mirror of
https://github.com/FunnyWolf/agentic-soc-platform.git
synced 2026-08-22 13:12:56 +02:00
71 lines
10 KiB
Python
71 lines
10 KiB
Python
# Generated by Django 6.0.6 on 2026-06-28 04:14
|
|
|
|
import django.db.models.deletion
|
|
import uuid
|
|
from django.db import migrations, models
|
|
|
|
|
|
class Migration(migrations.Migration):
|
|
|
|
initial = True
|
|
|
|
dependencies = [
|
|
('artifacts', '0001_initial'),
|
|
('cases', '0001_initial'),
|
|
]
|
|
|
|
operations = [
|
|
migrations.CreateModel(
|
|
name='Alert',
|
|
fields=[
|
|
('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
|
|
('created_at', models.DateTimeField(auto_now_add=True)),
|
|
('updated_at', models.DateTimeField(auto_now=True)),
|
|
('alert_id', models.CharField(blank=True, db_index=True, default='', editable=False, help_text='Record ID e.g. alert_000001, auto-generated, no manual input needed (记录 ID e.g. alert_000001, 系统自动生成,无需手动赋值)', max_length=32, unique=True)),
|
|
('title', models.CharField(blank=True, default='', help_text='Alert title (告警标题)', max_length=500)),
|
|
('severity', models.CharField(choices=[('Unknown', 'Unknown'), ('Informational', 'Informational'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High'), ('Critical', 'Critical')], default='Unknown', help_text='Source-defined severity (告警来源定义的严重程度)', max_length=20)),
|
|
('confidence', models.CharField(choices=[('Unknown', 'Unknown'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High')], default='Unknown', help_text='True-positive confidence (真阳性置信度)', max_length=20)),
|
|
('impact', models.CharField(choices=[('Unknown', 'Unknown'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High'), ('Critical', 'Critical')], default='Unknown', help_text='Potential impact (告警潜在影响)', max_length=20)),
|
|
('disposition', models.CharField(choices=[('Unknown', 'Unknown'), ('Allowed', 'Allowed'), ('Blocked', 'Blocked'), ('Quarantined', 'Quarantined'), ('Isolated', 'Isolated'), ('Deleted', 'Deleted'), ('Dropped', 'Dropped'), ('Custom Action', 'Custom Action'), ('Approved', 'Approved'), ('Restored', 'Restored'), ('Exonerated', 'Exonerated'), ('Corrected', 'Corrected'), ('Partially Corrected', 'Partially Corrected'), ('Uncorrected', 'Uncorrected'), ('Delayed', 'Delayed'), ('Detected', 'Detected'), ('No Action', 'No Action'), ('Logged', 'Logged'), ('Tagged', 'Tagged'), ('Alert', 'Alert'), ('Count', 'Count'), ('Reset', 'Reset'), ('Captcha', 'Captcha'), ('Challenge', 'Challenge'), ('Access Revoked', 'Access Revoked'), ('Rejected', 'Rejected'), ('Unauthorized', 'Unauthorized'), ('Error', 'Error'), ('Other', 'Other')], default='Unknown', help_text='Source disposition (告警源处置结果)', max_length=20)),
|
|
('action', models.CharField(choices=[('Unknown', 'Unknown'), ('Allowed', 'Allowed'), ('Denied', 'Denied'), ('Observed', 'Observed'), ('Modified', 'Modified'), ('Other', 'Other')], default='Unknown', help_text='Observed action (告警源的动作)', max_length=20)),
|
|
('labels', models.JSONField(blank=True, default=list, help_text='Alert labels (告警标签)')),
|
|
('desc', models.TextField(blank=True, default='', help_text='Alert description (告警描述)')),
|
|
('first_seen_time', models.DateTimeField(blank=True, help_text='First observed time (首次观测时间)', null=True)),
|
|
('last_seen_time', models.DateTimeField(blank=True, help_text='Last observed time (最后观测时间)', null=True)),
|
|
('rule_id', models.CharField(blank=True, default='', help_text='SIEM rule ID (SIEM 规则 ID)', max_length=255)),
|
|
('rule_name', models.CharField(blank=True, default='', help_text='SIEM rule name (SIEM 规则名称)', max_length=255)),
|
|
('correlation_uid', models.CharField(blank=True, db_index=True, default='', help_text='Case correlation ID, alerts with the same correlation_uid are linked to the same event (事件关联 ID,相同 correlation_uid 告警关联到同一个事件)', max_length=255)),
|
|
('src_url', models.URLField(blank=True, default='', help_text='Source alert URL (原始告警 URL)', max_length=500)),
|
|
('source_uid', models.CharField(blank=True, db_index=True, default='', help_text='Source product ID, can be used to locate the unique alert in the source system (原始告警 唯一ID, 可通过该 ID 在原始来源中定位唯一告警)', max_length=255)),
|
|
('data_sources', models.JSONField(blank=True, default=list, help_text='Underlying data sources (告警源生成告警的数据来源列表)')),
|
|
('analytic_name', models.CharField(blank=True, default='', help_text='Analytic engine name (分析引擎名称)', max_length=255)),
|
|
('analytic_type', models.CharField(choices=[('Unknown', 'Unknown'), ('Rule', 'Rule'), ('Behavioral', 'Behavioral'), ('Statistical', 'Statistical'), ('Learning (ML/DL)', 'Learning (ML/DL)'), ('Fingerprinting', 'Fingerprinting'), ('Tagging', 'Tagging'), ('Keyword Match', 'Keyword Match'), ('Regular Expressions', 'Regular Expressions'), ('Exact Data Match', 'Exact Data Match'), ('Partial Data Match', 'Partial Data Match'), ('Indexed Data Match', 'Indexed Data Match'), ('Other', 'Other')], default='Unknown', help_text='Analytic engine type (分析引擎类型)', max_length=30)),
|
|
('analytic_state', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('Active', 'Active'), ('Suppressed', 'Suppressed'), ('Experimental', 'Experimental'), ('Other', 'Other')], default='', help_text='Analytic rule state (分析规则状态)', max_length=20)),
|
|
('analytic_desc', models.TextField(blank=True, default='', help_text='Analytic rule description (分析规则描述)')),
|
|
('tactic', models.CharField(blank=True, choices=[('Reconnaissance', 'Reconnaissance'), ('Resource Development', 'Resource Development'), ('Initial Access', 'Initial Access'), ('Execution', 'Execution'), ('Persistence', 'Persistence'), ('Privilege Escalation', 'Privilege Escalation'), ('Defense Evasion', 'Defense Evasion'), ('Credential Access', 'Credential Access'), ('Discovery', 'Discovery'), ('Lateral Movement', 'Lateral Movement'), ('Collection', 'Collection'), ('Command and Control', 'Command and Control'), ('Exfiltration', 'Exfiltration'), ('Impact', 'Impact')], default='', help_text='Mapped MITRE tactic (映射的 MITRE 战术)', max_length=100)),
|
|
('technique', models.CharField(blank=True, default='', help_text='Mapped MITRE technique (映射的 MITRE 技术)', max_length=100)),
|
|
('sub_technique', models.CharField(blank=True, default='', help_text='Mapped MITRE sub-technique (映射的 MITRE 子技术)', max_length=100)),
|
|
('mitigation', models.TextField(blank=True, default='', help_text='Suggested mitigation (建议的缓解措施)')),
|
|
('product_category', models.CharField(blank=True, choices=[('DLP', 'DLP'), ('Email', 'Email'), ('OT', 'OT'), ('Proxy', 'Proxy'), ('UEBA', 'UEBA'), ('ThreatIntelligence', 'ThreatIntelligence'), ('IAM', 'IAM'), ('EDR', 'EDR'), ('NDR', 'NDR'), ('Cloud', 'Cloud'), ('SIEM', 'SIEM'), ('WAF', 'WAF'), ('Other', 'Other')], default='', help_text='Source product category (原始产品类别)', max_length=30)),
|
|
('product_vendor', models.CharField(blank=True, default='', help_text='Source vendor (原始厂商)', max_length=255)),
|
|
('product_name', models.CharField(blank=True, default='', help_text='Source product name (原始产品名称)', max_length=255)),
|
|
('product_feature', models.CharField(blank=True, default='', help_text='Source product feature (原始产品功能)', max_length=255)),
|
|
('policy_name', models.CharField(blank=True, default='', help_text='Trigger policy name (触发策略名称)', max_length=255)),
|
|
('policy_type', models.CharField(blank=True, choices=[('Identity Policy', 'Identity Policy'), ('Resource Policy', 'Resource Policy'), ('Service Control Policy', 'Service Control Policy'), ('Access Control Policy', 'Access Control Policy'), ('Other', 'Other')], default='', help_text='Trigger policy type (触发策略类型)', max_length=30)),
|
|
('policy_desc', models.TextField(blank=True, default='', help_text='Trigger policy description (触发策略描述)')),
|
|
('risk_level', models.CharField(blank=True, choices=[('Info', 'Info'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High'), ('Critical', 'Critical'), ('Other', 'Other')], default='', help_text='Assessed risk level (评估的风险等级)', max_length=20)),
|
|
('status', models.CharField(choices=[('Unknown', 'Unknown'), ('New', 'New'), ('In Progress', 'In Progress'), ('Suppressed', 'Suppressed'), ('Resolved', 'Resolved'), ('Archived', 'Archived'), ('Deleted', 'Deleted'), ('Other', 'Other')], default='New', help_text='Alert handling status (告警处理状态)', max_length=20)),
|
|
('status_detail', models.TextField(blank=True, default='', help_text='Handling status details (处理状态详情)')),
|
|
('remediation', models.TextField(blank=True, default='', help_text='Remediation advice or record (处置建议或记录)')),
|
|
('unmapped', models.JSONField(blank=True, default=dict, help_text='Raw unmapped fields, JSON Format (原始未映射字段 JSON 格式)')),
|
|
('raw_data', models.JSONField(blank=True, default=dict, help_text='Raw alert log JSON (原始告警日志 JSON)')),
|
|
('artifacts', models.ManyToManyField(blank=True, help_text='Extracted artifacts (关联表, 提取的实体列表)', related_name='alerts', to='artifacts.artifact')),
|
|
('case', models.ForeignKey(help_text='Linked case id, reverse association, auto-linked, no manual setting needed (关联案件行 ID,反向关联,自动化关联,无需手动设置)', on_delete=django.db.models.deletion.CASCADE, related_name='alerts', to='cases.case')),
|
|
],
|
|
options={
|
|
'db_table': 'alerts',
|
|
'ordering': ['-created_at'],
|
|
},
|
|
),
|
|
]
|