# Database Schema to store Snort alerts in MySQL
#
# Written by:	raffael.marty@arcsight.com
#
# URL:		http://afterglow.sourceforge.net
#
# MySQL Server version: 4.1.6
# The Schema contains some extra fields that are used with other 
# utilities of the AfterGlow package
#

CREATE TABLE sans (
  id int(11) NOT NULL auto_increment,
  `timestamp` datetime NOT NULL default '0000-00-00 00:00:00',
  sourcemac varchar(17) NOT NULL default '',
  destmac varchar(17) NOT NULL default '',
  sourceip varchar(15) NOT NULL default '',
  destip varchar(15) NOT NULL default '',
  sourceport int(5) NOT NULL default '0',
  destport int(5) NOT NULL default '0',
  proto varchar(10) default NULL,
  tcpflags varchar(10) default NULL,
  length int(11) NOT NULL default '0',
  ttl int(11) default NULL,
  ipid int(11) default NULL,
  iptos varchar(10) default NULL,
  ipflags varchar(5) default NULL,
  `offset` int(11) default NULL,
  snort_alert varchar(100) default NULL,
  service int(11) default NULL,
  delta int(11) default NULL,
  delta2 int(7) default NULL,
  PRIMARY KEY  (id),
  KEY `timestamp` (`timestamp`),
  KEY id (id),
  KEY sourceip (sourceip),
  KEY destip (destip),
  KEY snort_alert (snort_alert)
)

