admin/activecm-rita
1
0
Fork 0
mirror of https://github.com/activecm/rita synced 2026-06-08 13:02:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

changing the materialized view to use src_bytes (package payload bytes) instead of the src_ip_bytes (full ip package byte count)

Browse Source
This commit is contained in:
Samuel Carroll
2025-06-12 13:47:39 -05:00
parent e11d5c2bef
commit 6b27aac3e4
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
database/tables.go
+3 -3
View File
@@ -340,7 +340,7 @@ func (db *DB) createUconnTable(ctx context.Context) error {
uniqExactState(ts) as unique_ts_count,
countStateIf(missing_host_header = true) as missing_host_header_count,
groupArrayStateIf(86400)(toUnixTimestamp(ts), missing_host_header = false) as ts_list,
groupArrayStateIf(86400)(c.src_ip_bytes, missing_host_header = false) as src_ip_bytes_list,
groupArrayStateIf(86400)(c.src_bytes, missing_host_header = false) as src_ip_bytes_list,
sumStateIf(c.src_ip_bytes, missing_host_header = false) as total_src_ip_bytes,
sumStateIf(c.dst_ip_bytes, missing_host_header = false) as total_dst_ip_bytes,
sumStateIf(c.src_bytes, missing_host_header = false) as total_src_bytes,
@@ -1021,7 +1021,7 @@ func (db *DB) createUSNIConnTable(ctx context.Context) error {
countState() as count,
uniqExactState(ts) as unique_ts_count,
groupArrayState(86400)(toUnixTimestamp(ts)) as ts_list,
groupArrayState(86400)(s.src_ip_bytes) as src_ip_bytes_list,
groupArrayState(86400)(s.src_bytes) as src_ip_bytes_list,
sumState(s.src_ip_bytes) as total_src_ip_bytes,
sumState(s.dst_ip_bytes) as total_dst_ip_bytes,
sumState(s.src_bytes) as total_src_bytes,
@@ -1060,7 +1060,7 @@ func (db *DB) createUSNIConnTable(ctx context.Context) error {
countStateIf(proxy = true) AS proxy_count,
uniqExactState(ts) as unique_ts_count,
groupArrayState(86400)(toUnixTimestamp(ts)) as ts_list,
groupArrayState(86400)(h.src_ip_bytes) as src_ip_bytes_list,
groupArrayState(86400)(h.src_bytes) as src_ip_bytes_list,
sumState(h.src_ip_bytes) as total_src_ip_bytes,
sumState(h.dst_ip_bytes) as total_dst_ip_bytes,
sumState(h.src_bytes) as total_src_bytes,