From f39322ec5a047897015ec7d9bf2c38e28d579055 Mon Sep 17 00:00:00 2001
From: houjinchuan <houjinchuan@iie.ac.cn>
Date: Fri, 29 Mar 2024 17:14:43 +0800
Subject: [PATCH] =?UTF-8?q?[CN-1568]=20=E6=95=B0=E5=AD=97=E5=9C=B0?=
 =?UTF-8?q?=E5=B9=B3=E7=BA=BF=E7=9B=B8=E5=85=B3ck=E5=BA=93=E8=A1=A8?=
 =?UTF-8?q?=E8=B0=83=E6=95=B4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../CN-24.01.rc1/clickhouse/check-24.01.rc1-ck.sql |  4 ++
 .../CN-24.01.rc1/clickhouse/update-24.01.rc1-ck.sql | 37 +++++++++++++++
 .../Clickhouse_CN_建表语句.sql                | 47 ++++++++++++++++---
 3 files changed, 81 insertions(+), 7 deletions(-)
 create mode 100644 CN发布版本更新记录/2024/CN-24.01.rc1/clickhouse/check-24.01.rc1-ck.sql
 create mode 100644 CN发布版本更新记录/2024/CN-24.01.rc1/clickhouse/update-24.01.rc1-ck.sql

diff --git a/CN发布版本更新记录/2024/CN-24.01.rc1/clickhouse/check-24.01.rc1-ck.sql b/CN发布版本更新记录/2024/CN-24.01.rc1/clickhouse/check-24.01.rc1-ck.sql
new file mode 100644
index 0000000..bcee010
--- /dev/null
+++ b/CN发布版本更新记录/2024/CN-24.01.rc1/clickhouse/check-24.01.rc1-ck.sql
@@ -0,0 +1,4 @@
+set distributed_ddl_task_timeout = 180;
+
+SELECT status, is_builtin, rule_type, victim_ip,victim_country_region, victim_super_admin_area, victim_admin_area, victim_longitude, victim_latitude, offender_ip, offender_country_region, offender_super_admin_area, offender_admin_area, offender_longitude, offender_latitude, offender_ip, event_info, event_key, severity, event_type, duration_s, event_name, app, `domain`, event_id, rule_id, start_time, end_time, match_times
+FROM cyber_narrator_galaxy.cn_security_event where start_time >= toUnixTimestamp('2030-01-01 00:00:00') AND start_time <toUnixTimestamp('2030-01-01 00:00:01');
\ No newline at end of file
diff --git a/CN发布版本更新记录/2024/CN-24.01.rc1/clickhouse/update-24.01.rc1-ck.sql b/CN发布版本更新记录/2024/CN-24.01.rc1/clickhouse/update-24.01.rc1-ck.sql
new file mode 100644
index 0000000..3d46635
--- /dev/null
+++ b/CN发布版本更新记录/2024/CN-24.01.rc1/clickhouse/update-24.01.rc1-ck.sql
@@ -0,0 +1,37 @@
+set distributed_ddl_task_timeout = 180;
+
+ALTER  table cyber_narrator_galaxy.cn_security_event_local on cluster ck_cluster 
+add column IF NOT EXISTS offender_latitude Nullable(Float64) after offender_ip,
+add column IF NOT EXISTS offender_longitude Nullable(Float64) after offender_ip,
+add column IF NOT EXISTS offender_admin_area String after offender_ip,
+add column IF NOT EXISTS offender_super_admin_area String after offender_ip,
+add column IF NOT EXISTS offender_country_region String after offender_ip,
+add column IF NOT EXISTS victim_latitude Nullable(Float64) after victim_ip,
+add column IF NOT EXISTS victim_longitude Nullable(Float64) after victim_ip,
+add column IF NOT EXISTS victim_admin_area String after victim_ip,
+add column IF NOT EXISTS victim_super_admin_area String after victim_ip,
+add column IF NOT EXISTS victim_country_region String after victim_ip;
+
+ALTER  table cyber_narrator_galaxy.cn_security_event on cluster ck_cluster 
+add column IF NOT EXISTS offender_latitude Nullable(Float64) after offender_ip,
+add column IF NOT EXISTS offender_longitude Nullable(Float64) after offender_ip,
+add column IF NOT EXISTS offender_admin_area String after offender_ip,
+add column IF NOT EXISTS offender_super_admin_area String after offender_ip,
+add column IF NOT EXISTS offender_country_region String after offender_ip,
+add column IF NOT EXISTS victim_latitude Nullable(Float64) after victim_ip,
+add column IF NOT EXISTS victim_longitude Nullable(Float64) after victim_ip,
+add column IF NOT EXISTS victim_admin_area String after victim_ip,
+add column IF NOT EXISTS victim_super_admin_area String after victim_ip,
+add column IF NOT EXISTS victim_country_region String after victim_ip;
+
+ALTER  table cyber_narrator_galaxy.cn_security_event on cluster ck_query 
+add column IF NOT EXISTS offender_latitude Nullable(Float64) after offender_ip,
+add column IF NOT EXISTS offender_longitude Nullable(Float64) after offender_ip,
+add column IF NOT EXISTS offender_admin_area String after offender_ip,
+add column IF NOT EXISTS offender_super_admin_area String after offender_ip,
+add column IF NOT EXISTS offender_country_region String after offender_ip,
+add column IF NOT EXISTS victim_latitude Nullable(Float64) after victim_ip,
+add column IF NOT EXISTS victim_longitude Nullable(Float64) after victim_ip,
+add column IF NOT EXISTS victim_admin_area String after victim_ip,
+add column IF NOT EXISTS victim_super_admin_area String after victim_ip,
+add column IF NOT EXISTS victim_country_region String after victim_ip;
\ No newline at end of file
diff --git a/Clickhouse最新全量建表语句/Clickhouse_CN_建表语句.sql b/Clickhouse最新全量建表语句/Clickhouse_CN_建表语句.sql
index 5b7d244..8a01062 100644
--- a/Clickhouse最新全量建表语句/Clickhouse_CN_建表语句.sql
+++ b/Clickhouse最新全量建表语句/Clickhouse_CN_建表语句.sql
@@ -1906,12 +1906,21 @@ GROUP BY
 
 CREATE TABLE IF NOT EXISTS cyber_narrator_galaxy.cn_security_event_local ON CLUSTER ck_cluster
 (
-
     status Int64,
     is_builtin Int64,
     rule_type String,
     victim_ip String,
+	victim_country_region String,
+    victim_super_admin_area String,
+    victim_admin_area String,
+    victim_longitude Nullable(Float64),
+    victim_latitude Nullable(Float64),
     offender_ip String,
+    offender_country_region String,
+    offender_super_admin_area String,
+    offender_admin_area String,
+    offender_longitude Nullable(Float64),
+    offender_latitude Nullable(Float64),
     event_info String,
     event_key String,
     severity String,
@@ -1935,7 +1944,17 @@ TTL toDateTime(end_time) + toIntervalSecond(2592000),
  is_builtin = anyLast(is_builtin),
  rule_type = anyLast(rule_type),
  victim_ip = anyLast(victim_ip),
+ victim_country_region = anyLast(victim_country_region),
+ victim_super_admin_area = anyLast(victim_super_admin_area),
+ victim_admin_area = anyLast(victim_admin_area),
+ victim_longitude = anyLast(victim_longitude),
+ victim_latitude = anyLast(victim_latitude),
  offender_ip = anyLast(offender_ip),
+ offender_country_region = anyLast(offender_country_region),
+ offender_super_admin_area = anyLast(offender_super_admin_area),
+ offender_admin_area = anyLast(offender_admin_area),
+ offender_longitude = anyLast(offender_longitude),
+ offender_latitude = anyLast(offender_latitude),
  event_info = anyLast(event_info),
  event_key = anyLast(event_key),
  severity = anyLast(severity),
@@ -1952,12 +1971,21 @@ TTL toDateTime(end_time) + toIntervalSecond(2592000),
 
 CREATE TABLE IF NOT EXISTS cyber_narrator_galaxy.cn_security_event ON CLUSTER ck_cluster
 (
-
     status Int64,
     is_builtin Int64,
     rule_type String,
     victim_ip String,
+	victim_country_region String,
+    victim_super_admin_area String,
+    victim_admin_area String,
+    victim_longitude Nullable(Float64),
+    victim_latitude Nullable(Float64),
     offender_ip String,
+    offender_country_region String,
+    offender_super_admin_area String,
+    offender_admin_area String,
+    offender_longitude Nullable(Float64),
+    offender_latitude Nullable(Float64),
     event_info String,
     event_key String,
     severity String,
@@ -1979,12 +2007,21 @@ ENGINE = Distributed('ck_cluster',
 
 CREATE TABLE IF NOT EXISTS cyber_narrator_galaxy.cn_security_event  ON CLUSTER ck_query
 (
-
     status Int64,
     is_builtin Int64,
     rule_type String,
     victim_ip String,
+	victim_country_region String,
+    victim_super_admin_area String,
+    victim_admin_area String,
+    victim_longitude Nullable(Float64),
+    victim_latitude Nullable(Float64),
     offender_ip String,
+    offender_country_region String,
+    offender_super_admin_area String,
+    offender_admin_area String,
+    offender_longitude Nullable(Float64),
+    offender_latitude Nullable(Float64),
     event_info String,
     event_key String,
     severity String,
@@ -2003,7 +2040,3 @@ ENGINE = Distributed('ck_cluster',
  'cyber_narrator_galaxy',
  'cn_security_event_local',
  rand());
-
-
-
-