Method GetEventSummary

pkg/security/audit.go:742–782

GetEventSummary 获取事件摘要

(timeRange TimeRange)

// GetEventSummary 获取事件摘要
func (al *InMemoryAuditLog) GetEventSummary(timeRange TimeRange) (*EventSummary, error) {
	query := &AuditQuery{
		TimeRange: &timeRange,
	}

	result, err := al.QueryEvents(context.Background(), query)
	if err != nil {
		return nil, err
	}

	summary := &EventSummary{
		TimeRange:   timeRange,
		TotalEvents: result.Total,
		KeyMetrics:  make(map[string]any),
		Trends:      []TrendData{},
		Alerts:      []SecurityAlert{},
	}

	// 生成趋势数据
	trendData := make(map[string]int64)
	for _, event := range result.Events {
		hour := event.Timestamp.Truncate(time.Hour)
		key := hour.Format("2006-01-02 15:00")
		trendData[key]++
	}

	for timestamp, count := range trendData {
		t, _ := time.Parse("2006-01-02 15:00", timestamp)
		summary.Trends = append(summary.Trends, TrendData{
			Timestamp: t,
			Value:     count,
			Label:     timestamp,
		})
	}

	// 设置关键指标
	summary.KeyMetrics["events_per_hour"] = float64(result.Total) / timeRange.End.Sub(timeRange.Start).Hours()
	summary.KeyMetrics["unique_users"] = len(getUniqueUsers(result.Events))

	return summary, nil
}

// ArchiveEvents 归档事件
func (al *InMemoryAuditLog) ArchiveEvents(ctx context.Context, before time.Time) (int64, error) {