AlertMessage:
1、alertmessage添加is_distribute(待删除)、command_uuid、create_time、modify_time、alert_message_uuid属性。 2、AlertMessageController添加queryAlarmsByCommandId方法,根据commandUUID查询alertmessage 3、AlertMessageMapper添加新建、查询alertmessage 4、service重写处理alertmessage逻辑,现在alertmessage的isdistribute不需要了,需要删除 Command: 1、service添加updateCommandVaid方法,用于对研判后任务生成的指令研判下发 Task: 1、TaskCommandInfo类添加taskStatus,减少AlertMessageService的查询,并做了标注 2、Controller添加研判后任务下发指令\停止指令的方法validCommandInfoByTaskId StaticRule、DynamicRule、WhiteList: 1、添加分页查询返回数据总数
This commit is contained in:
@@ -3,16 +3,33 @@ package com.realtime.protection.configuration.entity.rule.dynamicrule;
|
|||||||
import com.fasterxml.jackson.annotation.JsonProperty;
|
import com.fasterxml.jackson.annotation.JsonProperty;
|
||||||
import com.realtime.protection.configuration.entity.task.FiveTupleWithMask;
|
import com.realtime.protection.configuration.entity.task.FiveTupleWithMask;
|
||||||
import lombok.Data;
|
import lombok.Data;
|
||||||
|
import lombok.NonNull;
|
||||||
|
|
||||||
@Data
|
@Data
|
||||||
public class AlertMessage {
|
public class AlertMessage {
|
||||||
|
|
||||||
@JsonProperty("task_id")
|
@JsonProperty("task_id")
|
||||||
private Long taskId;
|
private Long taskId;
|
||||||
@JsonProperty("five_tuple_with_mask")
|
|
||||||
private FiveTupleWithMask fiveTupleWithMask;
|
|
||||||
|
|
||||||
@JsonProperty("dynamic_rule_id")
|
@JsonProperty("dynamic_rule_id")
|
||||||
private Integer dynamicRuleId;
|
private Integer dynamicRuleId;
|
||||||
|
|
||||||
|
|
||||||
|
@JsonProperty("five_tuple_with_mask")
|
||||||
|
private FiveTupleWithMask fiveTupleWithMask;
|
||||||
|
|
||||||
|
@JsonProperty("is_distribute")
|
||||||
|
private Boolean isDistribute;//待删除
|
||||||
|
|
||||||
|
@JsonProperty("command_uuid")
|
||||||
|
private String commandUUID;
|
||||||
|
|
||||||
|
@JsonProperty("create_time")
|
||||||
|
private String createTime;
|
||||||
|
@JsonProperty("modify_time")
|
||||||
|
private String modifyTime;
|
||||||
|
@JsonProperty("alert_message_uuid")
|
||||||
|
private String alertMessageUUID;
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -55,4 +55,21 @@ public class FiveTupleWithMask {
|
|||||||
|
|
||||||
@Schema(description = "协议掩码", example = "0")
|
@Schema(description = "协议掩码", example = "0")
|
||||||
private String maskProtocol;
|
private String maskProtocol;
|
||||||
|
|
||||||
|
// 复制构造函数
|
||||||
|
public void copyFiveTupleWithMask(FiveTupleWithMask original) {
|
||||||
|
this.addrType = original.addrType;
|
||||||
|
this.sourceIP = original.sourceIP;
|
||||||
|
this.sourcePort = original.sourcePort;
|
||||||
|
this.destinationIP = original.destinationIP;
|
||||||
|
this.destinationPort = original.destinationPort;
|
||||||
|
this.protocol = original.protocol;
|
||||||
|
this.protocolNum = original.protocolNum;
|
||||||
|
this.maskSourceIP = original.maskSourceIP;
|
||||||
|
this.maskSourcePort = original.maskSourcePort;
|
||||||
|
this.maskDestinationIP = original.maskDestinationIP;
|
||||||
|
this.maskDestinationPort = original.maskDestinationPort;
|
||||||
|
this.maskProtocol = original.maskProtocol;
|
||||||
|
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -69,9 +69,14 @@ public class TaskCommandInfo {
|
|||||||
@Schema(description = "最新下发时间", accessMode = Schema.AccessMode.READ_ONLY)
|
@Schema(description = "最新下发时间", accessMode = Schema.AccessMode.READ_ONLY)
|
||||||
private LocalDateTime latestSendTime;
|
private LocalDateTime latestSendTime;
|
||||||
|
|
||||||
|
/*
|
||||||
|
以下属性用于动态规则生成,不写入doris:t_command表
|
||||||
|
*/
|
||||||
@Schema(description = "防御策略模板ID", accessMode = Schema.AccessMode.READ_ONLY)
|
@Schema(description = "防御策略模板ID", accessMode = Schema.AccessMode.READ_ONLY)
|
||||||
private Integer templateId;
|
private Integer templateId;
|
||||||
|
|
||||||
@Schema(description = "防护等级", accessMode = Schema.AccessMode.READ_ONLY)
|
@Schema(description = "防护等级", accessMode = Schema.AccessMode.READ_ONLY)
|
||||||
private Integer protectLevel;
|
private Integer protectLevel;
|
||||||
|
@Schema(description = "指令所属任务的运行状态", accessMode = Schema.AccessMode.READ_ONLY)
|
||||||
|
private Integer taskStatus;
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,13 +1,13 @@
|
|||||||
package com.realtime.protection.server.alertmessage;
|
package com.realtime.protection.server.alertmessage;
|
||||||
|
|
||||||
import com.realtime.protection.configuration.entity.rule.dynamicrule.AlertMessage;
|
import com.realtime.protection.configuration.entity.rule.dynamicrule.AlertMessage;
|
||||||
|
import com.realtime.protection.configuration.entity.task.TaskCommandInfo;
|
||||||
import com.realtime.protection.configuration.response.ResponseResult;
|
import com.realtime.protection.configuration.response.ResponseResult;
|
||||||
import jakarta.validation.Valid;
|
import jakarta.validation.Valid;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
import org.springframework.web.bind.annotation.PostMapping;
|
import org.springframework.web.bind.annotation.*;
|
||||||
import org.springframework.web.bind.annotation.RequestBody;
|
|
||||||
import org.springframework.web.bind.annotation.RequestMapping;
|
import java.util.List;
|
||||||
import org.springframework.web.bind.annotation.RestController;
|
|
||||||
|
|
||||||
@RestController
|
@RestController
|
||||||
@RequestMapping("alertmessage")
|
@RequestMapping("alertmessage")
|
||||||
@@ -25,4 +25,12 @@ public class AlertMessageController
|
|||||||
return ResponseResult.ok();
|
return ResponseResult.ok();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
//实时任务、研判后任务:查看指令对应的告警信息
|
||||||
|
@GetMapping("/{commandId}/alarms")
|
||||||
|
public ResponseResult queryAlarmsByCommandId(@PathVariable String commandId) {
|
||||||
|
return ResponseResult.ok()
|
||||||
|
.setData("success", true)
|
||||||
|
.setData("alarms", alertMessageService.queryAlarmsByCommandId(commandId));
|
||||||
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,10 +1,14 @@
|
|||||||
package com.realtime.protection.server.alertmessage;
|
package com.realtime.protection.server.alertmessage;
|
||||||
|
|
||||||
|
import com.baomidou.dynamic.datasource.annotation.DS;
|
||||||
import com.realtime.protection.configuration.entity.defense.template.ProtectLevel;
|
import com.realtime.protection.configuration.entity.defense.template.ProtectLevel;
|
||||||
|
import com.realtime.protection.configuration.entity.rule.dynamicrule.AlertMessage;
|
||||||
import com.realtime.protection.configuration.entity.task.FiveTupleWithMask;
|
import com.realtime.protection.configuration.entity.task.FiveTupleWithMask;
|
||||||
import com.realtime.protection.configuration.entity.task.TaskCommandInfo;
|
import com.realtime.protection.configuration.entity.task.TaskCommandInfo;
|
||||||
import org.apache.ibatis.annotations.Mapper;
|
import org.apache.ibatis.annotations.Mapper;
|
||||||
|
|
||||||
|
import java.util.List;
|
||||||
|
|
||||||
|
|
||||||
@Mapper
|
@Mapper
|
||||||
public interface AlertMessageMapper {
|
public interface AlertMessageMapper {
|
||||||
@@ -12,5 +16,10 @@ public interface AlertMessageMapper {
|
|||||||
TaskCommandInfo getDynamicTaskInfos(Long taskId) ;
|
TaskCommandInfo getDynamicTaskInfos(Long taskId) ;
|
||||||
|
|
||||||
|
|
||||||
ProtectLevel queryTemplateProtectLevel(Integer templateId, Integer protectLevel, FiveTupleWithMask fiveTupleWithMask);
|
ProtectLevel queryTemplateProtectLevel(Integer templateId, Integer protectLevel);
|
||||||
|
|
||||||
|
@DS("doris")
|
||||||
|
void insertAlertMessage(AlertMessage alertMessage);
|
||||||
|
@DS("doris")
|
||||||
|
List<AlertMessage> queryAlermsByCommandId(String commandId);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -5,9 +5,15 @@ import com.realtime.protection.configuration.entity.rule.dynamicrule.AlertMessag
|
|||||||
import com.realtime.protection.configuration.entity.task.FiveTupleWithMask;
|
import com.realtime.protection.configuration.entity.task.FiveTupleWithMask;
|
||||||
import com.realtime.protection.configuration.entity.task.TaskCommandInfo;
|
import com.realtime.protection.configuration.entity.task.TaskCommandInfo;
|
||||||
import com.realtime.protection.configuration.utils.enums.StateEnum;
|
import com.realtime.protection.configuration.utils.enums.StateEnum;
|
||||||
|
import com.realtime.protection.configuration.utils.enums.TaskTypeEnum;
|
||||||
import com.realtime.protection.server.command.CommandService;
|
import com.realtime.protection.server.command.CommandService;
|
||||||
import com.realtime.protection.server.task.TaskService;
|
import com.realtime.protection.server.task.TaskService;
|
||||||
import org.springframework.stereotype.Service;
|
import org.springframework.stereotype.Service;
|
||||||
|
import org.springframework.transaction.annotation.Transactional;
|
||||||
|
import com.baomidou.dynamic.datasource.annotation.DSTransactional;
|
||||||
|
|
||||||
|
import java.util.List;
|
||||||
|
|
||||||
|
|
||||||
@Service
|
@Service
|
||||||
public class AlertMessageService {
|
public class AlertMessageService {
|
||||||
@@ -22,52 +28,119 @@ public class AlertMessageService {
|
|||||||
this.alertMessageMapper = alertMessageMapper;
|
this.alertMessageMapper = alertMessageMapper;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@DSTransactional
|
||||||
public void processAlertMessage(AlertMessage alertMessage) {
|
public void processAlertMessage(AlertMessage alertMessage) {
|
||||||
Long taskId = alertMessage.getTaskId();
|
TaskCommandInfo dynamicTaskCommandInfo = generateDynamicCommand(alertMessage);
|
||||||
//检查task status是否为running?
|
|
||||||
Integer taskStatus = taskService.queryTaskStatus(taskId);
|
|
||||||
Integer temp = StateEnum.RUNNING.getStateNum();
|
|
||||||
// if (taskStatus != StateEnum.RUNNING.getStateNum()) {
|
|
||||||
// return;
|
|
||||||
// }
|
|
||||||
|
|
||||||
//查task信息,和alertMessage中的fiveTuple信息 合并成 TaskCommandInfo
|
Integer taskStatus = dynamicTaskCommandInfo.getTaskStatus();
|
||||||
TaskCommandInfo dynamicTaskCommandInfo = alertMessageMapper.getDynamicTaskInfos(taskId);
|
Integer taskType = dynamicTaskCommandInfo.getTaskType();
|
||||||
|
|
||||||
//根据策略模板更新五元组
|
|
||||||
ProtectLevel templateProtectLevel = alertMessageMapper.queryTemplateProtectLevel(
|
|
||||||
dynamicTaskCommandInfo.getTemplateId(),
|
|
||||||
dynamicTaskCommandInfo.getProtectLevel(),
|
|
||||||
alertMessage.getFiveTupleWithMask());
|
|
||||||
updateFiveTupleWithMask(alertMessage.getFiveTupleWithMask(), templateProtectLevel);
|
|
||||||
dynamicTaskCommandInfo.setFiveTupleWithMask(alertMessage.getFiveTupleWithMask());
|
|
||||||
|
|
||||||
// command入库
|
|
||||||
commandService.createCommand(dynamicTaskCommandInfo);
|
|
||||||
|
|
||||||
|
if (taskType == TaskTypeEnum.DYNAMIC.getTaskType())//动态
|
||||||
|
switch (taskStatus) {
|
||||||
|
case 2://running
|
||||||
|
insertCommandAndAlertMessage(dynamicTaskCommandInfo, true, alertMessage, true);
|
||||||
|
break;
|
||||||
|
case 3://Paused
|
||||||
|
insertCommandAndAlertMessage(dynamicTaskCommandInfo, false, alertMessage, true);
|
||||||
|
break;
|
||||||
|
default://主要是stop
|
||||||
|
//command不入库
|
||||||
|
//alertmessage入库
|
||||||
|
insertAlertMessageOnly(alertMessage, true);
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
else if (taskType == TaskTypeEnum.JUDGED.getTaskType())//研判后
|
||||||
|
switch (taskStatus) {
|
||||||
|
case 2://running
|
||||||
|
insertCommandAndAlertMessage(dynamicTaskCommandInfo, false, alertMessage, false);
|
||||||
|
break;
|
||||||
|
case 3://Paused
|
||||||
|
insertCommandAndAlertMessage(dynamicTaskCommandInfo, false, alertMessage, false);
|
||||||
|
break;
|
||||||
|
default://主要是stop
|
||||||
|
//command不入库
|
||||||
|
//alertmessage入库
|
||||||
|
insertAlertMessageOnly(alertMessage, false);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
private void updateFiveTupleWithMask(FiveTupleWithMask alertMessageFiveTupleW, ProtectLevel templateProtectLevel) {
|
|
||||||
|
private TaskCommandInfo generateDynamicCommand(AlertMessage alertMessage){
|
||||||
|
Long taskId = alertMessage.getTaskId();
|
||||||
|
|
||||||
|
// 查task信息
|
||||||
|
// (1)查询生成指令所需信息:和alertMessage中的fiveTuple信息 合并成 TaskCommandInfo;
|
||||||
|
// (2)额外信息:并额外查询templateId、protectLevel和taskStatus
|
||||||
|
TaskCommandInfo dynamicCommandInfo = alertMessageMapper.getDynamicTaskInfos(taskId);
|
||||||
|
|
||||||
|
// 根据templateId、protectLevel获取策略模板
|
||||||
|
ProtectLevel templateProtectLevel = alertMessageMapper.queryTemplateProtectLevel(
|
||||||
|
dynamicCommandInfo.getTemplateId(),
|
||||||
|
dynamicCommandInfo.getProtectLevel());
|
||||||
|
//根据策略模板和alertMessage中的FiveTupleWithMask生成要下发五元组信息
|
||||||
|
FiveTupleWithMask fiveTupleWithMaskNew = updateFiveTupleWithMask(alertMessage.getFiveTupleWithMask(),
|
||||||
|
templateProtectLevel);
|
||||||
|
//指令加入策略模板筛选后的fiveTupleWithMaskNew
|
||||||
|
dynamicCommandInfo.setFiveTupleWithMask(fiveTupleWithMaskNew);
|
||||||
|
|
||||||
|
return dynamicCommandInfo;
|
||||||
|
}
|
||||||
|
|
||||||
|
@DSTransactional
|
||||||
|
private void insertCommandAndAlertMessage(TaskCommandInfo dynamicTaskCommandInfo, Boolean isValid,
|
||||||
|
AlertMessage alertMessage, Boolean isDistribute){
|
||||||
|
//command入库
|
||||||
|
dynamicTaskCommandInfo.setIsValid(isValid);
|
||||||
|
String commandUUID = commandService.createCommand(dynamicTaskCommandInfo);
|
||||||
|
if (true){
|
||||||
|
throw new RuntimeException("test");
|
||||||
|
}
|
||||||
|
//alertmessage入库
|
||||||
|
alertMessage.setIsDistribute(isDistribute);
|
||||||
|
alertMessage.setCommandUUID(commandUUID);
|
||||||
|
alertMessageMapper.insertAlertMessage(alertMessage);
|
||||||
|
}
|
||||||
|
private void insertAlertMessageOnly(AlertMessage alertMessage, Boolean isDistribute){
|
||||||
|
//alertmessage入库
|
||||||
|
alertMessage.setIsDistribute(isDistribute);
|
||||||
|
alertMessage.setCommandUUID(null);
|
||||||
|
alertMessageMapper.insertAlertMessage(alertMessage);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
private FiveTupleWithMask updateFiveTupleWithMask(FiveTupleWithMask fiveTupleWithMask, ProtectLevel templateProtectLevel) {
|
||||||
|
|
||||||
|
FiveTupleWithMask newFiveTupleWithMask = new FiveTupleWithMask();
|
||||||
|
newFiveTupleWithMask.copyFiveTupleWithMask(fiveTupleWithMask);
|
||||||
|
|
||||||
if(!templateProtectLevel.getHasProtectObjectIP()){
|
if(!templateProtectLevel.getHasProtectObjectIP()){
|
||||||
alertMessageFiveTupleW.setDestinationIP(null);
|
newFiveTupleWithMask.setDestinationIP(null);
|
||||||
alertMessageFiveTupleW.setMaskDestinationIP(null);
|
newFiveTupleWithMask.setMaskDestinationIP(null);
|
||||||
}
|
}
|
||||||
if(!templateProtectLevel.getHasProtectObjectPort()){
|
if(!templateProtectLevel.getHasProtectObjectPort()){
|
||||||
alertMessageFiveTupleW.setDestinationPort(null);
|
newFiveTupleWithMask.setDestinationPort(null);
|
||||||
alertMessageFiveTupleW.setMaskDestinationPort(null);
|
newFiveTupleWithMask.setMaskDestinationPort(null);
|
||||||
}
|
}
|
||||||
if(!templateProtectLevel.getHasPeerIP()){
|
if(!templateProtectLevel.getHasPeerIP()){
|
||||||
alertMessageFiveTupleW.setSourceIP(null);
|
newFiveTupleWithMask.setSourceIP(null);
|
||||||
alertMessageFiveTupleW.setMaskSourceIP(null);
|
newFiveTupleWithMask.setMaskSourceIP(null);
|
||||||
}
|
}
|
||||||
if(!templateProtectLevel.getHasPeerPort()){
|
if(!templateProtectLevel.getHasPeerPort()){
|
||||||
alertMessageFiveTupleW.setSourcePort(null);
|
newFiveTupleWithMask.setSourcePort(null);
|
||||||
alertMessageFiveTupleW.setMaskSourcePort(null);
|
newFiveTupleWithMask.setMaskSourcePort(null);
|
||||||
}
|
}
|
||||||
if (!templateProtectLevel.getHasProtocol()) {
|
if (!templateProtectLevel.getHasProtocol()) {
|
||||||
alertMessageFiveTupleW.setProtocol(null);
|
newFiveTupleWithMask.setProtocol(null);
|
||||||
alertMessageFiveTupleW.setMaskProtocol(null);
|
newFiveTupleWithMask.setMaskProtocol(null);
|
||||||
}
|
}
|
||||||
//目前告警信息还只是五元组,没有url、dns
|
//目前告警信息还只是五元组,没有url、dns
|
||||||
|
return newFiveTupleWithMask;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
public List<AlertMessage> queryAlarmsByCommandId(String commandId) {
|
||||||
|
return alertMessageMapper.queryAlermsByCommandId(commandId);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -79,4 +79,17 @@ public class CommandService {
|
|||||||
public Boolean removeCommandsByTaskId(Long taskId) {
|
public Boolean removeCommandsByTaskId(Long taskId) {
|
||||||
return commandMapper.removeCommandsByTaskId(taskId);
|
return commandMapper.removeCommandsByTaskId(taskId);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@DS("doris")
|
||||||
|
public Object updateCommandVaid(String commandId, Integer isValid) {
|
||||||
|
if (isValid == 0) {
|
||||||
|
return commandMapper.setCommandInvalid(commandId);
|
||||||
|
}
|
||||||
|
if (isValid == 1) {
|
||||||
|
return commandMapper.setCommandValid(commandId);
|
||||||
|
}
|
||||||
|
return new IllegalArgumentException("isValid must be 0 or 1");
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -103,7 +103,8 @@ public class DynamicRuleController implements DynamicRuleControllerApi {
|
|||||||
return ResponseResult.ok()
|
return ResponseResult.ok()
|
||||||
.setData("success", true)
|
.setData("success", true)
|
||||||
.setData("dynamic_rule_list", dynamicRuleService.queryDynamicRuleObject(dynamicRuleName, dynamicRuleId,
|
.setData("dynamic_rule_list", dynamicRuleService.queryDynamicRuleObject(dynamicRuleName, dynamicRuleId,
|
||||||
protectObjectSourceSystem, creator, page, pageSize));
|
protectObjectSourceSystem, creator, page, pageSize))
|
||||||
|
.setData("dynamic_rule_total_num",dynamicRuleService.queryDynamicRuleTotalNum());
|
||||||
}
|
}
|
||||||
|
|
||||||
//详情查看?? 就是按id查询吧
|
//详情查看?? 就是按id查询吧
|
||||||
|
|||||||
@@ -28,9 +28,9 @@ public interface DynamicRuleControllerApi {
|
|||||||
content = @Content(
|
content = @Content(
|
||||||
mediaType = "application/json",
|
mediaType = "application/json",
|
||||||
schema = @Schema(
|
schema = @Schema(
|
||||||
// title = "ResponseResult和DynamicRule的组合模型",
|
title = "ResponseResult和DynamicRule的组合模型",
|
||||||
// description = "ResponseResult的data内DynamicRule",
|
description = "ResponseResult的data内DynamicRule",
|
||||||
// anyOf = {ResponseResult.class, DynamicRuleObject.class})
|
anyOf = {ResponseResult.class, DynamicRuleObject.class},
|
||||||
implementation = ResponseResult.class)
|
implementation = ResponseResult.class)
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
@@ -84,7 +84,11 @@ public interface DynamicRuleControllerApi {
|
|||||||
description = "返回修改对象结果",
|
description = "返回修改对象结果",
|
||||||
content = @Content(
|
content = @Content(
|
||||||
mediaType = "application/json",
|
mediaType = "application/json",
|
||||||
schema = @Schema(implementation = ResponseResult.class)
|
schema = @Schema(
|
||||||
|
title = "ResponseResult和DynamicRule的组合模型",
|
||||||
|
description = "ResponseResult的data内DynamicRule",
|
||||||
|
anyOf = {ResponseResult.class, DynamicRuleObject.class},
|
||||||
|
implementation = ResponseResult.class)
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
},
|
},
|
||||||
|
|||||||
@@ -40,4 +40,6 @@ public interface DynamicRuleMapper {
|
|||||||
boolean newDynamicRulProtectObjectsConcat(Integer dynamicRuleId, List<Integer> protectObjectIds);
|
boolean newDynamicRulProtectObjectsConcat(Integer dynamicRuleId, List<Integer> protectObjectIds);
|
||||||
|
|
||||||
boolean queryProtectObjectById(Integer protectObjectId);
|
boolean queryProtectObjectById(Integer protectObjectId);
|
||||||
|
|
||||||
|
Integer queryDynamicRuleTotalNum();
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -160,4 +160,8 @@ public class DynamicRuleService {
|
|||||||
return dynamicRuleMapper.queryDynamicRuleObject(dynamicRuleName, dynamicRuleId,
|
return dynamicRuleMapper.queryDynamicRuleObject(dynamicRuleName, dynamicRuleId,
|
||||||
templateSourceSystem, creator, page, pageSize);
|
templateSourceSystem, creator, page, pageSize);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public Integer queryDynamicRuleTotalNum() {
|
||||||
|
return dynamicRuleMapper.queryDynamicRuleTotalNum();
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -44,7 +44,7 @@ public class StaticRuleController implements StaticRuleControllerApi {
|
|||||||
//以Excel方式批量导入静态规则
|
//以Excel方式批量导入静态规则
|
||||||
@PostMapping("/upload")
|
@PostMapping("/upload")
|
||||||
@Override
|
@Override
|
||||||
public ResponseResult uploadFile(MultipartFile uploadFile) throws IOException {
|
public ResponseResult uploadFile(@RequestPart("file")MultipartFile uploadFile) throws IOException {
|
||||||
EasyExcel.read(uploadFile.getInputStream(), StaticRuleObject.class,
|
EasyExcel.read(uploadFile.getInputStream(), StaticRuleObject.class,
|
||||||
new StaticRuleDataListener(staticRuleService)).sheet().doRead();
|
new StaticRuleDataListener(staticRuleService)).sheet().doRead();
|
||||||
return ResponseResult.ok();
|
return ResponseResult.ok();
|
||||||
@@ -137,7 +137,9 @@ public class StaticRuleController implements StaticRuleControllerApi {
|
|||||||
List<StaticRuleObject> pageResult = staticRuleService.queryStaticRule(
|
List<StaticRuleObject> pageResult = staticRuleService.queryStaticRule(
|
||||||
static_rule_name, static_rule_id,
|
static_rule_name, static_rule_id,
|
||||||
static_rule_creator, static_rule_ip, page, pageSize);
|
static_rule_creator, static_rule_ip, page, pageSize);
|
||||||
return ResponseResult.ok().setData("static_rule_list", pageResult);
|
return ResponseResult.ok()
|
||||||
|
.setData("static_rule_list", pageResult)
|
||||||
|
.setData("static_rule_total_num",staticRuleService.queryStaticRuleTotalNum());
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|||||||
@@ -12,6 +12,7 @@ import jakarta.validation.Valid;
|
|||||||
import org.springframework.web.bind.annotation.PathVariable;
|
import org.springframework.web.bind.annotation.PathVariable;
|
||||||
import org.springframework.web.bind.annotation.RequestBody;
|
import org.springframework.web.bind.annotation.RequestBody;
|
||||||
import org.springframework.web.bind.annotation.RequestParam;
|
import org.springframework.web.bind.annotation.RequestParam;
|
||||||
|
import org.springframework.web.bind.annotation.RequestPart;
|
||||||
import org.springframework.web.multipart.MultipartFile;
|
import org.springframework.web.multipart.MultipartFile;
|
||||||
|
|
||||||
import java.io.IOException;
|
import java.io.IOException;
|
||||||
@@ -28,7 +29,8 @@ public interface StaticRuleControllerApi {
|
|||||||
description = "返回新增对象结果",
|
description = "返回新增对象结果",
|
||||||
content = @Content(
|
content = @Content(
|
||||||
mediaType = "application/json",
|
mediaType = "application/json",
|
||||||
schema = @Schema(implementation = ResponseResult.class)
|
schema = @Schema(
|
||||||
|
implementation = ResponseResult.class)
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
},
|
},
|
||||||
@@ -52,7 +54,7 @@ public interface StaticRuleControllerApi {
|
|||||||
requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(
|
requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(
|
||||||
description = "Excel文件")
|
description = "Excel文件")
|
||||||
)
|
)
|
||||||
ResponseResult uploadFile(MultipartFile uploadFile) throws IOException;
|
ResponseResult uploadFile(@RequestPart("file")MultipartFile uploadFile) throws IOException;
|
||||||
|
|
||||||
@Operation(
|
@Operation(
|
||||||
summary = "下载静态规则模板",
|
summary = "下载静态规则模板",
|
||||||
|
|||||||
@@ -38,4 +38,6 @@ public interface StaticRuleMapper {
|
|||||||
Integer queryAuditStatusById(Integer id);
|
Integer queryAuditStatusById(Integer id);
|
||||||
|
|
||||||
Boolean updateAuditStatusById(Integer id, Integer auditStatus);
|
Boolean updateAuditStatusById(Integer id, Integer auditStatus);
|
||||||
|
|
||||||
|
Integer queryStaticRuleTotalNum();
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -147,4 +147,8 @@ public class StaticRuleService {
|
|||||||
public void deleteStaticRuleById(Integer id) {
|
public void deleteStaticRuleById(Integer id) {
|
||||||
staticRuleMapper.deleteStaticRuleById(id);
|
staticRuleMapper.deleteStaticRuleById(id);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public Integer queryStaticRuleTotalNum() {
|
||||||
|
return staticRuleMapper.queryStaticRuleTotalNum();
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -135,4 +135,14 @@ public class TaskController implements TaskControllerApi {
|
|||||||
.setData("success", true)
|
.setData("success", true)
|
||||||
.setData("commands", commandService.queryCommandInfoByTaskId(taskId));
|
.setData("commands", commandService.queryCommandInfoByTaskId(taskId));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
//研判后任务 下发指令\停止指令
|
||||||
|
@PostMapping("/{commandId}/valid/{isValid}")
|
||||||
|
public ResponseResult validCommandInfoByTaskId(@PathVariable Integer isValid,
|
||||||
|
@PathVariable String commandId) {
|
||||||
|
return ResponseResult.ok()
|
||||||
|
.setData("success", commandService.updateCommandVaid(commandId, isValid));
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -69,7 +69,8 @@ public class WhiteListController implements WhiteListControllerApi {
|
|||||||
.setData("whiteobj_list", null);
|
.setData("whiteobj_list", null);
|
||||||
}
|
}
|
||||||
return ResponseResult.ok()
|
return ResponseResult.ok()
|
||||||
.setData("whiteobj_list", whiteListService.queryWhiteListObject(whiteListName, whiteListId, page, pageSize));
|
.setData("whiteobj_list", whiteListService.queryWhiteListObject(whiteListName, whiteListId, page, pageSize))
|
||||||
|
.setData("whiteobj_total_num", whiteListService.queryWhiteListTotalNum());
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
|
|||||||
@@ -38,4 +38,6 @@ public interface WhiteListMapper {
|
|||||||
void deleteWhiteListObjects(@Param("whiteListIds") List<Integer> whiteListBatch);
|
void deleteWhiteListObjects(@Param("whiteListIds") List<Integer> whiteListBatch);
|
||||||
|
|
||||||
List<WhiteListObject> whiteListCommandJudge(@Param("command") FiveTupleWithMask fiveTupleWithMaskInCommand);
|
List<WhiteListObject> whiteListCommandJudge(@Param("command") FiveTupleWithMask fiveTupleWithMaskInCommand);
|
||||||
|
|
||||||
|
Integer queryWhiteListTotalNum();
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -157,5 +157,9 @@ public class WhiteListService {
|
|||||||
return resultMap;
|
return resultMap;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public Integer queryWhiteListTotalNum(){
|
||||||
|
return whiteListMapper.queryWhiteListTotalNum();
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -21,7 +21,7 @@
|
|||||||
|
|
||||||
<result column="template_id" property="templateId"/>
|
<result column="template_id" property="templateId"/>
|
||||||
<result column="dynamic_rule_protect_level" property="protectLevel"/>
|
<result column="dynamic_rule_protect_level" property="protectLevel"/>
|
||||||
|
<result column="task_status" property="taskStatus"/>
|
||||||
</resultMap>
|
</resultMap>
|
||||||
<resultMap id="protectLevelMap" type="com.realtime.protection.configuration.entity.defense.template.ProtectLevel">
|
<resultMap id="protectLevelMap" type="com.realtime.protection.configuration.entity.defense.template.ProtectLevel">
|
||||||
<id column="protect_level_id" property="protectLevelId"/>
|
<id column="protect_level_id" property="protectLevelId"/>
|
||||||
@@ -34,6 +34,75 @@
|
|||||||
<result column="has_dns" property="hasDNS"/>
|
<result column="has_dns" property="hasDNS"/>
|
||||||
</resultMap>
|
</resultMap>
|
||||||
|
|
||||||
|
<resultMap id="alertMessageMap" type="com.realtime.protection.configuration.entity.rule.dynamicrule.AlertMessage">
|
||||||
|
<id column="ALERT_MESSAGE_ID" property="alertMessageUUID"/>
|
||||||
|
<result column="TASK_ID" property="taskId"/>
|
||||||
|
<result column="DYNAMIC_RULE_ID" property="dynamicRuleId"/>
|
||||||
|
|
||||||
|
<result column="IS_DISTRIBUTE" property="isDistribute"/>
|
||||||
|
<result column="COMMAND_UUID" property="commandUUID"/>
|
||||||
|
|
||||||
|
<result column="CREATE_TIME" property="createTime"/>
|
||||||
|
<result column="LAST_UPDATE" property="modifyTime"/>
|
||||||
|
|
||||||
|
<association property="fiveTupleWithMask">
|
||||||
|
<result column="ADDR_TYPE" property="addrType"/>
|
||||||
|
<result column="SRC_IP" property="sourceIP"/>
|
||||||
|
<result column="SRC_PORT" property="sourcePort"/>
|
||||||
|
<result column="DST_IP" property="destinationIP"/>
|
||||||
|
<result column="DST_PORT" property="destinationPort"/>
|
||||||
|
<result column="PROTOCOL" property="protocol"/>
|
||||||
|
<result column="MASK_SRC_IP" property="maskSourceIP"/>
|
||||||
|
<result column="MASK_SRC_PORT" property="maskSourcePort"/>
|
||||||
|
<result column="MASK_DST_IP" property="maskDestinationIP"/>
|
||||||
|
<result column="MASK_DST_PORT" property="maskDestinationPort"/>
|
||||||
|
<result column="MASK_PROTOCOL" property="maskProtocol"/>
|
||||||
|
</association>
|
||||||
|
|
||||||
|
</resultMap>
|
||||||
|
|
||||||
|
<insert id="insertAlertMessage">
|
||||||
|
insert
|
||||||
|
into t_alertmessage(TASK_ID,
|
||||||
|
DYNAMIC_RULE_ID,
|
||||||
|
ADDR_TYPE,
|
||||||
|
SRC_IP,
|
||||||
|
SRC_PORT,
|
||||||
|
DST_IP,
|
||||||
|
DST_PORT,
|
||||||
|
PROTOCOL,
|
||||||
|
MASK_SRC_IP,
|
||||||
|
MASK_SRC_PORT,
|
||||||
|
MASK_DST_IP,
|
||||||
|
MASK_DST_PORT,
|
||||||
|
MASK_PROTOCOL,
|
||||||
|
IS_DISTRIBUTE,
|
||||||
|
COMMAND_UUID,
|
||||||
|
CREATE_TIME,
|
||||||
|
LAST_UPDATE,
|
||||||
|
ALERT_MESSAGE_ID)
|
||||||
|
values (
|
||||||
|
#{taskId},
|
||||||
|
#{dynamicRuleId},
|
||||||
|
#{fiveTupleWithMask.addrType},
|
||||||
|
#{fiveTupleWithMask.sourceIP},
|
||||||
|
#{fiveTupleWithMask.sourcePort},
|
||||||
|
#{fiveTupleWithMask.destinationIP},
|
||||||
|
#{fiveTupleWithMask.destinationPort},
|
||||||
|
#{fiveTupleWithMask.protocol},
|
||||||
|
#{fiveTupleWithMask.maskSourceIP},
|
||||||
|
#{fiveTupleWithMask.maskSourcePort},
|
||||||
|
#{fiveTupleWithMask.maskDestinationIP},
|
||||||
|
#{fiveTupleWithMask.maskDestinationPort},
|
||||||
|
#{fiveTupleWithMask.maskProtocol},
|
||||||
|
#{isDistribute},
|
||||||
|
#{commandUUID},
|
||||||
|
NOW(),
|
||||||
|
NOW(),
|
||||||
|
UUID())
|
||||||
|
|
||||||
|
</insert>
|
||||||
|
|
||||||
<select id="queryTemplateProtectLevel" resultMap="protectLevelMap">
|
<select id="queryTemplateProtectLevel" resultMap="protectLevelMap">
|
||||||
SELECT
|
SELECT
|
||||||
t_protect_level.protect_level_id,
|
t_protect_level.protect_level_id,
|
||||||
@@ -77,11 +146,43 @@
|
|||||||
t_task.task_end_time,
|
t_task.task_end_time,
|
||||||
|
|
||||||
t_dr.template_id,
|
t_dr.template_id,
|
||||||
t_dr.dynamic_rule_protect_level
|
t_dr.dynamic_rule_protect_level,
|
||||||
|
t_task.task_status
|
||||||
|
|
||||||
from t_task
|
from t_task
|
||||||
left join realtime_protection.t_dynamic_rule t_dr on t_task.task_id = t_dr.dynamic_rule_used_task_id
|
left join realtime_protection.t_dynamic_rule t_dr on t_task.task_id = t_dr.dynamic_rule_used_task_id
|
||||||
where
|
where
|
||||||
t_task.task_id = #{task_id}
|
t_task.task_id = #{task_id}
|
||||||
</select>
|
</select>
|
||||||
|
|
||||||
|
<select id="queryAlermsByCommandId"
|
||||||
|
resultMap="alertMessageMap">
|
||||||
|
select
|
||||||
|
t_alertmessage.ALERT_MESSAGE_ID,
|
||||||
|
t_alertmessage.TASK_ID,
|
||||||
|
t_alertmessage.DYNAMIC_RULE_ID,
|
||||||
|
|
||||||
|
t_alertmessage.ADDR_TYPE,
|
||||||
|
t_alertmessage.SRC_IP,
|
||||||
|
t_alertmessage.SRC_PORT,
|
||||||
|
t_alertmessage.DST_IP,
|
||||||
|
t_alertmessage.DST_PORT,
|
||||||
|
t_alertmessage.PROTOCOL,
|
||||||
|
t_alertmessage.MASK_SRC_IP,
|
||||||
|
t_alertmessage.MASK_SRC_PORT,
|
||||||
|
t_alertmessage.MASK_DST_IP,
|
||||||
|
t_alertmessage.MASK_DST_PORT,
|
||||||
|
t_alertmessage.MASK_PROTOCOL,
|
||||||
|
|
||||||
|
t_alertmessage.IS_DISTRIBUTE,
|
||||||
|
t_alertmessage.COMMAND_UUID,
|
||||||
|
|
||||||
|
t_alertmessage.CREATE_TIME,
|
||||||
|
t_alertmessage.LAST_UPDATE
|
||||||
|
|
||||||
|
from t_alertmessage
|
||||||
|
where
|
||||||
|
t_alertmessage.COMMAND_UUID = #{commandId}
|
||||||
|
AND IS_DELETE = FALSE
|
||||||
|
</select>
|
||||||
</mapper>
|
</mapper>
|
||||||
@@ -206,6 +206,10 @@
|
|||||||
from t_protect_object
|
from t_protect_object
|
||||||
where protect_object_id = #{protectObjectId}
|
where protect_object_id = #{protectObjectId}
|
||||||
</select>
|
</select>
|
||||||
|
<select id="queryDynamicRuleTotalNum" resultType="java.lang.Integer">
|
||||||
|
SELECT COUNT(*)
|
||||||
|
FROM t_dynamic_rule
|
||||||
|
</select>
|
||||||
|
|
||||||
|
|
||||||
</mapper>
|
</mapper>
|
||||||
@@ -158,5 +158,9 @@
|
|||||||
SELECT static_rule_audit_status FROM t_static_rule
|
SELECT static_rule_audit_status FROM t_static_rule
|
||||||
WHERE static_rule_id = #{id}
|
WHERE static_rule_id = #{id}
|
||||||
</select>
|
</select>
|
||||||
|
<select id="queryStaticRuleTotalNum" resultType="java.lang.Integer">
|
||||||
|
SELECT COUNT(*)
|
||||||
|
FROM t_static_rule
|
||||||
|
</select>
|
||||||
|
|
||||||
</mapper>
|
</mapper>
|
||||||
@@ -198,5 +198,9 @@
|
|||||||
|
|
||||||
</where>
|
</where>
|
||||||
</select>
|
</select>
|
||||||
|
<select id="queryWhiteListTotalNum" resultType="java.lang.Integer">
|
||||||
|
select COUNT(*)
|
||||||
|
from t_white_list
|
||||||
|
</select>
|
||||||
|
|
||||||
</mapper>
|
</mapper>
|
||||||
@@ -0,0 +1,45 @@
|
|||||||
|
package com.realtime.protection.server.alertmessage;
|
||||||
|
|
||||||
|
import com.realtime.protection.configuration.entity.rule.dynamicrule.AlertMessage;
|
||||||
|
import com.realtime.protection.configuration.entity.task.FiveTupleWithMask;
|
||||||
|
import org.junit.jupiter.api.Test;
|
||||||
|
import org.springframework.beans.factory.annotation.Autowired;
|
||||||
|
import org.springframework.boot.test.context.SpringBootTest;
|
||||||
|
|
||||||
|
@SpringBootTest
|
||||||
|
public class AlertMessageTest {
|
||||||
|
|
||||||
|
private final AlertMessageService alertMessageService;
|
||||||
|
@Autowired
|
||||||
|
public AlertMessageTest(AlertMessageService alertMessageService) {
|
||||||
|
this.alertMessageService = alertMessageService;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
void testReceiveAlertMessage() {
|
||||||
|
for (int i = 1; i < 10; i++) {
|
||||||
|
AlertMessage alertMessage = new AlertMessage();
|
||||||
|
FiveTupleWithMask fiveTupleWithMask = new FiveTupleWithMask();
|
||||||
|
fiveTupleWithMask.setSourceIP("1.1.1." + i);
|
||||||
|
fiveTupleWithMask.setMaskSourceIP("255.255.255.0");
|
||||||
|
fiveTupleWithMask.setDestinationIP("2.2.3.4");
|
||||||
|
fiveTupleWithMask.setMaskDestinationIP("255.255.255.255");
|
||||||
|
fiveTupleWithMask.setSourcePort("80");
|
||||||
|
fiveTupleWithMask.setDestinationPort("80");
|
||||||
|
fiveTupleWithMask.setProtocol("TCP");
|
||||||
|
|
||||||
|
alertMessage.setTaskId(1937L);
|
||||||
|
alertMessage.setFiveTupleWithMask(fiveTupleWithMask);
|
||||||
|
alertMessage.setDynamicRuleId(31);
|
||||||
|
alertMessageService.processAlertMessage(alertMessage);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
void queryAlertMessageByCommandId() {
|
||||||
|
|
||||||
|
// String commandId = "3e2fde7c-cd91-41f3-aedf-bd9993a61737";
|
||||||
|
//
|
||||||
|
// System.out.println(alertMessageService.queryAlarmsByCommandId(commandId));
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user