@@ -113,27 +113,30 @@ def upgrade() -> None:
113113 sa .Column ("id" , sa .String (36 ), nullable = False ),
114114 sa .Column ("timestamp" , sa .DateTime (timezone = True ), nullable = False ),
115115 sa .Column ("detected_at" , sa .DateTime (timezone = True ), nullable = False ),
116+ sa .Column ("correlation_id" , sa .String (64 ), nullable = True ),
117+ sa .Column ("log_entry_id" , sa .String (36 ), nullable = True ),
116118 sa .Column ("event_type" , sa .String (100 ), nullable = False ),
117119 sa .Column ("severity" , sa .String (20 ), nullable = False ),
118- sa .Column ("category" , sa .String (100 ), nullable = False ),
120+ sa .Column ("category" , sa .String (50 ), nullable = False ),
119121 sa .Column ("user_id" , sa .String (255 ), nullable = True ),
120122 sa .Column ("user_email" , sa .String (255 ), nullable = True ),
121123 sa .Column ("client_ip" , sa .String (45 ), nullable = False ),
122124 sa .Column ("user_agent" , sa .Text (), nullable = True ),
123125 sa .Column ("description" , sa .Text (), nullable = False ),
124126 sa .Column ("action_taken" , sa .String (100 ), nullable = True ),
125127 sa .Column ("threat_score" , sa .Float (), nullable = False , server_default = "0.0" ),
126- sa .Column ("threat_indicators" , sa .JSON (), nullable = True ),
128+ sa .Column ("threat_indicators" , sa .JSON (), nullable = False , server_default = "{}" ),
127129 sa .Column ("failed_attempts_count" , sa .Integer (), nullable = False , server_default = "0" ),
128- sa .Column ("context" , sa .JSON (), nullable = True ),
129- sa .Column ("correlation_id" , sa .String (255 ), nullable = True ),
130130 sa .Column ("resolved" , sa .Boolean (), nullable = False , server_default = "false" ),
131131 sa .Column ("resolved_at" , sa .DateTime (timezone = True ), nullable = True ),
132132 sa .Column ("resolved_by" , sa .String (255 ), nullable = True ),
133133 sa .Column ("resolution_notes" , sa .Text (), nullable = True ),
134134 sa .Column ("alert_sent" , sa .Boolean (), nullable = False , server_default = "false" ),
135135 sa .Column ("alert_sent_at" , sa .DateTime (timezone = True ), nullable = True ),
136+ sa .Column ("alert_recipients" , sa .JSON (), nullable = True ),
137+ sa .Column ("context" , sa .JSON (), nullable = True ),
136138 sa .PrimaryKeyConstraint ("id" ),
139+ sa .ForeignKeyConstraint (["log_entry_id" ], ["structured_log_entries.id" ]),
137140 )
138141
139142 # Create indexes for security_events
@@ -146,9 +149,13 @@ def upgrade() -> None:
146149 op .create_index ("ix_security_events_user_id" , "security_events" , ["user_id" ], unique = False )
147150 op .create_index ("ix_security_events_user_email" , "security_events" , ["user_email" ], unique = False )
148151 op .create_index ("ix_security_events_client_ip" , "security_events" , ["client_ip" ], unique = False )
149- op .create_index ("idx_security_event_time" , "security_events" , ["event_type" , "timestamp" ], unique = False )
152+ op .create_index ("ix_security_events_log_entry_id" , "security_events" , ["log_entry_id" ], unique = False )
153+ op .create_index ("ix_security_events_resolved" , "security_events" , ["resolved" ], unique = False )
154+ op .create_index ("idx_security_type_time" , "security_events" , ["event_type" , "timestamp" ], unique = False )
150155 op .create_index ("idx_security_severity_time" , "security_events" , ["severity" , "timestamp" ], unique = False )
151156 op .create_index ("idx_security_user_time" , "security_events" , ["user_id" , "timestamp" ], unique = False )
157+ op .create_index ("idx_security_ip_time" , "security_events" , ["client_ip" , "timestamp" ], unique = False )
158+ op .create_index ("idx_security_unresolved" , "security_events" , ["resolved" , "severity" , "timestamp" ], unique = False )
152159
153160 # Create audit_trails table
154161 op .create_table (
0 commit comments