8180f4af04
- Remove UA regex extraction (extract_ua_regex, _extract_ua_from_all/any) - Remove Country rule collection from parse_bot_policies_inline - Simplify fetch_rules.py: collect_all_rules returns (ip_rules, asn_rules) - Remove insert_ua_rules and insert_country_rules functions - reload_dicts now only reloads dict_anubis_ip + dict_anubis_asn - Simplify CASE blocks in 04_mv_http_logs.sql, 07_ai_features_view.sql, view_ai_features_anubis.sql, mv_http_logs.sql: IP > ASN (was 5-level UA+IP > UA > IP > ASN > Country cascade) - Remove dict_anubis_country + dict_anubis_ua from 03_anubis_tables.sql (UA table kept as stub for REGEXP_TREE catch-all compatibility) - Remove anubis_country_rules table from schema - Remove Anubis UA and Country tabs from dashboard reflists page - Remove anubis_ua_rules/country_rules from API reflist queries - deploy_schema.sql simplified from 339 to 122 lines - 764 lines removed across 9 files Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
125 lines
5.5 KiB
SQL
125 lines
5.5 KiB
SQL
-- ============================================================================
|
|
-- ANUBIS CRAWLER RULES — Labeling des http_logs + pipeline ML
|
|
-- Architecture simplifiée (IP/CIDR et ASN uniquement) :
|
|
-- anubis_ua_rules (table stub) → dict_anubis_ua (REGEXP_TREE, catch-all)
|
|
-- anubis_ip_rules (table) → dict_anubis_ip (IP_TRIE)
|
|
-- anubis_asn_rules (table) → dict_anubis_asn (FLAT)
|
|
-- http_logs : +anubis_bot_name, +anubis_bot_action, +anubis_bot_category
|
|
-- mv_http_logs : enrichissement Anubis (IP > ASN)
|
|
-- view_ai_features_1h : +anubis_bot_name, +anubis_bot_action (via dictGet)
|
|
-- ml_detected_anomalies / ml_all_scores : colonnes Anubis
|
|
-- ============================================================================
|
|
|
|
-- ----------------------------------------------------------------------------
|
|
-- 1. TABLE SOURCE — règles User-Agent (stub REGEXP_TREE)
|
|
-- REGEXP_TREE nécessite ≥1 règle ; le catch-all est injecté à l'init.
|
|
-- Cette table n'est PAS peuplée par fetch_rules.py.
|
|
-- ----------------------------------------------------------------------------
|
|
CREATE TABLE IF NOT EXISTS ja4_processing.anubis_ua_rules
|
|
(
|
|
id UInt64,
|
|
parent_id UInt64,
|
|
regexp String,
|
|
keys Array(String),
|
|
values Array(String)
|
|
)
|
|
ENGINE = ReplacingMergeTree()
|
|
ORDER BY id;
|
|
|
|
-- ----------------------------------------------------------------------------
|
|
-- 2. TABLE SOURCE — règles IP/CIDR (pour dictionnaire IP_TRIE)
|
|
-- Peuplée par fetch_rules.py depuis les fichiers YAML Anubis.
|
|
-- ----------------------------------------------------------------------------
|
|
CREATE TABLE IF NOT EXISTS ja4_processing.anubis_ip_rules
|
|
(
|
|
prefix String,
|
|
bot_name LowCardinality(String),
|
|
action LowCardinality(String),
|
|
rule_id UInt64,
|
|
has_ua UInt8,
|
|
category LowCardinality(String)
|
|
)
|
|
ENGINE = ReplacingMergeTree()
|
|
ORDER BY prefix;
|
|
|
|
-- ----------------------------------------------------------------------------
|
|
-- 3. TABLE SOURCE — règles ASN (pour dictionnaire Flat)
|
|
-- Peuplée par fetch_rules.py depuis botPolicies.yaml.
|
|
-- ----------------------------------------------------------------------------
|
|
CREATE TABLE IF NOT EXISTS ja4_processing.anubis_asn_rules
|
|
(
|
|
asn UInt32,
|
|
bot_name LowCardinality(String),
|
|
action LowCardinality(String),
|
|
category LowCardinality(String)
|
|
)
|
|
ENGINE = ReplacingMergeTree()
|
|
ORDER BY asn;
|
|
|
|
-- ----------------------------------------------------------------------------
|
|
-- 4. DICTIONNAIRE IP — IP_TRIE (actif)
|
|
-- ----------------------------------------------------------------------------
|
|
DROP DICTIONARY IF EXISTS ja4_processing.dict_anubis_ip;
|
|
CREATE DICTIONARY ja4_processing.dict_anubis_ip
|
|
(
|
|
prefix String,
|
|
bot_name String,
|
|
action String,
|
|
rule_id UInt64,
|
|
has_ua UInt8,
|
|
category String
|
|
)
|
|
PRIMARY KEY prefix
|
|
SOURCE(CLICKHOUSE(HOST 'localhost' PORT 9000 USER 'admin' PASSWORD 'CHANGE_ME' DB 'ja4_processing' TABLE 'anubis_ip_rules'))
|
|
LAYOUT(IP_TRIE())
|
|
LIFETIME(MIN 300 MAX 600);
|
|
|
|
-- ----------------------------------------------------------------------------
|
|
-- 5. DICTIONNAIRE ASN — Flat (actif)
|
|
-- ----------------------------------------------------------------------------
|
|
DROP DICTIONARY IF EXISTS ja4_processing.dict_anubis_asn;
|
|
CREATE DICTIONARY ja4_processing.dict_anubis_asn
|
|
(
|
|
asn UInt32,
|
|
bot_name String,
|
|
action String,
|
|
category String
|
|
)
|
|
PRIMARY KEY asn
|
|
SOURCE(CLICKHOUSE(HOST 'localhost' PORT 9000 USER 'admin' PASSWORD 'CHANGE_ME' DB 'ja4_processing' TABLE 'anubis_asn_rules'))
|
|
LAYOUT(FLAT())
|
|
LIFETIME(MIN 300 MAX 600);
|
|
|
|
-- ----------------------------------------------------------------------------
|
|
-- 6. AJOUT DES COLONNES ANUBIS dans http_logs (idempotent)
|
|
-- ----------------------------------------------------------------------------
|
|
ALTER TABLE ja4_logs.http_logs
|
|
ADD COLUMN IF NOT EXISTS anubis_bot_name LowCardinality(String) DEFAULT '',
|
|
ADD COLUMN IF NOT EXISTS anubis_bot_action LowCardinality(String) DEFAULT '',
|
|
ADD COLUMN IF NOT EXISTS anubis_bot_category LowCardinality(String) DEFAULT '';
|
|
|
|
-- ============================================================================
|
|
-- INTÉGRATION ML — Propagation Anubis vers le pipeline bot_detector
|
|
-- ============================================================================
|
|
|
|
-- ----------------------------------------------------------------------------
|
|
-- 7. COLONNES ANUBIS dans ml_detected_anomalies
|
|
-- ----------------------------------------------------------------------------
|
|
ALTER TABLE ja4_processing.ml_detected_anomalies
|
|
ADD COLUMN IF NOT EXISTS anubis_bot_name LowCardinality(String) DEFAULT '',
|
|
ADD COLUMN IF NOT EXISTS anubis_bot_action LowCardinality(String) DEFAULT '',
|
|
ADD COLUMN IF NOT EXISTS anubis_bot_category LowCardinality(String) DEFAULT '';
|
|
|
|
-- ----------------------------------------------------------------------------
|
|
-- 8. COLONNES ANUBIS dans ml_all_scores
|
|
-- ----------------------------------------------------------------------------
|
|
ALTER TABLE ja4_processing.ml_all_scores
|
|
ADD COLUMN IF NOT EXISTS anubis_bot_name LowCardinality(String) DEFAULT '',
|
|
ADD COLUMN IF NOT EXISTS anubis_bot_action LowCardinality(String) DEFAULT '',
|
|
ADD COLUMN IF NOT EXISTS anubis_bot_category LowCardinality(String) DEFAULT '';
|
|
|
|
-- ----------------------------------------------------------------------------
|
|
-- 9. VIEW view_ai_features_1h — Enrichissement Anubis
|
|
-- Voir view_ai_features_anubis.sql pour le CREATE OR REPLACE VIEW complet.
|
|
-- ----------------------------------------------------------------------------
|