20 lines
507 B
SQL
20 lines
507 B
SQL
INSERT INTO analytics_1c.cases
|
|
SELECT
|
|
ts AS opened_at,
|
|
detection_id AS case_id,
|
|
infobase,
|
|
concat('1C ', upper(severity), ' · ', rule_title, ' · ', entity_id) AS title,
|
|
severity,
|
|
'open' AS status,
|
|
'' AS assignee,
|
|
detection_id,
|
|
entity_type,
|
|
entity_id,
|
|
summary
|
|
FROM analytics_1c.detections
|
|
WHERE (
|
|
severity IN ('high', 'critical')
|
|
OR (severity = 'medium' AND score >= 35)
|
|
)
|
|
AND detection_id NOT IN (SELECT case_id FROM analytics_1c.cases);
|