{"id":984,"date":"2019-07-10T21:49:19","date_gmt":"2019-07-10T12:49:19","guid":{"rendered":"\/blog\/?p=984"},"modified":"2023-09-21T09:26:51","modified_gmt":"2023-09-21T00:26:51","slug":"appdefender-%ec%9c%a0%ec%a7%80%eb%b3%b4%ec%88%98-%ea%b4%80%eb%a0%a8-%ea%b8%b0%ec%88%a0%ec%9e%90%eb%a3%8c","status":"publish","type":"post","link":"https:\/\/hasu0707.duckdns.org\/blog\/?p=984","title":{"rendered":"[AppDefender] \uc791\ub3d9 \uc0c1\ud0dc \uc810\uac80 (v19.2.0)"},"content":{"rendered":"\n

\u25a0 docker ps --format \"table {{.Names}}\\t{{.Ports}}\"<\/span><\/font><\/div>

<\/span><\/font><\/div>
appdefender_backend_jobs_1       8080\/tcp<\/span><\/font><\/div>
haproxy                          0.0.0.0:1936->1936\/tcp, 0.0.0.0:4321->4321\/tcp, 0.0.0.0:8443-8444->8443-8444\/tcp<\/span><\/font><\/div>
rsyslog_defender                 0.0.0.0:514->514\/tcp, 0.0.0.0:1999->1999\/tcp<\/span><\/font><\/div>
appdefender_command_channel_1    0.0.0.0:32768->8080\/tcp<\/span><\/font><\/div>
appdefender_edge_1               0.0.0.0:32770->4321\/tcp<\/span><\/font><\/div>
appdefender_registrator_1<\/span><\/font><\/div>
consul                           53\/tcp, 0.0.0.0:8300->8300\/tcp, 0.0.0.0:8400->8400\/tcp, 8301-8302\/tcp, 0.0.0.0:8500->8500\/tcp, 8301-8302\/udp, 0.0.0.0:8600->53\/udp<\/span><\/font><\/div>
appdefender_kafka_1              0.0.0.0:9092->9092\/tcp<\/span><\/font><\/div>
appdefender_storm_supervisor_1   22\/tcp, 6700-6703\/tcp, 8000\/tcp<\/span><\/font><\/div>
storm_nimbus                     22\/tcp, 0.0.0.0:6627->6627\/tcp<\/span><\/font><\/div>
appdefender_zookeeper_1          0.0.0.0:2181->2181\/tcp, 0.0.0.0:2888->2888\/tcp, 0.0.0.0:3888->3888\/tcp<\/span><\/font><\/div>
appdefender_ui_customer_1        0.0.0.0:32769->8080\/tcp<\/span><\/font><\/div>
appdefender_cassandra_1          7001\/tcp, 0.0.0.0:7000->7000\/tcp, 7199\/tcp, 0.0.0.0:9042->9042\/tcp, 9160\/tcp<\/span><\/font><\/div>
postgres                         0.0.0.0:5432->5432\/tcp<\/span><\/font><\/div>

<\/span><\/font><\/div>
\u25a0 docker ps | wc -l<\/span><\/font><\/div>
15<\/span><\/font><\/div>

<\/span><\/font><\/div>
\u25a0 \ub85c\uadf8 \ud655\uc778 (\ucd5c\uadfc \ud55c\ub2ec)<\/span><\/font><\/div>

<\/span><\/font><\/div>
docker logs --since 44640m --details appdefender_backend_jobs_1     2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details haproxy                        2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details rsyslog_defender               2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details appdefender_command_channel_1  2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details appdefender_edge_1             2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details appdefender_registrator_1      2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details consul                         2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details topologies                     2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details appdefender_kafka_1            2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details appdefender_storm_supervisor_1 2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details storm_nimbus                   2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details appdefender_zookeeper_1        2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details appdefender_ui_customer_1      2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details db_migrations                  2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details appdefender_cassandra_1        2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>
docker logs --since 44640m --details postgres                       2>&1 | grep -E \"ERR|FATAL\"<\/span><\/font><\/div>

<\/span><\/font><\/div>
\u25a0 docker \ucee8\ud14c\uc774\ub108 \uc258 \uc9c4\uc785<\/span><\/font><\/div>

<\/span><\/font><\/div>
docker exec -it appdefender_backend_jobs_1     \/bin\/bash<\/span><\/font><\/div>
docker exec -it haproxy                        \/bin\/bash<\/span><\/font><\/div>
docker exec -it rsyslog_defender               \/bin\/bash<\/span><\/font><\/div>
docker exec -it appdefender_command_channel_1  \/bin\/bash<\/span><\/font><\/div>
docker exec -it appdefender_edge_1             \/bin\/bash<\/span><\/font><\/div>
docker exec -it appdefender_registrator_1      \/bin\/bash<\/span><\/font><\/div>
docker exec -it consul                         \/bin\/bash<\/span><\/font><\/div>
docker exec -it topologies                     \/bin\/bash<\/span><\/font><\/div>
docker exec -it appdefender_kafka_1            \/bin\/bash<\/span><\/font><\/div>
docker exec -it appdefender_storm_supervisor_1 \/bin\/bash<\/span><\/font><\/div>
docker exec -it storm_nimbus                   \/bin\/bash<\/span><\/font><\/div>
docker exec -it appdefender_zookeeper_1        \/bin\/bash<\/span><\/font><\/div>
docker exec -it appdefender_ui_customer_1      \/bin\/bash<\/span><\/font><\/div>
docker exec -it db_migrations                  \/bin\/bash<\/span><\/font><\/div>
docker exec -it appdefender_cassandra_1        \/bin\/bash<\/span><\/font><\/div>
docker exec -it postgres                       \/bin\/bash<\/span><\/font><\/div>

<\/span><\/font><\/div>
\u25a0 docker \ucee8\ud14c\uc774\ub108 IP\uc8fc\uc18c \uc54c\uc544\ub0b4\uae30<\/span><\/font><\/div>

<\/span><\/font><\/div>
docker inspect appdefender_backend_jobs_1     | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect haproxy                        | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect rsyslog_defender               | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect appdefender_command_channel_1  | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect appdefender_edge_1             | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect appdefender_registrator_1      | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect consul                         | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect topologies                     | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect appdefender_kafka_1            | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect appdefender_storm_supervisor_1 | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect storm_nimbus                   | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect appdefender_zookeeper_1        | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect appdefender_ui_customer_1      | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect db_migrations                  | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect appdefender_cassandra_1        | grep \"IPAddress\"<\/span><\/font><\/div>
docker inspect postgres                       | grep \"IPAddress\"<\/span><\/font><\/div>

<\/span><\/font><\/div>
\u25a0 postgreSQL<\/span><\/font><\/div>

<\/span><\/font><\/div>
# docker ps | grep postgres<\/span><\/font><\/div>
# docker exec -it postgres \/bin\/bash<\/span><\/font><\/div>

<\/span><\/font><\/div>
###########################################################<\/span><\/font><\/div>
#<\/span><\/font><\/div>
# \uc5ec\uae30\ubd80\ud130 postgres\uc758 docker \ub0b4\ubd80...<\/span><\/font><\/div>
#<\/span><\/font><\/div>
###########################################################<\/span><\/font><\/div>
# su - postgres<\/span><\/font><\/div>
$ psql db_appdefender -U postgres<\/span><\/font><\/div>

<\/span><\/font><\/div>
-- Database \uc870\ud68c<\/span><\/font><\/div>
\\list<\/span><\/font><\/div>

<\/span><\/font><\/div>
-- \ud604\uc7ac DB\uc758 \uc804\uccb4 \uc2a4\ud0a4\ub9c8 \uc870\ud68c<\/span><\/font><\/div>
SELECT NSPNAME FROM PG_CATALOG.PG_NAMESPACE;<\/span><\/font><\/div>

<\/span><\/font><\/div>
-- \uc804\uccb4 \ud14c\uc774\ube14 \uc870\ud68c<\/span><\/font><\/div>
SELECT TABLENAME FROM PG_TABLES;<\/span><\/font><\/div>

<\/span><\/font><\/div>
-- \ubaa8\ub4e0 \uc2a4\ud0a4\ub9c8\uc640 \ud14c\uc774\ube14 \ubcf4\uae30<\/span><\/font><\/div>
SELECT TABLE_SCHEMA,TABLE_NAME FROM INFORMATION_SCHEMA.TABLES ORDER BY TABLE_SCHEMA,TABLE_NAME;<\/span><\/font><\/div>

<\/span><\/font><\/div>
-- \ub05d\ub0b4\uae30<\/span><\/font><\/div>
\\q<\/span><\/font><\/div>

<\/span><\/font><\/div>
-- Application Defender \ud14c\uc774\ube14 \uc870\ud68c<\/span><\/font><\/div>
SELECT * FROM auth_data.hp_sso_license;<\/span><\/font><\/div>
SELECT * FROM auth_data.integration;<\/span><\/font><\/div>
SELECT * FROM auth_data.invalid_cat_door_token;<\/span><\/font><\/div>
SELECT * FROM auth_data.nonce;<\/span><\/font><\/div>
SELECT * FROM auth_data.role;<\/span><\/font><\/div>
SELECT * FROM auth_data.tenant;<\/span><\/font><\/div>
SELECT * FROM auth_data.tenant_metrics;<\/span><\/font><\/div>
SELECT * FROM auth_data.user_account;<\/span><\/font><\/div>
SELECT * FROM auth_data.user_role;<\/span><\/font><\/div>
SELECT * FROM global_metadata.agent_binary_version;<\/span><\/font><\/div>
SELECT * FROM global_metadata.blacklisted_domain;<\/span><\/font><\/div>
SELECT * FROM global_metadata.category_snapshot;<\/span><\/font><\/div>
SELECT * FROM global_metadata.certificate_config;<\/span><\/font><\/div>
SELECT * FROM global_metadata.defender_version;<\/span><\/font><\/div>
SELECT * FROM global_metadata.global_blobs;<\/span><\/font><\/div>
SELECT * FROM global_metadata.language_snapshot;<\/span><\/font><\/div>
SELECT * FROM global_metadata.rulepack_category;<\/span><\/font><\/div>
SELECT * FROM global_metadata.rulepack_parameter;<\/span><\/font><\/div>
SELECT * FROM global_metadata.rulepack_version;<\/span><\/font><\/div>
SELECT * FROM global_metadata.schema_version;<\/span><\/font><\/div>
SELECT * FROM global_metadata.snapshot_instance;<\/span><\/font><\/div>
SELECT * FROM global_metadata.system_config;<\/span><\/font><\/div>
SELECT * FROM global_metadata.tenant_snapshot;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.tenant_config;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.security_log_setting;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.ping_record;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.notification_aud;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.notification;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.licensed_agent_delta;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.alert_definition_aud;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.alert_condition_aud;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.agent_system_environment;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.agent_states;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.agent_log_file;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.agent_group_custom_rulepack_version;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.agent_config;<\/span><\/font><\/div>
SELECT * FROM td3f1a94d8560493cb65250f2358c0c3b.active_agent_count;<\/span><\/font><\/div>

<\/span><\/font><\/div>

<\/span><\/font><\/div>
\u25a0 Vertica Database<\/span><\/font><\/div>

<\/span><\/font><\/div>
\u25a3 \ud14c\uc774\ube14 \ubaa9\ub85d \ucd9c\ub825<\/span><\/font><\/div>

<\/span><\/font><\/div>
SELECT SCHEMA_NAME, TABLE_NAME FROM ALL_TABLES WHERE TABLE_TYPE='TABLE';<\/span><\/font><\/div>

<\/span><\/font><\/div>
schema_version<\/span><\/font><\/div>
security_events<\/span><\/font><\/div>
security_events_map<\/span><\/font><\/div>
security_events_flownode<\/span><\/font><\/div>
security_events_fn_trace<\/span><\/font><\/div>
monitor_events_count<\/span><\/font><\/div>
security_events_unexpected<\/span><\/font><\/div>
monitor_events_unexpected<\/span><\/font><\/div>
vulnerability<\/span><\/font><\/div>

<\/span><\/font><\/div>
\u25a3 \ud14c\uc774\ube14 \ub0b4\uc6a9 \uc870\ud68c<\/span><\/font><\/div>

<\/span><\/font><\/div>
-- SCHEMA_VERSION.TABLE_NAME\uc73c\ub85c \ud14c\uc774\ube14\uc744 \uba85\uc2dc\ud558\uc5ec SELECT<\/span><\/font><\/div>
SELECT EVENT_TIMESTAMP, INSERT_TIMESTAMP, CATEGORY, SEVERITY, REQUEST_IP, REQUEST_PATH FROM TD3F1A94D8560493CB65250F2358C0C3B.SECURITY_EVENTS;<\/span><\/font><\/div>

<\/span><\/font><\/div>
-- \uc2a4\ud0a4\ub9c8 \uc0ad\uc81c (\uc8fc\uc758!!)<\/span><\/font><\/div>
DROP SCHEMA IF EXISTS td3f1a94d8560493cb65250f2358c0c3b CASCADE;<\/span><\/font><\/div>

<\/span><\/font><\/div>
-- \uae30\uac04\uc744 \uc124\uc815\ud558\uc5ec \uac80\uc0c9<\/span><\/font><\/div>
SELECT COUNT(*)<\/span><\/font><\/div>
FROM td3f1a94d8560493cb65250f2358c0c3b.SECURITY_EVENTS<\/span><\/font><\/div>
WHERE EVENT_TIMESTAMP >= '2018-01-01 00:00:00' AND<\/span><\/font><\/div>
      EVENT_TIMESTAMP < '2050-12-31 23:59:59';<\/span><\/font><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"

\u25a0 docker ps –format “table {{.Names}}\\t{{.Ports}}” appdefender_backend_jobs_1       8080\/tcp haproxy                          0.0.0.0:1936->1936\/tcp, 0.0.0.0:4321->4321\/tcp, 0.0.0.0:8443-8444->8443-8444\/tcp rsyslog_defender                 0.0.0.0:514->514\/tcp, 0.0.0.0:1999->1999\/tcp appdefender_command_channel_1    0.0.0.0:32768->8080\/tcp appdefender_edge_1               0.0.0.0:32770->4321\/tcp appdefender_registrator_1 consul              […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_import_markdown_pro_load_document_selector":0,"_import_markdown_pro_submit_text_textarea":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[66],"tags":[],"class_list":["post-984","post","type-post","status-publish","format-standard","hentry","category-computing_fortify"],"_links":{"self":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/984","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=984"}],"version-history":[{"count":0,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/984\/revisions"}],"wp:attachment":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=984"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=984"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=984"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}