Metadata-Version: 2.4
Name: yunzhi-ueba-receiver
Version: 0.1.8
Summary: YunZhi UEBA receiver for SiteLLM callback events
License-Expression: MIT
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: fastapi>=0.110.0
Requires-Dist: uvicorn[standard]>=0.29.0
Requires-Dist: jinja2>=3.1.0
Requires-Dist: httpx>=0.27.0
Requires-Dist: python-dotenv>=1.0.0

# YunZhi UEBA Receiver

接收 SiteLLM YunZhi UEBA 回调事件的轻量级服务，支持实时和批量两种发送模式的验证。

## 快速开始

```bash

# 1. 安装依赖
 # pip install fastapi uvicorn jinja2 httpx python-dotenv pydantic
pip install yunzhi-ueba-receiver

# 2. 配置 (可选)
# 编辑 .env 文件，修改端口和 API Key

YUNZHI_RECEIVER_PORT=9090
YUNZHI_RECEIVER_API_KEY=test-key
YUNZHI_RECEIVER_DB_PATH=../ueba_events.db
YUNZHI_RECEIVER_LOG_LEVEL=INFO
YUNZHI_RECEIVER_MAX_EVENTS=100000
YUNZHI_RECEIVER_REFRESH_MS=5000


# 3. 启动服务
python -m receiver.main

```

服务启动后：
- **API 端点**: `http://localhost:9090`
- **Web UI**: 浏览器打开 `http://localhost:9090`
- **健康检查**: `GET /api/health`

## 配置

| 环境变量 | 默认值 | 说明 |
|----------|--------|------|
| `YUNZHI_RECEIVER_PORT` | `9090` | HTTP 服务端口 |
| `YUNZHI_RECEIVER_API_KEY` | `test-key` | 接收端认证密钥 |
| `YUNZHI_RECEIVER_DB_PATH` | `./ueba_events.db` | SQLite 数据库路径 |
| `YUNZHI_RECEIVER_MAX_EVENTS` | `100000` | 最大存储条数 |

## 测试

```bash
# 启动接收端后，另一个终端运行：
python scripts/test_sender.py --receiver-url http://localhost:9090 --api-key test-key
```

## 与 siteLLM 对接

UI上添加日志回调或在 siteLLM 的 `config.yaml` 中配置：

### Realtime 模式
```yaml
litellm_params:
  callbacks:
    - yunzhi_ueba

yunzhi_ueba_callback_config:
  YUNZHI_UEBA_API_BASE: "http://localhost:9090"
  YUNZHI_UEBA_API_KEY: "test-key"
  YUNZHI_UEBA_MODE: "realtime"
```

### Batch 模式
```yaml
yunzhi_ueba_callback_config:
  YUNZHI_UEBA_API_BASE: "http://localhost:9090"
  YUNZHI_UEBA_API_KEY: "test-key"
  YUNZHI_UEBA_MODE: "batch"
  YUNZHI_UEBA_BATCH_SIZE: 20
  YUNZHI_UEBA_FLUSH_INTERVAL: 30
```

## API 文档

### `POST /api/events` — 接收事件

请求体：
```json
{
  "events": [
    {
      "event": "completion",
      "topic": "UEBA-Agent",
      "sitellm_payload": { ...完整 StandardLoggingPayload... }
    }
  ]
}
```

响应：
```json
{"received": 1, "errors": []}
```

### `GET /api/query` — 查询事件

参数：`model`, `provider`, `status`, `session_id`, `user`, `startTime`, `endTime`, `page`, `limit`

### `GET /api/health` — 健康检查

响应：`{"status": "healthy"}`
