71 lines
2.5 KiB
SQL
71 lines
2.5 KiB
SQL
CREATE TABLE IF NOT EXISTS users (
|
|
id INT AUTO_INCREMENT PRIMARY KEY,
|
|
username VARCHAR(50) NOT NULL UNIQUE,
|
|
password VARCHAR(255) NOT NULL,
|
|
role VARCHAR(20) DEFAULT 'analyst',
|
|
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS cases (
|
|
id INT AUTO_INCREMENT PRIMARY KEY,
|
|
title VARCHAR(255) NOT NULL,
|
|
status ENUM('open', 'investigating', 'resolved', 'closed') DEFAULT 'open',
|
|
severity ENUM('low', 'medium', 'high', 'critical') DEFAULT 'low',
|
|
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
|
|
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS alerts (
|
|
id INT AUTO_INCREMENT PRIMARY KEY,
|
|
wazuh_alert_id VARCHAR(100) NOT NULL,
|
|
rule_id INT NOT NULL,
|
|
rule_level INT NOT NULL,
|
|
description TEXT,
|
|
agent_id VARCHAR(50),
|
|
agent_name VARCHAR(100),
|
|
agent_ip VARCHAR(50),
|
|
full_log TEXT,
|
|
raw_data JSON,
|
|
case_id INT,
|
|
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
|
|
FOREIGN KEY (case_id) REFERENCES cases(id) ON DELETE SET NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS playbooks (
|
|
id INT AUTO_INCREMENT PRIMARY KEY,
|
|
name VARCHAR(100) NOT NULL,
|
|
description TEXT,
|
|
trigger_rule_id INT, -- If this rule ID triggers, run playbook
|
|
trigger_level INT, -- OR if alert level >= this, run playbook
|
|
is_active BOOLEAN DEFAULT TRUE,
|
|
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS playbook_actions (
|
|
id INT AUTO_INCREMENT PRIMARY KEY,
|
|
playbook_id INT NOT NULL,
|
|
action_type VARCHAR(50) NOT NULL, -- e.g., 'wazuh_active_response', 'virustotal_scan', 'slack_notify'
|
|
action_params JSON, -- e.g., {"command": "firewall-drop", "target": "agent"}
|
|
sequence INT DEFAULT 1,
|
|
FOREIGN KEY (playbook_id) REFERENCES playbooks(id) ON DELETE CASCADE
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS action_logs (
|
|
id INT AUTO_INCREMENT PRIMARY KEY,
|
|
alert_id INT,
|
|
playbook_id INT,
|
|
action_id INT,
|
|
status ENUM('pending', 'success', 'failed') DEFAULT 'pending',
|
|
result_message TEXT,
|
|
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
|
|
FOREIGN KEY (alert_id) REFERENCES alerts(id) ON DELETE CASCADE,
|
|
FOREIGN KEY (playbook_id) REFERENCES playbooks(id) ON DELETE SET NULL,
|
|
FOREIGN KEY (action_id) REFERENCES playbook_actions(id) ON DELETE SET NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS ai_remediation_cache (
|
|
rule_id INT PRIMARY KEY,
|
|
recommendation TEXT,
|
|
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
|
|
);
|