+    private String httpReqHeaderRaw;
+    private String httpUrl;
+    private String uname;
+    private String originHostname;
+    private String originOs;
+    private String originAgentMac;
+    private String originHostId;
+    private String originAgentVersion;
+    private String originAgentId;
+    private String originAgentName;
+    private String originWorkGroup;
+    private String originAssetGroup;
+    private Long originLocalPort;
+    private String originAgentIp;
+    private String originInternalIp;
+    private String originExternalIp;
+    private String originLocalAddr;
+    private Long agentId;
+    private String agentName;
+    private String tcTitle;
+    private String logId;
+    private LocalDateTime eventDate;
+    private Long eventTimeTs;
+    private Integer eventLevel;
+    private String srcIp;
+    private Long srcPort;
+    private String destIp;
+    private Long destPort;
+    private Long eventTime;
+    private String attackerCountry;
+    private String srcMac;
+    private String destMac;
+    private String proto;
+    private Long devId;
+    private Long createdTime;
+    private String srcCountry;
+    private String srcCountryCode;
+    private String srcRegion;
+    private String srcRegionCode;
+    private String srcCity;
+    private String srcLon;
+    private String httpMethod;
+    private String httpHost;
+    private String httpReqHeader;
+    private String httpReqBody;
+    private String httpRespHeader;
+    private String httpRespBody;
+    private String fileType;
+    private String fileMd5;
+    private String fileSize;
+    private String process;
+    private Long startTime;
+    private String action;
+    private String attackerRegion;
+    private Long endTime;
+    private Long fileCreatedTime;
+    private Long fileModifiedTime;
+    private String tcMiguanScanPort;
+    private String processPath;
+    private String parentProcessPath;
+    private String gname;
+    private String exeName;
+    private String exePath;
+    private Long loginTime;
+    private Long loginTimes;
+    private String checkItem;
+    private String checkType;
+    private String attackerIp;
+    private Long attackerPort;
+    private String victimIp;
+    private Long victimPort;
+    private String attackerCity;
+    private String attackerLon;
+    private String attackerLat;
+    private String victimCountry;
+    private String victimRegion;
+    private String victimCity;
+    private String victimLon;
+    private String victimLat;
+    private String originEventId;
+    private String originEventName;
+    private String originEventCategory;
+    private String originEventLevel;
+    private String originAttackChain;
+    private String engineType;
+    private String evilPayload;
+    private String httpRespStatus;
+    private String dnsQuery;
+    private String dnsQueryType;
+    private String dnsTtl;
+    private String dnsAnswer;
+    private String dnsSubdomains;
+    private String fileSha256;
+    private String fileSsdeep;
+    private String victimCountryCode;
+    private String httpXffIp;
+    private String tcMiguanClass;
+    private String pid;
+    private String ppid;
+    private String processName;
+    private String backdoorType;
+    private String tty;
+    private String sudoUser;
+    private String sudoGroup;
+    private String originEventType;
+    private String destDomain;
+    private String shellCmdline;
+    private String parentCmdline;
+    private String attackChain;
+    private String processTree;
+    private String hostFileSha256;
+    private String hostFileMd5;
+    private String hostFileSize;
+    private String hostFileType;
+    private String destCountry;
+    private String destCountryCode;
+    private String logOrigin;
+    private String destRegion;
+    private String srcLat;
+    private String destRegionCode;
+    private String destCity;
+    private String destLon;
+    private String destLat;
+    private Integer eventCategory;
+    private Integer attackResult;
+    private String probeIp;
+    private String deviceIp;
+    private String deviceManufacturer;
+    private String deviceName;
+    private String productName;
+    private String id1;
+    private Long count;
+    private String countReason;
+    private Integer eventType;
+    private String protocol;
+    private String shellCmd;
+    private String parentName;
+    private String hostFilePath;
+    private String uid;
+    private Integer fall;
+    private String tcMiguanServerIp;
+    private Integer devType;
+    private Integer collectMethod;
+    private Integer fieldCateId;
+    private Integer deviceType;
+    private String tcMiguanClientIp;
+    private String tcMiguanName;
+    private Long originTotalPackages;
+    private Long originTotalBytes;
+    private Long originPeakPackagesRate;
+    private Long originPeakBytesRate;
+    private Long originPeakFlowsRate;
+    private String aptOrgname;
+    private String aptOrgmsg;
+    private String mailMessageId;
+    private String mailBcc;
+    private String mailSize;
+    private String mailAttachHashcode;
+    private String mailUrl;
+    private String mailCc;
+    private String algorithm;
+    private String miningpoolIp;
+    private String processMd5;
+    private String pprocessMd5;
+    private String sourceServername;
+    private String originSourceServername;
+    private String mailFilename;
+    private String dstUploadAppname;
+    private Long targetPort;
+    private String gid;
+    private String originUid;
+    private String originGid;
+    private Long targetPorts;
+    private String tcMiguanName1;
+    private String tcMiguanClass1;
+    private Long etlTime;
+    private String tcMiguanScanPort2;
+    private String desipSecurityScope;
+    private String srcipSecurityScope;
+    private Long collectTimeTs;
+    private String tcMiguanScanPort1;
+    private String srcDevName;
+    private String collectProtocol;
+    private String destinationSystemType;
+    private String destinationSystem;
+    private String etlHost;
+    private Integer normalizeRuleId;
+    private String normalizeRuleName;
+    private String syslogUuid;
+    private String syslogTopic;
+
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/SyslogNormalData.java

@@ -0,0 +1,381 @@
+package com.common.entity;
+
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+
+@Data
+public class SyslogNormalData {
+    private String id;
+    private LocalDateTime createdAt;
+    private LocalDateTime logTime;
+    private Integer deviceId;
+    private String webshellType;
+    private String vuirsType;
+    private String vuirsUrl;
+    private String classFilename;
+    private String classPath;
+    private String parentClass;
+    private String jarPath;
+    private String classMd5;
+    private String classLoader;
+    private String classHashcode;
+    private String classLoaderHashcode;
+    private String tcNameip;
+    private String performSql;
+    private String tcAccount;
+    private String tcAppname;
+    private String processUname;
+    private String pProcessUname;
+    private String containerName;
+    private String containerId;
+    private String httpRespServer;
+    private Long srcipId;
+    private String cdnip;
+    private String natip;
+    private String mailSender;
+    private String mailReceiver;
+    private String vpnMac;
+    private String vpnOs;
+    private String vpnUser;
+    private String vpnGroupname;
+    private String vpnAccessIp;
+    private Boolean destIpApt;
+    private String originAttackResult;
+    private String description;
+    private String solution;
+    private String attackCause;
+    private String username;
+    private String tcFlowId;
+    private String loginResult;
+    private String cmdline;
+    private String originAttackAction;
+    private String victimDomain;
+    private String vpnDeviceid;
+    private String vpnAccessAction;
+    private Long fileAccessTime;
+    private String fileName;
+    private String tcClass;
+    private String tcName2;
+    private Long loginLasttime;
+    private String originPermissions;
+    private String beginPermissions;
+    private Long printTime;
+    private String printer;
+    private String printerType;
+    private Long printPages;
+    private Long printCopies;
+    private String srcDevice;
+    private String dstDevice;
+    private String srcFile;
+    private String srcFileType;
+    private String srcFilePath;
+    private String dstFile;
+    private String dstFileType;
+    private String dstFilePath;
+    private String dlpPolicyName;
+    private String dlpPolicyType;
+    private String dstUploadUrl;
+    private String processUuid;
+    private String pProcessUuid;
+    private String env;
+    private String bruteForceService;
+    private String vuirsName;
+    private Long httpReqLength;
+    private String httpReqContentType;
+    private String tcScanPort;
+    private String tcLabels;
+    private String httpRespContentType;
+    private String dnsMsgType;
+    private String dnsAnswerLength;
+    private Boolean dnsIoc;
+    private BigDecimal txBytes;
+    private BigDecimal rxBytes;
+    private BigDecimal allBytes;
+    private Long durationTime;
+    private String mailAttachName;
+    private String mailSubject;
+    private String mailMessage;
+    private String mailSendServer;
+    private String mailAgent;
+    private String tlsVersion;
+    private String tlsServerCert;
+    private String tlsServerSuite;
+    private String tlsClientSuitesLen;
+    private String tlsJa3;
+    private String tlsJa3s;
+    private String vpnAccessPort;
+    private String logTopic;
+    private Long collectTime;
+    private Boolean srcIsIntranetip;
+    private Boolean srcIpIoc;
+    private Boolean srcIpApt;
+    private String srcipName;
+    private String tcClient;
+    private Long srcipOrganizationId;
+    private Boolean destIpIntranetip;
+    private Boolean destIpIoc;
+    private Long desipId;
+    private String desipName;
+    private String tcHostip;
+    private Long desipOrganizationId;
+    private String originConfidence;
+    private String originMalscore;
+    private String attackerIcampaign;
+    private Long attackerHostAssetId;
+    private Long attackerOrganizationId;
+    private Long victimHostAssetId;
+    private Long victimOrganizationId;
+    private Long logoutTime;
+    private String httpReqLine;
+    private String desipSecurityScopeId;
+    private String srcipSecurityScopeId;
+    private Long httpRespLength;
+    private String tcAttackType;
+    private String tcRealip;
+    private String attackerIpLists;
+    private String loginPassword;
+    private String detail;
+    private String attackerCountryCode;
+    private String attackerRegionCode;
+    private String victimRegionCode;
+    private String payload;
+    private String httpReferer;
+    private String httpUserAgent;
+    private String httpSession;
+    private String httpQueryString;
+    private String filePath;
+    private String filePermission;
+    private String loginAbnormalType;
+    private String fileTag;
+    private String filePlatform;
+    private String targetIp;
+    private String collectDate;
+    private String tcClientIp;
+    private String tcServerIp;
+    private String tcExternalip;
+    private Long httpStatusCode;
+    private String deviceDomian;
+    private String srcIpStr;
+    private String srcPortStr;
+    private String destIpStr;
+    private String destPortStr;
+    private String pcap;
+    private String ioc;
+    private String maliciousFamily;
+    private String vulnCve;
+    private String aliyunType;
+    private String attackerHostAssetName;
+    private String attackerOrganizationName;
+    private String ctId;
+    private String cveList;
+    private String desipOrganizationName;
+    private String destIpGroup;
+    private String fileGid;
+    private String fileOwner;
+    private String fileOwnergroup;
+    private String fileUid;
+    private String httpRespCookie;
+    private String originRuleId;
+    private String originRuleName;
+    private String serviceName;
+    private String srcIpAssetGroup;
+    private String srcipOrganizationName;
+    private String victimHostAssetName;
+    private Long httpRespCodes;
+    private String victimOrganizationName;
+    private String tcType;
+    private String direction;
+    private String httpReqCookie;
+    private String httpReqProtocol;
+    private String httpReqHeaderRaw;
+    private String httpUrl;
+    private String uname;
+    private String originHostname;
+    private String originOs;
+    private String originAgentMac;
+    private String originHostId;
+    private String originAgentVersion;
+    private String originAgentId;
+    private String originAgentName;
+    private String originWorkGroup;
+    private String originAssetGroup;
+    private Long originLocalPort;
+    private String originAgentIp;
+    private String originInternalIp;
+    private String originExternalIp;
+    private String originLocalAddr;
+    private Long agentId;
+    private String agentName;
+    private String tcTitle;
+    private String logId;
+    private LocalDateTime eventDate;
+    private Long eventTimeTs;
+    private Integer eventLevel;
+    private String srcIp;
+    private Long srcPort;
+    private String destIp;
+    private Long destPort;
+    private Long eventTime;
+    private String attackerCountry;
+    private String srcMac;
+    private String destMac;
+    private String proto;
+    private Long devId;
+    private Long createdTime;
+    private String srcCountry;
+    private String srcCountryCode;
+    private String srcRegion;
+    private String srcRegionCode;
+    private String srcCity;
+    private String srcLon;
+    private String httpMethod;
+    private String httpHost;
+    private String httpReqHeader;
+    private String httpReqBody;
+    private String httpRespHeader;
+    private String httpRespBody;
+    private String fileType;
+    private String fileMd5;
+    private String fileSize;
+    private String process;
+    private Long startTime;
+    private String action;
+    private String attackerRegion;
+    private Long endTime;
+    private Long fileCreatedTime;
+    private Long fileModifiedTime;
+    private String tcMiguanScanPort;
+    private String processPath;
+    private String parentProcessPath;
+    private String gname;
+    private String exeName;
+    private String exePath;
+    private Long loginTime;
+    private Long loginTimes;
+    private String checkItem;
+    private String checkType;
+    private String attackerIp;
+    private Long attackerPort;
+    private String victimIp;
+    private Long victimPort;
+    private String attackerCity;
+    private String attackerLon;
+    private String attackerLat;
+    private String victimCountry;
+    private String victimRegion;
+    private String victimCity;
+    private String victimLon;
+    private String victimLat;
+    private String originEventId;
+    private String originEventName;
+    private String originEventCategory;
+    private String originEventLevel;
+    private String originAttackChain;
+    private String engineType;
+    private String evilPayload;
+    private String httpRespStatus;
+    private String dnsQuery;
+    private String dnsQueryType;
+    private String dnsTtl;
+    private String dnsAnswer;
+    private String dnsSubdomains;
+    private String fileSha256;
+    private String fileSsdeep;
+    private String victimCountryCode;
+    private String httpXffIp;
+    private String tcMiguanClass;
+    private String pid;
+    private String ppid;
+    private String processName;
+    private String backdoorType;
+    private String tty;
+    private String sudoUser;
+    private String sudoGroup;
+    private String originEventType;
+    private String destDomain;
+    private String shellCmdline;
+    private String parentCmdline;
+    private String attackChain;
+    private String processTree;
+    private String hostFileSha256;
+    private String hostFileMd5;
+    private String hostFileSize;
+    private String hostFileType;
+    private String destCountry;
+    private String destCountryCode;
+    private String logOrigin;
+    private String destRegion;
+    private String srcLat;
+    private String destRegionCode;
+    private String destCity;
+    private String destLon;
+    private String destLat;
+    private Integer eventCategory;
+    private Integer attackResult;
+    private String probeIp;
+    private String deviceIp;
+    private String deviceManufacturer;
+    private String deviceName;
+    private String productName;
+    private String id1;
+    private Long count;
+    private String countReason;
+    private Integer eventType;
+    private String protocol;
+    private String shellCmd;
+    private String parentName;
+    private String hostFilePath;
+    private String uid;
+    private Integer fall;
+    private String tcMiguanServerIp;
+    private Integer devType;
+    private Integer collectMethod;
+    private Integer fieldCateId;
+    private Integer deviceType;
+    private String tcMiguanClientIp;
+    private String tcMiguanName;
+    private Long originTotalPackages;
+    private Long originTotalBytes;
+    private Long originPeakPackagesRate;
+    private Long originPeakBytesRate;
+    private Long originPeakFlowsRate;
+    private String aptOrgname;
+    private String aptOrgmsg;
+    private String mailMessageId;
+    private String mailBcc;
+    private String mailSize;
+    private String mailAttachHashcode;
+    private String mailUrl;
+    private String mailCc;
+    private String algorithm;
+    private String miningpoolIp;
+    private String processMd5;
+    private String pprocessMd5;
+    private String sourceServername;
+    private String originSourceServername;
+    private String mailFilename;
+    private String dstUploadAppname;
+    private Long targetPort;
+    private String gid;
+    private String originUid;
+    private String originGid;
+    private Long targetPorts;
+    private String tcMiguanName1;
+    private String tcMiguanClass1;
+    private Long etlTime;
+    private String tcMiguanScanPort2;
+    private String desipSecurityScope;
+    private String srcipSecurityScope;
+    private Long collectTimeTs;
+    private String tcMiguanScanPort1;
+    private String srcDevName;
+    private String collectProtocol;
+    private String destinationSystemType;
+    private String destinationSystem;
+    private String etlHost;
+    private Integer normalizeRuleId;
+    private String normalizeRuleName;
+    private String syslogUuid;
+    private String syslogTopic;
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/SyslogRequest.java

@@ -0,0 +1,90 @@
+package com.common.entity;
+
+import javax.validation.constraints.NotBlank;
+import javax.validation.constraints.NotNull;
+
+public class SyslogRequest {
+
+    @NotBlank(message = "IP地址不能为空")
+    private String ip;
+
+    @NotNull(message = "端口号不能为空")
+    private Integer port;
+
+    @NotBlank(message = "日志内容不能为空")
+    private String logContent;
+
+    private String protocol = "UDP"; // 默认UDP协议
+    private String facility = "USER"; // 设施
+    private String severity = "INFO"; // 严重级别
+
+    // 构造函数
+    public SyslogRequest() {}
+
+    public SyslogRequest(String ip, Integer port, String logContent) {
+        this.ip = ip;
+        this.port = port;
+        this.logContent = logContent;
+    }
+
+    // Getter和Setter方法
+    public String getIp() {
+        return ip;
+    }
+
+    public void setIp(String ip) {
+        this.ip = ip;
+    }
+
+    public Integer getPort() {
+        return port;
+    }
+
+    public void setPort(Integer port) {
+        this.port = port;
+    }
+
+    public String getLogContent() {
+        return logContent;
+    }
+
+    public void setLogContent(String logContent) {
+        this.logContent = logContent;
+    }
+
+    public String getProtocol() {
+        return protocol;
+    }
+
+    public void setProtocol(String protocol) {
+        this.protocol = protocol;
+    }
+
+    public String getFacility() {
+        return facility;
+    }
+
+    public void setFacility(String facility) {
+        this.facility = facility;
+    }
+
+    public String getSeverity() {
+        return severity;
+    }
+
+    public void setSeverity(String severity) {
+        this.severity = severity;
+    }
+
+    @Override
+    public String toString() {
+        return "SyslogRequest{" +
+                "ip='" + ip + '\'' +
+                ", port=" + port +
+                ", logContent='" + logContent + '\'' +
+                ", protocol='" + protocol + '\'' +
+                ", facility='" + facility + '\'' +
+                ", severity='" + severity + '\'' +
+                '}';
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/WecomNotification.java

@@ -0,0 +1,74 @@
+package com.common.entity;
+
+import lombok.Data;
+import java.time.LocalDateTime;
+
+/**
+ * 微信通知实体类
+ * 对应表: wecom_notification
+ */
+@Data
+public class WecomNotification {
+    
+    /** 企微通知id */
+    private Long wecomNotificationId;
+    
+    /** 用户信息 */
+    private String userId;
+    
+    /** 通知名称 */
+    private String wecomNotificationName;
+    
+    /** 通知IP */
+    private String wecomNotificationIp;
+    
+    /** 通知类型 */
+    private String wecomNotificationType;
+    
+    /** 通知等级 */
+    private String wecomNotificationLevel;
+    
+    /** 通知内容 */
+    private String wecomNotificationContent;
+    
+    /** 告警通知时间 */
+    private LocalDateTime wecomNotificationTime;
+    
+    /** 租户编号 */
+    private String tenantId;
+    
+    /** 创建部门 */
+    private Long createDept;
+    
+    /** 创建者 */
+    private Long createBy;
+    
+    /** 创建时间 */
+    private LocalDateTime createTime;
+    
+    /** 更新者 */
+    private Long updateBy;
+    
+    /** 更新时间 */
+    private LocalDateTime updateTime;
+    
+    /** 备注 */
+    private String remark;
+    
+    /** 通知状态（0:已发送, 1:未发送） */
+    private String wecomNotificationStatus;
+    
+    public WecomNotification() {
+    }
+    
+    public WecomNotification(String wecomNotificationName, String wecomNotificationType, 
+                            String wecomNotificationLevel, String wecomNotificationContent) {
+        this.wecomNotificationName = wecomNotificationName;
+        this.wecomNotificationType = wecomNotificationType;
+        this.wecomNotificationLevel = wecomNotificationLevel;
+        this.wecomNotificationContent = wecomNotificationContent;
+        this.wecomNotificationTime = LocalDateTime.now();
+        this.wecomNotificationStatus = "1"; // 默认未发送
+        this.createTime = LocalDateTime.now();
+    }
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/XdrHoneypot.java

@@ -0,0 +1,260 @@
+package com.common.entity;
+
+import java.time.LocalDateTime;
+
+/**
+ * XDR Honeypot 实体类
+ * 对应数据库表 xdr_honeypot
+ */
+public class XdrHoneypot {
+    private Long id;
+    private String vcsource;
+    private String dstartTime;
+    private String dtime;
+    private String riskLevel;
+    private String vcconnection;
+    private String fileInfo;
+    private String extra;
+    private String vctype;
+    private String agentSn;
+    private String agentName;
+    private String honeypotId;
+    private String honeypotName;
+    private String srcIp;
+    private String srcPort;
+    private String srcMac;
+    private String destIp;
+    private String destPort;
+    private String proxyIp;
+    private String node;
+    private LocalDateTime createTime;
+
+    // 默认构造函数
+    public XdrHoneypot() {
+        this.createTime = LocalDateTime.now();
+    }
+
+    // 带参构造函数
+    public XdrHoneypot(String vcsource, String dstartTime, String dtime, String riskLevel,
+                       String vcconnection, String fileInfo, String extra, String vctype,
+                       String agentSn, String agentName, String honeypotId, String honeypotName,
+                       String srcIp, String srcPort, String srcMac, String destIp,
+                       String destPort, String proxyIp, String node) {
+        this();
+        this.vcsource = vcsource;
+        this.dstartTime = dstartTime;
+        this.dtime = dtime;
+        this.riskLevel = riskLevel;
+        this.vcconnection = vcconnection;
+        this.fileInfo = fileInfo;
+        this.extra = extra;
+        this.vctype = vctype;
+        this.agentSn = agentSn;
+        this.agentName = agentName;
+        this.honeypotId = honeypotId;
+        this.honeypotName = honeypotName;
+        this.srcIp = srcIp;
+        this.srcPort = srcPort;
+        this.srcMac = srcMac;
+        this.destIp = destIp;
+        this.destPort = destPort;
+        this.proxyIp = proxyIp;
+        this.node = node;
+    }
+
+    // Getter 和 Setter 方法
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public String getVcsource() {
+        return vcsource;
+    }
+
+    public void setVcsource(String vcsource) {
+        this.vcsource = vcsource;
+    }
+
+    public String getDstartTime() {
+        return dstartTime;
+    }
+
+    public void setDstartTime(String dstartTime) {
+        this.dstartTime = dstartTime;
+    }
+
+    public String getDtime() {
+        return dtime;
+    }
+
+    public void setDtime(String dtime) {
+        this.dtime = dtime;
+    }
+
+    public String getRiskLevel() {
+        return riskLevel;
+    }
+
+    public void setRiskLevel(String riskLevel) {
+        this.riskLevel = riskLevel;
+    }
+
+    public String getVcconnection() {
+        return vcconnection;
+    }
+
+    public void setVcconnection(String vcconnection) {
+        this.vcconnection = vcconnection;
+    }
+
+    public String getFileInfo() {
+        return fileInfo;
+    }
+
+    public void setFileInfo(String fileInfo) {
+        this.fileInfo = fileInfo;
+    }
+
+    public String getExtra() {
+        return extra;
+    }
+
+    public void setExtra(String extra) {
+        this.extra = extra;
+    }
+
+    public String getVctype() {
+        return vctype;
+    }
+
+    public void setVctype(String vctype) {
+        this.vctype = vctype;
+    }
+
+    public String getAgentSn() {
+        return agentSn;
+    }
+
+    public void setAgentSn(String agentSn) {
+        this.agentSn = agentSn;
+    }
+
+    public String getAgentName() {
+        return agentName;
+    }
+
+    public void setAgentName(String agentName) {
+        this.agentName = agentName;
+    }
+
+    public String getHoneypotId() {
+        return honeypotId;
+    }
+
+    public void setHoneypotId(String honeypotId) {
+        this.honeypotId = honeypotId;
+    }
+
+    public String getHoneypotName() {
+        return honeypotName;
+    }
+
+    public void setHoneypotName(String honeypotName) {
+        this.honeypotName = honeypotName;
+    }
+
+    public String getSrcIp() {
+        return srcIp;
+    }
+
+    public void setSrcIp(String srcIp) {
+        this.srcIp = srcIp;
+    }
+
+    public String getSrcPort() {
+        return srcPort;
+    }
+
+    public void setSrcPort(String srcPort) {
+        this.srcPort = srcPort;
+    }
+
+    public String getSrcMac() {
+        return srcMac;
+    }
+
+    public void setSrcMac(String srcMac) {
+        this.srcMac = srcMac;
+    }
+
+    public String getDestIp() {
+        return destIp;
+    }
+
+    public void setDestIp(String destIp) {
+        this.destIp = destIp;
+    }
+
+    public String getDestPort() {
+        return destPort;
+    }
+
+    public void setDestPort(String destPort) {
+        this.destPort = destPort;
+    }
+
+    public String getProxyIp() {
+        return proxyIp;
+    }
+
+    public void setProxyIp(String proxyIp) {
+        this.proxyIp = proxyIp;
+    }
+
+    public String getNode() {
+        return node;
+    }
+
+    public void setNode(String node) {
+        this.node = node;
+    }
+
+    public LocalDateTime getCreateTime() {
+        return createTime;
+    }
+
+    public void setCreateTime(LocalDateTime createTime) {
+        this.createTime = createTime;
+    }
+
+    @Override
+    public String toString() {
+        return "XdrHoneypot{" +
+                "id=" + id +
+                ", vcsource='" + vcsource + '\'' +
+                ", dstartTime='" + dstartTime + '\'' +
+                ", dtime='" + dtime + '\'' +
+                ", riskLevel='" + riskLevel + '\'' +
+                ", vcconnection='" + vcconnection + '\'' +
+                ", fileInfo='" + fileInfo + '\'' +
+                ", extra='" + extra + '\'' +
+                ", vctype='" + vctype + '\'' +
+                ", agentSn='" + agentSn + '\'' +
+                ", agentName='" + agentName + '\'' +
+                ", honeypotId='" + honeypotId + '\'' +
+                ", honeypotName='" + honeypotName + '\'' +
+                ", srcIp='" + srcIp + '\'' +
+                ", srcPort='" + srcPort + '\'' +
+                ", srcMac='" + srcMac + '\'' +
+                ", destIp='" + destIp + '\'' +
+                ", destPort='" + destPort + '\'' +
+                ", proxyIp='" + proxyIp + '\'' +
+                ", node='" + node + '\'' +
+                ", createTime=" + createTime +
+                '}';
+    }
+}