补测：行为检测支持历史区间；特征扫描自动时间切片；历史画像保留

graylog_ops/behavior.py

@@ -134,11 +134,20 @@ def asn_info(ip, root):
     return {"asn": "", "org": "未知", "shared": "unknown"}
 
 
+RANGE_OVERRIDE = None
+
+
 def pivot(client, series, row_groups, column_groups=None, query="*",
           limit=300, timeout=180000):
+    if RANGE_OVERRIDE:
+        timerange = {"type": "absolute",
+                     "from": RANGE_OVERRIDE["from"],
+                     "to": RANGE_OVERRIDE["to"]}
+    else:
+        timerange = {"type": "relative", "range": WINDOW}
     body = {"queries": [{
         "id": "q1",
-        "timerange": {"type": "relative", "range": WINDOW},
+        "timerange": timerange,
         "query": {"type": "elasticsearch", "query_string": query},
         "filter": {"type": "or", "filters": [{"type": "stream",
                                                "id": "6ac83059a6878e26256fcacc"}]},
@@ -401,9 +410,13 @@ class BehaviorAnalyzer:
             except GraylogError:
                 pass
             try:
+                extra = {}
+                if RANGE_OVERRIDE:
+                    extra = {"from_ts": RANGE_OVERRIDE["from"],
+                             "to_ts": RANGE_OVERRIDE["to"]}
                 hist = self.client.histogram(query=q, range_seconds=self.window,
                                              interval="5m",
-                                             filter_str=self.filter_str)
+                                             filter_str=self.filter_str, **extra)
                 from .client import normalize_histogram
                 detail["buckets5m"] = [b["count"]
                                        for b in normalize_histogram(hist)]