OSSIM主要数据库表结构
对于从事OSSIM开发的技术人员，最主要的需要知道OSSIM库里的多种表结构，下面举几个典型事例：
/* ======== config表 ======== */
DROP TABLE IF EXISTS conf;
CREATE TABLE conf (
recovery int NOT NULL,
threshold int NOT NULL,
graph_threshold int NOT NULL,
bar_length_left int NOT NULL,
bar_length_right int NOT NULL,
PRIMARY KEY (recovery, threshold, graph_threshold,
bar_length_left, bar_length_right)
);
/* ======== hosts & nets表 ======== */
DROP TABLE IF EXISTS host;
CREATE TABLE host (
ip varchar(15) UNIQUE NOT NULL,
hostname varchar(128) NOT NULL,
asset smallint(6) NOT NULL,
threshold_c int NOT NULL,
threshold_a int NOT NULL,
alert int NOT NULL,
persistence int NOT NULL,
nat varchar(15),
descr varchar(255),
PRIMARY KEY (ip)
);
DROP TABLE IF EXISTS scan;
CREATE TABLE scan (
ip varchar(15) UNIQUE NOT NULL,
active int NOT NULL,
PRIMARY KEY (ip)
);
DROP TABLE IF EXISTS net;
CREATE TABLE net (
name varchar(128) UNIQUE NOT NULL,
ips varchar(255) NOT NULL,
priority int NOT NULL,
threshold_c int NOT NULL,
threshold_a int NOT NULL,
alert int NOT NULL,
persistence int NOT NULL,
descr varchar(255),
PRIMARY KEY (name)
);
DROP TABLE IF EXISTS net_host_reference;
CREATE TABLE net_host_reference (
net_name varchar(128) NOT NULL,
host_ip varchar(15) NOT NULL,
PRIMARY KEY (net_name,host_ip)
);
/* ======== signatures表 ======== */
DROP TABLE IF EXISTS signature_group;
CREATE TABLE signature_group (
name varchar(64) NOT NULL,
descr varchar(255),
PRIMARY KEY (name)
);
DROP TABLE IF EXISTS signature;
CREATE TABLE signature (
name varchar(64) NOT NULL,
PRIMARY KEY (name)
);
DROP TABLE IF EXISTS signature_group_reference;
CREATE TABLE signature_group_reference (
sig_group_name varchar(64) NOT NULL,
sig_name varchar(64) NOT NULL,
PRIMARY KEY (sig_group_name, sig_name)
);
/* ======== ports表 ======== */
DROP TABLE IF EXISTS port_group;
CREATE TABLE port_group (
name varchar(64) NOT NULL,
descr varchar(255),
PRIMARY KEY (name)
);
DROP TABLE IF EXISTS port;
CREATE TABLE port (
port_number int NOT NULL,
protocol_name varchar(12) NOT NULL,
service varchar(64),
descr varchar(255),
PRIMARY KEY (port_number,protocol_name)
);
DROP TABLE IF EXISTS port_group_reference;
CREATE TABLE port_group_reference (
port_group_name varchar(64) NOT NULL,
port_number int NOT NULL,
protocol_name varchar(12) NOT NULL,
PRIMARY KEY (port_group_name, port_number, protocol_name)
);
DROP TABLE IF EXISTS protocol;
CREATE TABLE protocol (
id int NOT NULL,
name varchar(24) NOT NULL,
alias varchar(24),
descr varchar(255) NOT NULL,
PRIMARY KEY (id)
);
/* ======== sensors表 ======== */
DROP TABLE IF EXISTS sensor;
CREATE TABLE sensor (
name varchar(64) NOT NULL,
ip varchar(15) NOT NULL,
priority smallint NOT NULL,
port int NOT NULL,
connect smallint NOT NULL,
/* sig_group_id int NOT NULL, */
descr varchar(255) NOT NULL,
PRIMARY KEY (name)
);
DROP TABLE IF EXISTS host_sensor_reference;
CREATE TABLE host_sensor_reference (
host_ip varchar(15) NOT NULL,
sensor_name varchar(64) NOT NULL,
PRIMARY KEY (host_ip, sensor_name)
);
DROP TABLE IF EXISTS net_sensor_reference;
CREATE TABLE net_sensor_reference (
net_name varchar(15) NOT NULL,
sensor_name varchar(64) NOT NULL,
PRIMARY KEY (net_name, sensor_name)
);
/* ======== policy 表======== */
DROP TABLE IF EXISTS policy;
CREATE TABLE policy (
id int NOT NULL auto_increment,
priority smallint NOT NULL,
descr varchar(255),
PRIMARY KEY (id)
);
DROP TABLE IF EXISTS policy_port_reference;
CREATE TABLE policy_port_reference (
policy_id int NOT NULL,
port_group_name varchar(64) NOT NULL,
PRIMARY KEY (policy_id, port_group_name)
);
DROP TABLE IF EXISTS policy_host_reference;
CREATE TABLE policy_host_reference (
policy_id int NOT NULL,
host_ip varchar(15) NOT NULL,
direction enum (‘source‘, ‘dest‘) NOT NULL,
PRIMARY KEY (policy_id, host_ip, direction)
);
DROP TABLE IF EXISTS policy_net_reference;
CREATE TABLE policy_net_reference (
policy_id int NOT NULL,
net_name varchar(64) NOT NULL,
direction enum (‘source‘, ‘dest‘) NOT NULL,
PRIMARY KEY (policy_id, net_name, direction)
);
DROP TABLE IF EXISTS policy_sensor_reference;
CREATE TABLE policy_sensor_reference (
policy_id int NOT NULL,
sensor_name varchar(64) NOT NULL,
PRIMARY KEY (policy_id, sensor_name)
);
DROP TABLE IF EXISTS policy_sig_reference;
CREATE TABLE policy_sig_reference (
policy_id int NOT NULL,
sig_group_name varchar(64) NOT NULL,
PRIMARY KEY (policy_id, sig_group_name)
);
DROP TABLE IF EXISTS policy_time;
CREATE TABLE policy_time (
policy_id int NOT NULL,
begin_hour smallint NOT NULL,
end_hour smallint NOT NULL,
begin_day smallint NOT NULL,
end_day smallint NOT NULL,
PRIMARY KEY (policy_id)
);
/* ======== qualification表 ======== */
DROP TABLE IF EXISTS host_qualification;
CREATE TABLE host_qualification (
host_ip varchar(15) NOT NULL,
compromise int NOT NULL DEFAULT 1,
attack int NOT NULL DEFAULT 1,
PRIMARY KEY (host_ip)
);
DROP TABLE IF EXISTS net_qualification;
CREATE TABLE net_qualification (
net_name varchar(64) NOT NULL,
compromise int NOT NULL DEFAULT 1,
attack int NOT NULL DEFAULT 1,
PRIMARY KEY (net_name)
);
DROP TABLE IF EXISTS host_vulnerability;
CREATE TABLE host_vulnerability (
ip varchar(15) NOT NULL,
vulnerability int NOT NULL DEFAULT 1,
PRIMARY KEY (ip)
);
DROP TABLE IF EXISTS net_vulnerability;
CREATE TABLE net_vulnerability (
net varchar(15) NOT NULL,
vulnerability int NOT NULL DEFAULT 1,
PRIMARY KEY (net)
);
DROP TABLE IF EXISTS control_panel_host;
CREATE TABLE control_panel_host (
host_ip varchar(15) NOT NULL,
time_range varchar(5) NOT NULL DEFAULT ‘day‘,
max_c int NOT NULL,
max_a int NOT NULL,
max_c_date datetime,
max_a_date datetime,
avg_c int NOT NULL,
avg_a int NOT NULL,
PRIMARY KEY (host_ip, time_range)
);
DROP TABLE IF EXISTS control_panel_net;
CREATE TABLE control_panel_net (
net_name varchar(15) NOT NULL,
time_range varchar(5) NOT NULL DEFAULT ‘day‘,
max_c int NOT NULL,
max_a int NOT NULL,
max_c_date datetime,
max_a_date datetime,
avg_c int NOT NULL,
avg_a int NOT NULL,
PRIMARY KEY (net_name, time_range)
);
DROP TABLE IF EXISTS host_mac;
CREATE TABLE host_mac (
ip varchar(15) UNIQUE NOT NULL,
mac varchar(255) NOT NULL,
previous varchar(255) NOT NULL,
anom int NOT NULL,
mac_time varchar(100) NOT NULL,
PRIMARY KEY (ip)
);
DROP TABLE IF EXISTS host_os;
CREATE TABLE host_os (
ip varchar(15) UNIQUE NOT NULL,
os varchar(255) NOT NULL,
previous varchar(255) NOT NULL,
anom int NOT NULL,
os_time varchar(100) NOT NULL,
PRIMARY KEY (ip)
);
DROP TABLE IF EXISTS host_services;
CREATE TABLE host_services (
ip varchar(15) NOT NULL,
service varchar(128) NOT NULL,
version varchar(255) NOT NULL,
PRIMARY KEY (ip, service, version)
);
DROP TABLE IF EXISTS host_netbios;
CREATE TABLE host_netbios (
ip varchar(15) NOT NULL,
name varchar(128) NOT NULL,
wgroup varchar(128),
PRIMARY KEY (ip)
);
DROP TABLE IF EXISTS rrd_conf;
CREATE TABLE rrd_conf (
ip varchar(15) UNIQUE NOT NULL,
pkt_sent varchar(60) NOT NULL,
pkt_rcvd varchar(60) NOT NULL,
bytes_sent varchar(60) NOT NULL,
bytes_rcvd varchar(60) NOT NULL,
tot_contacted_sent_peersvarchar(60) NOT NULL,
tot_contacted_rcvd_peersvarchar(60) NOT NULL,
ip_dns_sent_bytes varchar(60) NOT NULL,
ip_dns_rcvd_bytes varchar(60) NOT NULL,
ip_nbios_ip_sent_bytesvarchar(60) NOT NULL,
ip_nbios_ip_rcvd_bytesvarchar(60) NOT NULL,
ip_mail_sent_bytes varchar(60) NOT NULL,
ip_mail_rcvd_bytes varchar(60) NOT NULL,
mrtg_a varchar(60) NOT NULL,
mrtg_c varchar(60) NOT NULL,
PRIMARY KEY (ip)
);
DROP TABLE IF EXISTS rrd_anomalies;
CREATE TABLE rrd_anomalies (
ip varchar(15) NOT NULL,
what varchar(100) NOT NULL,
count int NOT NULL,
anomaly_time varchar(40) NOT NULL,
range varchar(30) NOT NULL,
over int NOT NULL,
acked int DEFAULT 0
);
DROP TABLE IF EXISTS rrd_conf_global;
CREATE TABLE rrd_conf_global (
active_host_senders_num VARCHAR(60) NOT NULL,
arp_rarp_bytes VARCHAR(60) NOT NULL,
broadcast_pkts VARCHAR(60) NOT NULL,
ethernet_bytes VARCHAR(60) NOT NULL,
ethernet_pkts VARCHAR(60) NOT NULL,
icmp_bytes VARCHAR(60) NOT NULL,
igmp_bytes VARCHAR(60) NOT NULL,
ip_bytes VARCHAR(60) NOT NULL,
ip_dhcp_bootp_bytes VARCHAR(60) NOT NULL,
ip_dns_bytes VARCHAR(60) NOT NULL,
ip_edonkey_bytes VARCHAR(60) NOT NULL,
ip_ftp_bytes VARCHAR(60) NOT NULL,
ip_gnutella_bytes VARCHAR(60) NOT NULL,
ip_http_bytes VARCHAR(60) NOT NULL,
ip_kazaa_bytes VARCHAR(60) NOT NULL,
ip_mail_bytes VARCHAR(60) NOT NULL,
ip_messenger_bytes VARCHAR(60) NOT NULL,
ip_nbios_ip_bytes VARCHAR(60) NOT NULL,
ip_nfs_bytes VARCHAR(60) NOT NULL,
ip_nttp_bytes VARCHAR(60) NOT NULL,
ip_snmp_bytes VARCHAR(60) NOT NULL,
ip_ssh_bytes VARCHAR(60) NOT NULL,
ip_telnet_bytes VARCHAR(60) NOT NULL,
ip_winmx_bytes VARCHAR(60) NOT NULL,
ip_x11_bytes VARCHAR(60) NOT NULL,
ipx_bytes VARCHAR(60) NOT NULL,
known_hosts_num VARCHAR(60) NOT NULL,
multicast_pkts VARCHAR(60) NOT NULL,
ospf_bytes VARCHAR(60) NOT NULL,
other_bytes VARCHAR(60) NOT NULL,
tcp_bytes VARCHAR(60) NOT NULL,
udp_bytes VARCHAR(60) NOT NULL,
up_to_1024_pkts VARCHAR(60) NOT NULL,
up_to_128_pkts VARCHAR(60) NOT NULL,
up_to_1518_pkts VARCHAR(60) NOT NULL,
up_to_512_pkts VARCHAR(60) NOT NULL,
up_to_64_pkts VARCHAR(60) NOT NULL
);
DROP TABLE IF EXISTS rrd_anomalies_global;
CREATE TABLE rrd_anomalies_global (
what varchar(100) NOT NULL,
count int NOT NULL,
anomaly_time varchar(40) NOT NULL,
range varchar(30) NOT NULL,
over int NOT NULL,
acked int DEFAULT 0
);
--
-- Table: Category表
--
DROP TABLE IF EXISTS category;
CREATE TABLE category (
idINTEGER NOT NULL,
nameVARCHAR (100) NOT NULL,
PRIMARY KEY (id)
);
--
-- Table: Classification表
--
DROP TABLE IF EXISTS classification;
CREATE TABLE classification (
idINTEGER NOT NULL,
nameVARCHAR (100) NOT NULL,
descriptionTEXT,
priorityINTEGER,
PRIMARY KEY (id)
);
--
-- Table: Plugin表
--
DROP TABLE IF EXISTS plugin;
CREATE TABLE plugin (
idINTEGER NOT NULL,
typeSMALLINT NOT NULL,
nameVARCHAR (100) NOT NULL,
descriptionTEXT,
PRIMARY KEY (id)
);
--
-- Table: Plugin Sid表
--
DROP TABLE IF EXISTS plugin_sid;
CREATE TABLE plugin_sid (
plugin_idINTEGER NOT NULL,
sidINTEGER NOT NULL,
category_idINTEGER,
class_idINTEGER,
reliabilityINTEGER DEFAULT 1,
priorityINTEGER DEFAULT 1,
nameVARCHAR (255) NOT NULL,
PRIMARY KEY (plugin_id, sid)
);
--
-- Table: Alert表
--
DROP TABLE IF EXISTS alert;
CREATE TABLE alert (
idBIGINT NOT NULL AUTO_INCREMENT,
timestampTIMESTAMP,
sensorTEXT NOT NULL,
interfaceTEXT NOT NULL,
typeINTEGER NOT NULL,
plugin_idINTEGER NOT NULL,
plugin_sidINTEGER,
protocolINTEGER,
src_ipINTEGER UNSIGNED,
dst_ipINTEGER UNSIGNED,
src_portINTEGER,
dst_portINTEGER,
conditionINTEGER,
valueTEXT,
time_intervalINTEGER,
absoluteTINYINT,
priorityINTEGER DEFAULT 1,
reliabilityINTEGER DEFAULT 1,
asset_srcINTEGER DEFAULT 1,
asset_dstINTEGER DEFAULT 1,
risk_aINTEGER DEFAULT 1,
risk_cINTEGER DEFAULT 1,
alarm TINYINT DEFAULT 1,
PRIMARY KEY (id)
);
--
-- Table: Backlog表
--
DROP TABLE IF EXISTS backlog;
CREATE TABLE backlog (
utimeBIGINT NOT NULL,
idINTEGER NOT NULL,
nameTEXT,
rule_levelINTEGER,
rule_typeTINYINT,
rule_nameTEXT,
occurrence INTEGER,
time_outINTEGER,
matchedTINYINT,
plugin_idINTEGER,
plugin_sidINTEGER,
src_ipINTEGER UNSIGNED,
dst_ipINTEGER UNSIGNED,
src_portINTEGER,
dst_portINTEGER,
condition INTEGER,
valueTEXT,
time_intervalINTEGER,
absoluteTINYINT,
priorityINTEGER,
reliability INTEGER,
PRIMARY KEY (utime, id)
);
--
-- Table: plugin_reference表
--
DROP TABLE IF EXISTS plugin_reference;
CREATE TABLE plugin_reference (
plugin_idINTEGER NOT NULL,
plugin_sidINTEGER NOT NULL,
reference_idINTEGER NOT NULL,
reference_sidINTEGER NOT NULL,
PRIMARY KEY (plugin_id, plugin_sid, reference_id, reference_sid)
);
--
-- Table: Host plugin sid表
--
DROP TABLE IF EXISTS host_plugin_sid;
CREATE TABLE host_plugin_sid (
host_ip INTEGER UNSIGNED NOT NULL,
plugin_idINTEGER NOT NULL,
plugin_sidINTEGER NOT NULL,
PRIMARY KEY (host_ip, plugin_id, plugin_sid)
);
--
-- Table: Host scan表
--
DROP TABLE IF EXISTS host_scan;
CREATE TABLE host_scan (
host_ip INTEGER UNSIGNED NOT NULL,
plugin_idINTEGER NOT NULL,
plugin_sidINTEGER NOT NULL,
PRIMARY KEY (host_ip, plugin_id, plugin_sid)
);
有关OSSIM更多内容请参阅《开源安全运维平台-OSSIM最佳实践》一书。