Skip to content

Commit 9b41fb1

Browse files
mjabascal10mjabascal10
committed
feat(chore): add Liquibase changelogs for visualization updates and module activation
1 parent e0009e1 commit 9b41fb1

File tree

5 files changed

+284
-0
lines changed

5 files changed

+284
-0
lines changed

‎backend/src/main/resources/config/liquibase/changelog/20260122001_update_is_activatable_macos_module.xml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
6+
7+
<changeSet id="20260122001" author="manuel">
8+
9+
<update tableName="utm_module">
10+
<column name="is_activatable" value="false"/>
11+
<column name="module_active" value="true"/>
12+
<where> module_name = 'MACOS' </where>
13+
</update>
14+
15+
<update tableName="utm_menu">
16+
<column name="menu_active" value="true"/>
17+
<where> name = 'MacOS' </where>
18+
</update>
19+
20+
</changeSet>
21+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/changelog/20260122002_update_o365_visualizations_filters.xml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
6+
7+
<changeSet id="20260122002" author="Manuel Abascal">
8+
9+
<sql dbms="postgresql" splitStatements="true" stripComments="true">
10+
<![CDATA[
11+
12+
------------------------------------------------------------------
13+
-- Filters field replacements (safe one-by-one updates)
14+
------------------------------------------------------------------
15+
16+
UPDATE utm_visualization SET filters = REPLACE(filters,'emailVerdict.keyword','log.Verdict.keyword') WHERE filters IS NOT NULL;
17+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.P2Sender.keyword','log.P2Sender.keyword') WHERE filters IS NOT NULL;
18+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.DetectionMethod.keyword','log.DetectionMethod.keyword') WHERE filters IS NOT NULL;
19+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.logonError.keyword','log.LogonError.keyword') WHERE filters IS NOT NULL;
20+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.OrganizationName.keyword','log.OrganizationName.keyword') WHERE filters IS NOT NULL;
21+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.ClientIPAddress.keyword','log.clientIp.keyword') WHERE filters IS NOT NULL;
22+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.MailboxOwnerUPN.keyword','log.MailboxOwnerUPN.keyword') WHERE filters IS NOT NULL;
23+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.MailboxOwnerSid.keyword','log.MailboxOwnerSid.keyword') WHERE filters IS NOT NULL;
24+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.ClientInfoString.keyword','log.ClientInfoString.keyword') WHERE filters IS NOT NULL;
25+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.Operation','action.keyword') WHERE filters IS NOT NULL;
26+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.Platform.keyword','log.Platform.keyword') WHERE filters IS NOT NULL;
27+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.TargetUserOrGroupType.keyword','log.TargetUserOrGroupType.keyword') WHERE filters IS NOT NULL;
28+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.Severity.keyword','log.Severity.keyword') WHERE filters IS NOT NULL;
29+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.OriginatingServer.keyword','log.OriginatingServer.keyword') WHERE filters IS NOT NULL;
30+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.SourceFileExtension.keyword','log.SourceFileExtension.keyword') WHERE filters IS NOT NULL;
31+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.UserType','log.UserType.keyword') WHERE filters IS NOT NULL;
32+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.GeoLocation.keyword','log.GeoLocation.keyword') WHERE filters IS NOT NULL;
33+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.ObjectId.keyword','log.ObjectId.keyword') WHERE filters IS NOT NULL;
34+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.SourceFileName.keyword','log.SourceFileName.keyword') WHERE filters IS NOT NULL;
35+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.SiteUrl.keyword','log.SiteUrl.keyword') WHERE filters IS NOT NULL;
36+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.AppAccessContext.ClientAppName.keyword','log.appAccessContextClientAppId.keyword') WHERE filters IS NOT NULL;
37+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.CorrelationId.keyword','log.CorrelationId.keyword') WHERE filters IS NOT NULL;
38+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.ApplicationDisplayName.keyword','log.ApplicationDisplayName.keyword') WHERE filters IS NOT NULL;
39+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.UserAgent.keyword','log.UserAgent.keyword') WHERE filters IS NOT NULL;
40+
41+
------------------------------------------------------------------
42+
-- ExternalAccess and LogonType
43+
------------------------------------------------------------------
44+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.ExternalAccess','log.ExternalAccess.keyword') WHERE filters IS NOT NULL;
45+
UPDATE utm_visualization SET filters = REPLACE(filters,'log.o365.LogonType','log.LogonType.keyword') WHERE filters IS NOT NULL;
46+
47+
]]>
48+
</sql>
49+
50+
</changeSet>
51+
52+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/changelog/20260122003_update_o365_visualizations_agg.xml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
6+
7+
<changeSet id="20260122003" author="Manuel Abascal">
8+
9+
<sql dbms="postgresql" splitStatements="true" stripComments="true">
10+
<![CDATA[
11+
12+
------------------------------------------------------------------
13+
-- Aggregation field replacements (safe one-by-one updates)
14+
------------------------------------------------------------------
15+
16+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'emailVerdict.keyword','log.Verdict.keyword') WHERE aggregation IS NOT NULL;
17+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.P2Sender.keyword','log.P2Sender.keyword') WHERE aggregation IS NOT NULL;
18+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.DetectionMethod.keyword','log.DetectionMethod.keyword') WHERE aggregation IS NOT NULL;
19+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.logonError.keyword','log.LogonError.keyword') WHERE aggregation IS NOT NULL;
20+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.OrganizationName.keyword','log.OrganizationName.keyword') WHERE aggregation IS NOT NULL;
21+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.ClientIPAddress.keyword','log.clientIp.keyword') WHERE aggregation IS NOT NULL;
22+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.MailboxOwnerUPN.keyword','log.MailboxOwnerUPN.keyword') WHERE aggregation IS NOT NULL;
23+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.MailboxOwnerSid.keyword','log.MailboxOwnerSid.keyword') WHERE aggregation IS NOT NULL;
24+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.ClientInfoString.keyword','log.ClientInfoString.keyword') WHERE aggregation IS NOT NULL;
25+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.Operation','action.keyword') WHERE aggregation IS NOT NULL;
26+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.Platform.keyword','log.Platform.keyword') WHERE aggregation IS NOT NULL;
27+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.TargetUserOrGroupType.keyword','log.TargetUserOrGroupType.keyword') WHERE aggregation IS NOT NULL;
28+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.Severity.keyword','log.Severity.keyword') WHERE aggregation IS NOT NULL;
29+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.OriginatingServer.keyword','log.OriginatingServer.keyword') WHERE aggregation IS NOT NULL;
30+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.SourceFileExtension.keyword','log.SourceFileExtension.keyword') WHERE aggregation IS NOT NULL;
31+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.UserType','log.UserType.keyword') WHERE aggregation IS NOT NULL;
32+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.GeoLocation.keyword','log.GeoLocation.keyword') WHERE aggregation IS NOT NULL;
33+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.ObjectId.keyword','log.ObjectId.keyword') WHERE aggregation IS NOT NULL;
34+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.SourceFileName.keyword','log.SourceFileName.keyword') WHERE aggregation IS NOT NULL;
35+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.SiteUrl.keyword','log.SiteUrl.keyword') WHERE aggregation IS NOT NULL;
36+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.AppAccessContext.ClientAppName.keyword','log.appAccessContextClientAppId.keyword') WHERE aggregation IS NOT NULL;
37+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.CorrelationId.keyword','log.CorrelationId.keyword') WHERE aggregation IS NOT NULL;
38+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.ApplicationDisplayName.keyword','log.ApplicationDisplayName.keyword') WHERE aggregation IS NOT NULL;
39+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.UserAgent.keyword','log.UserAgent.keyword') WHERE aggregation IS NOT NULL;
40+
41+
------------------------------------------------------------------
42+
-- ExternalAccess and LogonType
43+
------------------------------------------------------------------
44+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.ExternalAccess','log.ExternalAccess.keyword') WHERE aggregation IS NOT NULL;
45+
UPDATE utm_visualization SET aggregation = REPLACE(aggregation,'log.o365.LogonType','log.LogonType.keyword') WHERE aggregation IS NOT NULL;
46+
47+
------------------------------------------------------------------
48+
-- Replace origin.ip.keyword for specific IDs
49+
------------------------------------------------------------------
50+
UPDATE utm_visualization
51+
SET aggregation = REPLACE(aggregation, 'origin.ip.keyword', 'log.SenderIp.keyword')
52+
WHERE id IN (532, 470)
53+
AND aggregation IS NOT NULL;
54+
55+
]]>
56+
</sql>
57+
58+
</changeSet>
59+
60+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/changelog/20260122004_update_azure_visualizations.xml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
6+
7+
<changeSet id="20260122004" author="Manuel Abascal">
8+
9+
<sql dbms="postgresql" splitStatements="true" stripComments="true">
10+
<![CDATA[
11+
12+
------------------------------------------------------------------
13+
-- Azure: requestUri → og.propertiesRequestUri.keyword
14+
------------------------------------------------------------------
15+
UPDATE utm_visualization
16+
SET filters = REPLACE(filters,
17+
'log.azure.properties.requestUri.keyword',
18+
'log.propertiesRequestUri.keyword')
19+
WHERE filters IS NOT NULL;
20+
21+
UPDATE utm_visualization
22+
SET aggregation = REPLACE(aggregation,
23+
'log.azure.properties.requestUri.keyword',
24+
'log.propertiesRequestUri.keyword')
25+
WHERE aggregation IS NOT NULL;
26+
27+
28+
------------------------------------------------------------------
29+
-- Azure: operationName → log.operationName.keyword
30+
------------------------------------------------------------------
31+
UPDATE utm_visualization
32+
SET filters = REPLACE(filters,
33+
'log.azure.operationName.keyword',
34+
'log.operationName.keyword')
35+
WHERE filters IS NOT NULL;
36+
37+
UPDATE utm_visualization
38+
SET aggregation = REPLACE(aggregation,
39+
'log.azure.operationName.keyword',
40+
'log.operationName.keyword')
41+
WHERE aggregation IS NOT NULL;
42+
43+
44+
------------------------------------------------------------------
45+
-- Azure: resourceUri → log.resourceId.keyword
46+
------------------------------------------------------------------
47+
UPDATE utm_visualization
48+
SET filters = REPLACE(filters,
49+
'log.azure.resourceUri.keyword',
50+
'log.resourceId.keyword')
51+
WHERE filters IS NOT NULL;
52+
53+
UPDATE utm_visualization
54+
SET aggregation = REPLACE(aggregation,
55+
'log.azure.resourceUri.keyword',
56+
'log.resourceId.keyword')
57+
WHERE aggregation IS NOT NULL;
58+
59+
60+
------------------------------------------------------------------
61+
-- Azure: message → log.operationName.keyword
62+
------------------------------------------------------------------
63+
UPDATE utm_visualization
64+
SET filters = REPLACE(filters,
65+
'log.azure.message',
66+
'log.operationName.keyword')
67+
WHERE filters IS NOT NULL;
68+
69+
UPDATE utm_visualization
70+
SET aggregation = REPLACE(aggregation,
71+
'log.azure.message',
72+
'log.operationName.keyword')
73+
WHERE aggregation IS NOT NULL;
74+
75+
76+
------------------------------------------------------------------
77+
-- Visualización 569: override completo de filtros
78+
------------------------------------------------------------------
79+
UPDATE utm_visualization
80+
SET filters = '[{"operator":"IS_BETWEEN","field":"@timestamp","value":["now-24h","now"]},{"operator":"IS","field":"log.operationName.keyword","value":"Sign-in activity"}]'
81+
WHERE id = 569;
82+
83+
84+
------------------------------------------------------------------
85+
-- Azure: clientIp → origin.ip.keyword
86+
------------------------------------------------------------------
87+
UPDATE utm_visualization
88+
SET filters = REPLACE(filters,
89+
'log.azure.properties.clientIp.keyword',
90+
'origin.ip.keyword')
91+
WHERE filters IS NOT NULL;
92+
93+
UPDATE utm_visualization
94+
SET aggregation = REPLACE(aggregation,
95+
'log.azure.properties.clientIp.keyword',
96+
'origin.ip.keyword')
97+
WHERE aggregation IS NOT NULL;
98+
99+
100+
------------------------------------------------------------------
101+
-- Azure: message → log.message.keyword
102+
------------------------------------------------------------------
103+
UPDATE utm_visualization
104+
SET filters = REPLACE(filters,
105+
'log.azure.properties.message.keyword',
106+
'log.message.keyword')
107+
WHERE filters IS NOT NULL;
108+
109+
UPDATE utm_visualization
110+
SET aggregation = REPLACE(aggregation,
111+
'log.azure.properties.message.keyword',
112+
'log.message.keyword')
113+
WHERE aggregation IS NOT NULL;
114+
115+
116+
------------------------------------------------------------------
117+
-- Azure: category.localizedValue → log.category.keyword
118+
------------------------------------------------------------------
119+
UPDATE utm_visualization
120+
SET filters = REPLACE(filters,
121+
'log.azure.category.localizedValue.keyword',
122+
'log.category.keyword')
123+
WHERE filters IS NOT NULL;
124+
125+
UPDATE utm_visualization
126+
SET aggregation = REPLACE(aggregation,
127+
'log.azure.category.localizedValue.keyword',
128+
'log.category.keyword')
129+
WHERE aggregation IS NOT NULL;
130+
131+
132+
------------------------------------------------------------------
133+
-- DELETE visualización con id = 805
134+
------------------------------------------------------------------
135+
DELETE FROM utm_visualization
136+
WHERE id = 805;
137+
138+
]]>
139+
</sql>
140+
141+
</changeSet>
142+
143+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/master.xml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,4 +311,12 @@
311311

312312
<include file="/config/liquibase/changelog/20251203001_add_column_sqlQuery_to_visualization.xml" relativeToChangelogFile="false"/>
313313

314+
<include file="/config/liquibase/changelog/20260122001_update_is_activatable_macos_module.xml" relativeToChangelogFile="false"/>
315+
316+
<include file="/config/liquibase/changelog/20260122002_update_o365_visualizations_filters.xml" relativeToChangelogFile="false"/>
317+
318+
<include file="/config/liquibase/changelog/20260122003_update_o365_visualizations_agg.xml" relativeToChangelogFile="false"/>
319+
320+
<include file="/config/liquibase/changelog/20260122004_update_azure_visualizations.xml" relativeToChangelogFile="false"/>
321+
314322
</databaseChangeLog>

0 commit comments

Comments
 (0)