first sync
This commit is contained in:
148
sql/install.sql
Normal file
148
sql/install.sql
Normal file
@@ -0,0 +1,148 @@
|
||||
-- Plugin SIEM-Wazuh - Installation script
|
||||
|
||||
-- Table des serveurs Wazuh
|
||||
CREATE TABLE IF NOT EXISTS `glpi_plugin_siem_wazuh_servers` (
|
||||
`id` INT(11) NOT NULL AUTO_INCREMENT,
|
||||
`name` VARCHAR(255) NOT NULL COMMENT 'Nom de la connexion',
|
||||
`wazuh_url` VARCHAR(255) NOT NULL COMMENT 'URL du serveur Wazuh',
|
||||
`wazuh_port` INT(11) DEFAULT 55000 COMMENT 'Port API Wazuh',
|
||||
`wazuh_login` VARCHAR(255) NOT NULL COMMENT 'Login API Wazuh',
|
||||
`wazuh_password` TEXT NOT NULL COMMENT 'Mot de passe API Wazuh (crypté)',
|
||||
`indexer_url` VARCHAR(255) DEFAULT NULL COMMENT 'URL du serveur Indexer',
|
||||
`indexer_port` INT(11) DEFAULT 9200 COMMENT 'Port API Indexer',
|
||||
`indexer_login` VARCHAR(255) DEFAULT NULL COMMENT 'Login API Indexer',
|
||||
`indexer_password` TEXT DEFAULT NULL COMMENT 'Mot de passe API Indexer (crypté)',
|
||||
`sync_interval` INT(11) DEFAULT 300 COMMENT 'Intervalle de synchronisation en secondes',
|
||||
`is_active` TINYINT(1) DEFAULT 1 COMMENT 'Serveur actif',
|
||||
`last_sync` DATETIME DEFAULT NULL COMMENT 'Dernière synchronisation',
|
||||
`ticket_type` INT(11) DEFAULT 1 COMMENT 'Type de ticket par défaut',
|
||||
`ticket_category` INT(11) DEFAULT NULL COMMENT 'Catégorie de ticket par défaut',
|
||||
`date_creation` DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
`date_mod` DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
|
||||
PRIMARY KEY (`id`),
|
||||
INDEX `is_active` (`is_active`),
|
||||
INDEX `last_sync` (`last_sync`),
|
||||
INDEX `name` (`name`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
|
||||
|
||||
-- Table des alertes Wazuh
|
||||
CREATE TABLE IF NOT EXISTS `glpi_plugin_siem_wazuh_alerts` (
|
||||
`id` INT(11) NOT NULL AUTO_INCREMENT,
|
||||
`wazuh_server_id` INT(11) NOT NULL COMMENT 'ID du serveur Wazuh',
|
||||
`alert_id` VARCHAR(255) NOT NULL COMMENT 'ID unique de l\'alerte Wazuh',
|
||||
`rule_id` INT(11) DEFAULT NULL COMMENT 'ID de la règle Wazuh',
|
||||
`rule_level` INT(11) DEFAULT NULL COMMENT 'Niveau de la règle',
|
||||
`rule_description` TEXT DEFAULT NULL COMMENT 'Description de la règle',
|
||||
`agent_id` VARCHAR(255) DEFAULT NULL COMMENT 'ID de l\'agent Wazuh',
|
||||
`agent_name` VARCHAR(255) DEFAULT NULL COMMENT 'Nom de l\'agent Wazuh',
|
||||
`agent_ip` VARCHAR(45) DEFAULT NULL COMMENT 'IP de l\'agent',
|
||||
`timestamp` DATETIME NOT NULL COMMENT 'Timestamp de l\'alerte',
|
||||
`raw_data` LONGTEXT DEFAULT NULL COMMENT 'Données brutes de l\'alerte (JSON)',
|
||||
`computer_id` INT(11) DEFAULT NULL COMMENT 'ID de l\'ordinateur GLPI associé',
|
||||
`networkequipment_id` INT(11) DEFAULT NULL COMMENT 'ID de l\'équipement réseau GLPI associé',
|
||||
`peripheral_id` INT(11) DEFAULT NULL COMMENT 'ID du périphérique GLPI associé',
|
||||
`phone_id` INT(11) DEFAULT NULL COMMENT 'ID du téléphone GLPI associé',
|
||||
`printer_id` INT(11) DEFAULT NULL COMMENT 'ID de l\'imprimante GLPI associée',
|
||||
`ticket_id` INT(11) DEFAULT NULL COMMENT 'ID du ticket GLPI créé',
|
||||
`status` ENUM('new', 'processed', 'ignored', 'ticket_created') DEFAULT 'new',
|
||||
`severity` ENUM('low', 'medium', 'high', 'critical') DEFAULT 'medium',
|
||||
`date_creation` DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
`date_mod` DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
|
||||
PRIMARY KEY (`id`),
|
||||
UNIQUE KEY `unique_alert` (`wazuh_server_id`, `alert_id`),
|
||||
INDEX `agent_name` (`agent_name`),
|
||||
INDEX `agent_ip` (`agent_ip`),
|
||||
INDEX `status` (`status`),
|
||||
INDEX `severity` (`severity`),
|
||||
INDEX `timestamp` (`timestamp`),
|
||||
INDEX `rule_level` (`rule_level`),
|
||||
INDEX `computer_id` (`computer_id`),
|
||||
INDEX `networkequipment_id` (`networkequipment_id`),
|
||||
INDEX `peripheral_id` (`peripheral_id`),
|
||||
INDEX `phone_id` (`phone_id`),
|
||||
INDEX `printer_id` (`printer_id`),
|
||||
INDEX `ticket_id` (`ticket_id`),
|
||||
FOREIGN KEY (`wazuh_server_id`) REFERENCES `glpi_plugin_siem_wazuh_servers` (`id`) ON DELETE CASCADE
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
|
||||
|
||||
-- Table de configuration
|
||||
CREATE TABLE IF NOT EXISTS `glpi_plugin_siem_wazuh_config` (
|
||||
`id` INT(11) NOT NULL AUTO_INCREMENT,
|
||||
`name` VARCHAR(255) NOT NULL COMMENT 'Nom du paramètre',
|
||||
`value` TEXT DEFAULT NULL COMMENT 'Valeur du paramètre',
|
||||
`context` VARCHAR(100) DEFAULT 'global' COMMENT 'Contexte du paramètre',
|
||||
`date_creation` DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
`date_mod` DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
|
||||
PRIMARY KEY (`id`),
|
||||
UNIQUE KEY `name_context` (`name`, `context`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
|
||||
|
||||
-- Table des profils/droits
|
||||
CREATE TABLE IF NOT EXISTS `glpi_plugin_siem_wazuh_profiles` (
|
||||
`id` INT(11) NOT NULL AUTO_INCREMENT,
|
||||
`profiles_id` INT(11) NOT NULL COMMENT 'ID du profil GLPI',
|
||||
`wazuh_config` CHAR(1) DEFAULT NULL COMMENT 'Droit configuration Wazuh',
|
||||
`wazuh_server` CHAR(1) DEFAULT NULL COMMENT 'Droit serveur Wazuh',
|
||||
`wazuh_alert` CHAR(1) DEFAULT NULL COMMENT 'Droit alerte Wazuh',
|
||||
PRIMARY KEY (`id`),
|
||||
UNIQUE KEY `profiles_id` (`profiles_id`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
|
||||
|
||||
-- Table de logs
|
||||
CREATE TABLE IF NOT EXISTS `glpi_plugin_siem_wazuh_logs` (
|
||||
`id` INT(11) NOT NULL AUTO_INCREMENT,
|
||||
`wazuh_server_id` INT(11) DEFAULT NULL COMMENT 'ID du serveur Wazuh',
|
||||
`level` ENUM('debug', 'info', 'warning', 'error', 'critical') DEFAULT 'info',
|
||||
`message` TEXT NOT NULL,
|
||||
`context` JSON DEFAULT NULL COMMENT 'Contexte supplémentaire',
|
||||
`date_creation` DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
PRIMARY KEY (`id`),
|
||||
INDEX `level` (`level`),
|
||||
INDEX `wazuh_server_id` (`wazuh_server_id`),
|
||||
INDEX `date_creation` (`date_creation`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
|
||||
|
||||
-- Table des règles de correspondance
|
||||
CREATE TABLE IF NOT EXISTS `glpi_plugin_siem_wazuh_rules` (
|
||||
`id` INT(11) NOT NULL AUTO_INCREMENT,
|
||||
`name` VARCHAR(255) NOT NULL COMMENT 'Nom de la règle',
|
||||
`wazuh_rule_id` INT(11) DEFAULT NULL COMMENT 'ID de la règle Wazuh',
|
||||
`wazuh_rule_level` INT(11) DEFAULT NULL COMMENT 'Niveau de la règle Wazuh',
|
||||
`pattern_agent_name` VARCHAR(255) DEFAULT NULL COMMENT 'Pattern nom agent',
|
||||
`pattern_agent_ip` VARCHAR(255) DEFAULT NULL COMMENT 'Pattern IP agent',
|
||||
`ticket_type` INT(11) DEFAULT 1 COMMENT 'Type de ticket à créer',
|
||||
`ticket_category` INT(11) DEFAULT NULL COMMENT 'Catégorie de ticket',
|
||||
`ticket_priority` INT(11) DEFAULT 3 COMMENT 'Priorité du ticket',
|
||||
`ticket_urgency` INT(11) DEFAULT 3 COMMENT 'Urgence du ticket',
|
||||
`ticket_impact` INT(11) DEFAULT 3 COMMENT 'Impact du ticket',
|
||||
`auto_assign` TINYINT(1) DEFAULT 0 COMMENT 'Assignment automatique',
|
||||
`assigned_to` INT(11) DEFAULT NULL COMMENT 'Utilisateur assigné',
|
||||
`assigned_group` INT(11) DEFAULT NULL COMMENT 'Groupe assigné',
|
||||
`is_active` TINYINT(1) DEFAULT 1,
|
||||
`date_creation` DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
`date_mod` DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
|
||||
PRIMARY KEY (`id`),
|
||||
INDEX `wazuh_rule_id` (`wazuh_rule_id`),
|
||||
INDEX `wazuh_rule_level` (`wazuh_rule_level`),
|
||||
INDEX `is_active` (`is_active`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
|
||||
|
||||
-- Insertion des données par défaut
|
||||
INSERT INTO `glpi_plugin_siem_wazuh_config` (`name`, `value`, `context`) VALUES
|
||||
('auto_create_ticket', '1', 'global'),
|
||||
('default_ticket_priority', '3', 'global'),
|
||||
('default_ticket_urgency', '3', 'global'),
|
||||
('default_ticket_impact', '3', 'global'),
|
||||
('alert_retention_days', '90', 'global'),
|
||||
('sync_enabled', '1', 'global'),
|
||||
('max_alerts_per_sync', '100', 'global'),
|
||||
('notification_enabled', '1', 'global'),
|
||||
('min_rule_level', '5', 'global'),
|
||||
('debug_mode', '0', 'global');
|
||||
|
||||
-- Insertion des règles par défaut
|
||||
INSERT INTO `glpi_plugin_siem_wazuh_rules` (`name`, `wazuh_rule_level`, `ticket_type`, `ticket_priority`, `is_active`) VALUES
|
||||
('Alertes critiques (niveau 12+)', 12, 1, 5, 1),
|
||||
('Alertes élevées (niveau 10-11)', 10, 1, 4, 1),
|
||||
('Alertes moyennes (niveau 7-9)', 7, 1, 3, 1),
|
||||
('Alertes faibles (niveau 5-6)', 5, 1, 2, 0);
|
||||
46
sql/uninstall.sql
Normal file
46
sql/uninstall.sql
Normal file
@@ -0,0 +1,46 @@
|
||||
-- Plugin SIEM-Wazuh - Uninstallation script
|
||||
|
||||
-- Désactivation des contraintes de clés étrangères temporairement
|
||||
SET FOREIGN_KEY_CHECKS = 0;
|
||||
|
||||
-- Suppression des tables dans l'ordre inverse des dépendances
|
||||
DROP TABLE IF EXISTS `glpi_plugin_siem_wazuh_logs`;
|
||||
DROP TABLE IF EXISTS `glpi_plugin_siem_wazuh_rules`;
|
||||
DROP TABLE IF EXISTS `glpi_plugin_siem_wazuh_alerts`;
|
||||
DROP TABLE IF EXISTS `glpi_plugin_siem_wazuh_profiles`;
|
||||
DROP TABLE IF EXISTS `glpi_plugin_siem_wazuh_config`;
|
||||
DROP TABLE IF EXISTS `glpi_plugin_siem_wazuh_servers`;
|
||||
|
||||
-- Réactivation des contraintes de clés étrangères
|
||||
SET FOREIGN_KEY_CHECKS = 1;
|
||||
|
||||
-- Suppression des droits du plugin
|
||||
DELETE FROM `glpi_profilerights` WHERE `name` LIKE 'plugin_siem_wazuh_%';
|
||||
|
||||
-- Suppression des tâches cron
|
||||
DELETE FROM `glpi_crontasks` WHERE `itemtype` LIKE 'PluginSiemWazuh%';
|
||||
|
||||
-- Suppression des notifications
|
||||
DELETE FROM `glpi_notifications` WHERE `itemtype` LIKE 'PluginSiemWazuh%';
|
||||
DELETE FROM `glpi_notificationtemplates` WHERE `itemtype` LIKE 'PluginSiemWazuh%';
|
||||
|
||||
-- Suppression des événements de log
|
||||
DELETE FROM `glpi_events` WHERE `type` = 'siem-wazuh';
|
||||
|
||||
-- Suppression des configurations dans la table des configurations générales
|
||||
DELETE FROM `glpi_configs` WHERE `name` LIKE 'plugin_siem_wazuh_%';
|
||||
|
||||
-- Suppression des préférences utilisateur liées au plugin
|
||||
DELETE FROM `glpi_users_configs` WHERE `name` LIKE 'plugin_siem_wazuh_%';
|
||||
|
||||
-- Nettoyage des liens avec les tickets (optionnel - conserve les tickets créés)
|
||||
-- UPDATE `glpi_tickets` SET `content` = REPLACE(`content`, '[WAZUH-ALERT]', '') WHERE `content` LIKE '%[WAZUH-ALERT]%';
|
||||
|
||||
-- Nettoyage des recherches sauvegardées liées au plugin
|
||||
DELETE FROM `glpi_savedsearches` WHERE `type` LIKE 'PluginSiemWazuh%';
|
||||
|
||||
-- Suppression des affichages personnalisés
|
||||
DELETE FROM `glpi_displaypreferences` WHERE `itemtype` LIKE 'PluginSiemWazuh%';
|
||||
|
||||
-- Suppression des options de recherche personnalisées
|
||||
DELETE FROM `glpi_searchoptions` WHERE `itemtype` LIKE 'PluginSiemWazuh%';
|
||||
Reference in New Issue
Block a user