b6391afbeb
Replace all hardcoded 'mabase_prod.' table prefixes in dashboard route
SQL queries with configurable database names from settings:
- http_logs, http_logs_raw → settings.CLICKHOUSE_DB_LOGS
- All other tables → settings.CLICKHOUSE_DB_PROCESSING
Also qualify previously unqualified table references (bare FROM/JOIN
table_name) with the appropriate database prefix for consistency.
Each route file now imports 'from ..config import settings' and uses
f-strings with {settings.CLICKHOUSE_DB_PROCESSING} or
{settings.CLICKHOUSE_DB_LOGS} for database-qualified table names.
Files updated: analysis, attributes, audit, botnets, bruteforce,
clustering, detections, entities, fingerprints, header_fingerprint,
heatmap, incidents, investigation_summary, metrics, ml_features,
rotation, search, tcp_spoofing, variability (19 files).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
127 lines
4.4 KiB
Python
127 lines
4.4 KiB
Python
"""
|
|
Endpoint de recherche globale rapide — utilisé par la barre Cmd+K
|
|
"""
|
|
from fastapi import APIRouter, Query
|
|
from ..database import db
|
|
from ..config import settings
|
|
|
|
router = APIRouter(prefix="/api/search", tags=["search"])
|
|
|
|
IP_RE = r"^(\d{1,3}\.){0,3}\d{1,3}$"
|
|
|
|
|
|
@router.get("/quick")
|
|
async def quick_search(q: str = Query(..., min_length=1, max_length=100)):
|
|
"""
|
|
Recherche unifiée sur IPs, JA4, ASN, hosts.
|
|
Retourne jusqu'à 5 résultats par catégorie.
|
|
"""
|
|
q = q.strip()
|
|
pattern = f"%{q}%"
|
|
results = []
|
|
|
|
# ── IPs ──────────────────────────────────────────────────────────────────
|
|
ip_rows = db.query(
|
|
f"""
|
|
SELECT
|
|
replaceRegexpAll(toString(src_ip), '^::ffff:', '') AS clean_ip,
|
|
count() AS hits,
|
|
max(detected_at) AS last_seen,
|
|
any(threat_level) AS threat_level
|
|
FROM {settings.CLICKHOUSE_DB_PROCESSING}.ml_detected_anomalies
|
|
WHERE ilike(toString(src_ip), %(p)s)
|
|
AND detected_at >= now() - INTERVAL 24 HOUR
|
|
GROUP BY clean_ip
|
|
ORDER BY hits DESC
|
|
""",
|
|
{"p": pattern},
|
|
)
|
|
for r in ip_rows.result_rows:
|
|
ip = str(r[0])
|
|
results.append({
|
|
"type": "ip",
|
|
"value": ip,
|
|
"label": ip,
|
|
"meta": f"{r[1]} détections · {r[3]}",
|
|
"url": f"/detections/ip/{ip}",
|
|
"investigation_url": f"/investigation/{ip}",
|
|
})
|
|
|
|
# ── JA4 fingerprints ─────────────────────────────────────────────────────
|
|
ja4_rows = db.query(
|
|
f"""
|
|
SELECT
|
|
ja4,
|
|
count() AS hits,
|
|
uniq(src_ip) AS unique_ips
|
|
FROM {settings.CLICKHOUSE_DB_PROCESSING}.ml_detected_anomalies
|
|
WHERE ilike(ja4, %(p)s)
|
|
AND ja4 != ''
|
|
AND detected_at >= now() - INTERVAL 24 HOUR
|
|
GROUP BY ja4
|
|
ORDER BY hits DESC
|
|
""",
|
|
{"p": pattern},
|
|
)
|
|
for r in ja4_rows.result_rows:
|
|
results.append({
|
|
"type": "ja4",
|
|
"value": str(r[0]),
|
|
"label": str(r[0]),
|
|
"meta": f"{r[1]} détections · {r[2]} IPs",
|
|
"url": f"/investigation/ja4/{r[0]}",
|
|
})
|
|
|
|
# ── Hosts ─────────────────────────────────────────────────────────────────
|
|
host_rows = db.query(
|
|
f"""
|
|
SELECT
|
|
host,
|
|
count() AS hits,
|
|
uniq(src_ip) AS unique_ips
|
|
FROM {settings.CLICKHOUSE_DB_PROCESSING}.ml_detected_anomalies
|
|
WHERE ilike(host, %(p)s)
|
|
AND host != ''
|
|
AND detected_at >= now() - INTERVAL 24 HOUR
|
|
GROUP BY host
|
|
ORDER BY hits DESC
|
|
""",
|
|
{"p": pattern},
|
|
)
|
|
for r in host_rows.result_rows:
|
|
results.append({
|
|
"type": "host",
|
|
"value": str(r[0]),
|
|
"label": str(r[0]),
|
|
"meta": f"{r[1]} hits · {r[2]} IPs",
|
|
"url": f"/detections?search={r[0]}",
|
|
})
|
|
|
|
# ── ASN ───────────────────────────────────────────────────────────────────
|
|
asn_rows = db.query(
|
|
f"""
|
|
SELECT
|
|
asn_org,
|
|
asn_number,
|
|
count() AS hits,
|
|
uniq(src_ip) AS unique_ips
|
|
FROM {settings.CLICKHOUSE_DB_PROCESSING}.ml_detected_anomalies
|
|
WHERE (ilike(asn_org, %(p)s) OR ilike(asn_number, %(p)s))
|
|
AND asn_org != '' AND asn_number != ''
|
|
AND detected_at >= now() - INTERVAL 24 HOUR
|
|
GROUP BY asn_org, asn_number
|
|
ORDER BY hits DESC
|
|
""",
|
|
{"p": pattern},
|
|
)
|
|
for r in asn_rows.result_rows:
|
|
results.append({
|
|
"type": "asn",
|
|
"value": str(r[1]),
|
|
"label": f"AS{r[1]} — {r[0]}",
|
|
"meta": f"{r[2]} hits · {r[3]} IPs",
|
|
"url": f"/detections?asn={r[1]}",
|
|
})
|
|
|
|
return {"query": q, "results": results}
|