nanChen/ai-security-xdr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

关联分析规则-数据降噪

Browse Source
This commit is contained in:
nanChen
2026-03-18 18:00:25 +08:00
parent cf6b89ea94
commit c0063a5a44
64 changed files with 6642 additions and 2007 deletions
Download Patch File Download Diff File Expand all files Collapse all files
haobang-security-xdr/syslog-consumer/src/main/resources/application-dev.properties
+26 -2
View File
@@ -25,9 +25,12 @@ influxdb.batch.size=1000
influxdb.flush.interval=1000
influxdb.retry.attempts=3
influxdb.retry.delay=1000
# InfluxDB 2.7 连接超时配置
influxdb.connection.timeout=30s
influxdb.connection.read-timeout=30s
influxdb.connection.write-timeout=60s
# Application Configuration
app.worker.threads=4
app.worker.threads=8
app.max.queue.size=10000
app.metrics.enabled=true
@@ -123,3 +126,24 @@ spring.elasticsearch.socket-timeout=30s
etl.batch.page-size=1000
etl.batch.insert-batch-size=500
etl.schedule.cron=0 0 2 * * ?
# ============================================
# HikariCP Connection Pool Configuration
# ============================================
spring.datasource.hikari.maximum-pool-size=50
spring.datasource.hikari.minimum-idle=5
spring.datasource.hikari.connection-timeout=30000
spring.datasource.hikari.idle-timeout=600000
spring.datasource.hikari.max-lifetime=900000
spring.datasource.hikari.connection-test-query=SELECT 1
spring.datasource.hikari.validation-timeout=5000
spring.datasource.hikari.leak-detection-threshold=30000
spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer
spring.datasource.hikari.auto-commit=false
spring.datasource.hikari.schema=public
# 关联分析规则配置
analysis.realtime.enabled= true
# 检查间隔（秒） - 默认10秒
analysis.realtime.check-interval-seconds: 10
haobang-security-xdr/syslog-consumer/src/main/resources/application-prod-zc.properties
+21 -2
View File
@@ -25,9 +25,12 @@ influxdb.batch.size=1000
influxdb.flush.interval=1000
influxdb.retry.attempts=3
influxdb.retry.delay=1000
# InfluxDB 2.7 连接超时配置
influxdb.connection.timeout=30s
influxdb.connection.read-timeout=30s
influxdb.connection.write-timeout=60s
# Application Configuration
app.worker.threads=4
app.worker.threads=8
app.max.queue.size=10000
app.metrics.enabled=true
@@ -122,3 +125,19 @@ spring.elasticsearch.socket-timeout=30s
etl.batch.page-size=1000
etl.batch.insert-batch-size=500
etl.schedule.cron=0 0 2 * * ?
# ============================================
# HikariCP Connection Pool Configuration
# ============================================
spring.datasource.hikari.maximum-pool-size=50
spring.datasource.hikari.minimum-idle=5
spring.datasource.hikari.connection-timeout=30000
spring.datasource.hikari.idle-timeout=600000
spring.datasource.hikari.max-lifetime=900000
spring.datasource.hikari.connection-test-query=SELECT 1
spring.datasource.hikari.validation-timeout=5000
spring.datasource.hikari.leak-detection-threshold=30000
spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer
spring.datasource.hikari.auto-commit=false
spring.datasource.hikari.schema=public
haobang-security-xdr/syslog-consumer/src/main/resources/application-prod.properties
+28 -3
View File
@@ -25,9 +25,12 @@ influxdb.batch.size=1000
influxdb.flush.interval=1000
influxdb.retry.attempts=3
influxdb.retry.delay=1000
# InfluxDB 2.7 连接超时配置
influxdb.connection.timeout=30s
influxdb.connection.read-timeout=30s
influxdb.connection.write-timeout=60s
# Application Configuration
app.worker.threads=4
app.worker.threads=8
app.max.queue.size=10000
app.metrics.enabled=true
@@ -123,4 +126,26 @@ spring.elasticsearch.socket-timeout=30s
# ETL配置
etl.batch.page-size=1000
etl.batch.insert-batch-size=500
etl.schedule.cron=0 0 2 * * ?
etl.schedule.cron=0 0 2 * * ?
# ============================================
# HikariCP Connection Pool Configuration
# ============================================
spring.datasource.hikari.maximum-pool-size=50
spring.datasource.hikari.minimum-idle=5
spring.datasource.hikari.connection-timeout=30000
spring.datasource.hikari.idle-timeout=600000
spring.datasource.hikari.max-lifetime=900000
spring.datasource.hikari.connection-test-query=SELECT 1
spring.datasource.hikari.validation-timeout=5000
spring.datasource.hikari.leak-detection-threshold=30000
spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer
spring.datasource.hikari.auto-commit=false
spring.datasource.hikari.schema=public
# 关联分析规则配置
analysis.realtime.enabled= true
# 检查间隔（秒） - 默认10秒
analysis.realtime.check-interval-seconds: 10
haobang-security-xdr/syslog-consumer/src/main/resources/application-test.properties
+1 -1
View File
@@ -27,7 +27,7 @@ influxdb.retry.attempts=3
influxdb.retry.delay=1000
# Application Configuration
app.worker.threads=4
app.worker.threads=8
app.max.queue.size=10000
app.metrics.enabled=true
haobang-security-xdr/syslog-consumer/src/main/resources/application.properties
+50 -24
View File
@@ -7,7 +7,7 @@ server.error.include-message=always
server.error.include-binding-errors=always
#run.environment: dev|test|pro
server.run.environment=dev
server.run.environment=pro
# Syslog Server Configuration
@@ -17,31 +17,33 @@ syslog.max.frame.length=65536
syslog.buffer.size=1000
# InfluxDB 2.7 Configuration
influxdb.url=http://192.168.222.131:8086
influxdb.token=3Tvu-IZWtaY03UDkbUDlufD0kxn85keo9LhYQcv2Cxk0LJmXqqHkNVrO664DbaJAYwoGI7UIg904KqZC7Q_ZFA==
influxdb.org=yelang
influxdb.url=http://192.168.4.26:8087
influxdb.token=LFjXZyRxTf1V84oN-wwjhSjS4qIK-ZMoHzQJB67ir3qHNSBVJbMcTkPuNmM0cNxvzFEDWLYNzrz1VJKMitY5hw==
influxdb.org=influxdb
influxdb.bucket=yelangbucket
influxdb.batch.size=1000
influxdb.flush.interval=1000
influxdb.retry.attempts=3
influxdb.retry.delay=1000
# InfluxDB 2.7 连接超时配置
influxdb.connection.timeout=30s
influxdb.connection.read-timeout=30s
influxdb.connection.write-timeout=60s
# Application Configuration
app.worker.threads=4
app.worker.threads=8
app.max.queue.size=10000
app.metrics.enabled=true
#database Configuration
spring.datasource.url=jdbc:postgresql://117.72.68.72:54329/ecosys
spring.datasource.url=jdbc:postgresql://192.168.4.26:5432/ecosys
spring.datasource.username=postgres
spring.datasource.password=TnLanWaidYSwTSG5
spring.datasource.password=caZ2TcmXNSW8L2Ap
spring.datasource.driver-class-name=org.postgresql.Driver
# mybatis Configuration
mybatis.mapper-locations=classpath:mapper/*.xml
mybatis.type-aliases-package=com.common.entity
#mybatis handler 类
mybatis.configuration.default-statement-timeout=30
mybatis.configuration.default-fetch-size=1000
@@ -49,20 +51,20 @@ mybatis.configuration.map-underscore-to-camel-case=true
mybatis.type-handlers-package=com.Modules.etl.handler
mybatis-plus.configuration.map-underscore-to-camel-case=true
mybatis-plus.type-handlers-package=com.Modules.etl.handler
# kafka Configuration
spring.kafka.consumer.bootstrap-servers=192.168.222.130:9092
spring.kafka.consumer.group-id=test-group-app
spring.kafka.consumer.bootstrap-servers=192.168.4.26:9092
spring.kafka.consumer.group-id=agent-syslog-group
spring.kafka.consumer.auto-offset-reset=latest
spring.kafka.consumer.enable-auto-commit=false
spring.kafka.consumer.auto-commit-interval=1000
spring.kafka.consumer.topic=test-topic
spring.kafka.consumer.topic=agent-syslog-topic
spring.kafka.consumer.max-poll-records=1000
spring.kafka.consumer.properties.max.poll.interval.ms=300000
spring.kafka.consumer.properties.session.timeout.ms=45000
#spring.kafka.consumer.key-deserializer: org.apache.kafka.common.serialization.StringDeserializer
#spring.kafka.consumer.value-deserializer: org.apache.kafka.common.serialization.StringDeserializer
spring.kafka.consumer.fetch-min-size= 1048576
spring.kafka.listener.ack-mode= manual
spring.kafka.listener.concurrency= 2
@@ -81,21 +83,23 @@ partition.check.tomorrow.enabled=true
partition.check.future.days=7
partition.auto.create=true
# 开发环境缓存配置
spring.redis.host=localhost
# 生产环境缓存配置
spring.redis.host=192.168.4.26
spring.redis.port=6379
# 密码（如果没有设置密码，可以省略）
spring.redis.password=
spring.redis.password=123456
spring.redis.database=0
spring.redis.timeout=2000
spring.redis.timeout=5000
#spring.redis.password=${REDIS_PASSWORD:default_prod_password}
spring.redis.lettuce.pool.max-active=8
spring.redis.lettuce.pool.max-wait=-1
spring.redis.lettuce.pool.max-idle=8
spring.redis.lettuce.pool.min-idle=0
# 开发环境缓存时间较短，方便调试
spring.cache.redis.time-to-live=600000
spring.redis.lettuce.pool.max-active=20
spring.redis.lettuce.pool.max-wait=5000
spring.redis.lettuce.pool.max-idle=10
spring.redis.lettuce.pool.min-idle=5
# 生产环境缓存时间较长
spring.cache.redis.time-to-live=3600000
# 应用处理器配置
app.processor.thread-pool.core-pool-size=10
@@ -123,3 +127,25 @@ spring.elasticsearch.socket-timeout=30s
etl.batch.page-size=1000
etl.batch.insert-batch-size=500
etl.schedule.cron=0 0 2 * * ?
# ============================================
# HikariCP Connection Pool Configuration
# ============================================
spring.datasource.hikari.maximum-pool-size=50
spring.datasource.hikari.minimum-idle=5
spring.datasource.hikari.connection-timeout=30000
spring.datasource.hikari.idle-timeout=600000
spring.datasource.hikari.max-lifetime=900000
spring.datasource.hikari.connection-test-query=SELECT 1
spring.datasource.hikari.validation-timeout=5000
spring.datasource.hikari.leak-detection-threshold=30000
spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer
spring.datasource.hikari.auto-commit=false
spring.datasource.hikari.schema=public
# 关联分析规则配置
analysis.realtime.enabled= true
# 检查间隔（秒） - 默认10秒
analysis.realtime.check-interval-seconds: 10
haobang-security-xdr/syslog-consumer/src/main/resources/mapper/AnalysisAnalysisRuleMapper.xml
+81
View File
@@ -0,0 +1,81 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.common.mapper.AnalysisAnalysisRuleMapper">
<resultMap id="BaseResultMap" type="com.common.entity.AnalysisAnalysisRule">
<id column="rule_id" property="ruleId" jdbcType="VARCHAR"/>
<result column="create_user" property="createUser" jdbcType="VARCHAR"/>
<result column="rule_name" property="ruleName" jdbcType="VARCHAR"/>
<result column="analysis_method" property="analysisMethod" jdbcType="VARCHAR"/>
<result column="run_mode" property="runMode" jdbcType="VARCHAR"/>
<result column="rule_output" property="ruleOutput" jdbcType="VARCHAR"/>
<result column="organization" property="organization" jdbcType="VARCHAR"/>
<result column="task_status" property="taskStatus" jdbcType="VARCHAR"/>
<result column="create_dept" property="createDept" jdbcType="BIGINT"/>
<result column="del_flag" property="delFlag" jdbcType="CHAR"/>
<result column="create_time" property="createTime" jdbcType="TIMESTAMP"/>
<result column="update_time" property="updateTime" jdbcType="TIMESTAMP"/>
<result column="create_by" property="createBy" jdbcType="BIGINT"/>
<result column="update_by" property="updateBy" jdbcType="BIGINT"/>
<result column="remark" property="remark" jdbcType="VARCHAR"/>
<result column="tenant_id" property="tenantId" jdbcType="VARCHAR"/>
<result column="rule_desc" property="ruleDesc" jdbcType="VARCHAR"/>
<result column="rule_type" property="ruleType" jdbcType="INTEGER"/>
<result column="rule_status" property="ruleStatus" jdbcType="INTEGER"/>
<result column="rule_content" property="ruleContent" jdbcType="VARCHAR"/>
<result column="rule_expression" property="ruleExpression" jdbcType="VARCHAR"/>
<result column="priority" property="priority" jdbcType="BIGINT"/>
<result column="tags" property="tags" jdbcType="VARCHAR"/>
<result column="version" property="version" jdbcType="INTEGER"/>
<result column="subset_id" property="subsetId" jdbcType="INTEGER"/>
</resultMap>
<sql id="Base_Column_List">
rule_id, create_user, rule_name, analysis_method, run_mode, rule_output,
organization, task_status, create_dept, del_flag, create_time, update_time,
create_by, update_by, remark, tenant_id, rule_desc, rule_type, rule_status,
rule_content, rule_expression, priority, tags, version, subset_id
</sql>
<!-- 查询指定运行模式的活动规则 -->
<select id="selectActiveRulesByRunMode" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_analysis_rule
WHERE run_mode = #{runMode}
AND del_flag = '0'
AND task_status IN ('stopped', 'waiting', 'STOPPED')
AND rule_status =1
ORDER BY priority DESC, create_time ASC
</select>
<!-- 根据规则ID查询规则 -->
<select id="selectByRuleId" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_analysis_rule
WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
AND del_flag = '0'
</select>
<!-- 根据ID查询规则（与selectByRuleId相同） -->
<select id="selectById" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_analysis_rule
WHERE rule_id = #{ruleId, jdbcType=OTHER}::uuid
AND del_flag = '0'
</select>
<!-- 更新规则任务状态 -->
<update id="updateTaskStatus">
UPDATE analysis_analysis_rule
SET task_status = #{taskStatus},
update_time = NOW()
<if test="updateBy != null">
,update_by = #{updateBy}
</if>
WHERE rule_id = #{ruleId, jdbcType=OTHER}::uuid
</update>
</mapper>
haobang-security-xdr/syslog-consumer/src/main/resources/mapper/AnalysisFieldMapper.xml
+72
View File
@@ -0,0 +1,72 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.common.mapper.AnalysisFieldMapper">
<resultMap id="BaseResultMap" type="com.common.entity.AnalysisField">
<id column="id" property="id" jdbcType="INTEGER"/>
<result column="rule_id" property="ruleId" jdbcType="VARCHAR"/>
<result column="type" property="type" jdbcType="VARCHAR"/>
<result column="data_source" property="dataSource" jdbcType="VARCHAR"/>
<result column="database" property="database" jdbcType="VARCHAR"/>
<result column="table_name" property="tableName" jdbcType="VARCHAR"/>
<result column="table_alias" property="tableAlias" jdbcType="VARCHAR"/>
<result column="column_name" property="columnName" jdbcType="VARCHAR"/>
<result column="column_desc" property="columnDesc" jdbcType="VARCHAR"/>
<result column="data_type" property="dataType" jdbcType="VARCHAR"/>
<result column="fn" property="fn" jdbcType="VARCHAR"/>
<result column="arguments" property="arguments" jdbcType="VARCHAR"/>
<result column="placeholder" property="placeholder" jdbcType="VARCHAR"/>
<result column="base_type" property="baseType" jdbcType="INTEGER"/>
<result column="category_id" property="categoryId" jdbcType="INTEGER"/>
<result column="create_dept" property="createDept" jdbcType="BIGINT"/>
<result column="del_flag" property="delFlag" jdbcType="CHAR"/>
<result column="create_time" property="createTime" jdbcType="TIMESTAMP"/>
<result column="update_time" property="updateTime" jdbcType="TIMESTAMP"/>
<result column="create_by" property="createBy" jdbcType="BIGINT"/>
<result column="update_by" property="updateBy" jdbcType="BIGINT"/>
<result column="remark" property="remark" jdbcType="VARCHAR"/>
<result column="tenant_id" property="tenantId" jdbcType="VARCHAR"/>
<result column="alarm_column_name" property="alarmColumnName" jdbcType="VARCHAR"/>
<result column="alarm_column_desc" property="alarmColumnDesc" jdbcType="VARCHAR"/>
</resultMap>
<sql id="Base_Column_List">
id, rule_id, type, data_source, database, table_name, table_alias,
column_name, column_desc, data_type, fn, arguments, placeholder,
base_type, category_id, create_dept, del_flag, create_time,
update_time, create_by, update_by, remark, tenant_id,alarm_column_name,alarm_column_desc
</sql>
<!-- 根据规则ID查询字段配置 -->
<select id="selectByRuleId" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_field
WHERE rule_id = #{ruleId, jdbcType=OTHER}::uuid
AND del_flag = '0'
ORDER BY id ASC
</select>
<!-- 查询规则中用于SELECT的字段（通过type字段区分） -->
<select id="selectSelectFieldsByRuleId" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_field
WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
AND del_flag = '0'
AND type IN ('measure', 'calc')
ORDER BY id ASC
</select>
<!-- 查询规则中用于GROUP BY的字段（通过type字段区分） -->
<select id="selectGroupByFieldsByRuleId" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_field
WHERE rule_id = #{ruleId, jdbcType=OTHER}::uuid
AND del_flag = '0'
AND type = 'dimension'
ORDER BY id ASC
</select>
</mapper>
haobang-security-xdr/syslog-consumer/src/main/resources/mapper/AnalysisFilterMapper.xml
+68
View File
@@ -0,0 +1,68 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.common.mapper.AnalysisFilterMapper">
<resultMap id="BaseResultMap" type="com.common.entity.AnalysisFilter">
<id column="id" property="id" jdbcType="INTEGER"/>
<result column="rule_id" property="ruleId" jdbcType="VARCHAR"/>
<result column="data_source" property="dataSource" jdbcType="VARCHAR"/>
<result column="database" property="database" jdbcType="VARCHAR"/>
<result column="table_name" property="tableName" jdbcType="VARCHAR"/>
<result column="table_alias" property="tableAlias" jdbcType="VARCHAR"/>
<result column="column_name" property="columnName" jdbcType="VARCHAR"/>
<result column="column_desc" property="columnDesc" jdbcType="VARCHAR"/>
<result column="data_type" property="dataType" jdbcType="VARCHAR"/>
<result column="fn" property="fn" jdbcType="VARCHAR"/>
<result column="arguments" property="arguments" jdbcType="OTHER"/>
<result column="operator" property="operator" jdbcType="VARCHAR"/>
<result column="value" property="value" jdbcType="OTHER"/>
<result column="base_type" property="baseType" jdbcType="INTEGER"/>
<result column="category_id" property="categoryId" jdbcType="INTEGER"/>
<result column="create_dept" property="createDept" jdbcType="BIGINT"/>
<result column="del_flag" property="delFlag" jdbcType="CHAR"/>
<result column="create_time" property="createTime" jdbcType="TIMESTAMP"/>
<result column="update_time" property="updateTime" jdbcType="TIMESTAMP"/>
<result column="create_by" property="createBy" jdbcType="BIGINT"/>
<result column="update_by" property="updateBy" jdbcType="BIGINT"/>
<result column="remark" property="remark" jdbcType="VARCHAR"/>
<result column="tenant_id" property="tenantId" jdbcType="VARCHAR"/>
<result column="cond_id" property="condId" jdbcType="INTEGER"/>
<result column="seq_num" property="seqNum" jdbcType="INTEGER"/>
</resultMap>
<sql id="Base_Column_List">
id, rule_id, data_source, database, table_name, table_alias,
column_name, column_desc, data_type, fn, arguments, operator, value,
base_type, category_id, create_dept, del_flag, create_time,
update_time, create_by, update_by, remark, tenant_id, cond_id, seq_num
</sql>
<!-- 根据规则ID查询过滤条件 -->
<select id="selectByRuleId" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_filter
WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
AND del_flag = '0'
</select>
<!-- 根据字段ID查询过滤条件 -->
<select id="selectByFieldId" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_filter
WHERE field_id = #{fieldId}
AND del_flag = '0'
</select>
<!-- 根据条件ID查询过滤条件（与where_condition表关联） -->
<select id="selectByCondId" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_filter
WHERE cond_id = #{condId}
AND del_flag = '0'
ORDER BY seq_num ASC
</select>
</mapper>
haobang-security-xdr/syslog-consumer/src/main/resources/mapper/AnalysisGroupByColumnMapper.xml
+80
View File
@@ -0,0 +1,80 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.common.mapper.AnalysisGroupByColumnMapper">
<resultMap id="BaseResultMap" type="com.common.entity.AnalysisGroupByColumn">
<id column="id" property="id" jdbcType="INTEGER"/>
<result column="group_by_id" property="groupById" jdbcType="INTEGER"/>
<result column="data_source" property="dataSource" jdbcType="VARCHAR"/>
<result column="database" property="database" jdbcType="VARCHAR"/>
<result column="table_name" property="tableName" jdbcType="VARCHAR"/>
<result column="table_alias" property="tableAlias" jdbcType="VARCHAR"/>
<result column="column_name" property="columnName" jdbcType="VARCHAR"/>
<result column="column_desc" property="columnDesc" jdbcType="VARCHAR"/>
<result column="data_type" property="dataType" jdbcType="VARCHAR"/>
<result column="base_type" property="baseType" jdbcType="INTEGER"/>
<result column="category_id" property="categoryId" jdbcType="INTEGER"/>
<result column="create_dept" property="createDept" jdbcType="BIGINT"/>
<result column="del_flag" property="delFlag" jdbcType="CHAR"/>
<result column="create_time" property="createTime" jdbcType="TIMESTAMP"/>
<result column="update_time" property="updateTime" jdbcType="TIMESTAMP"/>
<result column="create_by" property="createBy" jdbcType="BIGINT"/>
<result column="update_by" property="updateBy" jdbcType="BIGINT"/>
<result column="remark" property="remark" jdbcType="VARCHAR"/>
<result column="tenant_id" property="tenantId" jdbcType="VARCHAR"/>
<result column="rule_id" property="ruleId" jdbcType="VARCHAR"/>
<result column="group_id" property="groupId" jdbcType="BIGINT"/>
<result column="field_id" property="fieldId" jdbcType="BIGINT"/>
<result column="sort" property="sort" jdbcType="INTEGER"/>
</resultMap>
<sql id="Base_Column_List">
id, group_by_id, data_source, database, table_name, table_alias,
column_name, column_desc, data_type, base_type, category_id,
create_dept, del_flag, create_time, update_time, create_by, update_by,
remark, tenant_id, rule_id, group_id, field_id, sort
</sql>
<!-- 根据规则ID查询分组字段配置 -->
<select id="selectByRuleId" resultMap="BaseResultMap">
SELECT
id, group_by_id, data_source, database, table_name,
table_alias, column_name, column_desc, data_type,
base_type, category_id, create_dept, del_flag,
create_time, update_time, create_by, update_by, remark,
tenant_id, rule_id, group_id, field_id, sort
FROM analysis_group_by_column
WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
AND del_flag = '0'
ORDER BY sort ASC
</select>
<!-- 根据分组ID查询分组字段配置 -->
<select id="selectByGroupById" resultMap="BaseResultMap">
SELECT
id, group_by_id, data_source, database, table_name,
table_alias, column_name, column_desc, data_type,
base_type, category_id, create_dept, del_flag,
create_time, update_time, create_by, update_by, remark,
tenant_id, rule_id, group_id, field_id, sort
FROM analysis_group_by_column
WHERE group_by_id = #{groupById}
AND del_flag = '0'
ORDER BY sort ASC
</select>
<!-- 根据用户组ID查询分组字段配置 -->
<select id="selectByGroupId" resultMap="BaseResultMap">
SELECT
id, group_by_id, data_source, database, table_name,
table_alias, column_name, column_desc, data_type,
base_type, category_id, create_dept, del_flag,
create_time, update_time, create_by, update_by, remark,
tenant_id, rule_id, group_id, field_id, sort
FROM analysis_group_by_column
WHERE group_id = #{groupId}
AND del_flag = '0'
ORDER BY sort ASC
</select>
</mapper>
haobang-security-xdr/syslog-consumer/src/main/resources/mapper/AnalysisGroupByHavingMapper.xml
+62
View File
@@ -0,0 +1,62 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.common.mapper.AnalysisGroupByHavingMapper">
<resultMap id="BaseResultMap" type="com.common.entity.AnalysisGroupByHaving">
<id column="id" property="id" jdbcType="INTEGER"/>
<result column="group_by_id" property="groupById" jdbcType="INTEGER"/>
<result column="data_source" property="dataSource" jdbcType="VARCHAR"/>
<result column="database" property="database" jdbcType="VARCHAR"/>
<result column="table_name" property="tableName" jdbcType="VARCHAR"/>
<result column="table_alias" property="tableAlias" jdbcType="VARCHAR"/>
<result column="column_name" property="columnName" jdbcType="VARCHAR"/>
<result column="column_desc" property="columnDesc" jdbcType="VARCHAR"/>
<result column="data_type" property="dataType" jdbcType="VARCHAR"/>
<result column="fn" property="fn" jdbcType="VARCHAR"/>
<result column="arguments" property="arguments" jdbcType="OTHER"/>
<result column="operator" property="operator" jdbcType="VARCHAR"/>
<result column="value" property="value" jdbcType="OTHER"/>
<result column="base_type" property="baseType" jdbcType="INTEGER"/>
<result column="category_id" property="categoryId" jdbcType="INTEGER"/>
<result column="create_dept" property="createDept" jdbcType="BIGINT"/>
<result column="del_flag" property="delFlag" jdbcType="CHAR"/>
<result column="create_time" property="createTime" jdbcType="TIMESTAMP"/>
<result column="update_time" property="updateTime" jdbcType="TIMESTAMP"/>
<result column="create_by" property="createBy" jdbcType="BIGINT"/>
<result column="update_by" property="updateBy" jdbcType="BIGINT"/>
<result column="remark" property="remark" jdbcType="VARCHAR"/>
<result column="tenant_id" property="tenantId" jdbcType="VARCHAR"/>
</resultMap>
<sql id="Base_Column_List">
id, group_by_id, data_source, database, table_name, table_alias,
column_name, column_desc, data_type, fn, arguments, operator, value,
base_type, category_id, create_dept, del_flag, create_time,
update_time, create_by, update_by, remark, tenant_id
</sql>
<!-- 根据分组ID查询HAVING条件 -->
<select id="selectByGroupById" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_group_by_having
WHERE group_by_id = #{groupById}
AND del_flag = '0'
</select>
<!-- 根据规则ID查询HAVING条件（通过关联分组表） -->
<select id="selectByRuleId" resultMap="BaseResultMap">
SELECT
h.id, h.group_by_id, h.data_source, h.database, h.table_name, h.table_alias,
h.column_name, h.column_desc, h.data_type, h.fn, h.arguments, h.operator, h.value,
h.base_type, h.category_id, h.create_dept, h.del_flag, h.create_time,
h.update_time, h.create_by, h.update_by, h.remark, h.tenant_id
FROM analysis_group_by_having h
INNER JOIN analysis_group_by g ON h.group_by_id = g.id
WHERE g.rule_id =#{ruleId, jdbcType=OTHER}::uuid
AND h.del_flag = '0'
AND g.del_flag = '0'
ORDER BY h.id ASC
</select>
</mapper>
haobang-security-xdr/syslog-consumer/src/main/resources/mapper/AnalysisGroupByMapper.xml
+40
View File
@@ -0,0 +1,40 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.common.mapper.AnalysisGroupByMapper">
<resultMap id="BaseResultMap" type="com.common.entity.AnalysisGroupBy">
<id column="id" property="id" jdbcType="BIGINT"/>
<result column="rule_id" property="ruleId" jdbcType="OTHER"/>
<result column="group_type" property="groupType" jdbcType="INTEGER"/>
<result column="window_type" property="windowType" jdbcType="VARCHAR"/>
<result column="create_dept" property="createDept" jdbcType="BIGINT"/>
<result column="del_flag" property="delFlag" jdbcType="CHAR"/>
<result column="create_time" property="createTime" jdbcType="TIMESTAMP"/>
<result column="update_time" property="updateTime" jdbcType="TIMESTAMP"/>
<result column="create_by" property="createBy" jdbcType="BIGINT"/>
<result column="update_by" property="updateBy" jdbcType="BIGINT"/>
<result column="remark" property="remark" jdbcType="VARCHAR"/>
<result column="tenant_id" property="tenantId" jdbcType="VARCHAR"/>
</resultMap>
<resultMap id="WithWindowResultMap" type="com.common.entity.AnalysisGroupBy" extends="BaseResultMap">
<association property="window" javaType="com.common.entity.AnalysisGroupByWindow"
column="id" select="com.common.mapper.AnalysisGroupByWindowMapper.selectByGroupById"/>
</resultMap>
<sql id="Base_Column_List">
id, rule_id, group_type, window_type,
create_dept, del_flag, create_time, update_time, create_by, update_by,
remark, tenant_id
</sql>
<!-- 根据规则ID查询分组配置 -->
<select id="selectByRuleId" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_group_by
WHERE rule_id = #{ruleId, jdbcType=OTHER}::uuid
AND del_flag = '0'
</select>
</mapper>
haobang-security-xdr/syslog-consumer/src/main/resources/mapper/AnalysisGroupByWindowMapper.xml
+51
View File
@@ -0,0 +1,51 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.common.mapper.AnalysisGroupByWindowMapper">
<resultMap id="BaseResultMap" type="com.common.entity.AnalysisGroupByWindow">
<id column="id" property="id" jdbcType="INTEGER"/>
<result column="group_by_id" property="groupById" jdbcType="INTEGER"/>
<result column="window_type" property="windowType" jdbcType="VARCHAR"/>
<result column="tumble_window_time_type" property="tumbleWindowTimeType" jdbcType="VARCHAR"/>
<result column="tumble_window_size" property="tumbleWindowSize" jdbcType="INTEGER"/>
<result column="tumble_window_size_unit" property="tumbleWindowSizeUnit" jdbcType="VARCHAR"/>
<result column="hop_window_time_type" property="hopWindowTimeType" jdbcType="VARCHAR"/>
<result column="hop_window_size" property="hopWindowSize" jdbcType="INTEGER"/>
<result column="hop_window_size_unit" property="hopWindowSizeUnit" jdbcType="VARCHAR"/>
<result column="hop_window_slide" property="hopWindowSlide" jdbcType="INTEGER"/>
<result column="hop_window_slide_unit" property="hopWindowSlideUnit" jdbcType="VARCHAR"/>
<result column="hop_window_alarm_once_per_window" property="hopWindowAlarmOncePerWindow" jdbcType="BOOLEAN"/>
<result column="session_window_time_type" property="sessionWindowTimeType" jdbcType="VARCHAR"/>
<result column="session_window_size" property="sessionWindowSize" jdbcType="INTEGER"/>
<result column="session_window_size_unit" property="sessionWindowSizeUnit" jdbcType="VARCHAR"/>
<result column="create_dept" property="createDept" jdbcType="BIGINT"/>
<result column="del_flag" property="delFlag" jdbcType="CHAR"/>
<result column="create_time" property="createTime" jdbcType="TIMESTAMP"/>
<result column="update_time" property="updateTime" jdbcType="TIMESTAMP"/>
<result column="create_by" property="createBy" jdbcType="BIGINT"/>
<result column="update_by" property="updateBy" jdbcType="BIGINT"/>
<result column="remark" property="remark" jdbcType="VARCHAR"/>
<result column="tenant_id" property="tenantId" jdbcType="VARCHAR"/>
</resultMap>
<sql id="Base_Column_List">
id, group_by_id, window_type,
tumble_window_time_type, tumble_window_size, tumble_window_size_unit,
hop_window_time_type, hop_window_size, hop_window_size_unit,
hop_window_slide, hop_window_slide_unit, hop_window_alarm_once_per_window,
session_window_time_type, session_window_size, session_window_size_unit,
create_dept, del_flag, create_time, update_time, create_by, update_by,
remark, tenant_id
</sql>
<select id="selectByGroupById" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_group_by_window
WHERE group_by_id = #{groupById, jdbcType=INTEGER}
AND del_flag = '0'
LIMIT 1
</select>
</mapper>
haobang-security-xdr/syslog-consumer/src/main/resources/mapper/AnalysisTaskHistoryMapper.xml
+83
View File
@@ -0,0 +1,83 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.common.mapper.AnalysisTaskHistoryMapper">
<resultMap id="BaseResultMap" type="com.common.entity.AnalysisTaskHistory">
<id column="id" property="id" jdbcType="BIGINT"/>
<result column="rule_id" property="ruleId" jdbcType="VARCHAR"/>
<result column="start_time" property="startTime" jdbcType="TIMESTAMP"/>
<result column="end_time" property="endTime" jdbcType="TIMESTAMP"/>
<result column="duration_time" property="durationTime" jdbcType="BIGINT"/>
<result column="progress_percent" property="progressPercent" jdbcType="INTEGER"/>
<result column="input_count" property="inputCount" jdbcType="BIGINT"/>
<result column="output_count" property="outputCount" jdbcType="BIGINT"/>
<result column="status" property="status" jdbcType="VARCHAR"/>
<result column="create_dept" property="createDept" jdbcType="BIGINT"/>
<result column="del_flag" property="delFlag" jdbcType="CHAR"/>
<result column="create_time" property="createTime" jdbcType="TIMESTAMP"/>
<result column="update_time" property="updateTime" jdbcType="TIMESTAMP"/>
<result column="create_by" property="createBy" jdbcType="BIGINT"/>
<result column="update_by" property="updateBy" jdbcType="BIGINT"/>
<result column="remark" property="remark" jdbcType="VARCHAR"/>
<result column="tenant_id" property="tenantId" jdbcType="VARCHAR"/>
</resultMap>
<sql id="Base_Column_List">
id, rule_id, start_time, end_time, duration_time, progress_percent,
input_count, output_count, status, create_dept, del_flag,
create_time, update_time, create_by, update_by, remark, tenant_id
</sql>
<!-- 插入任务历史记录 -->
<insert id="insert" parameterType="com.common.entity.AnalysisTaskHistory">
INSERT INTO analysis_task_history (
<include refid="Base_Column_List"/>
) VALUES (
#{id}, #{ruleId}::uuid, #{startTime}, #{endTime}, #{durationTime}, #{progressPercent},
#{inputCount}, #{outputCount}, #{status}, #{createDept}, #{delFlag},
#{createTime}, #{updateTime}, #{createBy}, #{updateBy}, #{remark}, #{tenantId}
)
</insert>
<!-- 更新任务历史记录 -->
<update id="update" parameterType="com.common.entity.AnalysisTaskHistory">
UPDATE analysis_task_history
SET end_time = #{endTime},
duration_time = #{durationTime},
progress_percent = #{progressPercent},
input_count = #{inputCount},
output_count = #{outputCount},
status = #{status},
update_time = NOW()
<if test="remark != null">
,remark = #{remark}
</if>
WHERE id = #{id}
</update>
<!-- 根据规则ID查询最近的任务历史 -->
<select id="selectRecentByRuleId" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_task_history
WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
AND del_flag = '0'
ORDER BY create_time DESC
<if test="limit != null and limit > 0">
LIMIT #{limit}
</if>
</select>
<!-- 根据规则ID和状态查询任务历史 -->
<select id="selectByRuleIdAndStatus" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_task_history
WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
AND status = #{status}
AND del_flag = '0'
ORDER BY create_time DESC
LIMIT 1
</select>
</mapper>
haobang-security-xdr/syslog-consumer/src/main/resources/mapper/AnalysisWhereConditionMapper.xml
+58
View File
@@ -0,0 +1,58 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.common.mapper.AnalysisWhereConditionMapper">
<resultMap id="BaseResultMap" type="com.common.entity.AnalysisWhereCondition">
<id column="cond_id" property="condId" jdbcType="INTEGER"/>
<result column="rule_id" property="ruleId" jdbcType="VARCHAR"/>
<result column="logical_op" property="logicalOp" jdbcType="VARCHAR"/>
<result column="seq_num" property="seqNum" jdbcType="INTEGER"/>
<result column="parent_cond_id" property="parentCondId" jdbcType="INTEGER"/>
<result column="create_dept" property="createDept" jdbcType="BIGINT"/>
<result column="del_flag" property="delFlag" jdbcType="CHAR"/>
<result column="create_time" property="createTime" jdbcType="TIMESTAMP"/>
<result column="update_time" property="updateTime" jdbcType="TIMESTAMP"/>
<result column="create_by" property="createBy" jdbcType="BIGINT"/>
<result column="update_by" property="updateBy" jdbcType="BIGINT"/>
<result column="remark" property="remark" jdbcType="VARCHAR"/>
<result column="tenant_id" property="tenantId" jdbcType="VARCHAR"/>
</resultMap>
<sql id="Base_Column_List">
cond_id, rule_id, logical_op, seq_num, parent_cond_id,
create_dept, del_flag, create_time, update_time,
create_by, update_by, remark, tenant_id
</sql>
<!-- 根据规则ID查询WHERE条件 -->
<select id="selectByRuleId" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_where_condition
WHERE rule_id = #{ruleId}::uuid
AND del_flag = '0'
ORDER BY seq_num ASC
</select>
<!-- 查询根节点条件（无父节点） -->
<select id="selectRootConditions" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_where_condition
WHERE rule_id = #{ruleId}::uuid
AND (parent_cond_id IS NULL OR parent_cond_id = 0)
AND del_flag = '0'
ORDER BY seq_num ASC
</select>
<!-- 查询指定条件的子条件 -->
<select id="selectChildConditions" resultMap="BaseResultMap">
SELECT
<include refid="Base_Column_List"/>
FROM analysis_where_condition
WHERE parent_cond_id = #{parentCondId}
AND del_flag = '0'
ORDER BY seq_num ASC
</select>
</mapper>
haobang-security-xdr/syslog-consumer/src/main/resources/mapper/AppLogMapper.xml
+1 -1
View File
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.example.esdemo.mapper.AppLogMapper">
<mapper namespace="com.common.mapper.AppLogMapper">
<insert id="batchInsert" parameterType="list">
INSERT INTO applog (