diff options
| author | wangwei <[email protected]> | 2024-11-25 15:11:21 +0800 |
|---|---|---|
| committer | wangwei <[email protected]> | 2024-11-25 18:15:20 +0800 |
| commit | c4ac52a8856b7607038a25e47dfe2fbffd9058e9 (patch) | |
| tree | f57adbe50336948ecb697162fc3246d9880a8aae | |
| parent | e2a52d8da471e42348b9dd6a2782dacbbf694287 (diff) | |
[Fix][ClickHouse] 针对Client/Server 重命名为Source/Destination(TSG-23854)
18 files changed, 1137 insertions, 2074 deletions
diff --git a/config/flyway/tsg/R__init_datasets.sql b/config/flyway/tsg/R__init_datasets.sql index 342e032c..06b5f186 100644 --- a/config/flyway/tsg/R__init_datasets.sql +++ b/config/flyway/tsg/R__init_datasets.sql @@ -172,42 +172,42 @@ INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('ip-learning-fqdn-relate-ip', 'ip_learning', 'qgw', 'dsl', '{ "name": "ip-learning-fqdn-relate-ip", "data_source":"ip_learnging_view", "filter": "vsys_id in(${vsys_id}) AND (${filter})", "intervals": ["${start_time}/${end_time}"], "limit": "${limit}" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('ip-learning-active-ip', 'ip_learning', 'qgw', 'dsl', '{ "name": "ip-learning-active-ip", "data_source":"active_ip_view", "filter": "vsys_id in(${vsys_id}) AND (${filter})", "intervals": ["${start_time}/${end_time}"], "order_by": "${order_by}", "limit": "${limit}" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('top-frequent-elements-in-long-of-bit', 'benchmark', 'qgw', 'sql', '{ "statement": "select item,sum(count) as count from( select arrayJoin(items) as item, count from ( select bitmaskToArray(flags) as items,count(*) as count from session_record as sr where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') group by flags)) group by item order by count desc", "execution_mode": "oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('top-frequent-elements-in-flags-with-label', 'benchmark', 'qgw', 'sql', '{ "statement": "select flag, sum(sessions) as sessions from( select arrayJoin(array( if(bitAnd(flags, 1)= 1, ''Asymmetric'', ''''), if(bitAnd(flags, 2)= 2, ''Bulky'', ''''), if(bitAnd(flags, 4)= 4, ''CBR Streaming'', ''''), if(bitAnd(flags, 8)= 8, ''Client is Local'', ''''), if(bitAnd(flags, 16)= 16, ''Server is Local'', ''''), if(bitAnd(flags, 32)= 32, ''Download'', ''''), if(bitAnd(flags, 64)= 64, ''Interactive'', ''''), if(bitAnd(flags, 128)= 128, ''Inbound'', ''''), if(bitAnd(flags, 256)= 256, ''Outbound'', ''''), if(bitAnd(flags, 512)= 512, ''Pseudo Unidirectional'', ''''), if(bitAnd(flags, 1024)= 1024, ''Streaming'', ''''), if(bitAnd(flags, 2048)= 2048, ''Unidirectional'', ''''), if(bitAnd(flags, 4096)= 4096, ''Random looking'', ''''), if(bitAnd(flags, 8192)= 8192, ''C2S'', ''''), if(bitAnd(flags, 16384)= 16384, ''S2C'', ''''), if(bitAnd(flags, 32768)= 32768, ''Bidirectional'', ''''), if(flags=0, ''N/A'', ''''))) as flag , bytes, packets, sessions from ( select flags, count(*) as sessions, sum(sent_bytes + received_bytes) as bytes, sum(sent_pkts + received_pkts) as packets from session_record as sr where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') group by flags ) ) where notEmpty(flag) group by flag order by sessions desc", "execution_mode": "oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('top-frequent-elements-in-flags-with-label', 'benchmark', 'qgw', 'sql', '{ "statement": "select flag, sum(sessions) as sessions from( select arrayJoin(array( if(bitAnd(flags, 1)= 1, ''Asymmetric'', ''''), if(bitAnd(flags, 2)= 2, ''Bulky'', ''''), if(bitAnd(flags, 4)= 4, ''CBR Streaming'', ''''), if(bitAnd(flags, 8)= 8, ''Source is Local'', ''''), if(bitAnd(flags, 16)= 16, ''Destination is Local'', ''''), if(bitAnd(flags, 32)= 32, ''Download'', ''''), if(bitAnd(flags, 64)= 64, ''Interactive'', ''''), if(bitAnd(flags, 128)= 128, ''Inbound'', ''''), if(bitAnd(flags, 256)= 256, ''Outbound'', ''''), if(bitAnd(flags, 512)= 512, ''Pseudo Unidirectional'', ''''), if(bitAnd(flags, 1024)= 1024, ''Streaming'', ''''), if(bitAnd(flags, 2048)= 2048, ''Unidirectional'', ''''), if(bitAnd(flags, 4096)= 4096, ''Random looking'', ''''), if(bitAnd(flags, 8192)= 8192, ''C2S'', ''''), if(bitAnd(flags, 16384)= 16384, ''S2C'', ''''), if(bitAnd(flags, 32768)= 32768, ''Bidirectional'', ''''), if(flags=0, ''N/A'', ''''))) as flag , bytes, packets, sessions from ( select flags, count(*) as sessions, sum(sent_bytes + received_bytes) as bytes, sum(sent_pkts + received_pkts) as packets from session_record as sr where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') group by flags ) ) where notEmpty(flag) group by flag order by sessions desc", "execution_mode": "oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('top-frequent-elements-in-string-of-array', 'benchmark', 'qgw', 'sql', '{ "statement": "select item, sum(count) as count from( select arrayJoin(items) as item, count from ( select splitByString(''.'',decoded_path) as items, count(*) as count from session_record as sr where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and notEmpty(decoded_path) group by decoded_path)) group by item order by count desc limit 10", "execution_mode": "oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('top-frequent-elements-in-array-use-sub-query', 'benchmark', 'qgw', 'sql', '{ "statement": "select item, sum(count) as count,sum(bytes) from( select arrayJoin(items) as item, count, bytes from ( select monitor_rule_uuid_list as items, count(*) as count,sum(sent_bytes+received_bytes) as bytes from session_record as sr where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and notEmpty(monitor_rule_uuid_list) group by monitor_rule_uuid_list)) group by item order by count desc limit 20", "execution_mode": "oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('top-frequent-elements-in-array', 'benchmark', 'qgw', 'sql', '{ "statement": "select arrayJoin(monitor_rule_uuid_list) as item, count(*) as count,sum(sent_bytes+received_bytes) as bytes from session_record as sr where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and notEmpty(monitor_rule_uuid_list) group by arrayJoin(monitor_rule_uuid_list) order by count desc limit 20", "execution_mode": "oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('nested-json-parser-by-app-id', 'benchmark', 'qgw', 'sql', '{ "statement": "select app_debug_info, JSONExtract(app_debug_info, ''Tuple(UNKNOWN Nested(app_name String, app_id UInt32),THIRD Nested(app_name String, app_id UInt32),USER_DEFINE Nested(app_name String, app_id UInt32))'') as parsed_json, tupleElement(tupleElement(parsed_json,''THIRD''),''app_name'') THIRD_app_name, tupleElement(tupleElement(parsed_json,''USER_DEFINE''),''app_name'') USER_DEFINE_app_name from session_record sr where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and notEmpty(app_debug_info) and has(THIRD_app_name,''ssl'') group by app_debug_info", "execution_mode": "oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('log-summary', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(tcp_logs / logs,4) as \\"TCP Percentage\\", round(udp_logs / logs,4) as \\"UDP Percentage\\", round(out_bytes / bytes,4) as \\"Outgoing Percentage\\", round(in_bytes / bytes,4) as \\"Incoming Percentage\\", formatReadableQuantity(tcp_logs) as \\"TCP Logs\\", formatReadableQuantity(udp_logs) as \\"UDP Logs\\", formatReadableQuantity(logs) as \\"Logs\\", formatReadableSize(out_bytes) as \\"Outgoing Bytes\\", formatReadableSize(in_bytes) as \\"Incoming Bytes\\", formatReadableSize(bytes) as \\"Bytes\\" from( select sum(if(ip_protocol=''tcp'', 1, 0)) as tcp_logs, sum(if(ip_protocol=''udp'', 1, 0)) as udp_logs, sum(if(bitAnd(flags, 8) = 8, sent_bytes, received_bytes))as out_bytes, sum(if(bitAnd(flags, 8) = 8, received_bytes, sent_bytes)) as in_bytes, count(*) as logs, sum(sent_bytes + received_bytes) as bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}''))" , "output_mode":"json", "execution_mode":"oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('decoded-as', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(base_logs / total_logs, 4) as \\"BASE Percentage\\", round(http_logs / total_logs, 4) as \\"HTTP Percentage\\", round(ssl_logs / total_logs, 4) as \\"SSL Percentage\\", round(dns_logs / total_logs, 4) as \\"DNS Percentage\\", round(mail_logs / total_logs, 4) as \\"MAIL Percentage\\", round(rtp_logs / total_logs, 4) as \\"RTP Percentage\\", round(sip_logs / total_logs, 4) as \\"SIP Percentage\\", round(ftp_logs / total_logs, 4) as \\"FTP Percentage\\", base_logs as \\"BASE Logs\\", http_logs as \\"HTTP Logs\\", ssl_logs as \\"SSL Logs\\", dns_logs as \\"DNS Logs\\", mail_logs as \\"MAIL Logs\\", rtp_logs as \\"RTP Logs\\", sip_logs as \\"SIP Logs\\", ftp_logs as \\"FTP Logs\\", total_logs as \\"Total Logs\\" from( select sum(if(decoded_as=''BASE'', 1, 0)) as base_logs, sum(if(decoded_as=''HTTP'', 1, 0)) as http_logs, sum(if(decoded_as=''SSL'', 1, 0)) as ssl_logs, sum(if(decoded_as=''DNS'', 1, 0)) as dns_logs, sum(if(decoded_as=''MAIL'', 1, 0)) as mail_logs, sum(if(decoded_as=''RTP'', 1, 0)) as rtp_logs, sum(if(decoded_as=''SIP'', 1, 0)) as sip_logs, sum(if(decoded_as=''FTP'', 1, 0)) as ftp_logs, count(*) as total_logs from session_record as sub_connection where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}''))" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('endpoints', 'benchmark', 'qgw', 'sql', '{ "statement" : "select uniq(client_ip) as \\"Client IPs\\", uniq(server_ip) as \\"Server IPs\\", uniq(server_domain) as \\"Domains\\", uniq(http_host) as \\"Hosts\\", uniq(ssl_sni) as \\"SNIs\\" , uniq(client_ip, server_ip) as \\"Client and Server IPs\\" from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'')" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('endpoints-of-tcp', 'benchmark', 'qgw', 'sql', '{ "statement" : "select uniq(client_ip) as \\"Client IPs\\", uniq(server_ip) as \\"Server IPs\\", uniq(server_domain) as \\"Domains\\", uniq(http_host) as \\"Hosts\\", uniq(ssl_sni) as \\"SNIs\\" , uniq(client_ip, server_ip) as \\"Client and Server IPs\\" from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and ip_protocol =''tcp''" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('endpoints-of-udp', 'benchmark', 'qgw', 'sql', '{ "statement" : "select uniq(client_ip) as \\"Client IPs\\", uniq(server_ip) as \\"Server IPs\\", uniq(server_domain) as \\"Domains\\", uniq(http_host) as \\"Hosts\\", uniq(ssl_sni) as \\"SNIs\\" , uniq(client_ip, server_ip) as \\"Client and Server IPs\\" from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and ip_protocol =''udp''" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-percentile-distribution-bytes', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(bytes,0.9999),2) as p9999, round(QUANTILE(bytes,0.999),2) as p999, round(QUANTILE(bytes,0.996),2) as p996, round(QUANTILE(bytes,0.995),2) as p995, round(QUANTILE(bytes,0.99),2) as p99, round(QUANTILE(bytes,0.98),2) as p98, round(QUANTILE(bytes,0.96),2) as p96, round(QUANTILE(bytes,0.95),2) as p95, round(QUANTILE(bytes,0.92),2) as p92, round(QUANTILE(bytes,0.90),2) as p90, round(QUANTILE(bytes,0.89),2) as p89, round(QUANTILE(bytes,0.88),2) as p88, round(median(bytes),2) as p50 from( select server_ip, sum(sent_bytes+received_bytes) as bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) group by server_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-percentile-distribution-sessions', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(sessions,0.9999),2) as p9999, round(QUANTILE(sessions,0.999),2) as p999, round(QUANTILE(sessions,0.996),2) as p996, round(QUANTILE(sessions,0.995),2) as p995, round(QUANTILE(sessions,0.99),2) as p99, round(QUANTILE(sessions,0.98),2) as p98, round(QUANTILE(sessions,0.96),2) as p96, round(QUANTILE(sessions,0.95),2) as p95, round(QUANTILE(sessions,0.92),2) as p92, round(QUANTILE(sessions,0.90),2) as p90, round(QUANTILE(sessions,0.89),2) as p89, round(QUANTILE(sessions,0.88),2) as p88, round(median(sessions),2) as p50 from( select server_ip, count(1) as sessions from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) group by server_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp(53,443)-percentile-distribution-bytes', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(bytes,0.9999),2) as p9999, round(QUANTILE(bytes,0.999),2) as p999, round(QUANTILE(bytes,0.996),2) as p996, round(QUANTILE(bytes,0.995),2) as p995, round(QUANTILE(bytes,0.99),2) as p99, round(QUANTILE(bytes,0.98),2) as p98, round(QUANTILE(bytes,0.96),2) as p96, round(QUANTILE(bytes,0.95),2) as p95, round(QUANTILE(bytes,0.92),2) as p92, round(QUANTILE(bytes,0.90),2) as p90, round(QUANTILE(bytes,0.89),2) as p89, round(QUANTILE(bytes,0.88),2) as p88, round(median(bytes),2) as p50 from( select server_ip, sum(sent_bytes+received_bytes) as bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and ip_protocol in (''udp'') and server_port in (53,443) group by server_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp(53,443)-percentile-distribution-sessions', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(sessions,0.9999),2) as p9999, round(QUANTILE(sessions,0.999),2) as p999, round(QUANTILE(sessions,0.996),2) as p996, round(QUANTILE(sessions,0.995),2) as p995, round(QUANTILE(sessions,0.99),2) as p99, round(QUANTILE(sessions,0.98),2) as p98, round(QUANTILE(sessions,0.96),2) as p96, round(QUANTILE(sessions,0.95),2) as p95, round(QUANTILE(sessions,0.92),2) as p92, round(QUANTILE(sessions,0.90),2) as p90, round(QUANTILE(sessions,0.89),2) as p89, round(QUANTILE(sessions,0.88),2) as p88, round(median(sessions),2) as p50 from( select server_ip, count(*) as sessions from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and ip_protocol in (''udp'') and server_port in (53,443) group by server_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-percentile-distribution-of-server-ip-relate-uniq-cip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(client_ips,0.9999),2) as p9999, round(QUANTILE(client_ips,0.999),2) as p999, round(QUANTILE(client_ips,0.996),2) as p996, round(QUANTILE(client_ips,0.995),2) as p995, round(QUANTILE(client_ips,0.99),2) as p99, round(QUANTILE(client_ips,0.98),2) as p98, round(QUANTILE(client_ips,0.96),2) as p96, round(QUANTILE(client_ips,0.95),2) as p95, round(QUANTILE(client_ips,0.92),2) as p92, round(QUANTILE(client_ips,0.90),2) as p90, round(QUANTILE(client_ips,0.89),2) as p89, round(QUANTILE(client_ips,0.88),2) as p88, round(median(client_ips),2) as p50 from( select server_ip, uniq(client_ip) as client_ips from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) group by server_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp-percentile-distribution-of-server-ip-relate-uniq-cip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(client_ips,0.9999),2) as p9999, round(QUANTILE(client_ips,0.999),2) as p999, round(QUANTILE(client_ips,0.996),2) as p996, round(QUANTILE(client_ips,0.995),2) as p995, round(QUANTILE(client_ips,0.99),2) as p99, round(QUANTILE(client_ips,0.98),2) as p98, round(QUANTILE(client_ips,0.96),2) as p96, round(QUANTILE(client_ips,0.95),2) as p95, round(QUANTILE(client_ips,0.92),2) as p92, round(QUANTILE(client_ips,0.90),2) as p90, round(QUANTILE(client_ips,0.89),2) as p89, round(QUANTILE(client_ips,0.88),2) as p88, round(median(client_ips),2) as p50 from( select server_ip, uniq(client_ip) as client_ips from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) group by server_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-session-percent-of-top-100-server-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select sum(sessions) sessions, count(*) as server_ips,( select count(*) from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp''))) as total_sessions, round(sessions / total_sessions, 6) as percent_sessions_to_total from ( SELECT server_ip, count(*) AS sessions FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) GROUP BY server_ip order by sessions desc limit 100 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp-session-percent-of-top-100-server-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select sum(sessions) sessions, count(*) as server_ips,( select count(*) from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp''))) as total_sessions, round(sessions / total_sessions, 6) as percent_sessions_to_total from ( SELECT server_ip, count(*) AS sessions FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) GROUP BY server_ip order by sessions desc limit 100 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-byte-percent-of-top-100-server-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select sum(bytes) as bytes, count(*) as server_ips,( select sum(sent_bytes+received_bytes) as bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp''))) as total_bytes, round(bytes / total_bytes, 6) as percent_bytes_to_total from ( SELECT server_ip, sum(sent_bytes+received_bytes) as bytes FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) GROUP BY server_ip order by bytes desc limit 100 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp-byte-percent-of-top-100-server-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select sum(bytes) as bytes, count(*) as server_ips,( select sum(sent_bytes+received_bytes) as bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp''))) as total_bytes, round(bytes / total_bytes, 6) as percent_bytes_to_total from ( SELECT server_ip, sum(sent_bytes+received_bytes) as bytes FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) GROUP BY server_ip order by bytes desc limit 100 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-client-ip-and-traffic-percent-of-top-100-server-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select uniq(client_ip) as client_ips, count(*) as sessions,( select uniq(client_ip) as total_client_ips from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp''))) as total_client_ips, round(client_ips / total_client_ips,6) as percent_client_ips_to_total, ( select count(*) as total_sessions from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) ) as total_sessions, round(sessions / total_sessions,6) as percent_sessions_to_total, sum(sent_bytes+received_bytes) as bytes, ( select sum(sent_bytes+received_bytes) as total_bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) ) as total_bytes, round(bytes / total_bytes,6) as percent_bytes_to_total FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) and server_ip in ( SELECT server_ip FROM session_record as cc WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) GROUP BY server_ip order by uniq(server_ip) desc limit 10 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp-client-ip-and-traffic-percent-of-top-100-Server-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select uniq(client_ip) as client_ips, count(*) as sessions,( select uniq(client_ip) as total_client_ips from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp''))) as total_client_ips, round(client_ips / total_client_ips,6) as percent_client_ips_to_total, ( select count(*) as total_sessions from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) ) as total_sessions, round(sessions / total_sessions,6) as percent_sessions_to_total, sum(sent_bytes+received_bytes) as bytes, ( select sum(sent_bytes+received_bytes) as total_bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) ) as total_bytes, round(bytes / total_bytes,6) as percent_bytes_to_total FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) and server_ip in ( SELECT server_ip FROM session_record as cc WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) GROUP BY server_ip order by uniq(server_ip) desc limit 10 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('endpoints', 'benchmark', 'qgw', 'sql', '{ "statement" : "select uniq(source_ip) as \\"Source IPs\\", uniq(destination_ip) as \\"Destination IPs\\", uniq(destination_domain) as \\"Domains\\", uniq(http_host) as \\"Hosts\\", uniq(ssl_sni) as \\"SNIs\\" , uniq(source_ip, destination_ip) as \\"Source and Destination IPs\\" from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'')" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('endpoints-of-tcp', 'benchmark', 'qgw', 'sql', '{ "statement" : "select uniq(source_ip) as \\"Source IPs\\", uniq(destination_ip) as \\"Destination IPs\\", uniq(destination_domain) as \\"Domains\\", uniq(http_host) as \\"Hosts\\", uniq(ssl_sni) as \\"SNIs\\" , uniq(source_ip, destination_ip) as \\"Source and Destination IPs\\" from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and ip_protocol =''tcp''" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('endpoints-of-udp', 'benchmark', 'qgw', 'sql', '{ "statement" : "select uniq(source_ip) as \\"Source IPs\\", uniq(destination_ip) as \\"Destination IPs\\", uniq(destination_domain) as \\"Domains\\", uniq(http_host) as \\"Hosts\\", uniq(ssl_sni) as \\"SNIs\\" , uniq(source_ip, destination_ip) as \\"Source and Destination IPs\\" from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and ip_protocol =''udp''" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-percentile-distribution-bytes', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(bytes,0.9999),2) as p9999, round(QUANTILE(bytes,0.999),2) as p999, round(QUANTILE(bytes,0.996),2) as p996, round(QUANTILE(bytes,0.995),2) as p995, round(QUANTILE(bytes,0.99),2) as p99, round(QUANTILE(bytes,0.98),2) as p98, round(QUANTILE(bytes,0.96),2) as p96, round(QUANTILE(bytes,0.95),2) as p95, round(QUANTILE(bytes,0.92),2) as p92, round(QUANTILE(bytes,0.90),2) as p90, round(QUANTILE(bytes,0.89),2) as p89, round(QUANTILE(bytes,0.88),2) as p88, round(median(bytes),2) as p50 from( select destination_ip, sum(sent_bytes+received_bytes) as bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) group by destination_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-percentile-distribution-sessions', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(sessions,0.9999),2) as p9999, round(QUANTILE(sessions,0.999),2) as p999, round(QUANTILE(sessions,0.996),2) as p996, round(QUANTILE(sessions,0.995),2) as p995, round(QUANTILE(sessions,0.99),2) as p99, round(QUANTILE(sessions,0.98),2) as p98, round(QUANTILE(sessions,0.96),2) as p96, round(QUANTILE(sessions,0.95),2) as p95, round(QUANTILE(sessions,0.92),2) as p92, round(QUANTILE(sessions,0.90),2) as p90, round(QUANTILE(sessions,0.89),2) as p89, round(QUANTILE(sessions,0.88),2) as p88, round(median(sessions),2) as p50 from( select destination_ip, count(1) as sessions from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) group by destination_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp(53,443)-percentile-distribution-bytes', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(bytes,0.9999),2) as p9999, round(QUANTILE(bytes,0.999),2) as p999, round(QUANTILE(bytes,0.996),2) as p996, round(QUANTILE(bytes,0.995),2) as p995, round(QUANTILE(bytes,0.99),2) as p99, round(QUANTILE(bytes,0.98),2) as p98, round(QUANTILE(bytes,0.96),2) as p96, round(QUANTILE(bytes,0.95),2) as p95, round(QUANTILE(bytes,0.92),2) as p92, round(QUANTILE(bytes,0.90),2) as p90, round(QUANTILE(bytes,0.89),2) as p89, round(QUANTILE(bytes,0.88),2) as p88, round(median(bytes),2) as p50 from( select destination_ip, sum(sent_bytes+received_bytes) as bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and ip_protocol in (''udp'') and destination_port in (53,443) group by destination_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp(53,443)-percentile-distribution-sessions', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(sessions,0.9999),2) as p9999, round(QUANTILE(sessions,0.999),2) as p999, round(QUANTILE(sessions,0.996),2) as p996, round(QUANTILE(sessions,0.995),2) as p995, round(QUANTILE(sessions,0.99),2) as p99, round(QUANTILE(sessions,0.98),2) as p98, round(QUANTILE(sessions,0.96),2) as p96, round(QUANTILE(sessions,0.95),2) as p95, round(QUANTILE(sessions,0.92),2) as p92, round(QUANTILE(sessions,0.90),2) as p90, round(QUANTILE(sessions,0.89),2) as p89, round(QUANTILE(sessions,0.88),2) as p88, round(median(sessions),2) as p50 from( select destination_ip, count(*) as sessions from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and ip_protocol in (''udp'') and destination_port in (53,443) group by destination_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-percentile-distribution-of-destination-ip-relate-uniq-cip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(source_ips,0.9999),2) as p9999, round(QUANTILE(source_ips,0.999),2) as p999, round(QUANTILE(source_ips,0.996),2) as p996, round(QUANTILE(source_ips,0.995),2) as p995, round(QUANTILE(source_ips,0.99),2) as p99, round(QUANTILE(source_ips,0.98),2) as p98, round(QUANTILE(source_ips,0.96),2) as p96, round(QUANTILE(source_ips,0.95),2) as p95, round(QUANTILE(source_ips,0.92),2) as p92, round(QUANTILE(source_ips,0.90),2) as p90, round(QUANTILE(source_ips,0.89),2) as p89, round(QUANTILE(source_ips,0.88),2) as p88, round(median(source_ips),2) as p50 from( select destination_ip, uniq(source_ip) as source_ips from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) group by destination_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp-percentile-distribution-of-destination-ip-relate-uniq-cip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(QUANTILE(source_ips,0.9999),2) as p9999, round(QUANTILE(source_ips,0.999),2) as p999, round(QUANTILE(source_ips,0.996),2) as p996, round(QUANTILE(source_ips,0.995),2) as p995, round(QUANTILE(source_ips,0.99),2) as p99, round(QUANTILE(source_ips,0.98),2) as p98, round(QUANTILE(source_ips,0.96),2) as p96, round(QUANTILE(source_ips,0.95),2) as p95, round(QUANTILE(source_ips,0.92),2) as p92, round(QUANTILE(source_ips,0.90),2) as p90, round(QUANTILE(source_ips,0.89),2) as p89, round(QUANTILE(source_ips,0.88),2) as p88, round(median(source_ips),2) as p50 from( select destination_ip, uniq(source_ip) as source_ips from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) group by destination_ip)" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-session-percent-of-top-100-destination-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select sum(sessions) sessions, count(*) as destination_ips,( select count(*) from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp''))) as total_sessions, round(sessions / total_sessions, 6) as percent_sessions_to_total from ( SELECT destination_ip, count(*) AS sessions FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) GROUP BY destination_ip order by sessions desc limit 100 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp-session-percent-of-top-100-destination-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select sum(sessions) sessions, count(*) as destination_ips,( select count(*) from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp''))) as total_sessions, round(sessions / total_sessions, 6) as percent_sessions_to_total from ( SELECT destination_ip, count(*) AS sessions FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) GROUP BY destination_ip order by sessions desc limit 100 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-byte-percent-of-top-100-destination-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select sum(bytes) as bytes, count(*) as destination_ips,( select sum(sent_bytes+received_bytes) as bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp''))) as total_bytes, round(bytes / total_bytes, 6) as percent_bytes_to_total from ( SELECT destination_ip, sum(sent_bytes+received_bytes) as bytes FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) GROUP BY destination_ip order by bytes desc limit 100 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp-byte-percent-of-top-100-destination-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select sum(bytes) as bytes, count(*) as destination_ips,( select sum(sent_bytes+received_bytes) as bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp''))) as total_bytes, round(bytes / total_bytes, 6) as percent_bytes_to_total from ( SELECT destination_ip, sum(sent_bytes+received_bytes) as bytes FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) GROUP BY destination_ip order by bytes desc limit 100 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('tcp-source-ip-and-traffic-percent-of-top-100-destination-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select uniq(source_ip) as source_ips, count(*) as sessions,( select uniq(source_ip) as total_source_ips from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp''))) as total_source_ips, round(source_ips / total_source_ips,6) as percent_source_ips_to_total, ( select count(*) as total_sessions from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) ) as total_sessions, round(sessions / total_sessions,6) as percent_sessions_to_total, sum(sent_bytes+received_bytes) as bytes, ( select sum(sent_bytes+received_bytes) as total_bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) ) as total_bytes, round(bytes / total_bytes,6) as percent_bytes_to_total FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) and destination_ip in ( SELECT destination_ip FROM session_record as cc WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''tcp'')) GROUP BY destination_ip order by uniq(destination_ip) desc limit 10 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('udp-source-ip-and-traffic-percent-of-top-100-destination-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "select uniq(source_ip) as source_ips, count(*) as sessions,( select uniq(source_ip) as total_source_ips from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp''))) as total_source_ips, round(source_ips / total_source_ips,6) as percent_source_ips_to_total, ( select count(*) as total_sessions from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) ) as total_sessions, round(sessions / total_sessions,6) as percent_sessions_to_total, sum(sent_bytes+received_bytes) as bytes, ( select sum(sent_bytes+received_bytes) as total_bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) ) as total_bytes, round(bytes / total_bytes,6) as percent_bytes_to_total FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) and destination_ip in ( SELECT destination_ip FROM session_record as cc WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') AND (ip_protocol IN (''udp'')) GROUP BY destination_ip order by uniq(destination_ip) desc limit 10 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('session-percent-of-top-100-sni', 'benchmark', 'qgw', 'sql', '{ "statement" : "select sum(sessions) sessions, count(*) as ssl_snis,( select count(*) from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and notEmpty(ssl_sni)) as total_sessions, round(sessions / total_sessions, 6) as percent_sessions_to_total from ( SELECT ssl_sni, count(*) AS sessions FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and notEmpty(ssl_sni) GROUP BY ssl_sni order by sessions desc limit 100 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('byte-percent-of-top-100-sni', 'benchmark', 'qgw', 'sql', '{ "statement" : "select sum(bytes) as bytes, count(*) as ssl_snis,( select sum(sent_bytes+received_bytes) as bytes from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and notEmpty(ssl_sni)) as total_bytes, round(bytes / total_bytes, 6) as percent_bytes_to_total from ( SELECT ssl_sni, sum(sent_bytes+received_bytes) as bytes FROM session_record WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and notEmpty(ssl_sni) GROUP BY ssl_sni order by bytes desc limit 100 )" , "output_mode":"json", "execution_mode":"oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('top-10-client-ip-with-others', 'benchmark', 'qgw', 'sql', '{ "statement": "SELECT client_ip, sum(sent_bytes + received_bytes) as bytes from session_record sr1 where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') group by client_ip order by bytes desc limit 10 union all select null, sum(sent_bytes + received_bytes) as bytes from session_record sr2 where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and sr2.client_ip not in(select client_ip from session_record sr where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') group by client_ip order by sum(sent_bytes + received_bytes) desc limit 10)", "execution_mode": "oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('app-bitrate-per-server-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "SELECT app, round(median(traffic_bytes) * 8 / 1000 / 1000 / 300,2) AS \\"Medain Mbits/s\\", round(avg(traffic_bytes) * 8 / 1000 / 1000 / 300,2) AS \\"AVG Mbits / s\\", round(QUANTILE(traffic_bytes, 0.95) * 8 / 1000 / 1000 / 300,2) as \\"P95 Mbits / s\\" FROM( SELECT app, toDateTime(intDiv(toUInt32(toDateTime(toDateTime(recv_time))),300) * 300) as stat_time, round(sum(sent_bytes + received_bytes)/ uniq(server_ip),2) as traffic_bytes FROM session_record as ss WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') GROUP BY stat_time, app) group by app order by \\"AVG Mbits / s\\" desc", "output_mode":"json", "execution_mode":"oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('top-10-source-ip-with-others', 'benchmark', 'qgw', 'sql', '{ "statement": "SELECT source_ip, sum(sent_bytes + received_bytes) as bytes from session_record sr1 where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') group by source_ip order by bytes desc limit 10 union all select null, sum(sent_bytes + received_bytes) as bytes from session_record sr2 where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and sr2.source_ip not in(select source_ip from session_record sr where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') group by source_ip order by sum(sent_bytes + received_bytes) desc limit 10)", "execution_mode": "oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('app-bitrate-per-destination-ip', 'benchmark', 'qgw', 'sql', '{ "statement" : "SELECT app, round(median(traffic_bytes) * 8 / 1000 / 1000 / 300,2) AS \\"Medain Mbits/s\\", round(avg(traffic_bytes) * 8 / 1000 / 1000 / 300,2) AS \\"AVG Mbits / s\\", round(QUANTILE(traffic_bytes, 0.95) * 8 / 1000 / 1000 / 300,2) as \\"P95 Mbits / s\\" FROM( SELECT app, toDateTime(intDiv(toUInt32(toDateTime(toDateTime(recv_time))),300) * 300) as stat_time, round(sum(sent_bytes + received_bytes)/ uniq(destination_ip),2) as traffic_bytes FROM session_record as ss WHERE recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') GROUP BY stat_time, app) group by app order by \\"AVG Mbits / s\\" desc", "output_mode":"json", "execution_mode":"oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('http-url-length-distribution', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(max(url_length),2) as max, round(QUANTILE(url_length,0.9999),2) as p9999, round(QUANTILE(url_length,0.99),2) as p99, round(QUANTILE(url_length,0.95),2) as p95, round(QUANTILE(url_length,0.90),2) as p90, round(median(url_length),2) as p50 from(select length(http_url) as url_length from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and decoded_as=''HTTP'')", "output_mode":"json", "execution_mode":"oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('dns-rr-length-distribution', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(max(rr_length),2) as max, round(QUANTILE(rr_length,0.9999),2) as p9999, round(QUANTILE(rr_length,0.99),2) as p99, round(QUANTILE(rr_length,0.95),2) as p95, round(QUANTILE(rr_length,0.90),2) as p90, round(median(rr_length),2) as p50 from(select length(dns_rr) as rr_length from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and decoded_as=''DNS'')", "output_mode":"json", "execution_mode":"oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('ssl-san-length-distribution', 'benchmark', 'qgw', 'sql', '{ "statement" : "select round(max(san_length),2) as max, round(QUANTILE(san_length,0.9999),2) as p9999, round(QUANTILE(san_length,0.99),2) as p99, round(QUANTILE(san_length,0.95),2) as p95, round(QUANTILE(san_length,0.90),2) as p90, round(median(san_length),2) as p50 from(select length(ssl_san) as san_length from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and decoded_as=''SSL'')", "output_mode":"json", "execution_mode":"oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('averages-usage-analysis', 'benchmark', 'qgw', 'sql', '{ "statement": "SELECT FROM_UNIXTIME(TIME_FLOOR_WITH_FILL ( UNIX_TIMESTAMP( __time ), CHART_GRANULARITY(''${start_time}'', ''${end_time}''))) AS stat_time, sum( in_bytes + out_bytes )* 8 / 1800 / 1000 / 1000 AS normal_rate_mbps, sum( in_bytes + out_bytes )/ count(DISTINCT (TIME_FLOOR_WITH_FILL ( UNIX_TIMESTAMP( __time ), SAMPLE_GRANULARITY(''${start_time}'', ''${end_time}''))))* 8 / 15 / 1000 / 1000 AS usage_rate_mbps FROM traffic_general_stat WHERE __time >= ''${start_time}'' AND __time < ''${end_time}'' AND vsys_id IN ( 1 ) GROUP BY TIME_FLOOR_WITH_FILL ( UNIX_TIMESTAMP( __time ), CHART_GRANULARITY(''${start_time}'', ''${end_time}'')) ORDER BY stat_time ASC", "execution_mode": "oneshot" }',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('top-100-slowest-domains', 'benchmark', 'qgw', 'sql', '{ "statement": "select server_domain as domain, round(avg(tcp_rtt_ms),0) avg_rtt_latency_ms from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and notEmpty(server_domain) group by server_domain order by avg_rtt_latency_ms desc limit 100", "execution_mode": "oneshot" }',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('top-100-slowest-domains', 'benchmark', 'qgw', 'sql', '{ "statement": "select destination_domain as domain, round(avg(tcp_rtt_ms),0) avg_rtt_latency_ms from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') and notEmpty(destination_domain) group by destination_domain order by avg_rtt_latency_ms desc limit 100", "execution_mode": "oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('duplicate-logs-assessment', 'benchmark', 'qgw', 'sql', '{ "statement": "select ''Session Records'' as type, count(*) as num from(select log_uuid,count(*) as num from session_record where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') group by log_uuid having num >1) union all select ''Proxy Events'' as type, count(*) as num from (select log_uuid,count(*) as num from proxy_event where recv_time >= UNIX_TIMESTAMP(''${start_time}'') and recv_time <UNIX_TIMESTAMP(''${end_time}'') group by log_uuid having num >1)", "execution_mode": "oneshot" }',null); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('traffic-spectrum-summary', 'traffic_sketch_metric', 'qgw', 'dsl', '{"name":"traffic-spectrum-summary","filter":"vsys_id in (${vsys_id}) AND (${filter})","intervals":["${start_time}/${end_time}"]}',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('traffic-spectrum-unique-client-and-server-ips', 'traffic_sketch_metric', 'qgw', 'dsl', '{"name":"traffic-spectrum-unique-client-and-server-ips","filter":"vsys_id in (${vsys_id}) AND (${filter})","intervals":["${start_time}/${end_time}"]}',null); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('traffic-spectrum-app-distribution', 'traffic_sketch_metric', 'qgw', 'dsl', '{"name": "traffic-spectrum-app-distribution", "filter": "app = ''${app}'' AND vsys_id in (${vsys_id}) AND (${filter})", "intervals": ["${start_time}/${end_time}"] }','The traffic usage of specified applications. Include the Top Server IP and Top Server Domain. '); -INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('traffic-spectrum-client-ip-connect-application-usage', 'traffic_sketch_metric', 'qgw', 'dsl', '{"name":"traffic-spectrum-client-ip-connect-application-usage","filter":"vsys_id in (${vsys_id}) AND (${filter})","intervals":["${start_time}/${end_time}"]}','The traffic usage of Internal Client IP to external application and External Client IP to Internal Application.'); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('traffic-spectrum-unique-source-and-destination-ips', 'traffic_sketch_metric', 'qgw', 'dsl', '{"name":"traffic-spectrum-unique-source-and-destination-ips","filter":"vsys_id in (${vsys_id}) AND (${filter})","intervals":["${start_time}/${end_time}"]}',null); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('traffic-spectrum-app-distribution', 'traffic_sketch_metric', 'qgw', 'dsl', '{"name": "traffic-spectrum-app-distribution", "filter": "app = ''${app}'' AND vsys_id in (${vsys_id}) AND (${filter})", "intervals": ["${start_time}/${end_time}"] }','The traffic usage of specified applications. Include the Top Destination IP and Top Destination Domain.'); +INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('traffic-spectrum-source-ip-connect-application-usage', 'traffic_sketch_metric', 'qgw', 'dsl', '{"name":"traffic-spectrum-source-ip-connect-application-usage","filter":"vsys_id in (${vsys_id}) AND (${filter})","intervals":["${start_time}/${end_time}"]}','The traffic usage of Internal Source IP to external application and External Source IP to Internal Application.'); INSERT INTO `dataset` (`identifier_name`, `category`, `backend_engine`, `type`, `template`, `description`) VALUES ('traffic-spectrum-network-throughput-trend', 'traffic_sketch_metric', 'qgw', 'dsl', '{"name":"traffic-spectrum-network-throughput-trend","filter":"vsys_id in (${vsys_id}) AND (${filter})","intervals":["${start_time}/${end_time}"]}',null); COMMIT; SET FOREIGN_KEY_CHECKS = 1;
\ No newline at end of file diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/datapath_telemetry_record.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/datapath_telemetry_record.json index 2e8439fc..ad422508 100644 --- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/datapath_telemetry_record.json +++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/datapath_telemetry_record.json @@ -171,7 +171,7 @@ }, { "name": "destination_port", - "label": "DestinationPort", + "label": "Destination Port", "doc": { "visibility": "enabled" }, diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/datasets_variables.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/datasets_variables.json index 4ac2e079..24f3d99b 100644 --- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/datasets_variables.json +++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/datasets_variables.json @@ -96,7 +96,7 @@ "default": 86400 }, { - "key": "client_ip", + "key": "source_ip", "default": "120.242.132.200" }, { @@ -129,7 +129,7 @@ }, { "key": "column_name", - "default": "client_ip" + "default": "source_ip" }, { "key": "column_name_long", @@ -141,7 +141,7 @@ }, { "key": "column_name_array", - "default": "fqdn_category_list" + "default": "destination_fqdn_tags" }, { "key": "source", @@ -174,7 +174,7 @@ { "key": "dimension_list", "default": { - "dimension_name": "client_ip" + "dimension_name": "source_ip" } } ]
\ No newline at end of file diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/monitor_event.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/monitor_event.json index 4029a1de..a71568fe 100644 --- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/monitor_event.json +++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/monitor_event.json @@ -47,16 +47,12 @@ "s2c_ttl", "monitor_rule_list", "monitor_rule_uuid_list", - "client_ip", - "client_ip_tags", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_ip_tags", + "source_port", + "source_os_desc", + "source_country", + "source_asn", "subscriber_id", "imei", "imsi", @@ -65,19 +61,15 @@ "packet_capture_file", "in_src_mac", "out_src_mac", - "server_ip", - "server_ip_tags", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_fqdn_tags", - "server_domain", + "destination_ip", + "destination_ip_tags", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_fqdn_tags", + "destination_domain", "in_dest_mac", "out_dest_mac", "app_transition", @@ -91,8 +83,6 @@ "dup_traffic_flag", "tunnel_id_list", "tunnel_uuid_list", - "tunnel_endpoint_a_desc", - "tunnel_endpoint_b_desc", "http_url", "http_host", "http_request_line", @@ -230,14 +220,10 @@ "log_id", "c2s_ttl", "s2c_ttl", - "client_ip", - "client_port", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_port", + "source_country", + "source_asn", "subscriber_id", "imei", "imsi", @@ -245,16 +231,12 @@ "phone_number", "in_src_mac", "out_src_mac", - "server_ip", - "server_port", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_domain", + "destination_ip", + "destination_port", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_domain", "in_dest_mac", "out_dest_mac", "app", @@ -277,8 +259,8 @@ "tcp_c2s_rtx_bytes", "tcp_s2c_rtx_bytes", "tcp_rtt_ms", - "tcp_client_isn", - "tcp_server_isn", + "tcp_source_isn", + "tcp_destination_isn", "http_url", "http_host", "http_user_agent", @@ -360,16 +342,12 @@ "monitor_rule_uuid_list", "monitor_mirrored_pkts", "monitor_mirrored_bytes", - "client_ip", - "client_ip_tags", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_ip_tags", + "source_port", + "source_os_desc", + "source_country", + "source_asn", "subscriber_id", "imei", "imsi", @@ -377,19 +355,15 @@ "phone_number", "in_src_mac", "out_src_mac", - "server_ip", - "server_ip_tags", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_fqdn_tags", - "server_domain", + "destination_ip", + "destination_ip_tags", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_fqdn_tags", + "destination_domain", "in_dest_mac", "out_dest_mac", "app_transition", @@ -401,11 +375,8 @@ "dup_traffic_flag", "tunnel_id_list", "tunnel_uuid_list", - "tunnel_endpoint_a_desc", - "tunnel_endpoint_b_desc", "ip_protocol", "decoded_path", - "fqdn_category_list", "sent_pkts", "received_pkts", "sent_bytes", @@ -769,12 +740,12 @@ "default_columns": [ "recv_time", "subscriber_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "decoded_as", - "server_fqdn" + "destination_fqdn" ], "internal_columns": [ "recv_time", @@ -784,9 +755,7 @@ "encapsulation", "app_debug_info", "app_content", - "packet_capture_file", - "tunnel_endpoint_a_desc", - "tunnel_endpoint_b_desc" + "packet_capture_file" ], "sensitive_columns": [ "subscriber_id", @@ -1036,7 +1005,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_ip,''), if(bitAnd(flags, 16)=16, server_ip,''))" + "expression": "array(if(bitAnd(flags, 8)=8, source_ip,''), if(bitAnd(flags, 16)=16, destination_ip,''))" } }, { @@ -1051,7 +1020,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_ip,''), if(bitAnd(flags, 16)!=16, server_ip,''))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_ip,''), if(bitAnd(flags, 16)!=16, destination_ip,''))" } }, { @@ -1066,7 +1035,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_port, null), if(bitAnd(flags, 16)=16, server_port, null))" + "expression": "array(if(bitAnd(flags, 8)=8, source_port, null), if(bitAnd(flags, 16)=16, destination_port, null))" } }, { @@ -1081,7 +1050,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_port, null), if(bitAnd(flags, 16)!=16, server_port, null))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_port, null), if(bitAnd(flags, 16)!=16, destination_port, null))" } }, { @@ -1096,7 +1065,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_asn, null), if(bitAnd(flags, 16)=16, server_asn, null))" + "expression": "array(if(bitAnd(flags, 8)=8, source_asn, null), if(bitAnd(flags, 16)=16, destination_asn, null))" } }, { @@ -1111,7 +1080,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_asn, null), if(bitAnd(flags, 16)!=16, server_asn, null))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_asn, null), if(bitAnd(flags, 16)!=16, destination_asn, null))" } }, { @@ -1133,30 +1102,30 @@ } }, { - "name": "client_ip_tag", - "label": "Client IP Tag", + "name": "source_ip_tag", + "label": "Source IP Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(client_ip_tags), arrayPushFront(client_ip_tags, null),client_ip_tags))" + "expression": "arrayJoin(IF(empty(source_ip_tags), arrayPushFront(source_ip_tags, null),source_ip_tags))" } }, { - "name": "server_ip_tag", - "label": "Server IP Tag", + "name": "destination_ip_tag", + "label": "Destination IP Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(server_ip_tags), arrayPushFront(server_ip_tags, null),server_ip_tags))" + "expression": "arrayJoin(IF(empty(destination_ip_tags), arrayPushFront(destination_ip_tags, null),destination_ip_tags))" } }, { - "name": "server_fqdn_tag", - "label": "Server FQDN Tag", + "name": "destination_fqdn_tag", + "label": "Destination FQDN Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(server_fqdn_tags), arrayPushFront(server_fqdn_tags, null),server_fqdn_tags))" + "expression": "arrayJoin(IF(empty(destination_fqdn_tags), arrayPushFront(destination_fqdn_tags, null),destination_fqdn_tags))" } } ] @@ -1906,8 +1875,8 @@ "type": "string" }, { - "name": "proxy_server_side_latency_ms", - "label": "Proxy Server-Side Latency(ms)", + "name": "proxy_destination_side_latency_ms", + "label": "Proxy Destination-Side Latency(ms)", "doc": { "visibility": "hidden", "ttl": null @@ -1915,8 +1884,8 @@ "type": "int" }, { - "name": "proxy_client_side_latency_ms", - "label": "Proxy Client-Side Latency(ms)", + "name": "proxy_source_side_latency_ms", + "label": "Proxy Source-Side Latency(ms)", "doc": { "visibility": "hidden", "ttl": null @@ -1924,8 +1893,8 @@ "type": "int" }, { - "name": "proxy_client_side_version", - "label": "Proxy Client-Side Version", + "name": "proxy_source_side_version", + "label": "Proxy Source-Side Version", "doc": { "visibility": "hidden", "ttl": null @@ -1933,8 +1902,8 @@ "type": "string" }, { - "name": "proxy_server_side_version", - "label": "Proxy Server-Side Version", + "name": "proxy_destination_side_version", + "label": "Proxy Destination-Side Version", "doc": { "visibility": "hidden", "ttl": null @@ -1984,8 +1953,8 @@ } }, { - "name": "client_ip", - "label": "Client IP", + "name": "source_ip", + "label": "Source IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -1997,8 +1966,8 @@ "type": "string" }, { - "name": "client_ip_tags", - "label": "Client IP Tags", + "name": "source_ip_tags", + "label": "Source IP Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -2013,8 +1982,8 @@ } }, { - "name": "client_port", - "label": "Client Port", + "name": "source_port", + "label": "Source Port", "doc": { "constraints": { "type": "port", @@ -2026,26 +1995,17 @@ "type": "int" }, { - "name": "client_os_desc", + "name": "source_os_desc", "type": "string", "doc": { "visibility": "enabled", "ttl": null }, - "label": "Client OS Description" + "label": "Source OS Description" }, { - "name": "client_geolocation", - "label": "Client Geolocation(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_country", - "label": "Client Country", + "name": "source_country", + "label": "Source Country", "doc": { "constraints": { "type": "country" @@ -2056,41 +2016,8 @@ "type": "string" }, { - "name": "client_super_administrative_area", - "label": "Client Super Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "super_administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_administrative_area", - "label": "Client Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_sub_administrative_area", - "label": "Client SubAdministrative Area(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_asn", - "label": "Client ASN", + "name": "source_asn", + "label": "Source ASN", "doc": { "constraints": { "aggregation_functions": "COUNT, UNIQUE_COUNT, UNIQUE_ARRAY" @@ -2175,8 +2102,8 @@ "type": "string" }, { - "name": "server_ip", - "label": "Server IP", + "name": "destination_ip", + "label": "Destination IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -2188,8 +2115,8 @@ "type": "string" }, { - "name": "server_ip_tags", - "label": "Server IP Tags", + "name": "destination_ip_tags", + "label": "Destination IP Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -2204,8 +2131,8 @@ } }, { - "name": "server_port", - "label": "Server Port", + "name": "destination_port", + "label": "Destination Port", "doc": { "constraints": { "type": "port", @@ -2217,26 +2144,17 @@ "type": "int" }, { - "name": "server_os_desc", + "name": "destination_os_desc", "type": "string", "doc": { "visibility": "enabled", "ttl": null }, - "label": "Server OS Description" + "label": "Destination OS Description" }, { - "name": "server_geolocation", - "label": "Server Geolocation(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_country", - "label": "Server Country", + "name": "destination_country", + "label": "Destination Country", "doc": { "constraints": { "type": "country" @@ -2247,41 +2165,8 @@ "type": "string" }, { - "name": "server_super_administrative_area", - "label": "Server Super Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "super_administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_administrative_area", - "label": "Server Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_sub_administrative_area", - "label": "Server SubAdministrative Area(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_asn", - "label": "Server ASN", + "name": "destination_asn", + "label": "Destination ASN", "doc": { "constraints": { "aggregation_functions": "COUNT, UNIQUE_COUNT, UNIQUE_ARRAY" @@ -2292,8 +2177,8 @@ "type": "long" }, { - "name": "server_fqdn", - "label": "Server FQDN", + "name": "destination_fqdn", + "label": "Destination FQDN", "doc": { "constraints": { "type": "fqdn" @@ -2304,8 +2189,8 @@ "type": "string" }, { - "name": "server_fqdn_tags", - "label": "Server FQDN Tags", + "name": "destination_fqdn_tags", + "label": "Destination FQDN Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -2320,8 +2205,8 @@ } }, { - "name": "server_domain", - "label": "Server Domain", + "name": "destination_domain", + "label": "Destination Domain", "doc": { "constraints": { "type": "domain" @@ -2413,27 +2298,6 @@ "type": "string" }, { - "name": "fqdn_category_list", - "label": "FQDN Category List(Deprecated)", - "doc": { - "constraints": { - "operator_functions": "has,notEmpty,empty" - }, - "dict_location": { - "path": "/v1/policy/object?type=fqdn_category", - "key": "category_id", - "value": "category_name" - }, - "visibility": "enabled", - "ttl": null - }, - "type": { - "type": "array", - "items": "long", - "logicalType": "array" - } - }, - { "name": "sent_pkts", "label": "Packets Sent", "doc": { @@ -2615,8 +2479,8 @@ "type": "int" }, { - "name": "tcp_client_isn", - "label": "Client ISN", + "name": "tcp_source_isn", + "label": "Source ISN", "doc": { "visibility": "enabled", "ttl": null @@ -2624,8 +2488,8 @@ "type": "long" }, { - "name": "tcp_server_isn", - "label": "Server ISN", + "name": "tcp_destination_isn", + "label": "Destination ISN", "doc": { "visibility": "enabled", "ttl": null @@ -2732,24 +2596,6 @@ } }, { - "name": "tunnel_endpoint_a_desc", - "label": "Tunnel Endpoint A Description(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "tunnel_endpoint_b_desc", - "label": "Tunnel Endpoint B Description(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { "name": "http_url", "label": "HTTP.URL", "doc": { diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/proxy_event.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/proxy_event.json index b5b06205..9aabcb97 100644 --- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/proxy_event.json +++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/proxy_event.json @@ -43,30 +43,22 @@ "proxy_rule_list", "proxy_rule_uuid_list", "proxy_action", - "client_ip", - "client_ip_tags", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_ip_tags", + "source_port", + "source_os_desc", + "source_country", + "source_asn", "subscriber_id", - "server_ip", - "server_ip_tags", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_fqdn_tags", - "server_domain", + "destination_ip", + "destination_ip_tags", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_fqdn_tags", + "destination_domain", "ip_protocol", "tunnel_id_list", "tunnel_uuid_list", @@ -129,25 +121,17 @@ "metrics": [ "log_uuid", "log_id", - "client_ip", - "client_port", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_port", + "source_country", + "source_asn", "subscriber_id", - "server_ip", - "server_port", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_domain", + "destination_ip", + "destination_port", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_domain", "sent_bytes", "received_bytes", "tcp_rtt_ms", @@ -185,30 +169,22 @@ "proxy_rule_list", "proxy_rule_uuid_list", "proxy_action", - "client_ip", - "client_ip_tags", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_ip_tags", + "source_port", + "source_os_desc", + "source_country", + "source_asn", "subscriber_id", - "server_ip", - "server_ip_tags", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_fqdn_tags", - "server_domain", + "destination_ip", + "destination_ip_tags", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_fqdn_tags", + "destination_domain", "ip_protocol", "sent_bytes", "received_bytes", @@ -366,12 +342,12 @@ "default_columns": [ "recv_time", "subscriber_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "decoded_as", - "server_fqdn" + "destination_fqdn" ], "internal_columns": [ "recv_time", @@ -381,9 +357,7 @@ "encapsulation", "app_debug_info", "app_content", - "packet_capture_file", - "tunnel_endpoint_a_desc", - "tunnel_endpoint_b_desc" + "packet_capture_file" ], "sensitive_columns": [ "subscriber_id", @@ -394,10 +368,10 @@ "proxy_pinning_status", "proxy_intercept_status", "proxy_passthrough_reason", - "proxy_client_side_version", - "proxy_server_side_version", - "proxy_client_side_latency_ms", - "proxy_server_side_latency_ms", + "proxy_source_side_version", + "proxy_destination_side_version", + "proxy_source_side_latency_ms", + "proxy_destination_side_latency_ms", "proxy_cert_verify", "proxy_intercept_error" ] @@ -629,7 +603,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_ip,''), if(bitAnd(flags, 16)=16, server_ip,''))" + "expression": "array(if(bitAnd(flags, 8)=8, source_ip,''), if(bitAnd(flags, 16)=16, destination_ip,''))" } }, { @@ -644,7 +618,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_ip,''), if(bitAnd(flags, 16)!=16, server_ip,''))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_ip,''), if(bitAnd(flags, 16)!=16, destination_ip,''))" } }, { @@ -659,7 +633,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_port, null), if(bitAnd(flags, 16)=16, server_port, null))" + "expression": "array(if(bitAnd(flags, 8)=8, source_port, null), if(bitAnd(flags, 16)=16, destination_port, null))" } }, { @@ -674,7 +648,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_port, null), if(bitAnd(flags, 16)!=16, server_port, null))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_port, null), if(bitAnd(flags, 16)!=16, destination_port, null))" } }, { @@ -689,7 +663,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_asn, null), if(bitAnd(flags, 16)=16, server_asn, null))" + "expression": "array(if(bitAnd(flags, 8)=8, source_asn, null), if(bitAnd(flags, 16)=16, destination_asn, null))" } }, { @@ -704,7 +678,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_asn, null), if(bitAnd(flags, 16)!=16, server_asn, null))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_asn, null), if(bitAnd(flags, 16)!=16, destination_asn, null))" } }, { @@ -726,30 +700,30 @@ } }, { - "name": "client_ip_tag", - "label": "Client IP Tag", + "name": "source_ip_tag", + "label": "Source IP Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(client_ip_tags), arrayPushFront(client_ip_tags, null),client_ip_tags))" + "expression": "arrayJoin(IF(empty(source_ip_tags), arrayPushFront(source_ip_tags, null),source_ip_tags))" } }, { - "name": "server_ip_tag", - "label": "Server IP Tag", + "name": "destination_ip_tag", + "label": "Destination IP Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(server_ip_tags), arrayPushFront(server_ip_tags, null),server_ip_tags))" + "expression": "arrayJoin(IF(empty(destination_ip_tags), arrayPushFront(destination_ip_tags, null),destination_ip_tags))" } }, { - "name": "server_fqdn_tag", - "label": "Server FQDN Tag", + "name": "destination_fqdn_tag", + "label": "Destination FQDN Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(server_fqdn_tags), arrayPushFront(server_fqdn_tags, null),server_fqdn_tags))" + "expression": "arrayJoin(IF(empty(destination_fqdn_tags), arrayPushFront(destination_fqdn_tags, null),destination_fqdn_tags))" } } ] @@ -1487,8 +1461,8 @@ "type": "string" }, { - "name": "proxy_server_side_latency_ms", - "label": "Proxy Server-Side Latency(ms)", + "name": "proxy_destination_side_latency_ms", + "label": "Proxy Destination-Side Latency(ms)", "doc": { "visibility": "hidden", "ttl": null @@ -1496,8 +1470,8 @@ "type": "int" }, { - "name": "proxy_client_side_latency_ms", - "label": "Proxy Client-Side Latency(ms)", + "name": "proxy_source_side_latency_ms", + "label": "Proxy Source-Side Latency(ms)", "doc": { "visibility": "hidden", "ttl": null @@ -1505,8 +1479,8 @@ "type": "int" }, { - "name": "proxy_client_side_version", - "label": "Proxy Client-Side Version", + "name": "proxy_source_side_version", + "label": "Proxy Source-Side Version", "doc": { "visibility": "hidden", "ttl": null @@ -1514,8 +1488,8 @@ "type": "string" }, { - "name": "proxy_server_side_version", - "label": "Proxy Server-Side Version", + "name": "proxy_destination_side_version", + "label": "Proxy Destination-Side Version", "doc": { "visibility": "hidden", "ttl": null @@ -1565,8 +1539,8 @@ } }, { - "name": "client_ip", - "label": "Client IP", + "name": "source_ip", + "label": "Source IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -1578,8 +1552,8 @@ "type": "string" }, { - "name": "client_ip_tags", - "label": "Client IP Tags", + "name": "source_ip_tags", + "label": "Source IP Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -1594,8 +1568,8 @@ } }, { - "name": "client_port", - "label": "Client Port", + "name": "source_port", + "label": "Source Port", "doc": { "visibility": "enabled", "constraints": { @@ -1607,26 +1581,17 @@ "type": "int" }, { - "name": "client_os_desc", + "name": "source_os_desc", "type": "string", "doc": { "visibility": "hidden", "ttl": null }, - "label": "Client OS Description" + "label": "Source OS Description" }, { - "name": "client_geolocation", - "label": "Client Geolocation(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_country", - "label": "Client Country", + "name": "source_country", + "label": "Source Country", "doc": { "constraints": { "type": "country" @@ -1637,41 +1602,8 @@ "type": "string" }, { - "name": "client_super_administrative_area", - "label": "Client Super Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "super_administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_administrative_area", - "label": "Client Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_sub_administrative_area", - "label": "Client SubAdministrative Area(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_asn", - "label": "Client ASN", + "name": "source_asn", + "label": "Source ASN", "doc": { "visibility": "enabled", "constraints": { @@ -1756,8 +1688,8 @@ "type": "string" }, { - "name": "server_ip", - "label": "Server IP", + "name": "destination_ip", + "label": "Destination IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -1769,8 +1701,8 @@ "type": "string" }, { - "name": "server_ip_tags", - "label": "Server IP Tags", + "name": "destination_ip_tags", + "label": "Destination IP Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -1785,8 +1717,8 @@ } }, { - "name": "server_port", - "label": "Server Port", + "name": "destination_port", + "label": "Destination Port", "doc": { "visibility": "enabled", "constraints": { @@ -1798,26 +1730,17 @@ "type": "int" }, { - "name": "server_os_desc", + "name": "destination_os_desc", "type": "string", "doc": { "visibility": "hidden", "ttl": null }, - "label": "Server OS Description" + "label": "Destination OS Description" }, { - "name": "server_geolocation", - "label": "Server Geolocation(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_country", - "label": "Server Country", + "name": "destination_country", + "label": "Destination Country", "doc": { "constraints": { "type": "country" @@ -1828,41 +1751,8 @@ "type": "string" }, { - "name": "server_super_administrative_area", - "label": "Server Super Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "super_administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_administrative_area", - "label": "Server Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_sub_administrative_area", - "label": "Server SubAdministrative Area(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_asn", - "label": "Server ASN", + "name": "destination_asn", + "label": "Destination ASN", "doc": { "visibility": "enabled", "constraints": { @@ -1873,8 +1763,8 @@ "type": "long" }, { - "name": "server_fqdn", - "label": "Server FQDN", + "name": "destination_fqdn", + "label": "Destination FQDN", "doc": { "constraints": { "type": "fqdn" @@ -1885,8 +1775,8 @@ "type": "string" }, { - "name": "server_fqdn_tags", - "label": "Server FQDN Tags", + "name": "destination_fqdn_tags", + "label": "Destination FQDN Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -1901,8 +1791,8 @@ } }, { - "name": "server_domain", - "label": "Server Domain", + "name": "destination_domain", + "label": "Destination Domain", "doc": { "constraints": { "type": "domain" @@ -1994,27 +1884,6 @@ "type": "string" }, { - "name": "fqdn_category_list", - "label": "FQDN Category List(Deprecated)", - "doc": { - "constraints": { - "operator_functions": "has,notEmpty,empty" - }, - "dict_location": { - "path": "/v1/policy/object?type=fqdn_category", - "key": "category_id", - "value": "category_name" - }, - "visibility": "hidden", - "ttl": null - }, - "type": { - "type": "array", - "items": "long", - "logicalType": "array" - } - }, - { "name": "sent_pkts", "label": "Packets Sent", "doc": { @@ -2196,8 +2065,8 @@ "type": "int" }, { - "name": "tcp_client_isn", - "label": "Client ISN", + "name": "tcp_source_isn", + "label": "Source ISN", "doc": { "visibility": "hidden", "ttl": null @@ -2205,8 +2074,8 @@ "type": "long" }, { - "name": "tcp_server_isn", - "label": "Server ISN", + "name": "tcp_destination_isn", + "label": "Destination ISN", "doc": { "visibility": "hidden", "ttl": null @@ -2313,24 +2182,6 @@ } }, { - "name": "tunnel_endpoint_a_desc", - "label": "Tunnel Endpoint A Description(Deprecated)", - "doc": { - "visibility": "hidden", - "ttl": null - }, - "type": "string" - }, - { - "name": "tunnel_endpoint_b_desc", - "label": "Tunnel Endpoint B Description(Deprecated)", - "doc": { - "visibility": "hidden", - "ttl": null - }, - "type": "string" - }, - { "name": "http_url", "label": "HTTP.URL", "doc": { diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/public_schema_info.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/public_schema_info.json index ec0c6012..7b41957a 100644 --- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/public_schema_info.json +++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/public_schema_info.json @@ -406,43 +406,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -451,7 +443,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -467,8 +458,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -477,17 +468,15 @@ "encapsulation",
"dup_traffic_flag",
"tunnel_id_list",
- "tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc"
+ "tunnel_uuid_list"
],
"default_columns": [
"recv_time",
"subscriber_id",
- "client_ip",
- "client_port",
- "server_ip",
- "server_port"
+ "source_ip",
+ "source_port",
+ "destination_ip",
+ "destination_port"
]
},
"HTTP": {
@@ -541,43 +530,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -586,7 +567,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -602,8 +582,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -613,8 +593,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"http_url",
"http_host",
"http_request_line",
@@ -640,11 +618,11 @@ "default_columns": [
"recv_time",
"subscriber_id",
- "client_ip",
- "client_port",
+ "source_ip",
+ "source_port",
"http_url",
- "server_ip",
- "server_port"
+ "destination_ip",
+ "destination_port"
]
},
"MAIL": {
@@ -698,43 +676,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -743,7 +713,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -759,8 +728,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -770,8 +739,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"mail_protocol_type",
"mail_account",
"mail_from_cmd",
@@ -791,13 +758,13 @@ "default_columns": [
"recv_time",
"subscriber_id",
- "client_ip",
- "client_port",
+ "source_ip",
+ "source_port",
"mail_from",
"mail_to",
"mail_subject",
- "server_ip",
- "server_port"
+ "destination_ip",
+ "destination_port"
]
},
"DNS": {
@@ -851,43 +818,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -896,7 +855,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -912,8 +870,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -923,8 +881,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"dns_message_id",
"dns_qr",
"dns_opcode",
@@ -947,13 +903,13 @@ ],
"default_columns": [
"recv_time",
- "client_ip",
- "client_port",
+ "source_ip",
+ "source_port",
"dns_qr",
"dns_qname",
"dns_qtype",
- "server_ip",
- "server_port"
+ "destination_ip",
+ "destination_port"
]
},
"SSL": {
@@ -1007,43 +963,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -1052,7 +1000,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -1068,8 +1015,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -1079,8 +1026,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"ssl_version",
"ssl_sni",
"ssl_san",
@@ -1098,11 +1043,11 @@ "default_columns": [
"recv_time",
"subscriber_id",
- "client_ip",
- "client_port",
+ "source_ip",
+ "source_port",
"ssl_sni",
- "server_ip",
- "server_port"
+ "destination_ip",
+ "destination_port"
]
},
"DTLS": {
@@ -1156,43 +1101,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -1201,7 +1138,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -1217,8 +1153,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -1228,8 +1164,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"dtls_cookie",
"dtls_version",
"dtls_sni",
@@ -1244,11 +1178,11 @@ "default_columns": [
"recv_time",
"subscriber_id",
- "client_ip",
- "client_port",
+ "source_ip",
+ "source_port",
"dtls_sni",
- "server_ip",
- "server_port"
+ "destination_ip",
+ "destination_port"
]
},
"QUIC": {
@@ -1302,43 +1236,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -1347,7 +1273,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -1363,8 +1288,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -1374,8 +1299,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"quic_version",
"quic_sni",
"quic_user_agent"
@@ -1383,11 +1306,11 @@ "default_columns": [
"recv_time",
"subscriber_id",
- "client_ip",
- "client_port",
+ "source_ip",
+ "source_port",
"quic_sni",
- "server_ip",
- "server_port"
+ "destination_ip",
+ "destination_port"
]
},
"FTP": {
@@ -1441,43 +1364,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -1486,7 +1401,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -1502,8 +1416,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -1513,8 +1427,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"ftp_account",
"ftp_url",
"ftp_link_type"
@@ -1522,11 +1434,11 @@ "default_columns": [
"recv_time",
"subscriber_id",
- "client_ip",
- "client_port",
+ "source_ip",
+ "source_port",
"ftp_url",
- "server_ip",
- "server_port"
+ "destination_ip",
+ "destination_port"
]
},
"SIP": {
@@ -1580,43 +1492,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -1625,7 +1529,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -1641,8 +1544,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -1652,8 +1555,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"sip_call_id",
"sip_originator_description",
"sip_responder_description",
@@ -1673,13 +1574,13 @@ ],
"default_columns": [
"recv_time",
- "client_ip",
- "client_port",
+ "source_ip",
+ "source_port",
"sip_originator_description",
"sip_responder_description",
"sip_call_id",
- "server_ip",
- "server_port"
+ "destination_ip",
+ "destination_port"
]
},
"RTP": {
@@ -1733,43 +1634,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -1778,7 +1671,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -1794,8 +1686,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -1805,8 +1697,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"rtp_payload_type_c2s",
"rtp_payload_type_s2c",
"rtp_pcap_path",
@@ -1815,10 +1705,10 @@ "default_columns": [
"recv_time",
"subscriber_id",
- "client_ip",
- "client_port",
- "server_ip",
- "server_port",
+ "source_ip",
+ "source_port",
+ "destination_ip",
+ "destination_port",
"rtp_pcap_path",
"rtp_originator_dir"
]
@@ -1874,41 +1764,33 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"phone_number",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -1917,7 +1799,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -1933,8 +1814,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -1944,8 +1825,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"ssh_version",
"ssh_auth_success",
"ssh_client_version",
@@ -1961,10 +1840,10 @@ "default_columns": [
"recv_time",
"subscriber_id",
- "client_ip",
- "client_port",
- "server_ip",
- "server_port",
+ "source_ip",
+ "source_port",
+ "destination_ip",
+ "destination_port",
"ssh_auth_success"
]
},
@@ -2019,43 +1898,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -2064,7 +1935,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -2080,8 +1950,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -2091,8 +1961,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"stratum_cryptocurrency",
"stratum_mining_pools",
"stratum_mining_program",
@@ -2101,10 +1969,10 @@ "default_columns": [
"recv_time",
"subscriber_id",
- "client_port",
- "client_ip",
- "server_ip",
- "server_port",
+ "source_port",
+ "source_ip",
+ "destination_ip",
+ "destination_port",
"stratum_cryptocurrency",
"stratum_mining_pools",
"stratum_mining_program"
@@ -2161,43 +2029,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -2206,7 +2066,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -2222,8 +2081,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -2233,8 +2092,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"rdp_cookie",
"rdp_security_protocol",
"rdp_client_channels",
@@ -2309,43 +2166,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -2354,7 +2203,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -2370,8 +2218,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -2381,8 +2229,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"doh_url",
"doh_host",
"doh_request_line",
@@ -2420,10 +2266,10 @@ "proxy_rule_list",
"proxy_rule_uuid_list",
"proxy_action",
- "client_ip",
+ "source_ip",
"doh_url",
"doh_qname",
- "server_port"
+ "destination_port"
]
},
"VoIP": {
@@ -2477,43 +2323,35 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -2522,7 +2360,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -2538,8 +2375,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -2549,8 +2386,6 @@ "dup_traffic_flag",
"tunnel_id_list",
"tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc",
"sip_call_id",
"sip_originator_description",
"sip_responder_description",
@@ -2574,10 +2409,10 @@ ],
"default_columns": [
"recv_time",
- "client_ip",
- "client_port",
- "server_ip",
- "server_port",
+ "source_ip",
+ "source_port",
+ "destination_ip",
+ "destination_port",
"sip_originator_description",
"sip_responder_description",
"sip_call_id",
@@ -2623,41 +2458,33 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
"apn",
"phone_number",
"mobile_identify",
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain",
"app_transition",
"app",
"app_category",
@@ -2666,7 +2493,6 @@ "app_extra_info",
"ip_protocol",
"decoded_path",
- "fqdn_category_list",
"sent_pkts",
"received_pkts",
"sent_bytes",
@@ -2682,8 +2508,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn",
+ "tcp_source_isn",
+ "tcp_destination_isn",
"packet_capture_file",
"in_src_mac",
"out_src_mac",
@@ -2732,12 +2558,12 @@ "security_rule_list",
"security_rule_uuid_list",
"security_action",
- "client_ip",
- "client_port",
- "server_fqdn",
+ "source_ip",
+ "source_port",
+ "destination_fqdn",
"app",
- "server_ip",
- "server_port"
+ "destination_ip",
+ "destination_port"
]
}
},
@@ -2885,12 +2711,12 @@ "type": "int"
},
{
- "name": "l2tp_network_server_ip",
+ "name": "l2tp_network_destination_ip",
"label": "Network Server IP",
"type": "string"
},
{
- "name": "l2tp_network_server_port",
+ "name": "l2tp_network_destination_port",
"label": "Network Server Port",
"type": "int"
}
@@ -2909,25 +2735,25 @@ ],
"IPv4": [
{
- "name": "client_ip",
- "label": "Client IP",
+ "name": "source_ip",
+ "label": "Source IP",
"type": "string"
},
{
- "name": "server_ip",
- "label": "Server IP",
+ "name": "destination_ip",
+ "label": "Destination IP",
"type": "string"
}
],
"IPv6": [
{
- "name": "client_ip",
- "label": "Client IP",
+ "name": "source_ip",
+ "label": "Source IP",
"type": "string"
},
{
- "name": "server_ip",
- "label": "Server IP",
+ "name": "destination_ip",
+ "label": "Destination IP",
"type": "string"
}
],
@@ -2986,26 +2812,22 @@ "proxy_pinning_status",
"proxy_intercept_status",
"proxy_passthrough_reason",
- "proxy_client_side_latency_ms",
- "proxy_server_side_latency_ms",
- "proxy_client_side_version",
- "proxy_server_side_version",
+ "proxy_source_side_latency_ms",
+ "proxy_destination_side_latency_ms",
+ "proxy_source_side_version",
+ "proxy_destination_side_version",
"proxy_cert_verify",
"proxy_intercept_error",
"monitor_mirrored_pkts",
"monitor_mirrored_bytes"
],
"source": [
- "client_ip",
- "client_ip_tags",
- "client_port",
- "client_os_desc",
- "client_geolocation",
- "client_country",
- "client_super_administrative_area",
- "client_administrative_area",
- "client_sub_administrative_area",
- "client_asn",
+ "source_ip",
+ "source_ip_tags",
+ "source_port",
+ "source_os_desc",
+ "source_country",
+ "source_asn",
"subscriber_id",
"imei",
"imsi",
@@ -3014,20 +2836,15 @@ "mobile_identify"
],
"destination": [
- "server_ip",
- "server_ip_tags",
- "server_port",
- "server_os_desc",
- "server_geolocation",
- "server_country",
- "server_super_administrative_area",
- "server_administrative_area",
- "server_sub_administrative_area",
- "server_asn",
- "server_fqdn",
- "server_fqdn_tags",
- "server_domain",
- "fqdn_category_list"
+ "destination_ip",
+ "destination_ip_tags",
+ "destination_port",
+ "destination_os_desc",
+ "destination_country",
+ "destination_asn",
+ "destination_fqdn",
+ "destination_fqdn_tags",
+ "destination_domain"
],
"application": [
"app_transition",
@@ -3053,8 +2870,8 @@ "tcp_c2s_rtx_bytes",
"tcp_s2c_rtx_bytes",
"tcp_rtt_ms",
- "tcp_client_isn",
- "tcp_server_isn"
+ "tcp_source_isn",
+ "tcp_destination_isn"
],
"other": [
"packet_capture_file",
@@ -3064,9 +2881,7 @@ "out_dest_mac",
"dup_traffic_flag",
"tunnel_id_list",
- "tunnel_uuid_list",
- "tunnel_endpoint_a_desc",
- "tunnel_endpoint_b_desc"
+ "tunnel_uuid_list"
]
},
"fields": {
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/security_event.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/security_event.json index 07faabe7..3b5e9f97 100644 --- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/security_event.json +++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/security_event.json @@ -48,16 +48,12 @@ "security_action", "security_rule_list", "security_rule_uuid_list", - "client_ip", - "client_ip_tags", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_ip_tags", + "source_port", + "source_os_desc", + "source_country", + "source_asn", "subscriber_id", "imei", "imsi", @@ -66,19 +62,15 @@ "packet_capture_file", "in_src_mac", "out_src_mac", - "server_ip", - "server_ip_tags", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_fqdn_tags", - "server_domain", + "destination_ip", + "destination_ip_tags", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_fqdn_tags", + "destination_domain", "in_dest_mac", "out_dest_mac", "app_transition", @@ -92,8 +84,6 @@ "dup_traffic_flag", "tunnel_id_list", "tunnel_uuid_list", - "tunnel_endpoint_a_desc", - "tunnel_endpoint_b_desc", "http_url", "http_host", "http_request_line", @@ -231,14 +221,10 @@ "log_id", "c2s_ttl", "s2c_ttl", - "client_ip", - "client_port", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_port", + "source_country", + "source_asn", "subscriber_id", "imei", "imsi", @@ -246,16 +232,12 @@ "phone_number", "in_src_mac", "out_src_mac", - "server_ip", - "server_port", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_domain", + "destination_ip", + "destination_port", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_domain", "in_dest_mac", "out_dest_mac", "app", @@ -278,8 +260,8 @@ "tcp_c2s_rtx_bytes", "tcp_s2c_rtx_bytes", "tcp_rtt_ms", - "tcp_client_isn", - "tcp_server_isn", + "tcp_source_isn", + "tcp_destination_isn", "http_url", "http_host", "http_user_agent", @@ -362,16 +344,12 @@ "monitor_mirrored_bytes", "security_rule_list", "security_rule_uuid_list", - "client_ip", - "client_ip_tags", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_ip_tags", + "source_port", + "source_os_desc", + "source_country", + "source_asn", "subscriber_id", "imei", "imsi", @@ -379,19 +357,15 @@ "phone_number", "in_src_mac", "out_src_mac", - "server_ip", - "server_ip_tags", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_fqdn_tags", - "server_domain", + "destination_ip", + "destination_ip_tags", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_fqdn_tags", + "destination_domain", "in_dest_mac", "out_dest_mac", "app_transition", @@ -403,11 +377,8 @@ "dup_traffic_flag", "tunnel_id_list", "tunnel_uuid_list", - "tunnel_endpoint_a_desc", - "tunnel_endpoint_b_desc", "ip_protocol", "decoded_path", - "fqdn_category_list", "sent_pkts", "received_pkts", "sent_bytes", @@ -423,8 +394,8 @@ "tcp_c2s_rtx_bytes", "tcp_s2c_rtx_bytes", "tcp_rtt_ms", - "tcp_client_isn", - "tcp_server_isn", + "tcp_source_isn", + "tcp_destination_isn", "http_url", "http_host", "http_request_line", @@ -773,12 +744,12 @@ "default_columns": [ "recv_time", "subscriber_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "decoded_as", - "server_fqdn" + "destination_fqdn" ], "internal_columns": [ "recv_time", @@ -788,9 +759,7 @@ "encapsulation", "app_debug_info", "app_content", - "packet_capture_file", - "tunnel_endpoint_a_desc", - "tunnel_endpoint_b_desc" + "packet_capture_file" ], "sensitive_columns": [ "subscriber_id", @@ -1040,7 +1009,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_ip,''), if(bitAnd(flags, 16)=16, server_ip,''))" + "expression": "array(if(bitAnd(flags, 8)=8, source_ip,''), if(bitAnd(flags, 16)=16, destination_ip,''))" } }, { @@ -1055,7 +1024,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_ip,''), if(bitAnd(flags, 16)!=16, server_ip,''))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_ip,''), if(bitAnd(flags, 16)!=16, destination_ip,''))" } }, { @@ -1070,7 +1039,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_port, null), if(bitAnd(flags, 16)=16, server_port, null))" + "expression": "array(if(bitAnd(flags, 8)=8, source_port, null), if(bitAnd(flags, 16)=16, destination_port, null))" } }, { @@ -1085,7 +1054,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_port, null), if(bitAnd(flags, 16)!=16, server_port, null))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_port, null), if(bitAnd(flags, 16)!=16, destination_port, null))" } }, { @@ -1100,7 +1069,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_asn, null), if(bitAnd(flags, 16)=16, server_asn, null))" + "expression": "array(if(bitAnd(flags, 8)=8, source_asn, null), if(bitAnd(flags, 16)=16, destination_asn, null))" } }, { @@ -1115,7 +1084,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_asn, null), if(bitAnd(flags, 16)!=16, server_asn, null))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_asn, null), if(bitAnd(flags, 16)!=16, destination_asn, null))" } }, { @@ -1137,30 +1106,30 @@ } }, { - "name": "client_ip_tag", - "label": "Client IP Tag", + "name": "source_ip_tag", + "label": "Source IP Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(client_ip_tags), arrayPushFront(client_ip_tags, null),client_ip_tags))" + "expression": "arrayJoin(IF(empty(source_ip_tags), arrayPushFront(source_ip_tags, null),source_ip_tags))" } }, { - "name": "server_ip_tag", - "label": "Server IP Tag", + "name": "destination_ip_tag", + "label": "Destination IP Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(server_ip_tags), arrayPushFront(server_ip_tags, null),server_ip_tags))" + "expression": "arrayJoin(IF(empty(destination_ip_tags), arrayPushFront(destination_ip_tags, null),destination_ip_tags))" } }, { - "name": "server_fqdn_tag", - "label": "Server FQDN Tag", + "name": "destination_fqdn_tag", + "label": "Destination FQDN Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(server_fqdn_tags), arrayPushFront(server_fqdn_tags, null),server_fqdn_tags))" + "expression": "arrayJoin(IF(empty(destination_fqdn_tags), arrayPushFront(destination_fqdn_tags, null),destination_fqdn_tags))" } } ] @@ -1910,8 +1879,8 @@ "type": "string" }, { - "name": "proxy_server_side_latency_ms", - "label": "Proxy Server-Side Latency(ms)", + "name": "proxy_destination_side_latency_ms", + "label": "Proxy Destination-Side Latency(ms)", "doc": { "visibility": "hidden", "ttl": null @@ -1919,8 +1888,8 @@ "type": "int" }, { - "name": "proxy_client_side_latency_ms", - "label": "Proxy Client-Side Latency(ms)", + "name": "proxy_source_side_latency_ms", + "label": "Proxy Source-Side Latency(ms)", "doc": { "visibility": "hidden", "ttl": null @@ -1928,8 +1897,8 @@ "type": "int" }, { - "name": "proxy_client_side_version", - "label": "Proxy Client-Side Version", + "name": "proxy_source_side_version", + "label": "Proxy Source-Side Version", "doc": { "visibility": "hidden", "ttl": null @@ -1937,8 +1906,8 @@ "type": "string" }, { - "name": "proxy_server_side_version", - "label": "Proxy Server-Side Version", + "name": "proxy_destination_side_version", + "label": "Proxy Destination-Side Version", "doc": { "visibility": "hidden", "ttl": null @@ -1988,8 +1957,8 @@ } }, { - "name": "client_ip", - "label": "Client IP", + "name": "source_ip", + "label": "Source IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -2001,8 +1970,8 @@ "type": "string" }, { - "name": "client_ip_tags", - "label": "Client IP Tags", + "name": "source_ip_tags", + "label": "Source IP Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -2017,8 +1986,8 @@ } }, { - "name": "client_port", - "label": "Client Port", + "name": "source_port", + "label": "Source Port", "doc": { "constraints": { "type": "port", @@ -2030,26 +1999,17 @@ "type": "int" }, { - "name": "client_os_desc", + "name": "source_os_desc", "type": "string", "doc": { "visibility": "enabled", "ttl": null }, - "label": "Client OS Description" + "label": "Source OS Description" }, { - "name": "client_geolocation", - "label": "Client Geolocation(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_country", - "label": "Client Country", + "name": "source_country", + "label": "Source Country", "doc": { "constraints": { "type": "country" @@ -2060,41 +2020,8 @@ "type": "string" }, { - "name": "client_super_administrative_area", - "label": "Client Super Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "super_administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_administrative_area", - "label": "Client Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_sub_administrative_area", - "label": "Client SubAdministrative Area(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_asn", - "label": "Client ASN", + "name": "source_asn", + "label": "Source ASN", "doc": { "constraints": { "aggregation_functions": "COUNT, UNIQUE_COUNT, UNIQUE_ARRAY" @@ -2179,8 +2106,8 @@ "type": "string" }, { - "name": "server_ip", - "label": "Server IP", + "name": "destination_ip", + "label": "Destination IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -2192,8 +2119,8 @@ "type": "string" }, { - "name": "server_ip_tags", - "label": "Server IP Tags", + "name": "destination_ip_tags", + "label": "Destination IP Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -2208,8 +2135,8 @@ } }, { - "name": "server_port", - "label": "Server Port", + "name": "destination_port", + "label": "Destination Port", "doc": { "constraints": { "type": "port", @@ -2221,26 +2148,17 @@ "type": "int" }, { - "name": "server_os_desc", + "name": "destination_os_desc", "type": "string", "doc": { "visibility": "enabled", "ttl": null }, - "label": "Server OS Description" + "label": "Destination OS Description" }, { - "name": "server_geolocation", - "label": "Server Geolocation(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_country", - "label": "Server Country", + "name": "destination_country", + "label": "Destination Country", "doc": { "constraints": { "type": "country" @@ -2251,41 +2169,8 @@ "type": "string" }, { - "name": "server_super_administrative_area", - "label": "Server Super Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "super_administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_administrative_area", - "label": "Server Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_sub_administrative_area", - "label": "Server SubAdministrative Area(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_asn", - "label": "Server ASN", + "name": "destination_asn", + "label": "Destination ASN", "doc": { "constraints": { "aggregation_functions": "COUNT, UNIQUE_COUNT, UNIQUE_ARRAY" @@ -2296,8 +2181,8 @@ "type": "long" }, { - "name": "server_fqdn", - "label": "Server FQDN", + "name": "destination_fqdn", + "label": "Destination FQDN", "doc": { "constraints": { "type": "fqdn" @@ -2308,8 +2193,8 @@ "type": "string" }, { - "name": "server_fqdn_tags", - "label": "Server FQDN Tags", + "name": "destination_fqdn_tags", + "label": "Destination FQDN Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -2324,8 +2209,8 @@ } }, { - "name": "server_domain", - "label": "Server Domain", + "name": "destination_domain", + "label": "Destination Domain", "doc": { "constraints": { "type": "domain" @@ -2417,27 +2302,6 @@ "type": "string" }, { - "name": "fqdn_category_list", - "label": "FQDN Category List(Deprecated)", - "doc": { - "constraints": { - "operator_functions": "has,notEmpty,empty" - }, - "dict_location": { - "path": "/v1/policy/object?type=fqdn_category", - "key": "category_id", - "value": "category_name" - }, - "visibility": "enabled", - "ttl": null - }, - "type": { - "type": "array", - "items": "long", - "logicalType": "array" - } - }, - { "name": "sent_pkts", "label": "Packets Sent", "doc": { @@ -2619,8 +2483,8 @@ "type": "int" }, { - "name": "tcp_client_isn", - "label": "Client ISN", + "name": "tcp_source_isn", + "label": "Source ISN", "doc": { "visibility": "enabled", "ttl": null @@ -2628,8 +2492,8 @@ "type": "long" }, { - "name": "tcp_server_isn", - "label": "Server ISN", + "name": "tcp_destination_isn", + "label": "Destination ISN", "doc": { "visibility": "enabled", "ttl": null @@ -2736,24 +2600,6 @@ } }, { - "name": "tunnel_endpoint_a_desc", - "label": "Tunnel Endpoint A Description(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "tunnel_endpoint_b_desc", - "label": "Tunnel Endpoint B Description(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { "name": "http_url", "label": "HTTP.URL", "doc": { diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/session_record.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/session_record.json index 6e67783e..ad98d6ad 100644 --- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/session_record.json +++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/session_record.json @@ -63,16 +63,12 @@ "proxy_action", "proxy_rule_list", "proxy_rule_uuid_list", - "client_ip", - "client_ip_tags", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_ip_tags", + "source_port", + "source_os_desc", + "source_country", + "source_asn", "subscriber_id", "imei", "imsi", @@ -81,19 +77,15 @@ "packet_capture_file", "in_src_mac", "out_src_mac", - "server_ip", - "server_ip_tags", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_fqdn_tags", - "server_domain", + "destination_ip", + "destination_ip_tags", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_fqdn_tags", + "destination_domain", "in_dest_mac", "out_dest_mac", "app_transition", @@ -107,8 +99,6 @@ "dup_traffic_flag", "tunnel_id_list", "tunnel_uuid_list", - "tunnel_endpoint_a_desc", - "tunnel_endpoint_b_desc", "http_url", "http_host", "http_request_line", @@ -256,14 +246,10 @@ "log_id", "c2s_ttl", "s2c_ttl", - "client_ip", - "client_port", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_port", + "source_country", + "source_asn", "subscriber_id", "imei", "imsi", @@ -271,16 +257,12 @@ "phone_number", "in_src_mac", "out_src_mac", - "server_ip", - "server_port", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_domain", + "destination_ip", + "destination_port", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_domain", "in_dest_mac", "out_dest_mac", "app", @@ -400,16 +382,12 @@ "proxy_action", "monitor_mirrored_pkts", "monitor_mirrored_bytes", - "client_ip", - "client_ip_tags", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", + "source_ip", + "source_ip_tags", + "source_port", + "source_os_desc", + "source_country", + "source_asn", "subscriber_id", "imei", "imsi", @@ -417,19 +395,15 @@ "phone_number", "in_src_mac", "out_src_mac", - "server_ip", - "server_ip_tags", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", - "server_fqdn", - "server_fqdn_tags", - "server_domain", + "destination_ip", + "destination_ip_tags", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", + "destination_fqdn", + "destination_fqdn_tags", + "destination_domain", "in_dest_mac", "out_dest_mac", "app_transition", @@ -441,11 +415,8 @@ "dup_traffic_flag", "tunnel_id_list", "tunnel_uuid_list", - "tunnel_endpoint_a_desc", - "tunnel_endpoint_b_desc", "ip_protocol", "decoded_path", - "fqdn_category_list", "sent_pkts", "received_pkts", "sent_bytes", @@ -824,12 +795,12 @@ "default_columns": [ "recv_time", "subscriber_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "decoded_as", - "server_fqdn" + "destination_fqdn" ], "internal_columns": [ "recv_time", @@ -839,9 +810,7 @@ "encapsulation", "app_debug_info", "app_content", - "packet_capture_file", - "tunnel_endpoint_a_desc", - "tunnel_endpoint_b_desc" + "packet_capture_file" ], "sensitive_columns": [ "subscriber_id", @@ -1091,7 +1060,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_ip,''), if(bitAnd(flags, 16)=16, server_ip,''))" + "expression": "array(if(bitAnd(flags, 8)=8, source_ip,''), if(bitAnd(flags, 16)=16, destination_ip,''))" } }, { @@ -1106,7 +1075,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_ip,''), if(bitAnd(flags, 16)!=16, server_ip,''))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_ip,''), if(bitAnd(flags, 16)!=16, destination_ip,''))" } }, { @@ -1121,7 +1090,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_port, null), if(bitAnd(flags, 16)=16, server_port, null))" + "expression": "array(if(bitAnd(flags, 8)=8, source_port, null), if(bitAnd(flags, 16)=16, destination_port, null))" } }, { @@ -1136,7 +1105,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_port, null), if(bitAnd(flags, 16)!=16, server_port, null))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_port, null), if(bitAnd(flags, 16)!=16, destination_port, null))" } }, { @@ -1151,7 +1120,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)=8, client_asn, null), if(bitAnd(flags, 16)=16, server_asn, null))" + "expression": "array(if(bitAnd(flags, 8)=8, source_asn, null), if(bitAnd(flags, 16)=16, destination_asn, null))" } }, { @@ -1166,7 +1135,7 @@ "constraints": { "operator_functions": "has,notEmpty,empty" }, - "expression": "array(if(bitAnd(flags, 8)!=8, client_asn, null), if(bitAnd(flags, 16)!=16, server_asn, null))" + "expression": "array(if(bitAnd(flags, 8)!=8, source_asn, null), if(bitAnd(flags, 16)!=16, destination_asn, null))" } }, { @@ -1278,30 +1247,30 @@ } }, { - "name": "client_ip_tag", - "label": "Client IP Tag", + "name": "source_ip_tag", + "label": "Source IP Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(client_ip_tags), arrayPushFront(client_ip_tags, null),client_ip_tags))" + "expression": "arrayJoin(IF(empty(source_ip_tags), arrayPushFront(source_ip_tags, null),source_ip_tags))" } }, { - "name": "server_ip_tag", - "label": "Server IP Tag", + "name": "destination_ip_tag", + "label": "Destination IP Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(server_ip_tags), arrayPushFront(server_ip_tags, null),server_ip_tags))" + "expression": "arrayJoin(IF(empty(destination_ip_tags), arrayPushFront(destination_ip_tags, null),destination_ip_tags))" } }, { - "name": "server_fqdn_tag", - "label": "Server FQDN Tag", + "name": "destination_fqdn_tag", + "label": "Destination FQDN Tag", "type": "string", "doc": { "allow_query": false, - "expression": "arrayJoin(IF(empty(server_fqdn_tags), arrayPushFront(server_fqdn_tags, null),server_fqdn_tags))" + "expression": "arrayJoin(IF(empty(destination_fqdn_tags), arrayPushFront(destination_fqdn_tags, null),destination_fqdn_tags))" } } ] @@ -2051,8 +2020,8 @@ "type": "string" }, { - "name": "proxy_server_side_latency_ms", - "label": "Proxy Server-Side Latency(ms)", + "name": "proxy_destination_side_latency_ms", + "label": "Proxy Destination-Side Latency(ms)", "doc": { "visibility": "enabled", "ttl": null @@ -2060,8 +2029,8 @@ "type": "int" }, { - "name": "proxy_client_side_latency_ms", - "label": "Proxy Client-Side Latency(ms)", + "name": "proxy_source_side_latency_ms", + "label": "Proxy Source-Side Latency(ms)", "doc": { "visibility": "enabled", "ttl": null @@ -2069,8 +2038,8 @@ "type": "int" }, { - "name": "proxy_client_side_version", - "label": "Proxy Client-Side Version", + "name": "proxy_source_side_version", + "label": "Proxy Source-Side Version", "doc": { "visibility": "enabled", "ttl": null @@ -2078,8 +2047,8 @@ "type": "string" }, { - "name": "proxy_server_side_version", - "label": "Proxy Server-Side Version", + "name": "proxy_destination_side_version", + "label": "Proxy Destination-Side Version", "doc": { "visibility": "enabled", "ttl": null @@ -2129,8 +2098,8 @@ } }, { - "name": "client_ip", - "label": "Client IP", + "name": "source_ip", + "label": "Source IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -2142,8 +2111,8 @@ "type": "string" }, { - "name": "client_ip_tags", - "label": "Client IP Tags", + "name": "source_ip_tags", + "label": "Source IP Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -2158,8 +2127,8 @@ } }, { - "name": "client_port", - "label": "Client Port", + "name": "source_port", + "label": "Source Port", "doc": { "constraints": { "type": "port", @@ -2171,26 +2140,17 @@ "type": "int" }, { - "name": "client_os_desc", + "name": "source_os_desc", "type": "string", "doc": { "visibility": "enabled", "ttl": null }, - "label": "Client OS Description" + "label": "Source OS Description" }, { - "name": "client_geolocation", - "label": "Client Geolocation(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_country", - "label": "Client Country", + "name": "source_country", + "label": "Source Country", "doc": { "constraints": { "type": "country" @@ -2201,41 +2161,8 @@ "type": "string" }, { - "name": "client_super_administrative_area", - "label": "Client Super Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "super_administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_administrative_area", - "label": "Client Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_sub_administrative_area", - "label": "Client SubAdministrative Area(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_asn", - "label": "Client ASN", + "name": "source_asn", + "label": "Source ASN", "doc": { "constraints": { "aggregation_functions": "COUNT, UNIQUE_COUNT, UNIQUE_ARRAY" @@ -2320,8 +2247,8 @@ "type": "string" }, { - "name": "server_ip", - "label": "Server IP", + "name": "destination_ip", + "label": "Destination IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -2333,8 +2260,8 @@ "type": "string" }, { - "name": "server_ip_tags", - "label": "Server IP Tags", + "name": "destination_ip_tags", + "label": "Destination IP Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -2349,8 +2276,8 @@ } }, { - "name": "server_port", - "label": "Server Port", + "name": "destination_port", + "label": "Destination Port", "doc": { "constraints": { "type": "port", @@ -2362,26 +2289,17 @@ "type": "int" }, { - "name": "server_os_desc", + "name": "destination_os_desc", "type": "string", "doc": { "visibility": "enabled", "ttl": null }, - "label": "Server OS Description" + "label": "Destination OS Description" }, { - "name": "server_geolocation", - "label": "Server Geolocation(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_country", - "label": "Server Country", + "name": "destination_country", + "label": "Destination Country", "doc": { "constraints": { "type": "country" @@ -2392,41 +2310,8 @@ "type": "string" }, { - "name": "server_super_administrative_area", - "label": "Server Super Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "super_administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_administrative_area", - "label": "Server Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_sub_administrative_area", - "label": "Server SubAdministrative Area(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_asn", - "label": "Server ASN", + "name": "destination_asn", + "label": "Destination ASN", "doc": { "constraints": { "aggregation_functions": "COUNT, UNIQUE_COUNT, UNIQUE_ARRAY" @@ -2437,8 +2322,8 @@ "type": "long" }, { - "name": "server_fqdn", - "label": "Server FQDN", + "name": "destination_fqdn", + "label": "Destination FQDN", "doc": { "constraints": { "type": "fqdn" @@ -2449,8 +2334,8 @@ "type": "string" }, { - "name": "server_fqdn_tags", - "label": "Server FQDN Tags", + "name": "destination_fqdn_tags", + "label": "Destination FQDN Tags", "doc": { "constraints": { "operator_functions": "has,notEmpty,empty" @@ -2465,8 +2350,8 @@ } }, { - "name": "server_domain", - "label": "Server Domain", + "name": "destination_domain", + "label": "Destination Domain", "doc": { "constraints": { "type": "domain" @@ -2558,27 +2443,6 @@ "type": "string" }, { - "name": "fqdn_category_list", - "label": "FQDN Category List(Deprecated)", - "doc": { - "constraints": { - "operator_functions": "has,notEmpty,empty" - }, - "dict_location": { - "path": "/v1/policy/object?type=fqdn_category", - "key": "category_id", - "value": "category_name" - }, - "visibility": "enabled", - "ttl": null - }, - "type": { - "type": "array", - "items": "long", - "logicalType": "array" - } - }, - { "name": "sent_pkts", "label": "Packets Sent", "doc": { @@ -2760,8 +2624,8 @@ "type": "int" }, { - "name": "tcp_client_isn", - "label": "Client ISN", + "name": "tcp_source_isn", + "label": "Source ISN", "doc": { "visibility": "enabled", "ttl": null @@ -2769,8 +2633,8 @@ "type": "long" }, { - "name": "tcp_server_isn", - "label": "Server ISN", + "name": "tcp_destination_isn", + "label": "Destination ISN", "doc": { "visibility": "enabled", "ttl": null @@ -2877,24 +2741,6 @@ } }, { - "name": "tunnel_endpoint_a_desc", - "label": "Tunnel Endpoint A Description(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "tunnel_endpoint_b_desc", - "label": "Tunnel Endpoint B Description(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { "name": "http_url", "label": "HTTP.URL", "doc": { diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_sketch_metric.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_sketch_metric.json index 0d47ef7a..a573876f 100644 --- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_sketch_metric.json +++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_sketch_metric.json @@ -10,7 +10,7 @@ "direction", "ip_protocol", "app", - "client_ip", + "source_ip", "recv_time" ], "ttl": null, @@ -29,16 +29,16 @@ "data_center", "direction", "ip_protocol", - "client_ip", - "server_ip", + "source_ip", + "destination_ip", "internal_ip", "external_ip", - "client_country", - "server_country", - "client_asn", - "server_asn", - "server_fqdn", - "server_domain", + "source_country", + "destination_country", + "source_asn", + "destination_asn", + "destination_fqdn", + "destination_domain", "app", "app_category", "c2s_ttl", @@ -53,16 +53,16 @@ "data_center", "direction", "ip_protocol", - "client_ip", - "server_ip", + "source_ip", + "destination_ip", "internal_ip", "external_ip", - "client_country", - "server_country", - "client_asn", - "server_asn", - "server_fqdn", - "server_domain", + "source_country", + "destination_country", + "source_asn", + "destination_asn", + "destination_fqdn", + "destination_domain", "app", "app_category", "c2s_ttl", @@ -94,16 +94,16 @@ "data_center", "direction", "ip_protocol", - "client_ip", - "server_ip", + "source_ip", + "destination_ip", "internal_ip", "external_ip", - "client_country", - "server_country", - "client_asn", - "server_asn", - "server_fqdn", - "server_domain", + "source_country", + "destination_country", + "source_asn", + "destination_asn", + "destination_fqdn", + "destination_domain", "app", "app_category", "c2s_ttl", @@ -249,8 +249,8 @@ "type": "string" }, { - "name": "client_ip", - "label": "Client IP", + "name": "source_ip", + "label": "Source IP", "doc": { "constraints": { "type": "ip" @@ -261,8 +261,8 @@ "type": "string" }, { - "name": "server_ip", - "label": "Server IP", + "name": "destination_ip", + "label": "Destination IP", "doc": { "constraints": { "type": "ip" @@ -297,8 +297,8 @@ "type": "string" }, { - "name": "client_country", - "label": "Client Country", + "name": "source_country", + "label": "Source Country", "doc": { "constraints": { "type": "country" @@ -309,8 +309,8 @@ "type": "string" }, { - "name": "server_country", - "label": "Server Country", + "name": "destination_country", + "label": "Destination Country", "doc": { "constraints": { "type": "country" @@ -321,8 +321,8 @@ "type": "string" }, { - "name": "client_asn", - "label": "Client ASN", + "name": "source_asn", + "label": "Source ASN", "doc": { "constraints": { "aggregation_functions": "COUNT, UNIQUE_COUNT, UNIQUE_ARRAY" @@ -333,8 +333,8 @@ "type": "long" }, { - "name": "server_asn", - "label": "Server ASN", + "name": "destination_asn", + "label": "Destination ASN", "doc": { "constraints": { "aggregation_functions": "COUNT, UNIQUE_COUNT, UNIQUE_ARRAY" @@ -345,8 +345,8 @@ "type": "long" }, { - "name": "server_fqdn", - "label": "Server FQDN", + "name": "destination_fqdn", + "label": "Destination FQDN", "doc": { "constraints": { "type": "fqdn" @@ -357,8 +357,8 @@ "type": "string" }, { - "name": "server_domain", - "label": "Server Domain", + "name": "destination_domain", + "label": "Destination Domain", "doc": { "constraints": { "type": "domain" diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/transaction_record.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/transaction_record.json index 955dd5d6..c71c4f28 100644 --- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/transaction_record.json +++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/transaction_record.json @@ -28,10 +28,10 @@ "address_type", "decoded_as", "vsys_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "http_url", "http_host", "http_request_line", @@ -101,10 +101,10 @@ "address_type", "decoded_as", "vsys_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "sent_pkts", "received_pkts", "sent_bytes", @@ -186,10 +186,10 @@ "address_type", "decoded_as", "vsys_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "sent_pkts", "received_pkts", "sent_bytes", @@ -282,10 +282,10 @@ "insert_time", "address_type", "vsys_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "sent_pkts", "received_pkts", "sent_bytes", @@ -293,10 +293,10 @@ ], "default_columns": [ "recv_time", - "client_ip", - "client_port", - "server_ip", - "server_port" + "source_ip", + "source_port", + "destination_ip", + "destination_port" ] }, "DNS": { @@ -312,10 +312,10 @@ "insert_time", "address_type", "vsys_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "sent_pkts", "received_pkts", "sent_bytes", @@ -342,13 +342,13 @@ ], "default_columns": [ "recv_time", - "client_ip", - "client_port", + "source_ip", + "source_port", "dns_qr", "dns_qname", "dns_qtype", - "server_ip", - "server_port" + "destination_ip", + "destination_port" ] }, "HTTP": { @@ -364,10 +364,10 @@ "insert_time", "address_type", "vsys_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "sent_pkts", "received_pkts", "sent_bytes", @@ -396,11 +396,11 @@ ], "default_columns": [ "recv_time", - "client_ip", - "client_port", + "source_ip", + "source_port", "http_url", - "server_ip", - "server_port" + "destination_ip", + "destination_port" ] }, "MAIL": { @@ -416,10 +416,10 @@ "insert_time", "address_type", "vsys_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "sent_pkts", "received_pkts", "sent_bytes", @@ -442,13 +442,13 @@ ], "default_columns": [ "recv_time", - "client_ip", - "client_port", + "source_ip", + "source_port", "mail_from", "mail_to", "mail_subject", - "server_ip", - "server_port" + "destination_ip", + "destination_port" ] }, "SIP": { @@ -464,10 +464,10 @@ "insert_time", "address_type", "vsys_id", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "sent_pkts", "received_pkts", "sent_bytes", @@ -491,22 +491,22 @@ ], "default_columns": [ "recv_time", - "client_ip", - "client_port", + "source_ip", + "source_port", "sip_originator_description", "sip_responder_description", "sip_call_id", - "server_ip", - "server_port" + "destination_ip", + "destination_port" ] } }, "default_columns": [ "recv_time", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "decoded_as" ], "internal_columns": [ @@ -681,8 +681,8 @@ "default": 1 }, { - "name": "client_ip", - "label": "Client IP", + "name": "source_ip", + "label": "Source IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -694,8 +694,8 @@ "type": "string" }, { - "name": "client_port", - "label": "Client Port", + "name": "source_port", + "label": "Source Port", "doc": { "constraints": { "type": "port" @@ -706,8 +706,8 @@ "type": "int" }, { - "name": "server_ip", - "label": "Server IP", + "name": "destination_ip", + "label": "Destination IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -719,8 +719,8 @@ "type": "string" }, { - "name": "server_port", - "label": "Server Port", + "name": "destination_port", + "label": "Destination Port", "doc": { "constraints": { "type": "port" diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/voip_record.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/voip_record.json index a0c0a7f6..dee72e7b 100644 --- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/voip_record.json +++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/voip_record.json @@ -41,24 +41,16 @@ "vsys_id", "flags", "flags_identify_info", - "client_ip", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", - "server_ip", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", + "source_ip", + "source_port", + "source_os_desc", + "source_country", + "source_asn", + "destination_ip", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", "ip_protocol", "sip_call_id", "sip_originator_description", @@ -82,22 +74,14 @@ "metrics": [ "log_uuid", "log_id", - "client_ip", - "client_port", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", - "server_ip", - "server_port", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", + "source_ip", + "source_port", + "source_country", + "source_asn", + "destination_ip", + "destination_port", + "destination_country", + "destination_asn", "sent_pkts", "received_pkts", "sent_bytes", @@ -131,24 +115,16 @@ "vsys_id", "flags", "flags_identify_info", - "client_ip", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", - "server_ip", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", + "source_ip", + "source_port", + "source_os_desc", + "source_country", + "source_asn", + "destination_ip", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", "ip_protocol", "sent_pkts", "received_pkts", @@ -207,26 +183,18 @@ "flags_identify_info" ], "source": [ - "client_ip", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn" + "source_ip", + "source_port", + "source_os_desc", + "source_country", + "source_asn" ], "destination": [ - "server_ip", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn" + "destination_ip", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn" ], "protocol": [ "ip_protocol", @@ -288,24 +256,16 @@ "t_vsys_id", "flags", "flags_identify_info", - "client_ip", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", - "server_ip", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", + "source_ip", + "source_port", + "source_os_desc", + "source_country", + "source_asn", + "destination_ip", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", "ip_protocol", "sent_pkts", "received_pkts", @@ -330,13 +290,13 @@ ], "default_columns": [ "recv_time", - "client_ip", - "client_port", + "source_ip", + "source_port", "sip_originator_description", "sip_responder_description", "sip_call_id", - "server_ip", - "server_port" + "destination_ip", + "destination_port" ] }, "RTP": { @@ -367,24 +327,16 @@ "t_vsys_id", "flags", "flags_identify_info", - "client_ip", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", - "server_ip", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", + "source_ip", + "source_port", + "source_os_desc", + "source_country", + "source_asn", + "destination_ip", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", "ip_protocol", "sent_pkts", "received_pkts", @@ -397,10 +349,10 @@ ], "default_columns": [ "recv_time", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "rtp_pcap_path", "rtp_originator_dir" ] @@ -433,24 +385,16 @@ "t_vsys_id", "flags", "flags_identify_info", - "client_ip", - "client_port", - "client_os_desc", - "client_geolocation", - "client_country", - "client_super_administrative_area", - "client_administrative_area", - "client_sub_administrative_area", - "client_asn", - "server_ip", - "server_port", - "server_os_desc", - "server_geolocation", - "server_country", - "server_super_administrative_area", - "server_administrative_area", - "server_sub_administrative_area", - "server_asn", + "source_ip", + "source_port", + "source_os_desc", + "source_country", + "source_asn", + "destination_ip", + "destination_port", + "destination_os_desc", + "destination_country", + "destination_asn", "ip_protocol", "sent_pkts", "received_pkts", @@ -479,10 +423,10 @@ ], "default_columns": [ "recv_time", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "sip_originator_description", "sip_responder_description", "sip_call_id", @@ -493,10 +437,10 @@ }, "default_columns": [ "recv_time", - "client_ip", - "client_port", - "server_ip", - "server_port", + "source_ip", + "source_port", + "destination_ip", + "destination_port", "decoded_as" ], "internal_columns": [ @@ -970,8 +914,8 @@ "type": "string" }, { - "name": "client_ip", - "label": "Client IP", + "name": "source_ip", + "label": "Source IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -983,8 +927,8 @@ "type": "string" }, { - "name": "client_port", - "label": "Client Port", + "name": "source_port", + "label": "Source Port", "doc": { "visibility": "enabled", "constraints": { @@ -996,26 +940,17 @@ "type": "int" }, { - "name": "client_os_desc", + "name": "source_os_desc", "type": "string", "doc": { "visibility": "enabled", "ttl": null }, - "label": "Client OS Description" + "label": "Source OS Description" }, { - "name": "client_geolocation", - "label": "Client Geolocation(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_country", - "label": "Client Country", + "name": "source_country", + "label": "Source Country", "doc": { "constraints": { "type": "country" @@ -1026,41 +961,8 @@ "type": "string" }, { - "name": "client_super_administrative_area", - "label": "Client Super Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "super_administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_administrative_area", - "label": "Client Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_sub_administrative_area", - "label": "Client SubAdministrative Area(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "client_asn", - "label": "Client ASN", + "name": "source_asn", + "label": "Source ASN", "doc": { "visibility": "enabled", "constraints": { @@ -1071,8 +973,8 @@ "type": "long" }, { - "name": "server_ip", - "label": "Server IP", + "name": "destination_ip", + "label": "Destination IP", "doc": { "constraints": { "operator_functions": "=,!=,in,not in,like,not like,notEmpty,empty,isIPAddressInRange", @@ -1084,8 +986,8 @@ "type": "string" }, { - "name": "server_port", - "label": "Server Port", + "name": "destination_port", + "label": "Destination Port", "doc": { "visibility": "enabled", "constraints": { @@ -1097,26 +999,17 @@ "type": "int" }, { - "name": "server_os_desc", + "name": "destination_os_desc", "type": "string", "doc": { "visibility": "enabled", "ttl": null }, - "label": "Server OS Description" + "label": "Destination OS Description" }, { - "name": "server_geolocation", - "label": "Server Geolocation(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_country", - "label": "Server Country", + "name": "destination_country", + "label": "Destination Country", "doc": { "constraints": { "type": "country" @@ -1127,41 +1020,8 @@ "type": "string" }, { - "name": "server_super_administrative_area", - "label": "Server Super Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "super_administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_administrative_area", - "label": "Server Administrative Area(Deprecated)", - "doc": { - "constraints": { - "type": "administrative_area" - }, - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_sub_administrative_area", - "label": "Server SubAdministrative Area(Deprecated)", - "doc": { - "visibility": "enabled", - "ttl": null - }, - "type": "string" - }, - { - "name": "server_asn", - "label": "Server ASN", + "name": "destination_asn", + "label": "Destination ASN", "doc": { "visibility": "enabled", "constraints": { diff --git a/src/main/java/com/mesalab/qgw/constant/dsl/TrafficSpectrumConstants.java b/src/main/java/com/mesalab/qgw/constant/dsl/TrafficSpectrumConstants.java index fe19d138..ccfa6a4a 100644 --- a/src/main/java/com/mesalab/qgw/constant/dsl/TrafficSpectrumConstants.java +++ b/src/main/java/com/mesalab/qgw/constant/dsl/TrafficSpectrumConstants.java @@ -20,12 +20,12 @@ public class TrafficSpectrumConstants { public static final String ASYMMETRIC_FLOWS_PERCENT = "asymmetric_flows_percent"; public static final String FRAGMENTATION_PACKETS = "fragmentation_packets"; public static final String FRAGMENTATION_PERCENT = "fragmentation_percent"; - public static final String INTERNAL_UNIQ_CLIENT_IP = "internal_uniq_client_ip"; - public static final String INTERNAL_UNIQ_SERVER_IP = "internal_uniq_server_ip"; - public static final String EXTERNAL_UNIQ_CLIENT_IP = "external_uniq_client_ip"; - public static final String EXTERNAL_UNIQ_SERVER_IP = "external_uniq_server_ip"; - public static final String TOP_SERVER_IPS = "top_server_ips"; - public static final String TOP_SERVER_DOMAINS = "top_server_domains"; + public static final String INTERNAL_UNIQ_SOURCE_IP = "internal_uniq_source_ip"; + public static final String INTERNAL_UNIQ_DESTINATION_IP = "internal_uniq_destination_ip"; + public static final String EXTERNAL_UNIQ_SOURCE_IP = "external_uniq_source_ip"; + public static final String EXTERNAL_UNIQ_DESTINATION_IP = "external_uniq_destination_ip"; + public static final String TOP_DESTINATION_IPS = "top_destination_ips"; + public static final String TOP_DESTINATION_DOMAINS = "top_destination_domains"; public static final String MAX_RATE = "max_rate"; public static final String AVG_RATE = "avg_rate"; public static final String INTERNAL_NODE = "internal_node"; diff --git a/src/main/java/com/mesalab/qgw/service/impl/QueryJobServiceImpl.java b/src/main/java/com/mesalab/qgw/service/impl/QueryJobServiceImpl.java index 82aac717..1f68ea2a 100644 --- a/src/main/java/com/mesalab/qgw/service/impl/QueryJobServiceImpl.java +++ b/src/main/java/com/mesalab/qgw/service/impl/QueryJobServiceImpl.java @@ -171,10 +171,10 @@ public class QueryJobServiceImpl implements QueryJobService, EnvironmentAware { } else if (JobConfig.DATAPATH_PACKET_COMBINE.equals(request.getName())) { return jobExecuteService.addDslExecutorPacketCombineWithoutCache(request); } else if (JobConfig.TRAFFIC_SPECTRUM_SUMMARY.equals(request.getName()) - || JobConfig.TRAFFIC_SPECTRUM_UNIQUE_CLIENT_AND_SERVER_IPS.equals(request.getName()) + || JobConfig.TRAFFIC_SPECTRUM_UNIQUE_SOURCE_AND_DESTINATION_IPS.equals(request.getName()) || JobConfig.TRAFFIC_SPECTRUM_APP_DISTRIBUTION.equals(request.getName()) || JobConfig.TRAFFIC_SPECTRUM_NETWORK_THROUGHPUT_TREND.equals(request.getName()) - || JobConfig.TRAFFIC_SPECTRUM_CLIENT_IP_CONNECT_APPLICATION_USAGE.equals(request.getName())) { + || JobConfig.TRAFFIC_SPECTRUM_SOURCE_IP_CONNECT_APPLICATION_USAGE.equals(request.getName())) { QueryCache queryCache = new QueryCache(request.getId(), request.getName()); HazelcastInstanceMapUtil.put(request.getId(), queryCache); CountDownLatch countDownLatch = new CountDownLatch(1); @@ -223,10 +223,10 @@ public class QueryJobServiceImpl implements QueryJobService, EnvironmentAware { HazelcastInstanceMapUtil.put(request.getId(), queryCache); jobExecuteService.addExecutorDslPacketCombineWithCache(request, null); } else if (JobConfig.TRAFFIC_SPECTRUM_SUMMARY.equals(request.getName()) - || JobConfig.TRAFFIC_SPECTRUM_UNIQUE_CLIENT_AND_SERVER_IPS.equals(request.getName()) + || JobConfig.TRAFFIC_SPECTRUM_UNIQUE_SOURCE_AND_DESTINATION_IPS.equals(request.getName()) || JobConfig.TRAFFIC_SPECTRUM_APP_DISTRIBUTION.equals(request.getName()) || JobConfig.TRAFFIC_SPECTRUM_NETWORK_THROUGHPUT_TREND.equals(request.getName()) - || JobConfig.TRAFFIC_SPECTRUM_CLIENT_IP_CONNECT_APPLICATION_USAGE.equals(request.getName())) { + || JobConfig.TRAFFIC_SPECTRUM_SOURCE_IP_CONNECT_APPLICATION_USAGE.equals(request.getName())) { queryCache.setType(request.getName()); HazelcastInstanceMapUtil.put(request.getId(), queryCache); jobExecuteService.addDslExecutorTrafficSpectrumWithCache(request, null); @@ -285,10 +285,10 @@ public class QueryJobServiceImpl implements QueryJobService, EnvironmentAware { handleInterruptedExceptionAndThrowQGWBusinessException(e); } } else if (JobConfig.TRAFFIC_SPECTRUM_SUMMARY.equals(request.getName()) - || JobConfig.TRAFFIC_SPECTRUM_UNIQUE_CLIENT_AND_SERVER_IPS.equals(request.getName()) + || JobConfig.TRAFFIC_SPECTRUM_UNIQUE_SOURCE_AND_DESTINATION_IPS.equals(request.getName()) || JobConfig.TRAFFIC_SPECTRUM_APP_DISTRIBUTION.equals(request.getName()) || JobConfig.TRAFFIC_SPECTRUM_NETWORK_THROUGHPUT_TREND.equals(request.getName()) - || JobConfig.TRAFFIC_SPECTRUM_CLIENT_IP_CONNECT_APPLICATION_USAGE.equals(request.getName())) { + || JobConfig.TRAFFIC_SPECTRUM_SOURCE_IP_CONNECT_APPLICATION_USAGE.equals(request.getName())) { QueryCache queryCache = new QueryCache(request.getId(), request.getName()); HazelcastInstanceMapUtil.put(request.getId(), queryCache); CountDownLatch countDownLatch = new CountDownLatch(1); @@ -370,7 +370,7 @@ public class QueryJobServiceImpl implements QueryJobService, EnvironmentAware { queryCache = rebuildFieldDiscoveryQueryCache(queryCache); } else if (JobConfig.FIELD_DISCOVERY.equals(queryCache.getType())) { queryCache = rebuildFieldDiscoveryQueryCache(queryCache); - } else if (JobConfig.TRAFFIC_SPECTRUM_CLIENT_IP_CONNECT_APPLICATION_USAGE.equals(queryCache.getType())) { + } else if (JobConfig.TRAFFIC_SPECTRUM_SOURCE_IP_CONNECT_APPLICATION_USAGE.equals(queryCache.getType())) { queryCache = rebuildTrafficSpectrumCIPConnectAppUsageQueryCache(queryCache); } else if (JobConfig.SLICING_OPTIMIZATION.equals(queryCache.getType())) { queryCache = rebuildSlicingQueryCache(queryCache); diff --git a/src/main/java/com/mesalab/qgw/service/impl/TrafficSpectrumDslServiceImpl.java b/src/main/java/com/mesalab/qgw/service/impl/TrafficSpectrumDslServiceImpl.java index a615a2a4..2c0c5f08 100644 --- a/src/main/java/com/mesalab/qgw/service/impl/TrafficSpectrumDslServiceImpl.java +++ b/src/main/java/com/mesalab/qgw/service/impl/TrafficSpectrumDslServiceImpl.java @@ -27,7 +27,6 @@ import com.mesalab.qgw.service.SQLSyncQueryService; import com.mesalab.qgw.service.TrafficSpectrumDslService; import com.mesalab.services.common.property.SqlPropertySourceFactory; import com.mesalab.services.configuration.JobConfig; -import org.checkerframework.checker.nullness.qual.Nullable; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.PropertySource; import org.springframework.core.env.Environment; @@ -67,11 +66,11 @@ public class TrafficSpectrumDslServiceImpl implements TrafficSpectrumDslService public BaseResult run(DSLQueryRequestParam dslQueryRequestParam) { if (JobConfig.TRAFFIC_SPECTRUM_SUMMARY.equals(dslQueryRequestParam.getName())) { return BaseResultGenerator.success(summary(dslQueryRequestParam)); - } else if (JobConfig.TRAFFIC_SPECTRUM_UNIQUE_CLIENT_AND_SERVER_IPS.equals(dslQueryRequestParam.getName())) { + } else if (JobConfig.TRAFFIC_SPECTRUM_UNIQUE_SOURCE_AND_DESTINATION_IPS.equals(dslQueryRequestParam.getName())) { return BaseResultGenerator.success(uniqIpsStat(dslQueryRequestParam)); } else if (JobConfig.TRAFFIC_SPECTRUM_APP_DISTRIBUTION.equals(dslQueryRequestParam.getName())) { return BaseResultGenerator.success(topServerIpAndServerDomain(dslQueryRequestParam)); - } else if (JobConfig.TRAFFIC_SPECTRUM_CLIENT_IP_CONNECT_APPLICATION_USAGE.equals(dslQueryRequestParam.getName())) { + } else if (JobConfig.TRAFFIC_SPECTRUM_SOURCE_IP_CONNECT_APPLICATION_USAGE.equals(dslQueryRequestParam.getName())) { return BaseResultGenerator.success(internalExternalDimensionMetricsStat(dslQueryRequestParam)); } else if (JobConfig.TRAFFIC_SPECTRUM_NETWORK_THROUGHPUT_TREND.equals(dslQueryRequestParam.getName())) { return BaseResultGenerator.success(networkThroughputTrend(dslQueryRequestParam)); @@ -136,15 +135,15 @@ public class TrafficSpectrumDslServiceImpl implements TrafficSpectrumDslService .build()); if (baseResult.isSuccess()) { baseResult.getData().forEach(map -> { - long internalUniqClientIp = Long.parseLong(String.valueOf(map.get("internal_uniq_client_ip") == null ? 0 : map.get("internal_uniq_client_ip"))); - long internalUniqServerIp = Long.parseLong(String.valueOf(map.get("internal_uniq_server_ip") == null ? 0 : map.get("internal_uniq_server_ip"))); - long externalUniqClientIp = Long.parseLong(String.valueOf(map.get("external_uniq_client_ip") == null ? 0 : map.get("external_uniq_client_ip"))); - long externalUniqServerIp = Long.parseLong(String.valueOf(map.get("external_uniq_server_ip") == null ? 0 : map.get("external_uniq_server_ip"))); + long internalUniqClientIp = Long.parseLong(String.valueOf(map.get("internal_uniq_source_ip") == null ? 0 : map.get("internal_uniq_source_ip"))); + long internalUniqServerIp = Long.parseLong(String.valueOf(map.get("internal_uniq_destination_ip") == null ? 0 : map.get("internal_uniq_destination_ip"))); + long externalUniqClientIp = Long.parseLong(String.valueOf(map.get("external_uniq_source_ip") == null ? 0 : map.get("external_uniq_source_ip"))); + long externalUniqServerIp = Long.parseLong(String.valueOf(map.get("external_uniq_destination_ip") == null ? 0 : map.get("external_uniq_destination_ip"))); HashMap<String, Object> item = Maps.newLinkedHashMap(); - item.put(TrafficSpectrumConstants.INTERNAL_UNIQ_CLIENT_IP, internalUniqClientIp); - item.put(TrafficSpectrumConstants.INTERNAL_UNIQ_SERVER_IP, internalUniqServerIp); - item.put(TrafficSpectrumConstants.EXTERNAL_UNIQ_CLIENT_IP, externalUniqClientIp); - item.put(TrafficSpectrumConstants.EXTERNAL_UNIQ_SERVER_IP, externalUniqServerIp); + item.put(TrafficSpectrumConstants.INTERNAL_UNIQ_SOURCE_IP, internalUniqClientIp); + item.put(TrafficSpectrumConstants.INTERNAL_UNIQ_DESTINATION_IP, internalUniqServerIp); + item.put(TrafficSpectrumConstants.EXTERNAL_UNIQ_SOURCE_IP, externalUniqClientIp); + item.put(TrafficSpectrumConstants.EXTERNAL_UNIQ_DESTINATION_IP, externalUniqServerIp); map.clear(); map.putAll(item); }); @@ -186,8 +185,8 @@ public class TrafficSpectrumDslServiceImpl implements TrafficSpectrumDslService return Lists.newArrayList(); } Map<String, Object> map = Maps.newHashMap(); - map.put(TrafficSpectrumConstants.TOP_SERVER_IPS, baseResultIp.getData()); - map.put(TrafficSpectrumConstants.TOP_SERVER_DOMAINS, baseResultDomain.getData()); + map.put(TrafficSpectrumConstants.TOP_DESTINATION_IPS, baseResultIp.getData()); + map.put(TrafficSpectrumConstants.TOP_DESTINATION_DOMAINS, baseResultDomain.getData()); return Lists.newArrayList(map); } throw new QGWBusinessException(HttpStatusCodeEnum.SERVER_ERROR.getCode(), CommonErrorCode.UNKNOWN_EXCEPTION.getCode(), @@ -228,9 +227,9 @@ public class TrafficSpectrumDslServiceImpl implements TrafficSpectrumDslService long packets = Long.parseLong(String.valueOf(x.get("packets") == null ? 0 : x.get("packets"))); long maxRate = Long.parseLong(String.valueOf(x.get("max_rate") == null ? 0 : x.get("max_rate"))); long avgRate = Long.parseLong(String.valueOf(x.get("avg_rate") == null ? 0 : x.get("avg_rate"))); - String clientIp = String.valueOf(x.get("client_ip")); + String sourceIp = String.valueOf(x.get("source_ip")); String app = String.valueOf(x.get("app")); - String clientCountry = String.valueOf(x.get("client_country")); + String sourceCountry = String.valueOf(x.get("source_country")); String appCategory = String.valueOf(x.get("app_category")); Map<String, Object> internalNode = Maps.newHashMap(); @@ -238,11 +237,11 @@ public class TrafficSpectrumDslServiceImpl implements TrafficSpectrumDslService String uuidInternal; String uuidExternal; if (TrafficSpectrumConstants.OUTBOUND.equalsIgnoreCase(direction)) { - uuidInternal = UUID.nameUUIDFromBytes(StrUtil.concat(false, TrafficSpectrumConstants.INTERNAL_NODE, String.valueOf(clientIp), String.valueOf(clientCountry), TrafficSpectrumConstants.OBJECT_TYPE_IP).getBytes()).toString(); + uuidInternal = UUID.nameUUIDFromBytes(StrUtil.concat(false, TrafficSpectrumConstants.INTERNAL_NODE, String.valueOf(sourceIp), String.valueOf(sourceCountry), TrafficSpectrumConstants.OBJECT_TYPE_IP).getBytes()).toString(); internalNode.put(TrafficSpectrumConstants.ID, uuidInternal); internalNode.put(TrafficSpectrumConstants.OBJECT_TYPE, TrafficSpectrumConstants.OBJECT_TYPE_IP); - internalNode.put(TrafficSpectrumConstants.NAME, clientIp); - internalNode.put(TrafficSpectrumConstants.CATEGORY, getIpCategory(clientIp, clientCountry)); + internalNode.put(TrafficSpectrumConstants.NAME, sourceIp); + internalNode.put(TrafficSpectrumConstants.CATEGORY, getIpCategory(sourceIp, sourceCountry)); internalNodes.put(uuidInternal, internalNode); uuidExternal = UUID.nameUUIDFromBytes(StrUtil.concat(false, TrafficSpectrumConstants.EXTERNAL_NODE, String.valueOf(app), String.valueOf(appCategory), TrafficSpectrumConstants.OBJECT_TYPE_APPLICATION).getBytes()).toString(); @@ -253,11 +252,11 @@ public class TrafficSpectrumDslServiceImpl implements TrafficSpectrumDslService externalNodes.put(uuidExternal, externalNode); } else if (TrafficSpectrumConstants.INBOUND.equalsIgnoreCase(direction)) { - uuidExternal = UUID.nameUUIDFromBytes(StrUtil.concat(false, TrafficSpectrumConstants.EXTERNAL_NODE, String.valueOf(clientIp), String.valueOf(clientCountry), TrafficSpectrumConstants.OBJECT_TYPE_IP).getBytes()).toString(); + uuidExternal = UUID.nameUUIDFromBytes(StrUtil.concat(false, TrafficSpectrumConstants.EXTERNAL_NODE, String.valueOf(sourceIp), String.valueOf(sourceCountry), TrafficSpectrumConstants.OBJECT_TYPE_IP).getBytes()).toString(); externalNode.put(TrafficSpectrumConstants.ID, uuidExternal); externalNode.put(TrafficSpectrumConstants.OBJECT_TYPE, TrafficSpectrumConstants.OBJECT_TYPE_IP); - externalNode.put(TrafficSpectrumConstants.NAME, clientIp); - externalNode.put(TrafficSpectrumConstants.CATEGORY, getIpCategory(clientIp, clientCountry)); + externalNode.put(TrafficSpectrumConstants.NAME, sourceIp); + externalNode.put(TrafficSpectrumConstants.CATEGORY, getIpCategory(sourceIp, sourceCountry)); externalNodes.put(uuidExternal, externalNode); uuidInternal = UUID.nameUUIDFromBytes(StrUtil.concat(false, TrafficSpectrumConstants.INTERNAL_NODE, String.valueOf(app), String.valueOf(appCategory), TrafficSpectrumConstants.OBJECT_TYPE_APPLICATION).getBytes()).toString(); diff --git a/src/main/java/com/mesalab/services/configuration/JobConfig.java b/src/main/java/com/mesalab/services/configuration/JobConfig.java index 4784c15d..2b5b2ef3 100644 --- a/src/main/java/com/mesalab/services/configuration/JobConfig.java +++ b/src/main/java/com/mesalab/services/configuration/JobConfig.java @@ -60,9 +60,9 @@ public class JobConfig { public static final String LOG_QUERY = "log-query"; public static final String DATAPATH_PACKET_COMBINE = "datapath_telemetry_packet_combine"; public static final String TRAFFIC_SPECTRUM_SUMMARY = "traffic-spectrum-summary"; - public static final String TRAFFIC_SPECTRUM_UNIQUE_CLIENT_AND_SERVER_IPS = "traffic-spectrum-unique-client-and-server-ips"; + public static final String TRAFFIC_SPECTRUM_UNIQUE_SOURCE_AND_DESTINATION_IPS = "traffic-spectrum-unique-source-and-destination-ips"; public static final String TRAFFIC_SPECTRUM_APP_DISTRIBUTION = "traffic-spectrum-app-distribution"; - public static final String TRAFFIC_SPECTRUM_CLIENT_IP_CONNECT_APPLICATION_USAGE = "traffic-spectrum-client-ip-connect-application-usage"; + public static final String TRAFFIC_SPECTRUM_SOURCE_IP_CONNECT_APPLICATION_USAGE = "traffic-spectrum-source-ip-connect-application-usage"; public static final String SLICING_OPTIMIZATION = "slicing-optimization"; public static final String TRAFFIC_SPECTRUM_NETWORK_THROUGHPUT_TREND = "traffic-spectrum-network-throughput-trend"; public static final String CUSTOMIZED_STATISTICS = "customized-statistics"; diff --git a/src/main/resources/dsl-sql-template.sql b/src/main/resources/dsl-sql-template.sql index 3fd1b5f8..fcb1198d 100644 --- a/src/main/resources/dsl-sql-template.sql +++ b/src/main/resources/dsl-sql-template.sql @@ -20,7 +20,7 @@ SELECT FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time), '$granularity' SELECT app_name as app_name, SUM(bytes) as bytes, SUM(sessions) as sessions, MAX(bit_rate) as max_rate, SUM(bytes) * 8/$interval_seconds as avg_rate FROM (SELECT app_name as app_name, SUM(sessions) as sessions, SUM(c2s_bytes + s2c_bytes) as bytes, SUM(c2s_bytes + s2c_bytes) * 8 / $granularity_seconds as bit_rate FROM $table WHERE $intervals_and_filter AND notEmpty(app_name) GROUP BY app_name, TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time), '$granularity') ORDER BY bytes DESC ) GROUP BY app_name ORDER BY bytes DESC $limit #end #sql("APPLICATION_AND_PROTOCOL_APP_RELATED_INTERNAL_IPS") -SELECT if(bitAnd(flags, 8) = 8, client_ip, server_ip) AS ip, SUM(sent_bytes + received_bytes) AS bytes FROM $table WHERE $intervals_and_filter GROUP BY ip ORDER BY bytes DESC $limit +SELECT if(bitAnd(flags, 8) = 8, source_ip, destination_ip) AS ip, SUM(sent_bytes + received_bytes) AS bytes FROM $table WHERE $intervals_and_filter GROUP BY ip ORDER BY bytes DESC $limit #end #sql("APPLICATION_AND_PROTOCOL_APP_THROUGHPUT") SELECT FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'$granularity','zero')) AS stat_time, app_name, SUM(c2s_bytes + s2c_bytes) AS bytes, SUM(c2s_bytes + s2c_bytes) * 8 / $granularity_seconds AS bit_rate FROM $table WHERE $intervals_and_filter GROUP BY FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'$granularity','zero')), app_name ORDER BY stat_time ASC @@ -35,16 +35,16 @@ SELECT * FROM $table WHERE $intervals_and_filter ORDER BY timestamp_us ASC SELECT direction, SUM(bytes) AS total_bytes, SUM(sessions) AS total_sessions, SUM(pkts) AS total_packets, SUM(IF(app = 'unknown', bytes, 0)) AS unknown_app_bytes, SUM(asymmetric_c2s_flows + asymmetric_s2c_flows) AS asymmetric_flows, SUM(c2s_fragments + s2c_fragments) AS fragmentation_packets FROM $table WHERE $intervals_and_filter GROUP BY direction #end #sql("TRAFFIC_SPECTRUM_UNIQ_IP") -SELECT COUNT(DISTINCT(IF(direction = 'Outbound', client_ip, NULL))) AS internal_uniq_client_ip, COUNT(DISTINCT(IF(direction = 'Outbound', server_ip, NULL))) AS external_uniq_server_ip, COUNT(DISTINCT(IF(direction = 'Inbound', server_ip, NULL))) AS internal_uniq_server_ip, COUNT(DISTINCT(IF(direction = 'Inbound', client_ip, NULL))) AS external_uniq_client_ip FROM $table WHERE $intervals_and_filter +SELECT COUNT(DISTINCT(IF(direction = 'Outbound', source_ip, NULL))) AS internal_uniq_source_ip, COUNT(DISTINCT(IF(direction = 'Outbound', destination_ip, NULL))) AS external_uniq_destination_ip, COUNT(DISTINCT(IF(direction = 'Inbound', destination_ip, NULL))) AS internal_uniq_destination_ip, COUNT(DISTINCT(IF(direction = 'Inbound', source_ip, NULL))) AS external_uniq_source_ip FROM $table WHERE $intervals_and_filter #end #sql("TRAFFIC_SPECTRUM_APP_DISTRIBUTION_SERVER_IP") -SELECT server_ip as value, SUM(bytes) as bytes, SUM(sessions) as sessions, SUM(pkts) as packets FROM $table WHERE $intervals_and_filter GROUP BY server_ip ORDER BY bytes DESC $limit +SELECT destination_ip as value, SUM(bytes) as bytes, SUM(sessions) as sessions, SUM(pkts) as packets FROM $table WHERE $intervals_and_filter GROUP BY destination_ip ORDER BY bytes DESC $limit #end #sql("TRAFFIC_SPECTRUM_APP_DISTRIBUTION_SERVER_DOMAIN") -SELECT server_domain as value, SUM(bytes) as bytes, SUM(sessions) as sessions, SUM(pkts) as packets FROM $table WHERE $intervals_and_filter AND notEmpty(server_domain) GROUP BY server_domain ORDER BY bytes DESC $limit +SELECT destination_domain as value, SUM(bytes) as bytes, SUM(sessions) as sessions, SUM(pkts) as packets FROM $table WHERE $intervals_and_filter AND notEmpty(destination_domain) GROUP BY destination_domain ORDER BY bytes DESC $limit #end #sql("TRAFFIC_SPECTRUM_CLIENT_IP_CONNECT_APPLICATION_USAGE") -SELECT direction, SUM(temp_sessions) AS sessions, SUM(temp_bytes) AS bytes, SUM(temp_packets) AS packets, MAX(temp_rate) AS max_rate, ROUND(SUM(temp_bytes) * 8 /$interval_seconds) AS avg_rate, client_ip AS client_ip, client_country AS client_country, app AS app, app_category AS app_category FROM( SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(recv_time), INTERVAL $granularity_seconds SECOND))) AS stat_time, IF(client_ip IN ( SELECT client_ip FROM $table WHERE $intervals_and_filter AND notEmpty(app) GROUP BY client_ip,app ORDER BY SUM(bytes) DESC $limit), client_ip, 'Other') AS client_ip, IF(client_country IN ( SELECT anyLast(client_country) FROM $table WHERE $intervals_and_filter AND notEmpty(app) GROUP BY client_ip,app ORDER BY SUM(bytes) DESC $limit), client_country, 'Other') AS client_country, IF(app IN ( SELECT app FROM $table WHERE $intervals_and_filter AND notEmpty(app) GROUP BY client_ip,app ORDER BY SUM(bytes) DESC $limit), app, 'Other') AS app, IF(app_category IN ( SELECT anyLast(app_category) FROM $table WHERE $intervals_and_filter AND notEmpty(app) GROUP BY client_ip,app ORDER BY SUM(bytes) DESC $limit), app_category, 'Other') AS app_category, direction, SUM(sessions) AS temp_sessions, SUM(bytes) AS temp_bytes, SUM(pkts) AS temp_packets, ROUND(SUM(bytes) * 8 / $granularity_seconds) AS temp_rate FROM $table WHERE $intervals_and_filter GROUP BY stat_time, client_ip, client_country, app, app_category, direction) GROUP BY client_ip, client_country, app, app_category, direction ORDER BY bytes DESC +SELECT direction, SUM(temp_sessions) AS sessions, SUM(temp_bytes) AS bytes, SUM(temp_packets) AS packets, MAX(temp_rate) AS max_rate, ROUND(SUM(temp_bytes) * 8 /$interval_seconds) AS avg_rate, source_ip AS source_ip, source_country AS source_country, app AS app, app_category AS app_category FROM( SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(recv_time), INTERVAL $granularity_seconds SECOND))) AS stat_time, IF(source_ip IN ( SELECT source_ip FROM $table WHERE $intervals_and_filter AND notEmpty(app) GROUP BY source_ip,app ORDER BY SUM(bytes) DESC $limit), source_ip, 'Other') AS source_ip, IF(source_country IN ( SELECT anyLast(source_country) FROM $table WHERE $intervals_and_filter AND notEmpty(app) GROUP BY source_ip,app ORDER BY SUM(bytes) DESC $limit), source_country, 'Other') AS source_country, IF(app IN ( SELECT app FROM $table WHERE $intervals_and_filter AND notEmpty(app) GROUP BY source_ip,app ORDER BY SUM(bytes) DESC $limit), app, 'Other') AS app, IF(app_category IN ( SELECT anyLast(app_category) FROM $table WHERE $intervals_and_filter AND notEmpty(app) GROUP BY source_ip,app ORDER BY SUM(bytes) DESC $limit), app_category, 'Other') AS app_category, direction, SUM(sessions) AS temp_sessions, SUM(bytes) AS temp_bytes, SUM(pkts) AS temp_packets, ROUND(SUM(bytes) * 8 / $granularity_seconds) AS temp_rate FROM $table WHERE $intervals_and_filter GROUP BY stat_time, source_ip, source_country, app, app_category, direction) GROUP BY source_ip, source_country, app, app_category, direction ORDER BY bytes DESC #end #sql("TRAFFIC_SPECTRUM_NETWORK_THROUGHPUT_TREND") SELECT FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(recv_time, '$granularity', 'zero')) AS stat_time, ROUND(RATE(bytes,$granularity_seconds,1)) * 8 AS avg_bits_per_sec, ROUND(RATE(bytes,$granularity_seconds,1)) AS avg_bytes_per_sec, ROUND(RATE(pkts,$granularity_seconds,1)) AS avg_pkts_per_sec, ROUND(RATE(sessions,$granularity_seconds,1)) AS avg_sessions_per_sec FROM $table WHERE $intervals_and_filter GROUP BY stat_time ORDER BY stat_time ASC $limit diff --git a/src/test/resources/parameters/fieldDiscoveryTest.json b/src/test/resources/parameters/fieldDiscoveryTest.json index cfe70b2e..19a9b0b5 100644 --- a/src/test/resources/parameters/fieldDiscoveryTest.json +++ b/src/test/resources/parameters/fieldDiscoveryTest.json @@ -3,8 +3,8 @@ "name": "field-discovery", "data_source": "session_record", "fields": [ - "client_ip", - "server_port" + "source_ip", + "destination_port" ], "filter": "vsys_id in (1) AND ( 1 = 1 )" }, @@ -12,8 +12,8 @@ "name": "field-discovery", "data_source": "session_record", "fields": [ - "client_ip", - "server_port" + "source_ip", + "destination_port" ], "filter": "vsys_id in (1) AND ( 1 = 1 )", "custom.statistics.metrics": [ @@ -29,8 +29,8 @@ "name": "field-discovery", "data_source": "session_record", "fields": [ - "client_ip", - "server_port" + "source_ip", + "destination_port" ], "filter": "vsys_id in (1) AND ( 1 = 1 )", "custom.statistics.metrics": [ @@ -46,8 +46,8 @@ "name": "field-discovery", "data_source": "session_record", "fields": [ - "client_ip", - "server_port" + "source_ip", + "destination_port" ], "filter": "vsys_id in (1) AND ( 1 = 1 )", "custom.statistics.metrics": [ @@ -63,8 +63,8 @@ "name": "field-discovery", "data_source": "session_record", "fields": [ - "client_ip", - "server_port" + "source_ip", + "destination_port" ], "filter": "vsys_id in (1) AND ( 1 = 1 )", "custom.statistics.metrics": [ diff --git a/src/test/resources/parameters/sqlAdHocTest.json b/src/test/resources/parameters/sqlAdHocTest.json index efc526fd..745c9c3d 100644 --- a/src/test/resources/parameters/sqlAdHocTest.json +++ b/src/test/resources/parameters/sqlAdHocTest.json @@ -23,7 +23,7 @@ "output_mode": "csv" }, "query_sql_oneshot_error_trigger_sub_query": { - "statement": "SELECT COUNT_DISTINCT(client_ip) AS \"Client IP\" FROM security_event WHERE ((security_action = 'Deny')) AND recv_time >= UNIX_TIMESTAMP('2024-03-12T00:00:00+08:00') AND recv_time < UNIX_TIMESTAMP('2024-03-12T23:59:59+08:00') AND security_event.vsys_id IN (1) ORDER BY \"Client IP\" DESC LIMIT 20", + "statement": "SELECT COUNT_DISTINCT(source_ip) AS \"Source IP\" FROM security_event WHERE ((security_action = 'Deny')) AND recv_time >= UNIX_TIMESTAMP('2024-03-12T00:00:00+08:00') AND recv_time < UNIX_TIMESTAMP('2024-03-12T23:59:59+08:00') AND security_event.vsys_id IN (1) ORDER BY \"Source IP\" DESC LIMIT 20", "execution_mode": "oneshot" } }
\ No newline at end of file |