agentic-soc-platform/backend/apps/cases/migrations/0001_initial.py

# Generated by Django 6.0.6 on 2026-06-28 04:14

import django.db.models.deletion
import uuid
from django.conf import settings
from django.db import migrations, models


class Migration(migrations.Migration):

    initial = True

    dependencies = [
        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
    ]

    operations = [
        migrations.CreateModel(
            name='Case',
            fields=[
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
                ('created_at', models.DateTimeField(auto_now_add=True)),
                ('updated_at', models.DateTimeField(auto_now=True)),
                ('case_id', models.CharField(blank=True, db_index=True, default='', editable=False, help_text='Record ID e.g. case_000001 (记录 ID e.g. case_000001,系统自动生成,无需手动赋值)', max_length=32, unique=True)),
                ('title', models.CharField(help_text='Case title (案件标题)', max_length=500)),
                ('severity', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('Informational', 'Informational'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High'), ('Critical', 'Critical')], default='', help_text='Analyst-assessed severity (严重程度)', max_length=20)),
                ('impact', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High'), ('Critical', 'Critical')], default='', help_text='Analyst-assessed impact (影响)', max_length=20)),
                ('priority', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High'), ('Critical', 'Critical')], default='', help_text='Response priority (响应优先级)', max_length=20)),
                ('confidence', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High')], default='', help_text='Analyst-assessed confidence (分析师评估置信度)', max_length=20)),
                ('description', models.TextField(blank=True, default='', help_text='Case description (案件描述)')),
                ('category', models.CharField(blank=True, choices=[('DLP', 'DLP'), ('Email', 'Email'), ('OT', 'OT'), ('Proxy', 'Proxy'), ('UEBA', 'UEBA'), ('ThreatIntelligence', 'TI'), ('IAM', 'IAM'), ('EDR', 'EDR'), ('NDR', 'NDR'), ('Cloud', 'Cloud'), ('SIEM', 'SIEM'), ('WAF', 'WAF'), ('Other', 'Other')], default='', help_text='Case category (案件类别)', max_length=30)),
                ('tags', models.JSONField(blank=True, default=list, help_text='Case tags (案件标签)')),
                ('status', models.CharField(choices=[('New', 'New'), ('In Progress', 'In Progress'), ('On Hold', 'On Hold'), ('Resolved', 'Resolved'), ('Closed', 'Closed')], default='New', help_text='Case handling status (案件处理状态)', max_length=20)),
                ('verdict', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('False Positive', 'False Positive'), ('True Positive', 'True Positive'), ('Disregard', 'Disregard'), ('Suspicious', 'Suspicious'), ('Benign', 'Benign'), ('Test', 'Test'), ('Insufficient Data', 'Insufficient Data'), ('Security Risk', 'Security Risk'), ('Managed Externally', 'Managed Externally'), ('Duplicate', 'Duplicate'), ('Other', 'Other')], default='', help_text='Final verdict (最终判定结果)', max_length=30)),
                ('summary', models.TextField(blank=True, default='', help_text='Closure summary (结案摘要)')),
                ('acknowledged_time', models.DateTimeField(blank=True, help_text='L1 first acknowledged time (L1 首次接手时间)', null=True)),
                ('closed_time', models.DateTimeField(blank=True, help_text='case close time (事件关闭时间)', null=True)),
                ('correlation_uid', models.CharField(blank=True, db_index=True, default='', help_text='Case correlation ID (案件关联 ID)', max_length=255)),
                ('severity_ai', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('Informational', 'Informational'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High'), ('Critical', 'Critical')], default='', help_text='AI-assessed severity (AI 评估严重程度)', max_length=20)),
                ('confidence_ai', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High')], default='', help_text='AI-assessed confidence (AI 评估置信度)', max_length=20)),
                ('impact_ai', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High'), ('Critical', 'Critical')], default='', help_text='AI-assessed impact (AI 评估影响)', max_length=20)),
                ('priority_ai', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('Low', 'Low'), ('Medium', 'Medium'), ('High', 'High'), ('Critical', 'Critical')], default='', help_text='AI-assessed response priority (AI 评估响应优先级)', max_length=20)),
                ('verdict_ai', models.CharField(blank=True, choices=[('Unknown', 'Unknown'), ('False Positive', 'False Positive'), ('True Positive', 'True Positive'), ('Disregard', 'Disregard'), ('Suspicious', 'Suspicious'), ('Benign', 'Benign'), ('Test', 'Test'), ('Insufficient Data', 'Insufficient Data'), ('Security Risk', 'Security Risk'), ('Managed Externally', 'Managed Externally'), ('Duplicate', 'Duplicate'), ('Other', 'Other')], default='', help_text='AI-generated final verdict (AI 生成的最终判定结果)', max_length=30)),
                ('investigation_report_ai_json', models.TextField(blank=True, default='', help_text='AI-generated investigation report JSON Format (AI 生成的调查报告 JSON 格式)')),
                ('assignee', models.ForeignKey(blank=True, help_text='Current assigned analyst handling the case (当前正在处理案件的分析师)', null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='assigned_cases', to=settings.AUTH_USER_MODEL)),
            ],
            options={
                'db_table': 'cases',
                'ordering': ['-created_at'],
            },
        ),
    ]