alienvault库的报警、事件表结构

作为OSSIM数据库开发者，以下alienvault库的报警、事件表结构，需要了解。

 alienvault库的报警、事件表结构_第1张图片

1.alarm

Field Type Allow Null Default Value
backlog_id binary(16) No
event_id binary(16) No
corr_engine_ctx binary(16) No
timestamp timestamp Yes
status enum('open','closed') Yes 'open'
plugin_id int(11) No
plugin_sid int(11) No
protocol int(11) Yes
src_ip varbinary(16) Yes
dst_ip varbinary(16) Yes
src_port int(11) Yes
dst_port int(11) Yes
risk int(11) Yes
efr int(11) No 0
similar varchar(40) No '0000000000000000000000000000000000000000'
stats mediumtext No
removable tinyint(1) No 0
in_file tinyint(1) No 0

 

2.alarm_groups

Field Type Allow Null Default Value
group_id varchar(255) No
description text No
status enum('open','closed') No
timestamp timestamp No CURRENT_TIMESTAMP
owner varchar(64) No

 

3.alarm_hosts

Field Type Allow Null Default Value
id_alarm binary(16) No
id_host binary(16) No

 

4.alarm_kingdoms

Field Type Allow Null Default Value
id int(11) No
name varchar(128) No

 

5.alarm_nets

Field Type Allow Null Default Value
id_alarm binary(16) No
id_net binary(16) No

 

6.alarm_tags

Field Type Allow Null Default Value
id_alarm binary(16) No
id_tag int(11) No

 

alarm_taxonomy

Field Type Allow Null Default Value
sid int(11) No
engine_id binary(16) No '\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0'
kingdom int(11) No
category int(11) No
subcategory text No

7.databases

Field Type Allow Null Default Value
id int(10) UNSIGNED No
ctx binary(16) No
name varchar(64) No
ip varbinary(16) No
port int(11) No 3306
user varchar(64) No
pass varchar(64) No
icon mediumblob No

 

8.device_types

Field Type Allow Null Default Value
id int(11) No
name varchar(64) No
class int(11) No

 

9.event

Field Type Allow Null Default Value
id binary(16) No
agent_ctx binary(16) No
timestamp timestamp No CURRENT_TIMESTAMP
tzone float No 0
sensor_id binary(16) Yes
interface varchar(32) No
type int(11) No
plugin_id int(11) No
plugin_sid int(11) No
protocol int(11) Yes
src_ip varbinary(16) Yes
dst_ip varbinary(16) Yes
src_port int(11) Yes
dst_port int(11) Yes
event_condition int(11) Yes
value text Yes
time_interval int(11) Yes
absolute tinyint(4) Yes
priority int(11) Yes 1
reliability int(11) Yes 1
asset_src int(11) Yes 1
asset_dst int(11) Yes 1
risk_a int(11) Yes 0
risk_c int(11) Yes 0
alarm tinyint(4) Yes 0
filename varchar(256) Yes
username varchar(64) Yes
password varchar(64) Yes
userdata1 varchar(1024) Yes
userdata2 varchar(1024) Yes
userdata3 varchar(1024) Yes
userdata4 varchar(1024) Yes
userdata5 varchar(1024) Yes
userdata6 varchar(1024) Yes
userdata7 varchar(1024) Yes
userdata8 varchar(1024) Yes
userdata9 varchar(1024) Yes
rulename text Yes
rep_prio_src int(10) UNSIGNED Yes
rep_prio_dst int(10) UNSIGNED Yes
rep_rel_src int(10) UNSIGNED Yes
rep_rel_dst int(10) UNSIGNED Yes
rep_act_src varchar(64) Yes
rep_act_dst varchar(64) Yes
src_hostname varchar(64) Yes
dst_hostname varchar(64) Yes
src_mac binary(6) Yes
dst_mac binary(6) Yes
src_host binary(16) Yes
dst_host binary(16) Yes
src_net binary(16) Yes
dst_net binary(16) Yes
refs int(11) Yes

 

10.extra_data

Field Type Allow Null Default Value
event_id binary(16) No
data_payload text Yes
binary_data blob Yes

 

11.host

Field Type Allow Null Default Value
id binary(16) No
ctx binary(16) No
hostname varchar(128) No
fqdns varchar(255) No
asset smallint(6) No
threshold_c int(11) No
threshold_a int(11) No
alert int(11) No
persistence int(11) No
nat varchar(15) Yes
rrd_profile varchar(64) Yes
descr varchar(255) Yes
lat varchar(255) Yes '0'
lon varchar(255) Yes '0'
icon mediumblob Yes
country varchar(64) Yes
external_host tinyint(1) No 0
permissions binary(8) No '\0\0\0\0\0\0\0\0'
av_component tinyint(1) No 0
created datetime Yes
updated datetime Yes

12.incident

Field Type Allow Null Default Value
id int(11) No
uuid binary(16) No
ctx binary(16) No
title varchar(512) No
date datetime No 0000-00-00 00:00:00
ref enum('Alarm','Alert','Event','Metric','Anomaly','Vulnerability','Custom') No 'Alarm'
type_id varchar(64) No '0'
priority int(11) No
status enum('Open','Assigned','Studying','Waiting','Testing','Closed') No 'Open'
last_update datetime No 0000-00-00 00:00:00
in_charge varchar(64) No
submitter varchar(64) No
event_start datetime No 0000-00-00 00:00:00
event_end datetime No 0000-00-00 00:00:00

 

13.incident_alarm

Field Type Allow Null Default Value
id int(11) No
incident_id int(11) No
src_ips varchar(255) No
src_ports varchar(255) No
dst_ips varchar(255) No
dst_ports varchar(255) No
backlog_id binary(16) No
event_id binary(16) No
alarm_group_id binary(16) Yes

 

14.incident_anomaly

Field Type Allow Null Default Value
id int(11) No
incident_id int(11) No
anom_type enum('mac','service','os') No 'mac'
ip varchar(255) No
data_orig varchar(255) No
data_new varchar(255) No

 

15.plugin_sid

Field Type Allow Null Default Value
plugin_ctx binary(16) No
plugin_id int(11) No
sid int(11) No
class_id int(11) Yes
reliability int(11) Yes 1
priority int(11) Yes 1
name varchar(512) No
aro decimal(11,4) No 0.0000
subcategory_id int(11) Yes
category_id int(11) Yes

 通常我们一个线上OSSIM系统，另一个开发系统，现在要把开发系统更新到线上，但是开发系统的数据库结构与线上的略有差异，所以需要找出两个数据库的表结构差异，数据库表结构的差异。我们利用mysqldump和diff两个命令组合完成。

 

导出表结构
mysqldump -uroot -p -d alienvault >/home/db1.sql

mysqldump -uroot -p -d alienvault >/home/db2.sql

 

比较
diff db1.sql db2.sql>diff

alienvault库的报警、事件表结构_第2张图片