Add shadow security finding inbox

clickhouse-1c/security/security_finding_inbox.sql

@@ -0,0 +1,97 @@
+CREATE TABLE IF NOT EXISTS analytics_1c.security_findings
+(
+    ts DateTime64(3, 'UTC'),
+    finding_id String,
+    host String,
+    user String,
+    ip String,
+    department LowCardinality(String),
+    state LowCardinality(String),
+    severity LowCardinality(String),
+    confidence LowCardinality(String),
+    score UInt16,
+    source LowCardinality(String),
+    rule_id String,
+    rule_title String,
+    summary String,
+    recommended_action LowCardinality(String),
+    management_channel_checked UInt8,
+    evidence_ref String,
+    raw_json String,
+    ingested_at DateTime64(3, 'UTC') DEFAULT now64(3)
+)
+ENGINE = MergeTree
+PARTITION BY toYYYYMM(ts)
+ORDER BY (state, severity, host, ts, finding_id);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.security_finding_workflow_events
+(
+    ts DateTime64(3, 'UTC'),
+    finding_id String,
+    event_type LowCardinality(String),
+    status LowCardinality(String),
+    actor String,
+    comment String,
+    decision_status String,
+    rollback_plan_id String,
+    plan_id String,
+    evidence_json String
+)
+ENGINE = MergeTree
+PARTITION BY toYYYYMM(ts)
+ORDER BY (finding_id, ts, event_type);
+
+DROP VIEW IF EXISTS analytics_1c.security_finding_inbox;
+
+CREATE VIEW analytics_1c.security_finding_inbox AS
+SELECT
+    f.finding_id AS finding_id,
+    min(f.ts) AS first_seen,
+    max(f.ts) AS last_seen,
+    argMax(f.host, f.ingested_at) AS host,
+    argMax(f.user, f.ingested_at) AS user,
+    argMax(f.ip, f.ingested_at) AS ip,
+    argMax(f.department, f.ingested_at) AS department,
+    argMax(f.state, f.ingested_at) AS state,
+    argMax(f.severity, f.ingested_at) AS severity,
+    argMax(f.confidence, f.ingested_at) AS confidence,
+    argMax(f.score, f.ingested_at) AS score,
+    argMax(f.source, f.ingested_at) AS source,
+    argMax(f.rule_id, f.ingested_at) AS rule_id,
+    argMax(f.rule_title, f.ingested_at) AS rule_title,
+    argMax(f.summary, f.ingested_at) AS summary,
+    argMax(f.recommended_action, f.ingested_at) AS recommended_action,
+    argMax(f.management_channel_checked, f.ingested_at) AS management_channel_checked,
+    argMax(f.evidence_ref, f.ingested_at) AS evidence_ref,
+    argMax(f.raw_json, f.ingested_at) AS raw_json,
+    coalesce(nullIf(w.status, ''), 'new') AS workflow_status,
+    coalesce(nullIf(w.event_type, ''), 'created') AS last_workflow_event,
+    w.workflow_updated_at AS workflow_updated_at,
+    coalesce(w.actor, '') AS workflow_actor,
+    coalesce(w.decision_status, '') AS decision_status,
+    coalesce(w.rollback_plan_id, '') AS rollback_plan_id,
+    coalesce(w.plan_id, '') AS plan_id
+FROM analytics_1c.security_findings AS f
+LEFT JOIN
+(
+    SELECT
+        finding_id,
+        argMax(event_type, ts) AS event_type,
+        argMax(status, ts) AS status,
+        argMax(actor, ts) AS actor,
+        argMax(decision_status, ts) AS decision_status,
+        argMax(rollback_plan_id, ts) AS rollback_plan_id,
+        argMax(plan_id, ts) AS plan_id,
+        max(ts) AS workflow_updated_at
+    FROM analytics_1c.security_finding_workflow_events
+    GROUP BY finding_id
+) AS w USING finding_id
+GROUP BY
+    f.finding_id,
+    w.status,
+    w.event_type,
+    w.workflow_updated_at,
+    w.actor,
+    w.decision_status,
+    w.rollback_plan_id,
+    w.plan_id;