mirror of
https://github.com/marcredhat/kql
synced 2026-06-08 13:23:58 +00:00
marc
40 lines
1.4 KiB
Python
40 lines
1.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Find SDL's age cutoff for addEvents by sending probe events at increasing
|
|
ages and seeing which ones become queryable."""
|
|
import json, sys, time, uuid
|
|
from pathlib import Path
|
|
ROOT = Path(__file__).resolve().parents[1]; sys.path.insert(0, str(ROOT))
|
|
from harness.sdl_client import add_events, power_query
|
|
|
|
TS_NOW_MS = int(time.time() * 1000)
|
|
PROBE = uuid.uuid4().hex[:8]
|
|
|
|
# 30s, 5min, 30min, 1h, 2h, 4h, 6h, 12h, 24h
|
|
ages_min = [0.5, 5, 30, 60, 120, 240, 360, 720, 1440]
|
|
events = []
|
|
for i, age in enumerate(ages_min):
|
|
ts_ms = TS_NOW_MS - int(age * 60 * 1000)
|
|
events.append({
|
|
"ts": str(ts_ms * 1_000_000), "sev": 3, "thread": "T1",
|
|
"attrs": {"event_type": "CommonSecurityLog",
|
|
"probe": f"{PROBE}_{i:02d}", "age_min": age},
|
|
})
|
|
|
|
print(f"Sending {len(events)} events at ages {ages_min} min")
|
|
r = add_events(events)
|
|
print(f"addEvents -> {json.dumps(r)}")
|
|
|
|
print("\nWaiting 12 s ...")
|
|
time.sleep(12)
|
|
|
|
print(f"\nQuerying probe '{PROBE}' over last 48h ...")
|
|
res = power_query(f"probe contains '{PROBE}' | columns probe, age_min | limit 100", "48h")
|
|
n = res.get("matchingEvents", 0)
|
|
vals = res.get("values") or []
|
|
print(f"matching={n}")
|
|
got = {row[1] for row in vals}
|
|
print(f"\n{'age_min':>8} {'sent':>6} {'queryable':>10}")
|
|
for age in ages_min:
|
|
landed = "YES" if age in got else "NO"
|
|
print(f" {age:>6} {'yes':>6} {landed:>10}")
|