52 lines
2.2 KiB
SQL
52 lines
2.2 KiB
SQL
CREATE TABLE bell_rules (
|
|
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
code text NOT NULL UNIQUE,
|
|
name text NOT NULL,
|
|
enabled boolean NOT NULL DEFAULT true,
|
|
event_type text,
|
|
minimum_severity text NOT NULL CHECK (minimum_severity IN ('low','medium','high','critical')),
|
|
location_contains text,
|
|
version integer NOT NULL DEFAULT 1 CHECK (version > 0),
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now()
|
|
);
|
|
CREATE TABLE bell_alerts (
|
|
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
primary_rule_id uuid NOT NULL REFERENCES bell_rules(id),
|
|
correlation_key text NOT NULL,
|
|
status text NOT NULL DEFAULT 'open' CHECK (status IN ('open','acknowledged','closed')),
|
|
severity text NOT NULL CHECK (severity IN ('low','medium','high','critical')),
|
|
summary text NOT NULL,
|
|
location text NOT NULL,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now()
|
|
);
|
|
CREATE UNIQUE INDEX bell_alert_open_correlation_idx ON bell_alerts(primary_rule_id,correlation_key) WHERE status='open';
|
|
CREATE INDEX bell_alerts_page_idx ON bell_alerts(created_at DESC,id DESC);
|
|
CREATE TABLE bell_alert_events (
|
|
alert_id uuid NOT NULL REFERENCES bell_alerts(id),
|
|
event_id uuid NOT NULL REFERENCES bell_events(id),
|
|
linked_at timestamptz NOT NULL DEFAULT now(),
|
|
PRIMARY KEY(alert_id,event_id)
|
|
);
|
|
CREATE INDEX bell_alert_events_event_idx ON bell_alert_events(event_id,alert_id);
|
|
CREATE TABLE bell_rule_matches (
|
|
alert_id uuid NOT NULL REFERENCES bell_alerts(id),
|
|
event_id uuid NOT NULL REFERENCES bell_events(id),
|
|
rule_id uuid NOT NULL REFERENCES bell_rules(id),
|
|
rule_version integer NOT NULL,
|
|
rule_snapshot jsonb NOT NULL,
|
|
explanation text NOT NULL,
|
|
matched_at timestamptz NOT NULL DEFAULT now(),
|
|
PRIMARY KEY(event_id,rule_id)
|
|
);
|
|
CREATE TABLE bell_rule_evaluations (
|
|
event_id uuid NOT NULL REFERENCES bell_events(id),
|
|
rule_id uuid NOT NULL REFERENCES bell_rules(id),
|
|
rule_version integer NOT NULL,
|
|
matched boolean NOT NULL,
|
|
explanation text NOT NULL,
|
|
evaluated_at timestamptz NOT NULL DEFAULT now(),
|
|
PRIMARY KEY(event_id,rule_id)
|
|
);
|