diff --git a/cyber_narrator/upgrade/2024/CN-24.08/clickhouse/cn_clickhouse_ddl_24.08.sql b/cyber_narrator/upgrade/2024/CN-24.08/clickhouse/cn_clickhouse_ddl_24.08.sql index ae5c9aa..833acfc 100644 --- a/cyber_narrator/upgrade/2024/CN-24.08/clickhouse/cn_clickhouse_ddl_24.08.sql +++ b/cyber_narrator/upgrade/2024/CN-24.08/clickhouse/cn_clickhouse_ddl_24.08.sql @@ -1555,9 +1555,10 @@ CREATE TABLE IF NOT EXISTS cyber_narrator_galaxy.match_indicator ON CLUSTER ck_c CREATE TABLE cyber_narrator_galaxy.match_threshold_local ON CLUSTER ck_cluster ( key_fields String, key_values String, - threshold_num Int64, - records_num Int64, - reset Int64, + threshold_value Float32, + metric_value Float32, + unit Int64 DEFAULT 1, + reset Int64, start_time Int64, end_time Int64, match_id UInt64, @@ -1576,8 +1577,9 @@ ORDER BY (match_id, start_time); CREATE TABLE IF NOT EXISTS cyber_narrator_galaxy.match_threshold ON CLUSTER ck_cluster ( key_fields String, key_values String, - threshold_num Int64, - records_num Int64, + threshold_value Float32, + metric_value Float32, + unit Int64 DEFAULT 1, reset Int64, start_time Int64, end_time Int64, diff --git a/cyber_narrator/upgrade/2024/CN-24.08/clickhouse/cn_clickhouse_ddl_check_24.08.sql b/cyber_narrator/upgrade/2024/CN-24.08/clickhouse/cn_clickhouse_ddl_check_24.08.sql index 5ed9e32..1850a0b 100644 --- a/cyber_narrator/upgrade/2024/CN-24.08/clickhouse/cn_clickhouse_ddl_check_24.08.sql +++ b/cyber_narrator/upgrade/2024/CN-24.08/clickhouse/cn_clickhouse_ddl_check_24.08.sql @@ -58,7 +58,7 @@ FROM cyber_narrator_galaxy.session_record_cn where recv_time >= toUnixTimestamp( SELECT indicator_fields, indicator_values, match_num, reset, client_ip, client_country_region, client_super_admin_area, client_admin_area, client_longitude, client_latitude, server_ip, server_country_region, server_super_admin_area, server_admin_area, server_longitude, server_latitude, domain, app, match_time, match_id, rule_id, rule_version, rule_type, is_builtin, event_type, event_name, severity FROM cyber_narrator_galaxy.match_indicator where match_time >= toUnixTimestamp('2030-01-01 00:00:00') AND match_time = toUnixTimestamp('2030-01-01 00:00:00') AND start_time = toUnixTimestamp('2030-01-01 00:00:00') AND start_time