Skip to content

Commit 5d2412c

Browse files
author
zhvv117
committed
Support MATCH_RECOGNIZE formatting
commit_hash:a51361a96bfccae4f317752367bad8f0dc155032
1 parent dadcf6d commit 5d2412c

File tree

13 files changed

+419
-117
lines changed

13 files changed

+419
-117
lines changed

‎yql/essentials/sql/v1/format/sql_format.cpp

Lines changed: 91 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1979,6 +1979,95 @@ friend struct TStaticData;
19791979
}
19801980
}
19811981

1982+
void VisitRowPatternRecognitionClause(const TRule_row_pattern_recognition_clause& msg) {
1983+
VisitToken(msg.GetToken1());
1984+
VisitToken(msg.GetToken2());
1985+
1986+
NewLine();
1987+
PushCurrentIndent();
1988+
1989+
if (msg.HasBlock3()) {
1990+
Visit(msg.GetBlock3());
1991+
NewLine();
1992+
}
1993+
1994+
if (msg.HasBlock4()) {
1995+
Visit(msg.GetBlock4());
1996+
NewLine();
1997+
}
1998+
1999+
if (msg.HasBlock5()) {
2000+
const auto& block = msg.GetBlock5().GetRule_row_pattern_measures1();
2001+
VisitToken(block.GetToken1());
2002+
NewLine();
2003+
PushCurrentIndent();
2004+
const auto& measureList = block.GetRule_row_pattern_measure_list2();
2005+
Visit(measureList.GetRule_row_pattern_measure_definition1());
2006+
for (const auto& measureDefinitionBlock : measureList.GetBlock2()) {
2007+
VisitToken(measureDefinitionBlock.GetToken1());
2008+
NewLine();
2009+
Visit(measureDefinitionBlock.GetRule_row_pattern_measure_definition2());
2010+
}
2011+
PopCurrentIndent();
2012+
NewLine();
2013+
}
2014+
2015+
if (msg.HasBlock6()) {
2016+
Visit(msg.GetBlock6());
2017+
NewLine();
2018+
}
2019+
2020+
const auto& common = msg.GetRule_row_pattern_common_syntax7();
2021+
if (common.HasBlock1()) {
2022+
Visit(common.GetBlock1());
2023+
NewLine();
2024+
}
2025+
2026+
if (common.HasBlock2()) {
2027+
Visit(common.GetBlock2());
2028+
}
2029+
2030+
VisitToken(common.GetToken3());
2031+
VisitToken(common.GetToken4());
2032+
Visit(common.GetRule_row_pattern5());
2033+
VisitToken(common.GetToken6());
2034+
NewLine();
2035+
2036+
if (common.HasBlock7()) {
2037+
const auto& block = common.GetBlock7().GetRule_row_pattern_subset_clause1();
2038+
VisitToken(block.GetToken1());
2039+
NewLine();
2040+
PushCurrentIndent();
2041+
const auto& subsetList = block.GetRule_row_pattern_subset_list2();
2042+
Visit(subsetList.GetRule_row_pattern_subset_item1());
2043+
for (const auto& subsetItemBlock : subsetList.GetBlock2()) {
2044+
VisitToken(subsetItemBlock.GetToken1());
2045+
NewLine();
2046+
Visit(subsetItemBlock.GetRule_row_pattern_subset_item2());
2047+
}
2048+
PopCurrentIndent();
2049+
NewLine();
2050+
}
2051+
2052+
VisitToken(common.GetToken8());
2053+
NewLine();
2054+
PushCurrentIndent();
2055+
const auto& definitionList = common.GetRule_row_pattern_definition_list9();
2056+
Visit(definitionList.GetRule_row_pattern_definition1());
2057+
for (const auto& definitionBlock : definitionList.GetBlock2()) {
2058+
VisitToken(definitionBlock.GetToken1());
2059+
NewLine();
2060+
Visit(definitionBlock.GetRule_row_pattern_definition2());
2061+
}
2062+
PopCurrentIndent();
2063+
NewLine();
2064+
2065+
PopCurrentIndent();
2066+
NewLine();
2067+
2068+
VisitToken(msg.GetToken8());
2069+
}
2070+
19822071
void VisitJoinSource(const TRule_join_source& msg) {
19832072
if (msg.HasBlock1()) {
19842073
Visit(msg.GetBlock1());
@@ -2074,10 +2163,7 @@ friend struct TStaticData;
20742163
void VisitNamedSingleSource(const TRule_named_single_source& msg) {
20752164
Visit(msg.GetRule_single_source1());
20762165
if (msg.HasBlock2()) {
2077-
const auto& matchRecognize = msg.GetBlock2();
2078-
//TODO handle MATCH_RECOGNIZE block
2079-
//https://st.yandex-team.ru/YQL-16186
2080-
Visit(matchRecognize);
2166+
Visit(msg.GetBlock2());
20812167
}
20822168
if (msg.HasBlock3()) {
20832169
const auto& block3 = msg.GetBlock3();
@@ -2872,6 +2958,7 @@ TStaticData::TStaticData()
28722958
{TRule_reduce_core::GetDescriptor(), MakePrettyFunctor(&TPrettyVisitor::VisitReduceCore)},
28732959
{TRule_sort_specification_list::GetDescriptor(), MakePrettyFunctor(&TPrettyVisitor::VisitSortSpecificationList)},
28742960
{TRule_select_core::GetDescriptor(), MakePrettyFunctor(&TPrettyVisitor::VisitSelectCore)},
2961+
{TRule_row_pattern_recognition_clause::GetDescriptor(), MakePrettyFunctor(&TPrettyVisitor::VisitRowPatternRecognitionClause)},
28752962
{TRule_join_source::GetDescriptor(), MakePrettyFunctor(&TPrettyVisitor::VisitJoinSource)},
28762963
{TRule_join_constraint::GetDescriptor(), MakePrettyFunctor(&TPrettyVisitor::VisitJoinConstraint)},
28772964
{TRule_single_source::GetDescriptor(), MakePrettyFunctor(&TPrettyVisitor::VisitSingleSource)},

‎yql/essentials/sql/v1/format/sql_format_ut.h

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1378,8 +1378,13 @@ USE plato;
13781378
SELECT
13791379
*
13801380
FROM Input MATCH_RECOGNIZE(
1381-
PATTERN ( A )
1382-
DEFINE A as A
1381+
PARTITION BY a, b, c
1382+
ORDER BY ts
1383+
MEASURES LAST(B1.ts) AS b1, LAST(B3.ts) AS b3
1384+
ONE ROW PER MATCH AFTER MATCH SKIP TO NEXT ROW INITIAL
1385+
PATTERN ( A B2 + B3 )
1386+
SUBSET U = (C, D), W = (Q, P)
1387+
DEFINE A as A, B as B
13831388
);
13841389
)",
13851390
R"(PRAGMA FeatureR010 = "prototype";
@@ -1389,7 +1394,26 @@ USE plato;
13891394
SELECT
13901395
*
13911396
FROM
1392-
Input MATCH_RECOGNIZE (PATTERN (A) DEFINE A AS A)
1397+
Input MATCH_RECOGNIZE (
1398+
PARTITION BY
1399+
a,
1400+
b,
1401+
c
1402+
ORDER BY
1403+
ts
1404+
MEASURES
1405+
LAST(B1.ts) AS b1,
1406+
LAST(B3.ts) AS b3
1407+
ONE ROW PER MATCH
1408+
AFTER MATCH SKIP TO NEXT ROW
1409+
INITIAL PATTERN (A B2 + B3)
1410+
SUBSET
1411+
U = (C, D),
1412+
W = (Q, P)
1413+
DEFINE
1414+
A AS A,
1415+
B AS B
1416+
)
13931417
;
13941418
)"
13951419
}};

‎yql/essentials/tests/sql/sql2yql/canondata/test_sql_format.test_match_recognize-after_match_skip_past_last_row_/formatted.sql

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,14 @@ $input =
1616
SELECT
1717
*
1818
FROM
19-
$input MATCH_RECOGNIZE (ORDER BY
20-
CAST(time AS Timestamp)
21-
MEASURES FIRST(X.time) AS first_time, LAST(X.time) AS last_time PATTERN (X {2}) DEFINE X AS TRUE)
19+
$input MATCH_RECOGNIZE (
20+
ORDER BY
21+
CAST(time AS Timestamp)
22+
MEASURES
23+
FIRST(X.time) AS first_time,
24+
LAST(X.time) AS last_time
25+
PATTERN (X {2})
26+
DEFINE
27+
X AS TRUE
28+
)
2229
;

‎yql/essentials/tests/sql/sql2yql/canondata/test_sql_format.test_match_recognize-alerts-streaming_/formatted.sql

Lines changed: 37 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,41 @@ PRAGMA config.flags("MatchRecognizeStream", "force");
2020
SELECT
2121
*
2222
FROM
23-
AS_TABLE($osquery_data) MATCH_RECOGNIZE (ORDER BY
24-
CAST(dt AS Timestamp)
25-
MEASURES LAST(LOGIN_SUCCESS_REMOTE.host) AS remote_login_host, LAST(LOGIN_SUCCESS_REMOTE.user) AS remote_login_user, LAST(LOGIN_SUCCESS_REMOTE.dt) AS remote_login_dt, LAST(SUSPICIOUS_ACTION_SOON.dt) AS suspicious_action_dt, LAST(SUSPICIOUS_ACTION_TIMEOUT.dt) AS suspicious_action_timeout_dt, FIRST(LOGIN_FAILED_SAME_USER.dt) AS brutforce_begin, FIRST(LOGIN_SUCCESS_SAME_USER.dt) AS brutforce_end, LAST(LOGIN_SUCCESS_SAME_USER.user) AS brutforce_login ONE ROW PER MATCH AFTER MATCH SKIP TO NEXT ROW PATTERN (LOGIN_SUCCESS_REMOTE ANY_ROW1 * (SUSPICIOUS_ACTION_SOON | SUSPICIOUS_ACTION_TIMEOUT) | (LOGIN_FAILED_SAME_USER ANY_ROW2 *) {2,} LOGIN_SUCCESS_SAME_USER) DEFINE LOGIN_SUCCESS_REMOTE AS LOGIN_SUCCESS_REMOTE.ev_type == "login"
26-
AND LOGIN_SUCCESS_REMOTE.ev_status == "success"
27-
AND LOGIN_SUCCESS_REMOTE.vpn == TRUE
28-
AND COALESCE(LOGIN_SUCCESS_REMOTE.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE), ANY_ROW1 AS COALESCE(ANY_ROW1.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE), SUSPICIOUS_ACTION_SOON AS SUSPICIOUS_ACTION_SOON.host == LAST(LOGIN_SUCCESS_REMOTE.host)
29-
AND SUSPICIOUS_ACTION_SOON.ev_type == "delete_all"
30-
AND COALESCE(SUSPICIOUS_ACTION_SOON.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE), SUSPICIOUS_ACTION_TIMEOUT AS COALESCE(SUSPICIOUS_ACTION_TIMEOUT.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) > 500, TRUE), LOGIN_FAILED_SAME_USER AS LOGIN_FAILED_SAME_USER.ev_type == "login"
31-
AND LOGIN_FAILED_SAME_USER.ev_status != "success"
32-
AND (
33-
LAST(LOGIN_FAILED_SAME_USER.user) IS NULL
34-
OR LAST(LOGIN_FAILED_SAME_USER.user) == LOGIN_FAILED_SAME_USER.user
35-
) AND COALESCE(LOGIN_FAILED_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE), ANY_ROW2 AS COALESCE(ANY_ROW2.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE), LOGIN_SUCCESS_SAME_USER AS LOGIN_SUCCESS_SAME_USER.ev_type == "login"
36-
AND LOGIN_SUCCESS_SAME_USER.ev_status == "success"
37-
AND LOGIN_SUCCESS_SAME_USER.user == LAST(LOGIN_FAILED_SAME_USER.user)
38-
AND COALESCE(LOGIN_SUCCESS_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE)) AS MATCHED
23+
AS_TABLE($osquery_data) MATCH_RECOGNIZE (
24+
ORDER BY
25+
CAST(dt AS Timestamp)
26+
MEASURES
27+
LAST(LOGIN_SUCCESS_REMOTE.host) AS remote_login_host,
28+
LAST(LOGIN_SUCCESS_REMOTE.user) AS remote_login_user,
29+
LAST(LOGIN_SUCCESS_REMOTE.dt) AS remote_login_dt,
30+
LAST(SUSPICIOUS_ACTION_SOON.dt) AS suspicious_action_dt,
31+
LAST(SUSPICIOUS_ACTION_TIMEOUT.dt) AS suspicious_action_timeout_dt,
32+
FIRST(LOGIN_FAILED_SAME_USER.dt) AS brutforce_begin,
33+
FIRST(LOGIN_SUCCESS_SAME_USER.dt) AS brutforce_end,
34+
LAST(LOGIN_SUCCESS_SAME_USER.user) AS brutforce_login
35+
ONE ROW PER MATCH
36+
AFTER MATCH SKIP TO NEXT ROW
37+
PATTERN (LOGIN_SUCCESS_REMOTE ANY_ROW1 * (SUSPICIOUS_ACTION_SOON | SUSPICIOUS_ACTION_TIMEOUT) | (LOGIN_FAILED_SAME_USER ANY_ROW2 *) {2,} LOGIN_SUCCESS_SAME_USER)
38+
DEFINE
39+
LOGIN_SUCCESS_REMOTE AS LOGIN_SUCCESS_REMOTE.ev_type == "login"
40+
AND LOGIN_SUCCESS_REMOTE.ev_status == "success"
41+
AND LOGIN_SUCCESS_REMOTE.vpn == TRUE
42+
AND COALESCE(LOGIN_SUCCESS_REMOTE.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE),
43+
ANY_ROW1 AS COALESCE(ANY_ROW1.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE),
44+
SUSPICIOUS_ACTION_SOON AS SUSPICIOUS_ACTION_SOON.host == LAST(LOGIN_SUCCESS_REMOTE.host)
45+
AND SUSPICIOUS_ACTION_SOON.ev_type == "delete_all"
46+
AND COALESCE(SUSPICIOUS_ACTION_SOON.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE),
47+
SUSPICIOUS_ACTION_TIMEOUT AS COALESCE(SUSPICIOUS_ACTION_TIMEOUT.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) > 500, TRUE),
48+
LOGIN_FAILED_SAME_USER AS LOGIN_FAILED_SAME_USER.ev_type == "login"
49+
AND LOGIN_FAILED_SAME_USER.ev_status != "success"
50+
AND (
51+
LAST(LOGIN_FAILED_SAME_USER.user) IS NULL
52+
OR LAST(LOGIN_FAILED_SAME_USER.user) == LOGIN_FAILED_SAME_USER.user
53+
) AND COALESCE(LOGIN_FAILED_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE),
54+
ANY_ROW2 AS COALESCE(ANY_ROW2.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE),
55+
LOGIN_SUCCESS_SAME_USER AS LOGIN_SUCCESS_SAME_USER.ev_type == "login"
56+
AND LOGIN_SUCCESS_SAME_USER.ev_status == "success"
57+
AND LOGIN_SUCCESS_SAME_USER.user == LAST(LOGIN_FAILED_SAME_USER.user)
58+
AND COALESCE(LOGIN_SUCCESS_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE)
59+
) AS MATCHED
3960
;

‎yql/essentials/tests/sql/sql2yql/canondata/test_sql_format.test_match_recognize-alerts_/formatted.sql

Lines changed: 37 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,41 @@ PRAGMA config.flags("MatchRecognizeStream", "disable");
2020
SELECT
2121
*
2222
FROM
23-
AS_TABLE($osquery_data) MATCH_RECOGNIZE (ORDER BY
24-
CAST(dt AS Timestamp)
25-
MEASURES LAST(LOGIN_SUCCESS_REMOTE.host) AS remote_login_host, LAST(LOGIN_SUCCESS_REMOTE.user) AS remote_login_user, LAST(LOGIN_SUCCESS_REMOTE.dt) AS remote_login_dt, LAST(SUSPICIOUS_ACTION_SOON.dt) AS suspicious_action_dt, LAST(SUSPICIOUS_ACTION_TIMEOUT.dt) AS suspicious_action_timeout_dt, FIRST(LOGIN_FAILED_SAME_USER.dt) AS brutforce_begin, FIRST(LOGIN_SUCCESS_SAME_USER.dt) AS brutforce_end, LAST(LOGIN_SUCCESS_SAME_USER.user) AS brutforce_login ONE ROW PER MATCH AFTER MATCH SKIP TO NEXT ROW PATTERN (LOGIN_SUCCESS_REMOTE ANY_ROW1 * (SUSPICIOUS_ACTION_SOON | SUSPICIOUS_ACTION_TIMEOUT) | (LOGIN_FAILED_SAME_USER ANY_ROW2 *) {2,} LOGIN_SUCCESS_SAME_USER) DEFINE LOGIN_SUCCESS_REMOTE AS LOGIN_SUCCESS_REMOTE.ev_type == "login"
26-
AND LOGIN_SUCCESS_REMOTE.ev_status == "success"
27-
AND LOGIN_SUCCESS_REMOTE.vpn == TRUE
28-
AND COALESCE(LOGIN_SUCCESS_REMOTE.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE), ANY_ROW1 AS COALESCE(ANY_ROW1.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE), SUSPICIOUS_ACTION_SOON AS SUSPICIOUS_ACTION_SOON.host == LAST(LOGIN_SUCCESS_REMOTE.host)
29-
AND SUSPICIOUS_ACTION_SOON.ev_type == "delete_all"
30-
AND COALESCE(SUSPICIOUS_ACTION_SOON.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE), SUSPICIOUS_ACTION_TIMEOUT AS COALESCE(SUSPICIOUS_ACTION_TIMEOUT.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) > 500, TRUE), LOGIN_FAILED_SAME_USER AS LOGIN_FAILED_SAME_USER.ev_type == "login"
31-
AND LOGIN_FAILED_SAME_USER.ev_status != "success"
32-
AND (
33-
LAST(LOGIN_FAILED_SAME_USER.user) IS NULL
34-
OR LAST(LOGIN_FAILED_SAME_USER.user) == LOGIN_FAILED_SAME_USER.user
35-
) AND COALESCE(LOGIN_FAILED_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE), ANY_ROW2 AS COALESCE(ANY_ROW2.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE), LOGIN_SUCCESS_SAME_USER AS LOGIN_SUCCESS_SAME_USER.ev_type == "login"
36-
AND LOGIN_SUCCESS_SAME_USER.ev_status == "success"
37-
AND LOGIN_SUCCESS_SAME_USER.user == LAST(LOGIN_FAILED_SAME_USER.user)
38-
AND COALESCE(LOGIN_SUCCESS_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE)) AS MATCHED
23+
AS_TABLE($osquery_data) MATCH_RECOGNIZE (
24+
ORDER BY
25+
CAST(dt AS Timestamp)
26+
MEASURES
27+
LAST(LOGIN_SUCCESS_REMOTE.host) AS remote_login_host,
28+
LAST(LOGIN_SUCCESS_REMOTE.user) AS remote_login_user,
29+
LAST(LOGIN_SUCCESS_REMOTE.dt) AS remote_login_dt,
30+
LAST(SUSPICIOUS_ACTION_SOON.dt) AS suspicious_action_dt,
31+
LAST(SUSPICIOUS_ACTION_TIMEOUT.dt) AS suspicious_action_timeout_dt,
32+
FIRST(LOGIN_FAILED_SAME_USER.dt) AS brutforce_begin,
33+
FIRST(LOGIN_SUCCESS_SAME_USER.dt) AS brutforce_end,
34+
LAST(LOGIN_SUCCESS_SAME_USER.user) AS brutforce_login
35+
ONE ROW PER MATCH
36+
AFTER MATCH SKIP TO NEXT ROW
37+
PATTERN (LOGIN_SUCCESS_REMOTE ANY_ROW1 * (SUSPICIOUS_ACTION_SOON | SUSPICIOUS_ACTION_TIMEOUT) | (LOGIN_FAILED_SAME_USER ANY_ROW2 *) {2,} LOGIN_SUCCESS_SAME_USER)
38+
DEFINE
39+
LOGIN_SUCCESS_REMOTE AS LOGIN_SUCCESS_REMOTE.ev_type == "login"
40+
AND LOGIN_SUCCESS_REMOTE.ev_status == "success"
41+
AND LOGIN_SUCCESS_REMOTE.vpn == TRUE
42+
AND COALESCE(LOGIN_SUCCESS_REMOTE.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE),
43+
ANY_ROW1 AS COALESCE(ANY_ROW1.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE),
44+
SUSPICIOUS_ACTION_SOON AS SUSPICIOUS_ACTION_SOON.host == LAST(LOGIN_SUCCESS_REMOTE.host)
45+
AND SUSPICIOUS_ACTION_SOON.ev_type == "delete_all"
46+
AND COALESCE(SUSPICIOUS_ACTION_SOON.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE),
47+
SUSPICIOUS_ACTION_TIMEOUT AS COALESCE(SUSPICIOUS_ACTION_TIMEOUT.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) > 500, TRUE),
48+
LOGIN_FAILED_SAME_USER AS LOGIN_FAILED_SAME_USER.ev_type == "login"
49+
AND LOGIN_FAILED_SAME_USER.ev_status != "success"
50+
AND (
51+
LAST(LOGIN_FAILED_SAME_USER.user) IS NULL
52+
OR LAST(LOGIN_FAILED_SAME_USER.user) == LOGIN_FAILED_SAME_USER.user
53+
) AND COALESCE(LOGIN_FAILED_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE),
54+
ANY_ROW2 AS COALESCE(ANY_ROW2.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE),
55+
LOGIN_SUCCESS_SAME_USER AS LOGIN_SUCCESS_SAME_USER.ev_type == "login"
56+
AND LOGIN_SUCCESS_SAME_USER.ev_status == "success"
57+
AND LOGIN_SUCCESS_SAME_USER.user == LAST(LOGIN_FAILED_SAME_USER.user)
58+
AND COALESCE(LOGIN_SUCCESS_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE)
59+
) AS MATCHED
3960
;

‎yql/essentials/tests/sql/sql2yql/canondata/test_sql_format.test_match_recognize-alerts_without_order_/formatted.sql

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,39 @@ PRAGMA config.flags("MatchRecognizeStream", "disable");
2020
SELECT
2121
*
2222
FROM
23-
AS_TABLE($osquery_data) MATCH_RECOGNIZE (MEASURES LAST(LOGIN_SUCCESS_REMOTE.host) AS remote_login_host, LAST(LOGIN_SUCCESS_REMOTE.user) AS remote_login_user, LAST(LOGIN_SUCCESS_REMOTE.dt) AS remote_login_dt, LAST(SUSPICIOUS_ACTION_SOON.dt) AS suspicious_action_dt, LAST(SUSPICIOUS_ACTION_TIMEOUT.dt) AS suspicious_action_timeout_dt, FIRST(LOGIN_FAILED_SAME_USER.dt) AS brutforce_begin, FIRST(LOGIN_SUCCESS_SAME_USER.dt) AS brutforce_end, LAST(LOGIN_SUCCESS_SAME_USER.user) AS brutforce_login ONE ROW PER MATCH AFTER MATCH SKIP TO NEXT ROW PATTERN (LOGIN_SUCCESS_REMOTE ANY_ROW1 * (SUSPICIOUS_ACTION_SOON | SUSPICIOUS_ACTION_TIMEOUT) | (LOGIN_FAILED_SAME_USER ANY_ROW2 *) {2,} LOGIN_SUCCESS_SAME_USER) DEFINE LOGIN_SUCCESS_REMOTE AS LOGIN_SUCCESS_REMOTE.ev_type == "login"
24-
AND LOGIN_SUCCESS_REMOTE.ev_status == "success"
25-
AND LOGIN_SUCCESS_REMOTE.vpn == TRUE
26-
AND COALESCE(LOGIN_SUCCESS_REMOTE.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE), ANY_ROW1 AS COALESCE(ANY_ROW1.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE), SUSPICIOUS_ACTION_SOON AS SUSPICIOUS_ACTION_SOON.host == LAST(LOGIN_SUCCESS_REMOTE.host)
27-
AND SUSPICIOUS_ACTION_SOON.ev_type == "delete_all"
28-
AND COALESCE(SUSPICIOUS_ACTION_SOON.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE), SUSPICIOUS_ACTION_TIMEOUT AS COALESCE(SUSPICIOUS_ACTION_TIMEOUT.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) > 500, TRUE), LOGIN_FAILED_SAME_USER AS LOGIN_FAILED_SAME_USER.ev_type == "login"
29-
AND LOGIN_FAILED_SAME_USER.ev_status != "success"
30-
AND (
31-
LAST(LOGIN_FAILED_SAME_USER.user) IS NULL
32-
OR LAST(LOGIN_FAILED_SAME_USER.user) == LOGIN_FAILED_SAME_USER.user
33-
) AND COALESCE(LOGIN_FAILED_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE), ANY_ROW2 AS COALESCE(ANY_ROW2.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE), LOGIN_SUCCESS_SAME_USER AS LOGIN_SUCCESS_SAME_USER.ev_type == "login"
34-
AND LOGIN_SUCCESS_SAME_USER.ev_status == "success"
35-
AND LOGIN_SUCCESS_SAME_USER.user == LAST(LOGIN_FAILED_SAME_USER.user)
36-
AND COALESCE(LOGIN_SUCCESS_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE)) AS MATCHED
23+
AS_TABLE($osquery_data) MATCH_RECOGNIZE (
24+
MEASURES
25+
LAST(LOGIN_SUCCESS_REMOTE.host) AS remote_login_host,
26+
LAST(LOGIN_SUCCESS_REMOTE.user) AS remote_login_user,
27+
LAST(LOGIN_SUCCESS_REMOTE.dt) AS remote_login_dt,
28+
LAST(SUSPICIOUS_ACTION_SOON.dt) AS suspicious_action_dt,
29+
LAST(SUSPICIOUS_ACTION_TIMEOUT.dt) AS suspicious_action_timeout_dt,
30+
FIRST(LOGIN_FAILED_SAME_USER.dt) AS brutforce_begin,
31+
FIRST(LOGIN_SUCCESS_SAME_USER.dt) AS brutforce_end,
32+
LAST(LOGIN_SUCCESS_SAME_USER.user) AS brutforce_login
33+
ONE ROW PER MATCH
34+
AFTER MATCH SKIP TO NEXT ROW
35+
PATTERN (LOGIN_SUCCESS_REMOTE ANY_ROW1 * (SUSPICIOUS_ACTION_SOON | SUSPICIOUS_ACTION_TIMEOUT) | (LOGIN_FAILED_SAME_USER ANY_ROW2 *) {2,} LOGIN_SUCCESS_SAME_USER)
36+
DEFINE
37+
LOGIN_SUCCESS_REMOTE AS LOGIN_SUCCESS_REMOTE.ev_type == "login"
38+
AND LOGIN_SUCCESS_REMOTE.ev_status == "success"
39+
AND LOGIN_SUCCESS_REMOTE.vpn == TRUE
40+
AND COALESCE(LOGIN_SUCCESS_REMOTE.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE),
41+
ANY_ROW1 AS COALESCE(ANY_ROW1.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE),
42+
SUSPICIOUS_ACTION_SOON AS SUSPICIOUS_ACTION_SOON.host == LAST(LOGIN_SUCCESS_REMOTE.host)
43+
AND SUSPICIOUS_ACTION_SOON.ev_type == "delete_all"
44+
AND COALESCE(SUSPICIOUS_ACTION_SOON.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) <= 500, TRUE),
45+
SUSPICIOUS_ACTION_TIMEOUT AS COALESCE(SUSPICIOUS_ACTION_TIMEOUT.dt - FIRST(LOGIN_SUCCESS_REMOTE.dt) > 500, TRUE),
46+
LOGIN_FAILED_SAME_USER AS LOGIN_FAILED_SAME_USER.ev_type == "login"
47+
AND LOGIN_FAILED_SAME_USER.ev_status != "success"
48+
AND (
49+
LAST(LOGIN_FAILED_SAME_USER.user) IS NULL
50+
OR LAST(LOGIN_FAILED_SAME_USER.user) == LOGIN_FAILED_SAME_USER.user
51+
) AND COALESCE(LOGIN_FAILED_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE),
52+
ANY_ROW2 AS COALESCE(ANY_ROW2.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE),
53+
LOGIN_SUCCESS_SAME_USER AS LOGIN_SUCCESS_SAME_USER.ev_type == "login"
54+
AND LOGIN_SUCCESS_SAME_USER.ev_status == "success"
55+
AND LOGIN_SUCCESS_SAME_USER.user == LAST(LOGIN_FAILED_SAME_USER.user)
56+
AND COALESCE(LOGIN_SUCCESS_SAME_USER.dt - FIRST(LOGIN_FAILED_SAME_USER.dt) <= 500, TRUE)
57+
) AS MATCHED
3758
;

0 commit comments

Comments
 (0)