53 lines
2.1 KiB
Python
53 lines
2.1 KiB
Python
"""add_detection_rules_table
|
|
|
|
Revision ID: b009detectionrules
|
|
Revises: b008datasources
|
|
Create Date: 2026-02-09 14:10:00.000000
|
|
|
|
"""
|
|
from typing import Sequence, Union
|
|
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
from sqlalchemy.dialects.postgresql import UUID, JSONB
|
|
|
|
|
|
# revision identifiers, used by Alembic.
|
|
revision: str = 'b009detectionrules'
|
|
down_revision: Union[str, Sequence[str], None] = 'b008datasources'
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
|
depends_on: Union[str, Sequence[str], None] = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
"""Create detection_rules table."""
|
|
op.create_table(
|
|
'detection_rules',
|
|
sa.Column('id', UUID(as_uuid=True), primary_key=True),
|
|
sa.Column('mitre_technique_id', sa.String(), nullable=False),
|
|
sa.Column('title', sa.String(), nullable=False),
|
|
sa.Column('description', sa.Text(), nullable=True),
|
|
sa.Column('source', sa.String(), nullable=False),
|
|
sa.Column('source_id', sa.String(), nullable=True),
|
|
sa.Column('source_url', sa.String(), nullable=True),
|
|
sa.Column('rule_content', sa.Text(), nullable=False),
|
|
sa.Column('rule_format', sa.String(), nullable=False),
|
|
sa.Column('severity', sa.String(), nullable=True),
|
|
sa.Column('platforms', JSONB(), nullable=True),
|
|
sa.Column('log_sources', JSONB(), nullable=True),
|
|
sa.Column('false_positive_rate', sa.String(), nullable=True),
|
|
sa.Column('is_active', sa.Boolean(), server_default='true'),
|
|
sa.Column('created_at', sa.DateTime(), server_default=sa.func.now()),
|
|
)
|
|
op.create_index('ix_detection_rules_mitre_technique_id', 'detection_rules', ['mitre_technique_id'])
|
|
op.create_index('ix_detection_rules_source', 'detection_rules', ['source'])
|
|
op.create_index('ix_detection_rules_severity', 'detection_rules', ['severity'])
|
|
|
|
|
|
def downgrade() -> None:
|
|
"""Drop detection_rules table."""
|
|
op.drop_index('ix_detection_rules_severity', table_name='detection_rules')
|
|
op.drop_index('ix_detection_rules_source', table_name='detection_rules')
|
|
op.drop_index('ix_detection_rules_mitre_technique_id', table_name='detection_rules')
|
|
op.drop_table('detection_rules')
|