|
| 1 | +<?xml version="1.0" encoding="utf-8"?> |
| 2 | +<databaseChangeLog |
| 3 | + xmlns="http://www.liquibase.org/xml/ns/dbchangelog" |
| 4 | + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
| 5 | + xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd"> |
| 6 | + |
| 7 | + <changeSet id="20251107002" author="Manuel"> |
| 8 | + <!-- filters --> |
| 9 | + <update tableName="utm_visualization"> |
| 10 | + <column name="filters" valueComputed="REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(filters::text, 'log.winlog.event_id', 'log.winlogEventId'), 'log.winlog.event_data.SubjectUserName', 'log.winlogEventDataSubjectUserName'), 'log.winlog.event_data.TargetUserName', 'log.winlogEventDataTargetUserName'), 'log.winlog.event_data.NewProcessName.keyword', 'winlogEventDataProcessName.keyword'), 'log.winlog.event.code.keyword', 'log.eventCode'), 'log.winlog.event_name.keyword', 'log.eventName'), 'log.winlog.event_data.SubjectUserSid.keyword', 'log.winlogEventDataSubjectUserSid'), 'log.winlog.beat.hostname.keyword', 'dataSource.keyword'), 'log.winlog.event_data.LogonType.keyword', 'log.winlogEventDataLogonType.keyword')::json"/> |
| 11 | + <where> |
| 12 | + filters::text LIKE '%log.winlog.event_id%' OR |
| 13 | + filters::text LIKE '%log.winlog.event_data.SubjectUserName%' OR |
| 14 | + filters::text LIKE '%log.winlog.event_data.TargetUserName%' OR |
| 15 | + filters::text LIKE '%log.winlog.event_data.NewProcessName.keyword%' OR |
| 16 | + filters::text LIKE '%log.winlog.event.code.keyword%' OR |
| 17 | + filters::text LIKE '%log.winlog.event_name.keyword%' OR |
| 18 | + filters::text LIKE '%log.winlog.event_data.SubjectUserSid.keyword%' OR |
| 19 | + filters::text LIKE '%log.winlog.beat.hostname.keyword%' OR |
| 20 | + filters::text LIKE '%log.winlog.event_data.LogonType.keyword%' |
| 21 | + </where> |
| 22 | + </update> |
| 23 | + |
| 24 | + <!-- aggregation --> |
| 25 | + <update tableName="utm_visualization"> |
| 26 | + <column name="aggregation" valueComputed="REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(aggregation::text, 'log.winlog.event_id', 'log.winlogEventId'), 'log.winlog.event_data.SubjectUserName', 'log.winlogEventDataSubjectUserName'), 'log.winlog.event_data.TargetUserName', 'log.winlogEventDataTargetUserName'), 'log.winlog.event_data.NewProcessName.keyword', 'winlogEventDataProcessName.keyword'), 'log.winlog.event.code.keyword', 'log.eventCode'), 'log.winlog.event_name.keyword', 'log.eventName'), 'log.winlog.event_data.SubjectUserSid.keyword', 'log.winlogEventDataSubjectUserSid'), 'log.winlog.beat.hostname.keyword', 'dataSource.keyword'), 'log.winlog.event_data.LogonType.keyword', 'log.winlogEventDataLogonType.keyword')::json"/> |
| 27 | + <where> |
| 28 | + aggregation::text LIKE '%log.winlog.event_id%' OR |
| 29 | + aggregation::text LIKE '%log.winlog.event_data.SubjectUserName%' OR |
| 30 | + aggregation::text LIKE '%log.winlog.event_data.TargetUserName%' OR |
| 31 | + aggregation::text LIKE '%log.winlog.event_data.NewProcessName.keyword%' OR |
| 32 | + aggregation::text LIKE '%log.winlog.event.code.keyword%' OR |
| 33 | + aggregation::text LIKE '%log.winlog.event_name.keyword%' OR |
| 34 | + aggregation::text LIKE '%log.winlog.event_data.SubjectUserSid.keyword%' OR |
| 35 | + aggregation::text LIKE '%log.winlog.beat.hostname.keyword%' OR |
| 36 | + aggregation::text LIKE '%log.winlog.event_data.LogonType.keyword%' |
| 37 | + </where> |
| 38 | + </update> |
| 39 | + |
| 40 | + <rollback> |
| 41 | + <!-- filters rollback --> |
| 42 | + <update tableName="utm_visualization"> |
| 43 | + <column name="filters" valueComputed="REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(filters::text, 'log.winlogEventDataLogonType.keyword', 'log.winlog.event_data.LogonType.keyword'), 'dataSource.keyword', 'log.winlog.beat.hostname.keyword'), 'log.winlogEventDataSubjectUserSid', 'log.winlog.event_data.SubjectUserSid.keyword'), 'log.eventName', 'log.winlog.event_name.keyword'), 'log.eventCode', 'log.winlog.event.code.keyword'), 'winlogEventDataProcessName.keyword', 'log.winlog.event_data.NewProcessName.keyword'), 'log.winlogEventDataTargetUserName', 'log.winlog.event_data.TargetUserName'), 'log.winlogEventDataSubjectUserName', 'log.winlog.event_data.SubjectUserName'), 'log.winlogEventId', 'log.winlog.event_id')::json"/> |
| 44 | + <where> |
| 45 | + filters::text LIKE '%log.winlogEventId%' OR |
| 46 | + filters::text LIKE '%log.winlogEventDataSubjectUserName%' OR |
| 47 | + filters::text LIKE '%log.winlogEventDataTargetUserName%' OR |
| 48 | + filters::text LIKE '%winlogEventDataProcessName.keyword%' OR |
| 49 | + filters::text LIKE '%log.eventCode%' OR |
| 50 | + filters::text LIKE '%log.eventName%' OR |
| 51 | + filters::text LIKE '%log.winlogEventDataSubjectUserSid%' OR |
| 52 | + filters::text LIKE '%dataSource.keyword%' OR |
| 53 | + filters::text LIKE '%log.winlogEventDataLogonType.keyword%' |
| 54 | + </where> |
| 55 | + </update> |
| 56 | + |
| 57 | + <!-- aggregation rollback --> |
| 58 | + <update tableName="utm_visualization"> |
| 59 | + <column name="aggregation" valueComputed="REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(aggregation::text, 'log.winlogEventDataLogonType.keyword', 'log.winlog.event_data.LogonType.keyword'), 'dataSource.keyword', 'log.winlog.beat.hostname.keyword'), 'log.winlogEventDataSubjectUserSid', 'log.winlog.event_data.SubjectUserSid.keyword'), 'log.eventName', 'log.winlog.event_name.keyword'), 'log.eventCode', 'log.winlog.event.code.keyword'), 'winlogEventDataProcessName.keyword', 'log.winlog.event_data.NewProcessName.keyword'), 'log.winlogEventDataTargetUserName', 'log.winlog.event_data.TargetUserName'), 'log.winlogEventDataSubjectUserName', 'log.winlog.event_data.SubjectUserName'), 'log.winlogEventId', 'log.winlog.event_id')::json"/> |
| 60 | + <where> |
| 61 | + aggregation::text LIKE '%log.winlogEventId%' OR |
| 62 | + aggregation::text LIKE '%log.winlogEventDataSubjectUserName%' OR |
| 63 | + aggregation::text LIKE '%log.winlogEventDataTargetUserName%' OR |
| 64 | + aggregation::text LIKE '%winlogEventDataProcessName.keyword%' OR |
| 65 | + aggregation::text LIKE '%log.eventCode%' OR |
| 66 | + aggregation::text LIKE '%log.eventName%' OR |
| 67 | + aggregation::text LIKE '%log.winlogEventDataSubjectUserSid%' OR |
| 68 | + aggregation::text LIKE '%dataSource.keyword%' OR |
| 69 | + aggregation::text LIKE '%log.winlogEventDataLogonType.keyword%' |
| 70 | + </where> |
| 71 | + </update> |
| 72 | + </rollback> |
| 73 | + </changeSet> |
| 74 | + |
| 75 | +</databaseChangeLog> |
0 commit comments