feat(1c): add file-based analytics stack scaffold

clickhouse-1c/clickhouse/init/00_database.sql

@@ -0,0 +1 @@
+CREATE DATABASE IF NOT EXISTS analytics_1c;

clickhouse-1c/clickhouse/init/01_raw_tables.sql

@@ -0,0 +1,44 @@
+CREATE TABLE IF NOT EXISTS analytics_1c.raw_1c_documents
+(
+    ingested_at DateTime DEFAULT now(),
+    source_file String,
+    payload String
+)
+ENGINE = MergeTree
+ORDER BY (ingested_at, source_file);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.raw_1c_postings
+(
+    ingested_at DateTime DEFAULT now(),
+    source_file String,
+    payload String
+)
+ENGINE = MergeTree
+ORDER BY (ingested_at, source_file);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.raw_reglog
+(
+    ingested_at DateTime DEFAULT now(),
+    source_file String,
+    payload String
+)
+ENGINE = MergeTree
+ORDER BY (ingested_at, source_file);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.raw_audit
+(
+    ingested_at DateTime DEFAULT now(),
+    source_file String,
+    payload String
+)
+ENGINE = MergeTree
+ORDER BY (ingested_at, source_file);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.raw_host_metrics
+(
+    ingested_at DateTime DEFAULT now(),
+    source_file String,
+    payload String
+)
+ENGINE = MergeTree
+ORDER BY (ingested_at, source_file);

clickhouse-1c/clickhouse/init/02_core_tables.sql

@@ -0,0 +1,132 @@
+CREATE TABLE IF NOT EXISTS analytics_1c.documents
+(
+    ts DateTime,
+    infobase LowCardinality(String),
+    organization String,
+    department String,
+    doc_type LowCardinality(String),
+    doc_id String,
+    doc_number String,
+    author String,
+    counterparty String,
+    operation_type String,
+    amount Decimal(18, 2),
+    status LowCardinality(String),
+    posted UInt8,
+    source_file String
+)
+ENGINE = MergeTree
+ORDER BY (infobase, ts, doc_type, doc_id);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.postings
+(
+    ts DateTime,
+    infobase LowCardinality(String),
+    registrar String,
+    operation_type String,
+    account_dt String,
+    account_ct String,
+    amount Decimal(18, 2),
+    source_file String
+)
+ENGINE = MergeTree
+ORDER BY (infobase, ts, registrar);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.reglog_events
+(
+    ts DateTime,
+    infobase LowCardinality(String),
+    user String,
+    host String,
+    app String,
+    event_name String,
+    level LowCardinality(String),
+    duration_ms UInt32,
+    message String,
+    source_file String
+)
+ENGINE = MergeTree
+ORDER BY (infobase, ts, user, event_name);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.audit_events
+(
+    ts DateTime,
+    infobase LowCardinality(String),
+    user String,
+    object_type String,
+    object_id String,
+    action String,
+    before_hash String,
+    after_hash String,
+    risk_tag String,
+    source_file String
+)
+ENGINE = MergeTree
+ORDER BY (infobase, ts, object_type, object_id);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.host_events
+(
+    ts DateTime,
+    host String,
+    cpu_pct Float32,
+    ram_pct Float32,
+    disk_free_gb Float32,
+    disk_latency_ms Float32,
+    smb_errors UInt32,
+    rdp_sessions UInt32,
+    backup_ok UInt8,
+    source_file String
+)
+ENGINE = MergeTree
+ORDER BY (host, ts);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.entity_timeline
+(
+    ts DateTime,
+    entity_type LowCardinality(String),
+    entity_id String,
+    infobase LowCardinality(String),
+    actor String,
+    source LowCardinality(String),
+    event_type String,
+    severity LowCardinality(String),
+    score UInt32,
+    ref_id String,
+    summary String
+)
+ENGINE = MergeTree
+ORDER BY (entity_type, entity_id, ts);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.detections
+(
+    ts DateTime,
+    detection_id String,
+    infobase LowCardinality(String),
+    rule_id String,
+    rule_title String,
+    entity_type LowCardinality(String),
+    entity_id String,
+    severity LowCardinality(String),
+    score UInt32,
+    summary String,
+    status LowCardinality(String) DEFAULT 'open'
+)
+ENGINE = MergeTree
+ORDER BY (severity, ts, rule_id, entity_type, entity_id);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.cases
+(
+    opened_at DateTime,
+    case_id String,
+    infobase LowCardinality(String),
+    title String,
+    severity LowCardinality(String),
+    status LowCardinality(String),
+    assignee String,
+    detection_id String,
+    entity_type String,
+    entity_id String,
+    summary String
+)
+ENGINE = MergeTree
+ORDER BY (opened_at, case_id);

clickhouse-1c/clickhouse/init/03_views.sql

@@ -0,0 +1,26 @@
+CREATE VIEW IF NOT EXISTS analytics_1c.v_documents_daily AS
+SELECT
+    toDate(ts) AS d,
+    infobase,
+    organization,
+    doc_type,
+    count() AS docs_total,
+    sum(amount) AS amount_total,
+    sumIf(amount, posted = 0) AS unposted_amount
+FROM analytics_1c.documents
+GROUP BY d, infobase, organization, doc_type;
+
+CREATE VIEW IF NOT EXISTS analytics_1c.v_detections_daily AS
+SELECT
+    toDate(ts) AS d,
+    infobase,
+    severity,
+    count() AS detections_total,
+    sum(score) AS score_total
+FROM analytics_1c.detections
+GROUP BY d, infobase, severity;
+
+CREATE VIEW IF NOT EXISTS analytics_1c.v_open_cases AS
+SELECT *
+FROM analytics_1c.cases
+WHERE status != 'closed';