docs: ТЗ v1.0, планы и схема SAC (фаза 0)

Security Alert Center — документация без кода приложения. - TZ, архитектура, интеграция агентов (UseSAC) - JSON Schema событий v1, deployment Ubuntu 24.04 - План работ, roadmap, multi-root workspace
2026-05-26 19:54:47 +10:00
commit 4f3adc9429
17 changed files with 1702 additions and 0 deletions
@@ -0,0 +1,167 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://git.kalinamall.ru/PapaTramp/security-alert-center/schemas/event-v1.json",
+  "title": "Security Alert Center Event v1",
+  "description": "Каноническое событие от ssh-monitor или RDP-login-monitor",
+  "type": "object",
+  "required": [
+    "schema_version",
+    "event_id",
+    "occurred_at",
+    "source",
+    "host",
+    "category",
+    "type",
+    "severity",
+    "title",
+    "summary"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": {
+      "type": "string",
+      "const": "1.0"
+    },
+    "event_id": {
+      "type": "string",
+      "format": "uuid",
+      "description": "UUID v4, уникален глобально, для идемпотентности"
+    },
+    "occurred_at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 с offset, время события на хосте"
+    },
+    "source": {
+      "type": "object",
+      "required": ["product", "product_version"],
+      "additionalProperties": false,
+      "properties": {
+        "product": {
+          "type": "string",
+          "enum": ["ssh-monitor", "rdp-login-monitor"]
+        },
+        "product_version": {
+          "type": "string"
+        },
+        "agent_instance_id": {
+          "type": "string",
+          "description": "Стабильный ID установки агента"
+        }
+      }
+    },
+    "host": {
+      "type": "object",
+      "required": ["hostname", "os_family"],
+      "additionalProperties": false,
+      "properties": {
+        "hostname": { "type": "string" },
+        "display_name": { "type": "string" },
+        "fqdn": { "type": "string" },
+        "os_family": {
+          "type": "string",
+          "enum": ["linux", "windows"]
+        },
+        "os_version": { "type": "string" },
+        "ipv4": { "type": "string" },
+        "ipv6": { "type": "string" },
+        "timezone": {
+          "type": "string",
+          "description": "IANA, например Europe/Moscow"
+        }
+      }
+    },
+    "category": {
+      "type": "string",
+      "enum": [
+        "auth",
+        "privilege",
+        "network",
+        "session",
+        "report",
+        "agent"
+      ]
+    },
+    "type": {
+      "type": "string",
+      "description": "Машиночитаемый тип, см. docs/agent-integration.md",
+      "examples": [
+        "ssh.login.success",
+        "ssh.login.failed",
+        "privilege.sudo.command",
+        "ssh.ip.banned",
+        "ssh.bruteforce.mass",
+        "session.logind.new",
+        "rdp.login.success",
+        "rdp.login.failed",
+        "rdg.connection.success",
+        "report.daily.ssh",
+        "agent.heartbeat",
+        "agent.test"
+      ]
+    },
+    "severity": {
+      "type": "string",
+      "enum": ["info", "warning", "high", "critical"]
+    },
+    "title": {
+      "type": "string",
+      "maxLength": 256
+    },
+    "summary": {
+      "type": "string",
+      "description": "Человекочитаемый текст (как в Telegram сейчас)",
+      "maxLength": 8192
+    },
+    "details": {
+      "type": "object",
+      "description": "Структурированные поля по типу события",
+      "additionalProperties": true
+    },
+    "raw": {
+      "type": "object",
+      "properties": {
+        "format": {
+          "type": "string",
+          "enum": ["journal", "windows_event_xml", "text"]
+        },
+        "payload": {
+          "type": "string",
+          "maxLength": 16384
+        }
+      },
+      "additionalProperties": false
+    },
+    "tags": {
+      "type": "array",
+      "items": { "type": "string", "maxLength": 64 },
+      "maxItems": 32
+    },
+    "dedup_key": {
+      "type": "string",
+      "maxLength": 512
+    },
+    "correlation_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "fingerprint": {
+      "type": "string",
+      "maxLength": 128
+    },
+    "enrichment": {
+      "type": "object",
+      "additionalProperties": true,
+      "properties": {
+        "attempt_number": { "type": "integer", "minimum": 0 },
+        "threshold": { "type": "integer", "minimum": 0 },
+        "risk_level": {
+          "type": "string",
+          "enum": ["low", "medium", "high", "critical"]
+        },
+        "filtered_out": { "type": "boolean" },
+        "filter_reason": { "type": "string" }
+      }
+    }
+  }
+}