mirror of
https://github.com/FunnyWolf/agentic-soc-platform.git
synced 2026-08-22 13:12:56 +02:00
add all datamodel
This commit is contained in:
funnywolf
+202
-183
@@ -1,3 +1,5 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from datetime import datetime
|
||||
from typing import List, Optional, Literal, Any, Union
|
||||
|
||||
@@ -5,65 +7,65 @@ from pydantic import BaseModel, Field, field_validator, ConfigDict
|
||||
|
||||
|
||||
class AccountModel(BaseModel):
|
||||
accountId: Optional[str] = None
|
||||
avatar: Optional[str] = None
|
||||
email: Optional[str] = None
|
||||
fullname: Optional[str] = None
|
||||
jobNumber: Optional[str] = None
|
||||
mobilePhone: Optional[str] = None
|
||||
status: Optional[int] = None
|
||||
accountId: Optional[str] = Field(default=None, description="用户的唯一标识ID")
|
||||
avatar: Optional[str] = Field(default=None, description="用户头像的URL")
|
||||
email: Optional[str] = Field(default=None, description="用户的电子邮件地址")
|
||||
fullname: Optional[str] = Field(default=None, description="用户的全名")
|
||||
jobNumber: Optional[str] = Field(default=None, description="用户的工号")
|
||||
mobilePhone: Optional[str] = Field(default=None, description="用户的手机号码")
|
||||
status: Optional[int] = Field(default=None, description="用户状态, 例如: 1表示正常")
|
||||
|
||||
|
||||
class AttachmentModel(BaseModel):
|
||||
DownloadUrl: Optional[str] = None
|
||||
WaterMarkInfo: Optional[Any] = None
|
||||
allow_down: Optional[bool] = None
|
||||
allow_edit: Optional[bool] = None
|
||||
allow_view: Optional[bool] = None
|
||||
createTime: Optional[Union[datetime, str]] = None
|
||||
duration: Optional[float] = None
|
||||
file_id: Optional[str] = None
|
||||
file_name: Optional[str] = None
|
||||
file_path: Optional[str] = None
|
||||
file_size: Optional[int] = None
|
||||
file_type: Optional[int] = None
|
||||
height: Optional[int] = None
|
||||
is_delete: Optional[bool] = None
|
||||
is_knowledge: Optional[bool] = None
|
||||
large_thumbnail_name: Optional[str] = None
|
||||
large_thumbnail_path: Optional[str] = None
|
||||
node_id: Optional[str] = ""
|
||||
origin_link_url: Optional[str] = None
|
||||
original_file_full_path: Optional[str] = None
|
||||
original_file_name: Optional[str] = None
|
||||
preview_url: Optional[str] = None
|
||||
share_folder_url: Optional[str] = None
|
||||
short_link_url: Optional[str] = None
|
||||
thumbnail_name: Optional[str] = ""
|
||||
thumbnail_path: Optional[str] = ""
|
||||
width: Optional[int] = None
|
||||
DownloadUrl: Optional[str] = Field(default=None, description="文件的下载地址")
|
||||
WaterMarkInfo: Optional[Any] = Field(default=None, description="文件水印信息")
|
||||
allow_down: Optional[bool] = Field(default=None, description="是否允许下载")
|
||||
allow_edit: Optional[bool] = Field(default=None, description="是否允许编辑")
|
||||
allow_view: Optional[bool] = Field(default=None, description="是否允许预览")
|
||||
createTime: Optional[Union[datetime, str]] = Field(default=None, description="文件创建时间")
|
||||
duration: Optional[float] = Field(default=None, description="音视频文件的时长（秒）")
|
||||
file_id: Optional[str] = Field(default=None, description="文件的唯一ID")
|
||||
file_name: Optional[str] = Field(default=None, description="文件名")
|
||||
file_path: Optional[str] = Field(default=None, description="文件在服务器上的存储路径")
|
||||
file_size: Optional[int] = Field(default=None, description="文件大小（字节）")
|
||||
file_type: Optional[int] = Field(default=None, description="文件类型的一种数字表示")
|
||||
height: Optional[int] = Field(default=None, description="图片或视频的高度（像素）")
|
||||
is_delete: Optional[bool] = Field(default=None, description="文件是否已被删除")
|
||||
is_knowledge: Optional[bool] = Field(default=None, description="是否为知识库文件")
|
||||
large_thumbnail_name: Optional[str] = Field(default=None, description="大缩略图名称")
|
||||
large_thumbnail_path: Optional[str] = Field(default=None, description="大缩略图路径")
|
||||
node_id: Optional[str] = Field(default="", description="关联的节点ID")
|
||||
origin_link_url: Optional[str] = Field(default=None, description="原始链接URL")
|
||||
original_file_full_path: Optional[str] = Field(default=None, description="原始文件的完整路径")
|
||||
original_file_name: Optional[str] = Field(default=None, description="原始文件名")
|
||||
preview_url: Optional[str] = Field(default=None, description="文件的预览地址")
|
||||
share_folder_url: Optional[str] = Field(default=None, description="共享文件夹地址")
|
||||
short_link_url: Optional[str] = Field(default=None, description="短链接地址")
|
||||
thumbnail_name: Optional[str] = Field(default="", description="缩略图名称")
|
||||
thumbnail_path: Optional[str] = Field(default="", description="缩略图路径")
|
||||
width: Optional[int] = Field(default=None, description="图片或视频的宽度（像素）")
|
||||
|
||||
|
||||
class BaseSystemModel(BaseModel):
|
||||
model_config = ConfigDict(populate_by_name=True)
|
||||
|
||||
rowid: Optional[str] = None
|
||||
ownerid: Optional[AccountModel] = None
|
||||
caid: Optional[AccountModel] = None
|
||||
ctime: Optional[Union[datetime, str]] = None
|
||||
utime: Optional[Union[datetime, str]] = None
|
||||
uaid: Optional[AccountModel] = None
|
||||
rowid: Optional[str] = Field(default=None, description="数据的唯一行ID")
|
||||
ownerid: Optional[AccountModel] = Field(default=None, description="数据的所有者/创建者")
|
||||
caid: Optional[AccountModel] = Field(default=None, description="当前处理人/负责人")
|
||||
ctime: Optional[Union[datetime, str]] = Field(default=None, description="创建时间")
|
||||
utime: Optional[Union[datetime, str]] = Field(default=None, description="最后更新时间")
|
||||
uaid: Optional[AccountModel] = Field(default=None, description="最后更新人")
|
||||
|
||||
# 流程相关参数
|
||||
wfname: Optional[str] = None
|
||||
wfcuaids: Optional[Any] = None
|
||||
wfcaid: Optional[Any] = None
|
||||
wfctime: Optional[Union[datetime, str]] = None
|
||||
wfrtime: Optional[Union[datetime, str]] = None
|
||||
wfcotime: Optional[Union[datetime, str]] = None
|
||||
wfdtime: Optional[Union[datetime, str]] = None
|
||||
wfftime: Optional[Any] = None
|
||||
wfstatus: Optional[Literal["通过", "否决", "中止", "进行中", "", None]] = None
|
||||
wfname: Optional[str] = Field(default=None, description="关联的工作流名称")
|
||||
wfcuaids: Optional[Any] = Field(default=None, description="工作流当前处理人列表")
|
||||
wfcaid: Optional[Any] = Field(default=None, description="工作流当前激活的处理人")
|
||||
wfctime: Optional[Union[datetime, str]] = Field(default=None, description="工作流创建时间")
|
||||
wfrtime: Optional[Union[datetime, str]] = Field(default=None, description="工作流接收时间")
|
||||
wfcotime: Optional[Union[datetime, str]] = Field(default=None, description="工作流完成时间")
|
||||
wfdtime: Optional[Union[datetime, str]] = Field(default=None, description="工作流截止时间")
|
||||
wfftime: Optional[Any] = Field(default=None, description="工作流关注时间")
|
||||
wfstatus: Optional[Literal["通过", "否决", "中止", "进行中", "", None]] = Field(default=None, description="工作流状态")
|
||||
|
||||
@field_validator(
|
||||
"ctime", "utime", "wfctime", "wfrtime", "wfcotime", "wfdtime",
|
||||
@@ -81,66 +83,71 @@ class BaseSystemModel(BaseModel):
|
||||
|
||||
|
||||
class MessageModel(BaseSystemModel):
|
||||
playbook_rowid: str = Field(...)
|
||||
node: Optional[str] = ""
|
||||
content: Optional[str] = ""
|
||||
json: Optional[str] = ""
|
||||
type: Optional[Literal["SystemMessage", "HumanMessage", "ToolMessage", "AIMessage", None]] = None
|
||||
playbook_rowid: str = Field(..., description="所属Playbook的唯一行ID")
|
||||
node: Optional[str] = Field(default="", description="消息来源的节点名称或ID")
|
||||
content: Optional[str] = Field(default="", description="消息的文本内容")
|
||||
json: Optional[str] = Field(default="", description="消息的JSON格式内容，通常用于工具调用和返回")
|
||||
type: Optional[Literal["SystemMessage", "HumanMessage", "ToolMessage", "AIMessage", None]] = Field(default=None,
|
||||
description="消息类型，用于区分不同角色的发言")
|
||||
|
||||
|
||||
class PlaybookModel(BaseSystemModel):
|
||||
source_worksheet: Optional[str] = ""
|
||||
source_rowid: Optional[str] = ""
|
||||
job_id: Optional[str] = ""
|
||||
job_status: Optional[Literal["Pending", "Running", "Success", "Failed", None]] = None
|
||||
remark: Optional[str] = ""
|
||||
type: Optional[Literal["CASE", "ALERT", "ARTIFACT", None]] = None
|
||||
name: Optional[str] = ""
|
||||
messages: Optional[List[MessageModel]] = None
|
||||
user_input: Optional[str] = ""
|
||||
user: Optional[AccountModel] = None
|
||||
source_worksheet: Optional[str] = Field(default="", description="Playbook触发源所在的工作表名称")
|
||||
source_rowid: Optional[str] = Field(default="", description="Playbook触发源的行ID，例如具体的告警ID或事件ID")
|
||||
job_id: Optional[str] = Field(default="", description="执行Playbook的后台任务ID")
|
||||
job_status: Optional[Literal["Pending", "Running", "Success", "Failed", None]] = Field(default=None, description="Playbook执行任务的状态")
|
||||
remark: Optional[str] = Field(default="", description="关于Playbook执行的备注信息")
|
||||
type: Optional[Literal["CASE", "ALERT", "ARTIFACT", None]] = Field(default=None, description="Playbook关联的对象类型")
|
||||
name: Optional[str] = Field(default="", description="执行的Playbook的名称")
|
||||
messages: Optional[List[MessageModel]] = Field(default=None, description="Playbook执行过程中的所有消息记录，构成对话历史")
|
||||
user_input: Optional[str] = Field(default="", description="用户对Playbook的初始输入或后续指令")
|
||||
user: Optional[AccountModel] = Field(default=None, description="发起或与Playbook交互的用户")
|
||||
|
||||
|
||||
class Knowledge(BaseSystemModel):
|
||||
title: str = Field(...)
|
||||
body: Optional[str] = ""
|
||||
using: Optional[bool] = False
|
||||
action: Optional[Literal["Store", "Remove", "Done", None]] = None
|
||||
source: Literal["Manual", "Case"] = Field(...)
|
||||
title: str = Field(..., description="知识库条目的标题")
|
||||
body: Optional[str] = Field(default="", description="知识库条目的正文内容")
|
||||
using: Optional[bool] = Field(default=False, description="当前是否正在使用该知识")
|
||||
action: Optional[Literal["Store", "Remove", "Done", None]] = Field(default=None, description="对知识库条目执行的动作")
|
||||
source: Literal["Manual", "Case"] = Field(..., description="知识的来源，'Manual'表示手动创建，'Case'表示从安全事件中提取")
|
||||
|
||||
|
||||
class EnrichmentModel(BaseSystemModel):
|
||||
name: str = Field(...)
|
||||
type: Literal["Other"] = Field(...)
|
||||
provider: Optional[Literal["Other", None]] = None
|
||||
created_time: Optional[Union[datetime, str]] = None
|
||||
value: str = Field(...)
|
||||
src_url: Optional[str] = ""
|
||||
desc: Optional[str] = ""
|
||||
data: Optional[str] = ""
|
||||
name: str = Field(..., description="富化信息的名称或标题")
|
||||
type: Literal["Other"] = Field(..., description="富化信息的类型")
|
||||
provider: Optional[Literal["Other", None]] = Field(default=None, description="富化信息的提供方，例如威胁情报厂商")
|
||||
created_time: Optional[Union[datetime, str]] = Field(default=None, description="富化信息创建的时间")
|
||||
value: str = Field(..., description="富化信息的具体值")
|
||||
src_url: Optional[str] = Field(default="", description="富化信息的来源URL，方便溯源")
|
||||
desc: Optional[str] = Field(default="", description="对富化信息的简要描述")
|
||||
data: Optional[str] = Field(default="", description="富化信息的详细数据，通常是JSON字符串")
|
||||
|
||||
|
||||
class TicketModel(BaseSystemModel):
|
||||
status: Optional[Literal['Unknown', 'New', 'In Progress', 'Notified', 'On Hold', 'Resolved', 'Closed', 'Canceled', 'Reopened', 'Other', None]] = None
|
||||
type: Optional[Literal['Other', 'Jira', 'ServiceNow', None]] = None
|
||||
title: Optional[str] = ""
|
||||
uid: str = Field(...)
|
||||
src_url: str = Field(...)
|
||||
status: Optional[Literal['Unknown', 'New', 'In Progress', 'Notified', 'On Hold', 'Resolved', 'Closed', 'Canceled', 'Reopened', 'Other', None]] = Field(
|
||||
default=None, description="外部工单系统中的状态")
|
||||
type: Optional[Literal['Other', 'Jira', 'ServiceNow', None]] = Field(default=None, description="外部工单系统的类型")
|
||||
title: Optional[str] = Field(default="", description="工单的标题")
|
||||
uid: str = Field(..., description="工单在外部系统中的唯一ID")
|
||||
src_url: str = Field(..., description="访问该工单的URL")
|
||||
|
||||
|
||||
class ArtifactModel(BaseSystemModel):
|
||||
name: Optional[str] = ""
|
||||
name: Optional[str] = Field(default="", description="实体（Artifact）的名称，通常与值相同或为其描述")
|
||||
type: Optional[Literal[
|
||||
'Unknown', 'Hostname', 'IP Address', 'MAC Address', 'User Name', 'Email Address', 'URL String', 'File Name', 'Hash', 'Process Name', 'Resource UID', 'Port', 'Subnet', 'Command Line', 'Country', 'Process ID', 'HTTP User-Agent', 'CWE', 'CVE', 'User Credential ID', 'Endpoint', 'User', 'Email', 'Uniform Resource Locator', 'File', 'Process', 'Geo Location', 'Container', 'Registry', 'Fingerprint', 'Group', 'Account', 'Script Content', 'Serial Number', 'Resource', 'Message', 'Advisory', 'File Path', 'Device', 'Other', None]] = None
|
||||
role: Optional[Literal['Unknown', 'Target', 'Actor', 'Affected', 'Related', 'Other', None]] = None
|
||||
owner: Optional[str] = ""
|
||||
value: Optional[str] = ""
|
||||
reputation_provider: Optional[str] = ""
|
||||
'Unknown', 'Hostname', 'IP Address', 'MAC Address', 'User Name', 'Email Address', 'URL String', 'File Name', 'Hash', 'Process Name', 'Resource UID', 'Port', 'Subnet', 'Command Line', 'Country', 'Process ID', 'HTTP User-Agent', 'CWE', 'CVE', 'User Credential ID', 'Endpoint', 'User', 'Email', 'Uniform Resource Locator', 'File', 'Process', 'Geo Location', 'Container', 'Registry', 'Fingerprint', 'Group', 'Account', 'Script Content', 'Serial Number', 'Resource', 'Message', 'Advisory', 'File Path', 'Device', 'Other', None]] = Field(
|
||||
default=None, description="实体的类型, 例如: IP地址, 主机名, 文件哈希等")
|
||||
role: Optional[Literal['Unknown', 'Target', 'Actor', 'Affected', 'Related', 'Other', None]] = Field(default=None,
|
||||
description="实体在事件中扮演的角色, 如攻击者(Actor)、受害者(Target)等")
|
||||
owner: Optional[str] = Field(default="", description="实体归属的系统或用户")
|
||||
value: Optional[str] = Field(default="", description="实体的具体值, 如 '192.168.1.1'")
|
||||
reputation_provider: Optional[str] = Field(default="", description="提供信誉评分的威胁情报厂商名称")
|
||||
reputation_score: Optional[Literal[
|
||||
'Unknown', 'Very Safe', 'Safe', 'Probably Safe', 'Leans Safe', 'May not be Safe', 'Exercise Caution', 'Suspicious/Risky', 'Possibly Malicious', 'Probably Malicious', 'Malicious', 'Other', None]] = None
|
||||
'Unknown', 'Very Safe', 'Safe', 'Probably Safe', 'Leans Safe', 'May not be Safe', 'Exercise Caution', 'Suspicious/Risky', 'Possibly Malicious', 'Probably Malicious', 'Malicious', 'Other', None]] = Field(
|
||||
default=None, description="实体的信誉评分")
|
||||
|
||||
# 关联表
|
||||
enrichments: Optional[List[EnrichmentModel]] = []
|
||||
enrichments: Optional[List[EnrichmentModel]] = Field(default=[], description="针对此实体的一系列富化结果")
|
||||
|
||||
# playbooks: Optional[Any] = "" # 内部字段
|
||||
# playbook: Optional[Literal['TI Enrichment By AlienVaultOTX', 'TI Enrichment By Mock', None]] = None # 内部字段
|
||||
@@ -148,70 +155,79 @@ class ArtifactModel(BaseSystemModel):
|
||||
|
||||
|
||||
class AlertModel(BaseSystemModel):
|
||||
severity: Optional[Literal["Unknown", "Informational", "Low", "Medium", "High", "Critical", "Fatal", "Other", None]] = None
|
||||
title: Optional[str] = ""
|
||||
impact: Optional[Literal["Unknown", "Low", "Medium", "High", "Critical", "Other", None]] = None
|
||||
severity: Optional[Literal["Unknown", "Informational", "Low", "Medium", "High", "Critical", "Fatal", "Other", None]] = Field(default=None,
|
||||
description="告警的严重性，由源安全产品定义")
|
||||
title: Optional[str] = Field(default="", description="告警的标题")
|
||||
impact: Optional[Literal["Unknown", "Low", "Medium", "High", "Critical", "Other", None]] = Field(default=None, description="告警可能造成的影响范围")
|
||||
disposition: Optional[Literal[
|
||||
"Unknown", "Allowed", "Blocked", "Quarantined", "Isolated", "Deleted", "Dropped", "Custom Action", "Approved", "Restored", "Exonerated", "Corrected", "Partially Corrected", "Uncorrected", "Delayed", "Detected", "No Action", "Logged", "Tagged", "Alert", "Count", "Reset", "Captcha", "Challenge", "Access Revoked", "Rejected", "Unauthorized", "Error", "Other", None]] = None
|
||||
action: Optional[Literal["Unknown", "Allowed", "Denied", "Observed", "Modified", "Other", None]] = None
|
||||
confidence: Optional[Literal["Unknown", "Low", "Medium", "High", "Other", None]] = None
|
||||
uid: Optional[str] = ""
|
||||
labels: Optional[List[str]] = []
|
||||
desc: Optional[str] = ""
|
||||
"Unknown", "Allowed", "Blocked", "Quarantined", "Isolated", "Deleted", "Dropped", "Custom Action", "Approved", "Restored", "Exonerated", "Corrected", "Partially Corrected", "Uncorrected", "Delayed", "Detected", "No Action", "Logged", "Tagged", "Alert", "Count", "Reset", "Captcha", "Challenge", "Access Revoked", "Rejected", "Unauthorized", "Error", "Other", None]] = Field(
|
||||
default=None, description="安全产品对该活动的处置结果, 如'Blocked', 'Allowed等")
|
||||
action: Optional[Literal["Unknown", "Allowed", "Denied", "Observed", "Modified", "Other", None]] = Field(default=None,
|
||||
description="检测到的原始行为, 如'Allowed', 'Denied等")
|
||||
confidence: Optional[Literal["Unknown", "Low", "Medium", "High", "Other", None]] = Field(default=None,
|
||||
description="告警的置信度，表示该告警为真阳性的可能性")
|
||||
uid: Optional[str] = Field(default="", description="告警的唯一标识符")
|
||||
labels: Optional[List[str]] = Field(default=[], description="为告警打上的标签")
|
||||
desc: Optional[str] = Field(default="", description="对告警的详细描述")
|
||||
|
||||
created_time: Optional[Union[datetime, str]] = None
|
||||
modified_time: Optional[Union[datetime, str]] = None
|
||||
first_seen_time: Optional[Union[datetime, str]] = None
|
||||
last_seen_time: Optional[Union[datetime, str]] = None
|
||||
correlation: Optional[Any] = ""
|
||||
rule_id: Optional[str] = ""
|
||||
rule_name: Optional[str] = ""
|
||||
correlation_uid: Optional[str] = ""
|
||||
count: Optional[Union[int, str]] = None
|
||||
case: Optional[List[Any]] = []
|
||||
created_time: Optional[Union[datetime, str]] = Field(default=None, description="告警在SIRP平台中创建的时间")
|
||||
modified_time: Optional[Union[datetime, str]] = Field(default=None, description="告警在SIRP平台中最后修改的时间")
|
||||
first_seen_time: Optional[Union[datetime, str]] = Field(default=None, description="首次观测到该活动的时间")
|
||||
last_seen_time: Optional[Union[datetime, str]] = Field(default=None, description="最后一次观测到该活动的时间")
|
||||
|
||||
src_url: Optional[str] = ""
|
||||
source_uid: Optional[str] = ""
|
||||
data_sources: Optional[List[str]] = []
|
||||
analytic: Optional[Any] = ""
|
||||
analytic_name: Optional[str] = ""
|
||||
rule_id: Optional[str] = Field(default="", description="触发告警的规则ID")
|
||||
rule_name: Optional[str] = Field(default="", description="触发告警的规则名称")
|
||||
correlation_uid: Optional[str] = Field(default="", description="用于事件关联的唯一ID")
|
||||
count: Optional[Union[int, str]] = Field(default=None, description="告警聚合的次数")
|
||||
|
||||
src_url: Optional[str] = Field(default="", description="在源安全产品中查看此告警的URL")
|
||||
source_uid: Optional[str] = Field(default="", description="告警在源产品中的唯一ID")
|
||||
data_sources: Optional[List[str]] = Field(default=[], description="告警的数据来源，如'EDR', 'Firewall'等")
|
||||
|
||||
analytic: Optional[Any] = Field(default="", description="分析引擎的详细信息")
|
||||
analytic_name: Optional[str] = Field(default="", description="分析引擎的名称")
|
||||
analytic_type: Optional[Literal[
|
||||
"Unknown", "Rule", "Behavioral", "Statistical", "Learning (ML/DL)", "Fingerprinting", "Tagging", "Keyword Match", "Regular Expressions", "Exact Data Match", "Partial Data Match", "Indexed Data Match", "Other", None]] = None
|
||||
analytic_state: Optional[Literal["Unknown", "Active", "Suppressed", "Experimental", "Other", None]] = None
|
||||
analytic_desc: Optional[str] = ""
|
||||
"Unknown", "Rule", "Behavioral", "Statistical", "Learning (ML/DL)", "Fingerprinting", "Tagging", "Keyword Match", "Regular Expressions", "Exact Data Match", "Partial Data Match", "Indexed Data Match", "Other", None]] = Field(
|
||||
default=None, description="分析引擎的类型, 如'Rule', 'Behavioral'等")
|
||||
analytic_state: Optional[Literal["Unknown", "Active", "Suppressed", "Experimental", "Other", None]] = Field(default=None, description="分析规则当前的状态")
|
||||
analytic_desc: Optional[str] = Field(default="", description="分析规则的描述")
|
||||
|
||||
tactic: Optional[str] = ""
|
||||
technique: Optional[str] = ""
|
||||
sub_technique: Optional[str] = ""
|
||||
mitigation: Optional[str] = ""
|
||||
tactic: Optional[str] = Field(default="", description="关联的MITRE ATT&CK战术")
|
||||
technique: Optional[str] = Field(default="", description="关联的MITRE ATT&CK技术")
|
||||
sub_technique: Optional[str] = Field(default="", description="关联的MITRE ATT&CK子技术")
|
||||
mitigation: Optional[str] = Field(default="", description="针对该攻击的缓解措施建议")
|
||||
|
||||
product_category: Optional[Literal["DLP", "Email", "OT", "Proxy", "UEBA", "TI", "IAM", "EDR", "NDR", "Cloud", "Other", None]] = None
|
||||
product_vender: Optional[str] = None
|
||||
product_name: Optional[str] = None
|
||||
product_feature: Optional[str] = None
|
||||
product_category: Optional[Literal["DLP", "Email", "OT", "Proxy", "UEBA", "TI", "IAM", "EDR", "NDR", "Cloud", "Other", None]] = Field(default=None,
|
||||
description="产生告警的安全产品类别")
|
||||
product_vender: Optional[str] = Field(default=None, description="安全产品的厂商")
|
||||
product_name: Optional[str] = Field(default=None, description="安全产品的名称")
|
||||
product_feature: Optional[str] = Field(default=None, description="产生告警的产品具体功能模块")
|
||||
|
||||
policy_name: Optional[str] = ""
|
||||
policy_type: Optional[Literal["Identity Policy", "Resource Policy", "Service Control Policy", None]] = None
|
||||
policy_desc: Optional[str] = ""
|
||||
policy_name: Optional[str] = Field(default="", description="触发告警的策略名称")
|
||||
policy_type: Optional[Literal["Identity Policy", "Resource Policy", "Service Control Policy", None]] = Field(default=None, description="触发告警的策略类型")
|
||||
policy_desc: Optional[str] = Field(default="", description="触发告警的策略描述")
|
||||
|
||||
risk_level: Optional[Literal["Info", "Low", "Medium", "High", "Critical", "Other", None]] = None
|
||||
risk_details: Optional[str] = ""
|
||||
status: Optional[Literal["Unknown", "New", "In Progress", "Suppressed", "Resolved", "Archived", "Deleted", "Other", None]] = None
|
||||
status_detail: Optional[str] = ""
|
||||
remediation: Optional[str] = ""
|
||||
risk_level: Optional[Literal["Info", "Low", "Medium", "High", "Critical", "Other", None]] = Field(default=None, description="评估的风险等级")
|
||||
risk_details: Optional[str] = Field(default="", description="风险详情说明")
|
||||
|
||||
comment: Optional[str] = ""
|
||||
status: Optional[Literal["Unknown", "New", "In Progress", "Suppressed", "Resolved", "Archived", "Deleted", "Other", None]] = Field(default=None,
|
||||
description="告警的处理状态")
|
||||
status_detail: Optional[str] = Field(default="", description="状态的详细说明，例如抑制原因")
|
||||
remediation: Optional[str] = Field(default="", description="修复建议或记录")
|
||||
|
||||
suggestion_ai: Optional[str] = ""
|
||||
comment: Optional[str] = Field(default="", description="分析师对告警的评论")
|
||||
|
||||
unmapped: Optional[str] = ""
|
||||
unmapped: Optional[str] = Field(default="", description="未被映射到标准字段的原始数据")
|
||||
|
||||
raw_data: Optional[str] = ""
|
||||
raw_data: Optional[str] = Field(default="", description="原始告警日志，通常为JSON格式的字符串")
|
||||
|
||||
suggestion_ai: Optional[str] = Field(default="", description="AI提供的分析或处置建议")
|
||||
|
||||
# 关联表
|
||||
attachments: Optional[AttachmentModel] = []
|
||||
artifacts: Optional[List[ArtifactModel]] = []
|
||||
enrichments: Optional[List[EnrichmentModel]] = []
|
||||
case: Optional[CaseModel] = Field(default=None, description="此告警关联到的安全事件（Case）")
|
||||
attachments: Optional[AttachmentModel] = Field(default=[], description="告警的附件")
|
||||
artifacts: Optional[List[ArtifactModel]] = Field(default=[], description="从告警中提取出的实体（Artifact）列表")
|
||||
enrichments: Optional[List[EnrichmentModel]] = Field(default=[], description="对整个告警进行的富化结果")
|
||||
|
||||
# playbooks: Optional[Any] = "" # 内部字段
|
||||
# playbook: Optional[Literal["Alert Analysis Agent", None]] = None # 内部字段
|
||||
@@ -219,57 +235,60 @@ class AlertModel(BaseSystemModel):
|
||||
|
||||
|
||||
class CaseModel(BaseSystemModel):
|
||||
title: str = Field(...)
|
||||
description: Optional[str] = ""
|
||||
status: Optional[Literal["Unknown", "New", "In Progress", "On Hold", "Resolved", "Closed", "Other", None]] = None
|
||||
category: Optional[Literal["DLP", "Email", "OT", "Proxy", "UEBA", "TI", "IAM", "EDR", "NDR", "Cloud", "Other", None]] = None
|
||||
tags: Optional[List[str]] = []
|
||||
created_time: Optional[Union[datetime, str]] = None
|
||||
title: str = Field(..., description="安全事件的标题, 应能简明扼要地概括事件的核心内容")
|
||||
severity: Optional[Literal["Unknown", "Informational", "Low", "Medium", "High", "Critical", "Fatal", "Other", None]] = Field(default=None,
|
||||
description="由分析师评估或重新定义的事件严重性")
|
||||
impact: Optional[Literal["Unknown", "Low", "Medium", "High", "Critical", "Other", None]] = Field(default=None, description="由分析师评估的事件实际影响")
|
||||
priority: Optional[Literal["Unknown", "Low", "Medium", "High", "Critical", "Other", None]] = Field(default=None, description="事件的处置优先级")
|
||||
src_url: Optional[str] = Field(default="", description="在源系统中查看此事件的URL")
|
||||
confidence: Optional[Literal["Unknown", "Low", "Medium", "High", "Other", None]] = Field(default=None, description="由分析师评估的事件置信度")
|
||||
description: Optional[str] = Field(default="", description="对安全事件的详细描述")
|
||||
|
||||
assignee_l1: Optional[AccountModel] = None
|
||||
acknowledged_time: Optional[Union[datetime, str]] = None
|
||||
comment: Optional[str] = ""
|
||||
category: Optional[Literal["DLP", "Email", "OT", "Proxy", "UEBA", "TI", "IAM", "EDR", "NDR", "Cloud", "Other", None]] = Field(default=None,
|
||||
description="安全事件的分类，通常与主要告警源的产品类别一致")
|
||||
tags: Optional[List[str]] = Field(default=[], description="为事件打上的一系列标签")
|
||||
created_time: Optional[Union[datetime, str]] = Field(default=None, description="事件在SIRP中创建的时间")
|
||||
|
||||
closed_time: Optional[Union[datetime, str]] = None
|
||||
summary: Optional[str] = ""
|
||||
|
||||
severity: Optional[Literal["Unknown", "Informational", "Low", "Medium", "High", "Critical", "Fatal", "Other", None]] = None
|
||||
confidence: Optional[Literal["Unknown", "Low", "Medium", "High", "Other", None]] = None
|
||||
|
||||
correlation_uid: Optional[str] = ""
|
||||
|
||||
workbook: Optional[str] = ""
|
||||
|
||||
analysis_rationale_ai: Optional[str] = ""
|
||||
recommended_actions_ai: Optional[str] = ""
|
||||
attack_stage_ai: Optional[str] = ""
|
||||
severity_ai: Optional[Literal["Unknown", "Informational", "Low", "Medium", "High", "Critical", "Fatal", "Other", None]] = None
|
||||
confidence_ai: Optional[Literal["Unknown", "Low", "Medium", "High", "Other", None]] = None
|
||||
|
||||
threat_hunting_report: Optional[str] = ""
|
||||
|
||||
assignee_l2: Optional[AccountModel] = None
|
||||
assignee_l3: Optional[AccountModel] = None
|
||||
|
||||
impact: Optional[Literal["Unknown", "Low", "Medium", "High", "Critical", "Other", None]] = None
|
||||
priority: Optional[Literal["Unknown", "Low", "Medium", "High", "Critical", "Other", None]] = None
|
||||
src_url: Optional[str] = ""
|
||||
status: Optional[Literal["Unknown", "New", "In Progress", "On Hold", "Resolved", "Closed", "Other", None]] = Field(default=None,
|
||||
description="安全事件的处理状态")
|
||||
assignee_l1: Optional[AccountModel] = Field(default=None, description="分配给L1一线分析师")
|
||||
acknowledged_time: Optional[Union[datetime, str]] = Field(default=None, description="L1分析师首次确认接收事件的时间")
|
||||
comment: Optional[str] = Field(default="", description="分析师对整个事件的评论或处置记录")
|
||||
|
||||
assignee_l2: Optional[AccountModel] = Field(default=None, description="分配或升级给L2二线分析师")
|
||||
assignee_l3: Optional[AccountModel] = Field(default=None, description="分配或升级给L3专家分析师")
|
||||
closed_time: Optional[Union[datetime, str]] = Field(default=None, description="事件关闭的时间")
|
||||
verdict: Optional[Literal[
|
||||
"Unknown", "False Positive", "True Positive", "Disregard", "Suspicious", "Benign", "Test", "Insufficient Data", "Security Risk", "Managed Externally", "Duplicate", "Other", None]] = None
|
||||
"Unknown", "False Positive", "True Positive", "Disregard", "Suspicious", "Benign", "Test", "Insufficient Data", "Security Risk", "Managed Externally", "Duplicate", "Other", None]] = Field(
|
||||
default=None, description="对事件的最终裁定结论")
|
||||
summary: Optional[str] = Field(default="", description="事件关闭时生成的最终摘要总结")
|
||||
|
||||
correlation_uid: Optional[str] = Field(default="", description="用于关联其他事件或数据的唯一ID")
|
||||
|
||||
workbook: Optional[str] = Field(default="", description="事件调查使用的工作簿或调查手册内容")
|
||||
|
||||
# ai 字段
|
||||
analysis_rationale_ai: Optional[str] = Field(default="", description="AI对事件的分析基本原理和逻辑")
|
||||
recommended_actions_ai: Optional[str] = Field(default="", description="AI推荐的下一步操作或修复建议")
|
||||
attack_stage_ai: Optional[str] = Field(default="", description="AI评估的攻击阶段")
|
||||
severity_ai: Optional[Literal["Unknown", "Informational", "Low", "Medium", "High", "Critical", "Fatal", "Other", None]] = Field(default=None,
|
||||
description="AI评估的事件严重性")
|
||||
confidence_ai: Optional[Literal["Unknown", "Low", "Medium", "High", "Other", None]] = Field(default=None, description="AI评估的事件置信度")
|
||||
|
||||
threat_hunting_report_ai: Optional[str] = Field(default="", description="AI生成的与此事件相关的威胁狩猎报告")
|
||||
|
||||
# 公式计算字段
|
||||
start_time: Optional[Any] = None # 使用公式自动化计算,无需赋值
|
||||
end_time: Optional[Any] = None # 使用公式自动化计算,无需赋值
|
||||
detect_time: Optional[Any] = None # 使用公式自动化计算,无需赋值
|
||||
acknowledge_time: Optional[Any] = None # 使用公式自动化计算,无需赋值
|
||||
respond_time: Optional[Any] = None # 使用公式自动化计算,无需赋值
|
||||
start_time: Optional[Any] = Field(default=None, description="事件开始时间(通常是关联告警的最早first_seen_time), 用于计算MTTD")
|
||||
end_time: Optional[Any] = Field(default=None, description="事件结束时间(通常是closed_time), 用于计算MTTR")
|
||||
detect_time: Optional[Any] = Field(default=None, description="事件检测时间(通常是关联告警的最早created_time), 用于计算MTTD")
|
||||
acknowledge_time: Optional[Any] = Field(default=None, description="事件响应时间(acknowledged_time), 用于计算MTTA")
|
||||
respond_time: Optional[Any] = Field(default=None, description="事件处置完成时间(closed_time), 用于计算MTTR")
|
||||
|
||||
# 关联表
|
||||
attachments: Optional[List[AttachmentModel]] = []
|
||||
tickets: Optional[List[TicketModel]] = []
|
||||
enrichments: Optional[List[EnrichmentModel]] = []
|
||||
alerts: Optional[List[AlertModel]] = []
|
||||
attachments: Optional[List[AttachmentModel]] = Field(default=[], description="与事件相关的附件列表")
|
||||
tickets: Optional[List[TicketModel]] = Field(default=[], description="与此事件关联的外部工单列表")
|
||||
enrichments: Optional[List[EnrichmentModel]] = Field(default=[], description="对整个事件进行的富化结果")
|
||||
alerts: Optional[List[AlertModel]] = Field(default=[], description="合并到此事件中的告警列表")
|
||||
|
||||
# playbooks: Optional[Any] = "" # 内部字段
|
||||
# playbook: Optional[Literal["Threat Hunting Agent", "L3 SOC Analyst Agent", "L3 SOC Analyst Agent With Tools", None]] = None # 内部字段
|
||||
|
||||
Reference in New Issue
Block a user