feat(1c): make file dashboards live and provisioned

clickhouse-1c/detections/insert_detections.sql

@@ -17,8 +17,8 @@ WHERE event_name ILIKE '%login%'
 
 INSERT INTO analytics_1c.detections
 SELECT
-    max(ts) AS ts,
-    concat('failed_login_burst:', infobase, ':', user, ':', toString(toUnixTimestamp(max(ts)))) AS detection_id,
+    event_ts AS ts,
+    concat('failed_login_burst:', infobase, ':', user, ':', toString(toUnixTimestamp(event_ts))) AS detection_id,
     infobase,
     'failed_login_burst' AS rule_id,
     'Всплеск ошибок входа' AS rule_title,
@@ -28,16 +28,24 @@ SELECT
     65 AS score,
     concat('У пользователя ', user, ' более 5 ошибок входа за 15 минут') AS summary,
     'open' AS status
-FROM analytics_1c.reglog_events
-WHERE level IN ('error', 'warn')
-  AND (event_name ILIKE '%login%' OR message ILIKE '%парол%' OR message ILIKE '%auth%')
-GROUP BY infobase, user, toStartOfFifteenMinutes(ts)
-HAVING count() >= 5;
+FROM (
+    SELECT
+        infobase,
+        user,
+        toStartOfFifteenMinutes(ts) AS window_ts,
+        max(ts) AS event_ts,
+        count() AS attempts
+    FROM analytics_1c.reglog_events
+    WHERE level IN ('error', 'warn')
+      AND (event_name ILIKE '%login%' OR message ILIKE '%парол%' OR message ILIKE '%auth%')
+    GROUP BY infobase, user, window_ts
+    HAVING attempts >= 5
+);
 
 INSERT INTO analytics_1c.detections
 SELECT
-    max(ts) AS ts,
-    concat('disk_latency_high:', host, ':', toString(toUnixTimestamp(max(ts)))) AS detection_id,
+    event_ts AS ts,
+    concat('disk_latency_high:', host, ':', toString(toUnixTimestamp(event_ts))) AS detection_id,
     '' AS infobase,
     'disk_latency_high' AS rule_id,
     'Высокая задержка диска' AS rule_title,
@@ -47,6 +55,13 @@ SELECT
     65 AS score,
     concat('На хосте ', host, ' задержка диска превышает 50 мс') AS summary,
     'open' AS status
-FROM analytics_1c.host_events
-GROUP BY host, toStartOfHour(ts)
-HAVING avg(disk_latency_ms) > 50;
+FROM (
+    SELECT
+        host,
+        toStartOfHour(ts) AS hour_ts,
+        max(ts) AS event_ts,
+        avg(disk_latency_ms) AS avg_latency_ms
+    FROM analytics_1c.host_events
+    GROUP BY host, hour_ts
+    HAVING avg_latency_ms > 50
+);