|
|
|
@@ -1,313 +0,0 @@
|
|
|
|
|
<script setup lang="ts">
|
|
|
|
|
import {
|
|
|
|
|
NButton,
|
|
|
|
|
NInput,
|
|
|
|
|
NModal,
|
|
|
|
|
NPopconfirm,
|
|
|
|
|
NSelect,
|
|
|
|
|
NSwitch,
|
|
|
|
|
type SelectOption,
|
|
|
|
|
} from 'naive-ui'
|
|
|
|
|
import { computed, reactive, ref, watch } from 'vue'
|
|
|
|
|
|
|
|
|
|
import {
|
|
|
|
|
createAlertRule,
|
|
|
|
|
deleteAlertRule,
|
|
|
|
|
listAlertRules,
|
|
|
|
|
updateAlertRule,
|
|
|
|
|
} from '@/api/logevents'
|
|
|
|
|
import { listNotifyTemplates } from '@/api/settings'
|
|
|
|
|
import AppInputNumber from '@/components/AppInputNumber.vue'
|
|
|
|
|
import FormField from '@/components/FormField.vue'
|
|
|
|
|
import NotifyTemplateModal from '@/components/settings/NotifyTemplateModal.vue'
|
|
|
|
|
import TenantPicker from '@/components/TenantPicker.vue'
|
|
|
|
|
import { eventLabel } from '@/composables/useEventLabel'
|
|
|
|
|
import { useAsync } from '@/composables/useAsync'
|
|
|
|
|
import { useScopeStore } from '@/stores/scope'
|
|
|
|
|
import type { AlertRule, AlertRuleBody, NotifyTemplateItem } from '@/types/api'
|
|
|
|
|
import { useToast } from '@/composables/useToast'
|
|
|
|
|
|
|
|
|
|
const show = defineModel<boolean>('show', { required: true })
|
|
|
|
|
|
|
|
|
|
const message = useToast()
|
|
|
|
|
const scope = useScopeStore()
|
|
|
|
|
|
|
|
|
|
/** 可选事件短名 = 回传链路的关键事件清单(Connector 侧 filter 一致) */
|
|
|
|
|
const RELAY_EVENTS = [
|
|
|
|
|
'LaunchInstance', 'TerminateInstance', 'InstanceAction',
|
|
|
|
|
'CreateUser', 'DeleteUser', 'UpdateUser',
|
|
|
|
|
'CreateApiKey', 'DeleteApiKey', 'UpdateUserCapabilities',
|
|
|
|
|
'CreateRegionSubscription', 'CreatePolicy', 'UpdatePolicy', 'DeletePolicy',
|
|
|
|
|
'InteractiveLogin',
|
|
|
|
|
]
|
|
|
|
|
const eventOptions: SelectOption[] = RELAY_EVENTS.map((e) => ({
|
|
|
|
|
value: e,
|
|
|
|
|
label: eventLabel(e) ? `${eventLabel(e)}(${e})` : e,
|
|
|
|
|
}))
|
|
|
|
|
|
|
|
|
|
const rules = useAsync(listAlertRules, false)
|
|
|
|
|
watch(show, (v) => {
|
|
|
|
|
if (v) void rules.run()
|
|
|
|
|
})
|
|
|
|
|
|
|
|
|
|
// ---- 编辑表单:editing 非 null 时进入表单视图,id=0 表示新建 ----
|
|
|
|
|
const editing = ref<AlertRule | null>(null)
|
|
|
|
|
const saving = ref(false)
|
|
|
|
|
const form = reactive({
|
|
|
|
|
name: '',
|
|
|
|
|
enabled: true,
|
|
|
|
|
cfgId: null as number | null,
|
|
|
|
|
eventTypes: [] as string[],
|
|
|
|
|
sourceIps: '',
|
|
|
|
|
sourceIpMode: 'in' as 'in' | 'notin',
|
|
|
|
|
resourceMatch: '',
|
|
|
|
|
threshold: 1 as number | null,
|
|
|
|
|
windowMinutes: 5 as number | null,
|
|
|
|
|
})
|
|
|
|
|
|
|
|
|
|
function openCreate() {
|
|
|
|
|
editing.value = {
|
|
|
|
|
id: 0, name: '', enabled: true, ociConfigId: 0, eventTypes: '', sourceIps: '',
|
|
|
|
|
sourceIpMode: 'in', resourceMatch: '', threshold: 1, windowMinutes: 5,
|
|
|
|
|
createdAt: '', updatedAt: '',
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function openEdit(rule: AlertRule) {
|
|
|
|
|
editing.value = rule
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 进入表单时由所编辑规则回填
|
|
|
|
|
watch(editing, (r) => {
|
|
|
|
|
if (!r) return
|
|
|
|
|
form.name = r.name
|
|
|
|
|
form.enabled = r.enabled
|
|
|
|
|
form.cfgId = r.ociConfigId || null
|
|
|
|
|
form.eventTypes = r.eventTypes ? r.eventTypes.split(',') : []
|
|
|
|
|
form.sourceIps = r.sourceIps
|
|
|
|
|
form.sourceIpMode = r.sourceIpMode || 'in'
|
|
|
|
|
form.resourceMatch = r.resourceMatch
|
|
|
|
|
form.threshold = r.threshold || 1
|
|
|
|
|
form.windowMinutes = r.windowMinutes || 5
|
|
|
|
|
})
|
|
|
|
|
|
|
|
|
|
function buildBody(): AlertRuleBody {
|
|
|
|
|
return {
|
|
|
|
|
name: form.name.trim(),
|
|
|
|
|
enabled: form.enabled,
|
|
|
|
|
ociConfigId: form.cfgId ?? 0,
|
|
|
|
|
eventTypes: form.eventTypes.join(','),
|
|
|
|
|
sourceIps: form.sourceIps.trim(),
|
|
|
|
|
sourceIpMode: form.sourceIpMode,
|
|
|
|
|
resourceMatch: form.resourceMatch.trim(),
|
|
|
|
|
threshold: form.threshold ?? 1,
|
|
|
|
|
windowMinutes: form.windowMinutes ?? 5,
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
async function save() {
|
|
|
|
|
if (!editing.value) return
|
|
|
|
|
saving.value = true
|
|
|
|
|
try {
|
|
|
|
|
const body = buildBody()
|
|
|
|
|
if (editing.value.id) await updateAlertRule(editing.value.id, body)
|
|
|
|
|
else await createAlertRule(body)
|
|
|
|
|
message.success(editing.value.id ? '规则已更新' : '规则已创建')
|
|
|
|
|
editing.value = null
|
|
|
|
|
void rules.run()
|
|
|
|
|
} catch (e) {
|
|
|
|
|
message.error(e instanceof Error ? e.message : '保存失败')
|
|
|
|
|
} finally {
|
|
|
|
|
saving.value = false
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/** 列表行的启停开关:就地整体覆盖保存 */
|
|
|
|
|
async function toggleRule(rule: AlertRule, enabled: boolean) {
|
|
|
|
|
try {
|
|
|
|
|
await updateAlertRule(rule.id, { ...rule, enabled })
|
|
|
|
|
rule.enabled = enabled
|
|
|
|
|
} catch (e) {
|
|
|
|
|
message.error(e instanceof Error ? e.message : '操作失败')
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
async function removeRule(rule: AlertRule) {
|
|
|
|
|
try {
|
|
|
|
|
await deleteAlertRule(rule.id)
|
|
|
|
|
message.success(`已删除「${rule.name}」`)
|
|
|
|
|
void rules.run()
|
|
|
|
|
} catch (e) {
|
|
|
|
|
message.error(e instanceof Error ? e.message : '删除失败')
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/** 条件摘要:留空条件不出现 */
|
|
|
|
|
function ruleSummary(r: AlertRule): string {
|
|
|
|
|
const parts: string[] = []
|
|
|
|
|
const alias = scope.cfgOptions.find((o) => Number(o.value) === r.ociConfigId)?.label
|
|
|
|
|
parts.push(r.ociConfigId ? `租户 ${alias ?? `#${r.ociConfigId}`}` : '全部租户')
|
|
|
|
|
parts.push(r.eventTypes ? `${r.eventTypes.split(',').length} 种事件` : '全部事件')
|
|
|
|
|
if (r.sourceIps) parts.push(`IP ${r.sourceIpMode === 'notin' ? '不在' : '命中'} ${r.sourceIps}`)
|
|
|
|
|
if (r.resourceMatch) parts.push(`资源含「${r.resourceMatch}」`)
|
|
|
|
|
parts.push(r.threshold > 1 ? `${r.windowMinutes} 分钟内 ${r.threshold} 次` : '即时触发')
|
|
|
|
|
return parts.join(' · ')
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// ---- 通知模板入口:复用设置页模板编辑弹窗(kind=audit_alert) ----
|
|
|
|
|
const templates = useAsync(listNotifyTemplates, false)
|
|
|
|
|
const tplShow = ref(false)
|
|
|
|
|
const tplItem = ref<NotifyTemplateItem | null>(null)
|
|
|
|
|
|
|
|
|
|
async function openTemplate() {
|
|
|
|
|
if (!templates.data.value) await templates.run()
|
|
|
|
|
const item = (templates.data.value ?? []).find((t) => t.kind === 'audit_alert')
|
|
|
|
|
if (!item) {
|
|
|
|
|
message.error('模板加载失败,请稍后再试')
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
tplItem.value = item
|
|
|
|
|
tplShow.value = true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
const canSave = computed(() => !!form.name.trim())
|
|
|
|
|
</script>
|
|
|
|
|
|
|
|
|
|
<template>
|
|
|
|
|
<NModal
|
|
|
|
|
v-model:show="show"
|
|
|
|
|
preset="card"
|
|
|
|
|
closable
|
|
|
|
|
title="审计告警规则"
|
|
|
|
|
:style="{ width: '680px', maxWidth: 'calc(100vw - 24px)' }"
|
|
|
|
|
>
|
|
|
|
|
<!-- 表单视图 -->
|
|
|
|
|
<div v-if="editing" class="flex flex-col">
|
|
|
|
|
<FormField label="规则名称" required>
|
|
|
|
|
<NInput v-model:value="form.name" placeholder="如:非白名单终止实例" />
|
|
|
|
|
</FormField>
|
|
|
|
|
<div class="grid grid-cols-2 gap-3 max-md:grid-cols-1">
|
|
|
|
|
<FormField label="租户范围" hint="留空对全部租户生效">
|
|
|
|
|
<TenantPicker
|
|
|
|
|
v-model:value="form.cfgId"
|
|
|
|
|
clearable
|
|
|
|
|
placeholder="全部租户"
|
|
|
|
|
:configs="scope.configs.data ?? []"
|
|
|
|
|
:loading="scope.configs.loading"
|
|
|
|
|
/>
|
|
|
|
|
</FormField>
|
|
|
|
|
<FormField label="事件类型" hint="留空匹配全部回传事件">
|
|
|
|
|
<NSelect
|
|
|
|
|
v-model:value="form.eventTypes"
|
|
|
|
|
multiple
|
|
|
|
|
clearable
|
|
|
|
|
:options="eventOptions"
|
|
|
|
|
placeholder="全部事件"
|
|
|
|
|
:max-tag-count="2"
|
|
|
|
|
/>
|
|
|
|
|
</FormField>
|
|
|
|
|
</div>
|
|
|
|
|
<FormField
|
|
|
|
|
label="来源 IP 条件"
|
|
|
|
|
hint="逗号分隔 IP 或 CIDR;「不在列表才告警」适合白名单场景(非我发起的操作)"
|
|
|
|
|
>
|
|
|
|
|
<div class="mb-1.5 flex gap-1.5">
|
|
|
|
|
<button
|
|
|
|
|
v-for="m in [
|
|
|
|
|
{ v: 'in', t: '命中列表告警' },
|
|
|
|
|
{ v: 'notin', t: '不在列表才告警' },
|
|
|
|
|
]"
|
|
|
|
|
:key="m.v"
|
|
|
|
|
type="button"
|
|
|
|
|
class="cursor-pointer rounded-md border px-3 py-1 text-xs"
|
|
|
|
|
:class="
|
|
|
|
|
form.sourceIpMode === m.v
|
|
|
|
|
? 'border-accent bg-accent/10 font-semibold text-accent'
|
|
|
|
|
: 'border-line bg-white text-ink-2 hover:border-ink-3'
|
|
|
|
|
"
|
|
|
|
|
@click="form.sourceIpMode = m.v as 'in' | 'notin'"
|
|
|
|
|
>
|
|
|
|
|
{{ m.t }}
|
|
|
|
|
</button>
|
|
|
|
|
</div>
|
|
|
|
|
<NInput v-model:value="form.sourceIps" class="mono" placeholder="203.0.113.8, 10.0.0.0/8(留空=任意)" />
|
|
|
|
|
</FormField>
|
|
|
|
|
<div class="grid grid-cols-3 gap-3 max-md:grid-cols-1">
|
|
|
|
|
<FormField label="资源名包含" hint="子串匹配,留空=任意">
|
|
|
|
|
<NInput v-model:value="form.resourceMatch" placeholder="web-" />
|
|
|
|
|
</FormField>
|
|
|
|
|
<FormField label="触发阈值(次)" hint="1=每次命中即告警">
|
|
|
|
|
<AppInputNumber v-model:value="form.threshold" :min="1" :max="100" class="!w-full" />
|
|
|
|
|
</FormField>
|
|
|
|
|
<FormField label="聚合窗口(分钟)" hint="阈值>1 时生效,告警后同窗冷却">
|
|
|
|
|
<AppInputNumber
|
|
|
|
|
v-model:value="form.windowMinutes"
|
|
|
|
|
:min="1"
|
|
|
|
|
:max="1440"
|
|
|
|
|
:disabled="(form.threshold ?? 1) <= 1"
|
|
|
|
|
class="!w-full"
|
|
|
|
|
/>
|
|
|
|
|
</FormField>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="flex items-center justify-between rounded-lg bg-wash px-3 py-2">
|
|
|
|
|
<span class="text-[12.5px]">启用该规则</span>
|
|
|
|
|
<NSwitch v-model:value="form.enabled" size="small" />
|
|
|
|
|
</div>
|
|
|
|
|
<div class="mt-3 flex items-center gap-2">
|
|
|
|
|
<NButton size="small" type="primary" :loading="saving" :disabled="!canSave" @click="save">
|
|
|
|
|
保存
|
|
|
|
|
</NButton>
|
|
|
|
|
<NButton size="small" @click="editing = null">返回列表</NButton>
|
|
|
|
|
</div>
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<!-- 列表视图 -->
|
|
|
|
|
<div v-else class="flex flex-col">
|
|
|
|
|
<div class="mb-2 flex items-center justify-between gap-2">
|
|
|
|
|
<div class="text-xs text-ink-3">
|
|
|
|
|
命中规则的回传事件经「通知方式」的启用渠道推送;仅已建回传链路的租户产生事件
|
|
|
|
|
</div>
|
|
|
|
|
<div class="flex flex-none items-center gap-2">
|
|
|
|
|
<NButton size="tiny" quaternary type="primary" @click="openTemplate">通知模板</NButton>
|
|
|
|
|
<NButton size="small" type="primary" @click="openCreate">新建规则</NButton>
|
|
|
|
|
</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div
|
|
|
|
|
v-for="rule in rules.data.value ?? []"
|
|
|
|
|
:key="rule.id"
|
|
|
|
|
class="flex items-center gap-3 border-b border-line-soft py-2.5 last:border-b-0"
|
|
|
|
|
>
|
|
|
|
|
<div class="min-w-0 flex-1">
|
|
|
|
|
<div class="text-[13px] font-medium">{{ rule.name }}</div>
|
|
|
|
|
<div class="mt-0.5 truncate text-xs text-ink-3" :title="ruleSummary(rule)">
|
|
|
|
|
{{ ruleSummary(rule) }}
|
|
|
|
|
</div>
|
|
|
|
|
</div>
|
|
|
|
|
<NSwitch
|
|
|
|
|
size="small"
|
|
|
|
|
:value="rule.enabled"
|
|
|
|
|
@update:value="(v: boolean) => toggleRule(rule, v)"
|
|
|
|
|
/>
|
|
|
|
|
<NButton size="tiny" quaternary type="primary" @click="openEdit(rule)">编辑</NButton>
|
|
|
|
|
<NPopconfirm @positive-click="removeRule(rule)">
|
|
|
|
|
<template #trigger>
|
|
|
|
|
<NButton size="tiny" quaternary type="error">删除</NButton>
|
|
|
|
|
</template>
|
|
|
|
|
删除规则「{{ rule.name }}」？
|
|
|
|
|
</NPopconfirm>
|
|
|
|
|
</div>
|
|
|
|
|
<div
|
|
|
|
|
v-if="!rules.loading.value && !(rules.data.value ?? []).length"
|
|
|
|
|
class="py-8 text-center text-[13px] text-ink-3"
|
|
|
|
|
>
|
|
|
|
|
暂无规则,点击「新建规则」创建第一条
|
|
|
|
|
</div>
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<NotifyTemplateModal
|
|
|
|
|
v-model:show="tplShow"
|
|
|
|
|
:item="tplItem"
|
|
|
|
|
hint="命中告警规则时推送;变量:rule / tenant / event / resource / ip / count"
|
|
|
|
|
/>
|
|
|
|
|
</NModal>
|
|
|
|
|
</template>
|
