[CN-1698] match_threshold库表修改

This commit is contained in:
LAPTOP-KOK0F0TH\hjc
2024-09-10 10:53:24 +08:00
parent 703af2b8a3
commit a37ef55c93
3 changed files with 19 additions and 12 deletions

View File

@@ -1555,9 +1555,10 @@ CREATE TABLE IF NOT EXISTS cyber_narrator_galaxy.match_indicator ON CLUSTER ck_c
CREATE TABLE cyber_narrator_galaxy.match_threshold_local ON CLUSTER ck_cluster (
key_fields String,
key_values String,
threshold_num Int64,
records_num Int64,
reset Int64,
threshold_value Float32,
metric_value Float32,
unit Int64 DEFAULT 1,
reset Int64,
start_time Int64,
end_time Int64,
match_id UInt64,
@@ -1576,8 +1577,9 @@ ORDER BY (match_id, start_time);
CREATE TABLE IF NOT EXISTS cyber_narrator_galaxy.match_threshold ON CLUSTER ck_cluster (
key_fields String,
key_values String,
threshold_num Int64,
records_num Int64,
threshold_value Float32,
metric_value Float32,
unit Int64 DEFAULT 1,
reset Int64,
start_time Int64,
end_time Int64,

View File

@@ -58,7 +58,7 @@ FROM cyber_narrator_galaxy.session_record_cn where recv_time >= toUnixTimestamp(
SELECT indicator_fields, indicator_values, match_num, reset, client_ip, client_country_region, client_super_admin_area, client_admin_area, client_longitude, client_latitude, server_ip, server_country_region, server_super_admin_area, server_admin_area, server_longitude, server_latitude, domain, app, match_time, match_id, rule_id, rule_version, rule_type, is_builtin, event_type, event_name, severity
FROM cyber_narrator_galaxy.match_indicator where match_time >= toUnixTimestamp('2030-01-01 00:00:00') AND match_time <toUnixTimestamp('2030-01-01 00:00:01');
SELECT key_fields, key_values, threshold_num, records_num, reset, start_time, end_time, match_id, rule_id, rule_version, rule_type, is_builtin, event_type, event_name, severity
SELECT key_fields, key_values, threshold_value, metric_value, unit, reset, start_time, end_time, match_id, rule_id, rule_version, rule_type, is_builtin, event_type, event_name, severity
FROM cyber_narrator_galaxy.match_threshold where start_time >= toUnixTimestamp('2030-01-01 00:00:00') AND start_time <toUnixTimestamp('2030-01-01 00:00:01');
SELECT key_fields, key_values, event_info, start_time, end_time, match_id, rule_id, rule_version, rule_type, is_builtin, event_type, event_name, severity
FROM cyber_narrator_galaxy.match_sequence where start_time >= toUnixTimestamp('2030-01-01 00:00:00') AND start_time <toUnixTimestamp('2030-01-01 00:00:01');

View File

@@ -65,9 +65,10 @@ CREATE TABLE IF NOT EXISTS cyber_narrator_galaxy.match_indicator ON CLUSTER ck_c
CREATE TABLE cyber_narrator_galaxy.match_threshold_local ON CLUSTER ck_cluster (
key_fields String,
key_values String,
threshold_num Int64,
records_num Int64,
reset Int64,
threshold_value Float32,
metric_value Float32,
unit Int64 DEFAULT 1,
reset Int64,
start_time Int64,
end_time Int64,
match_id UInt64,
@@ -86,8 +87,9 @@ ORDER BY (match_id, start_time);
CREATE TABLE IF NOT EXISTS cyber_narrator_galaxy.match_threshold ON CLUSTER ck_cluster (
key_fields String,
key_values String,
threshold_num Int64,
records_num Int64,
threshold_value Float32,
metric_value Float32,
unit Int64 DEFAULT 1,
reset Int64,
start_time Int64,
end_time Int64,
@@ -212,4 +214,7 @@ CREATE TABLE IF NOT EXISTS cyber_narrator_galaxy.cn_event ON CLUSTER ck_cluster(
ENGINE = Distributed('ck_cluster',
'cyber_narrator_galaxy',
'cn_event_local',
rand());
rand());