Snort_AIPreproc/schemas/mysql.sql

83 lines
2.1 KiB
MySQL
Raw Normal View History

DROP TABLE IF EXISTS ca_ipv4_headers;
CREATE TABLE ca_ipv4_headers (
ip_hdr_id integer auto_increment,
ip_tos integer,
ip_len integer,
ip_id integer,
ip_ttl integer,
ip_proto integer,
ip_src_addr varchar(32),
ip_dst_addr varchar(32),
primary key(ip_hdr_id)
);
DROP TABLE IF EXISTS ca_tcp_headers;
CREATE TABLE ca_tcp_headers (
tcp_hdr_id integer auto_increment,
tcp_src_port integer,
tcp_dst_port integer,
tcp_seq integer,
tcp_ack integer,
tcp_flags integer,
tcp_window integer,
tcp_len integer,
primary key(tcp_hdr_id)
);
2010-10-05 04:01:35 +02:00
DROP TABLE IF EXISTS ca_clustered_alerts;
CREATE TABLE ca_clustered_alerts (
cluster_id integer auto_increment,
clustered_srcip varchar(255) default null,
clustered_dstip varchar(255) default null,
clustered_srcport varchar(255) default null,
clustered_dstport varchar(255) default null,
2010-10-05 04:01:35 +02:00
primary key(cluster_id)
);
DROP TABLE IF EXISTS ca_alerts;
CREATE TABLE ca_alerts (
alert_id integer auto_increment,
gid integer,
sid integer,
rev integer,
priority integer,
description varchar(255),
classification varchar(255),
timestamp datetime,
2010-10-05 04:01:35 +02:00
ip_hdr integer default 0,
tcp_hdr integer default 0,
cluster_id integer default 0,
primary key(alert_id),
foreign key(ip_hdr) references ca_ip_headers(ip_hdr_id),
foreign key(tcp_hdr) references ca_tcp_headers(tcp_hdr_id),
foreign key(cluster_id) references ca_clustered_alerts(cluster_id)
);
2010-10-05 04:01:35 +02:00
DROP TABLE IF EXISTS ca_packet_streams;
CREATE TABLE ca_packet_streams (
pkt_id integer auto_increment,
alert_id integer,
pkt_len integer,
timestamp datetime,
content longblob,
2010-10-05 04:01:35 +02:00
primary key(pkt_id),
foreign key(alert_id) references ca_alerts(alert_id)
);
DROP TABLE IF EXISTS ca_correlated_alerts;
CREATE TABLE ca_correlated_alerts (
alert1 integer,
alert2 integer,
correlation_coeff double,
primary key(alert1, alert2),
foreign key(alert1) references ca_alerts(alert_id),
foreign key(alert2) references ca_alerts(alert_id)
);