chaitin · 447502834 · Jul 4, 2026
diff --git a/services/qianxin__skyeye_v3.0.14.0/README.md b/services/qianxin__skyeye_v3.0.14.0/README.md
@@ -0,0 +1,84 @@
+# QianXin SkyEye V3.0.14.0
+
+OctoBus service package for QianXin SkyEye (天眼) V3.0.14.0 alarm and log queries.
+
+## Import
+
+```bash
+octobus service import --id qianxin-skyeye-v3-0-14-0 ./services/qianxin__skyeye_v3.0.14.0
+```
+
+## Package Layout
+
+```
+services/qianxin__skyeye_v3.0.14.0/
+  package.json              # NPM manifest
+  service.json              # OctoBus service manifest
+  config.schema.json        # Config bindings schema
+  secret.schema.json        # Secret bindings schema
+  proto/qianxin_skyeye_v3_0_14_0.proto  # gRPC service definition
+  src/qianxin-skyeye-v3.0.14.0.js        # Core handler logic
+  src/service.js            # Service assembly
+  bin/qianxin-skyeye-v3.0.14.0.js        # CLI entry point
+  test/                     # Unit tests + mock upstream
+  README.md
+```
+
+## Authentication
+
+Two modes supported:
+
+### Recommended: `login_key` dynamic auth
+
+Uses `login_key` to dynamically authenticate via the 2-step SkyEye auth flow:
+
+1. POST `/skyeye/v1/admin/auth` → `access_token`
+2. GET `/skyeye/v1/admin/auth?token=...` → session cookies + csrf_token from HTML
+
+Auth is performed for each call to match the verified Python script behavior. API requests carry cookies + csrf_token.
+
+| Binding | Key | Aliases | Description |
+|---------|-----|---------|-------------|
+| secret | `skyeye_login_key` | `login_key` | SkyEye login key (derived to client_id/client_secret via SHA256) |
+| config | `skyeye_domain` | `domain`, `baseUrl` | SkyEye API base URL (e.g. `https://10.0.0.1:443`) |
+| config | `skyeye_user_name` | `user_name` | SkyEye platform username for auth |
+| config | `client_id_random` | | Built-in random string for client_id derivation (default: empty) |
+| config | `client_secret_random` | | Built-in random string for client_secret derivation (default: empty) |
+
+### Legacy: static `csrf_token`
+
+If `login_key` is not configured, falls back to a pre-obtained `csrf_token`. No session cookies are sent.
+
+| Binding | Key | Aliases | Description |
+|---------|-----|---------|-------------|
+| secret | `skyeye_csrf_token` | `csrf_token` | Pre-obtained CSRF token |
+| config | `skyeye_staff_name` | `staff_name` | Staff name for alarm list queries |
+
+## Other Config Bindings
+
+| Key | Aliases | Description |
+|-----|---------|-------------|
+| `skyeye_domain` | `domain`, `baseUrl` | SkyEye API base URL |
+| `skyeye_staff_name` | `staff_name` | Staff name for alarm list queries |
+| `timeoutMs` | | HTTP timeout in ms (default 10000) |
+| `skipTlsVerify` | `tlsInsecureSkipVerify`, `insecureSkipVerify` | Skip TLS verification |
+
+## RPC Methods
+
+| Full Method | HTTP Path |
+|-------------|-----------|
+| `QianXin_SkyEye_V3_0_14_0.QianXin_SkyEye_V3_0_14_0/QueryAlarmList` | GET `/skyeye/v1/alarm/alarm/list` |
+| `QianXin_SkyEye_V3_0_14_0.QianXin_SkyEye_V3_0_14_0/QueryAlarmPacket` | GET `/skyeye/v1/alarm/alarm/info/packet` |
+| `QianXin_SkyEye_V3_0_14_0.QianXin_SkyEye_V3_0_14_0/DownloadAlarmPcap` | GET `/skyeye/v1/alarm/alarm/info/pcap/download` |
+| `QianXin_SkyEye_V3_0_14_0.QianXin_SkyEye_V3_0_14_0/QueryNetworkLog` | GET `/skyeye/v1/analysis/log-search/list` |
+
+## Behavior
+
+Each handler:
+1. Resolves auth: if `login_key` configured, performs 2-step auth flow; otherwise uses static `csrf_token`
+2. Builds query params: request fields + `csrf_token` + auto-generated `r` (random number)
+3. If auth flow was used, includes session cookies in Cookie header
+4. Makes HTTP GET to the SkyEye API
+5. Maps the upstream response `{ status, message, data }` to gRPC `{ response_code, verbose_msg, data }`
+
+On upstream HTTP errors (4xx/5xx), returns a gRPC error with the status code and body.
diff --git a/services/qianxin__skyeye_v3.0.14.0/bin/qianxin-skyeye-v3.0.14.0.js b/services/qianxin__skyeye_v3.0.14.0/bin/qianxin-skyeye-v3.0.14.0.js
@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { runServiceMain } from '@chaitin-ai/octobus-sdk';
+
+import { service } from '../src/service.js';
+
+runServiceMain(service);
diff --git a/services/qianxin__skyeye_v3.0.14.0/config.schema.json b/services/qianxin__skyeye_v3.0.14.0/config.schema.json
@@ -0,0 +1,66 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "skyeye_domain": {
+      "type": "string",
+      "description": "QianXin SkyEye API base URL, for example https://10.0.0.1:443."
+    },
+    "domain": {
+      "type": "string",
+      "description": "Alias for skyeye_domain."
+    },
+    "baseUrl": {
+      "type": "string",
+      "description": "Alias for skyeye_domain."
+    },
+    "skyeye_user_name": {
+      "type": "string",
+      "description": "SkyEye platform username for authentication. Defaults to skyeye_staff_name if not set."
+    },
+    "user_name": {
+      "type": "string",
+      "description": "Alias for skyeye_user_name."
+    },
+    "skyeye_staff_name": {
+      "type": "string",
+      "description": "Staff name for alarm list queries."
+    },
+    "staff_name": {
+      "type": "string",
+      "description": "Alias for skyeye_staff_name."
+    },
+    "client_id_random": {
+      "type": "string",
+      "default": "",
+      "description": "Built-in random string for client_id derivation in authentication."
+    },
+    "client_secret_random": {
+      "type": "string",
+      "default": "",
+      "description": "Built-in random string for client_secret derivation in authentication."
+    },
+    "timeoutMs": {
+      "type": "integer",
+      "minimum": 1,
+      "default": 10000,
+      "description": "HTTP timeout in milliseconds."
+    },
+    "skipTlsVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip TLS certificate verification for private deployments."
+    },
+    "tlsInsecureSkipVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Legacy alias for skipTlsVerify."
+    },
+    "insecureSkipVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Alias for skipTlsVerify."
+    }
+  }
+}
diff --git a/services/qianxin__skyeye_v3.0.14.0/package.json b/services/qianxin__skyeye_v3.0.14.0/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "qianxin-skyeye-v3.0.14.0",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "bin": {
+    "qianxin-skyeye-v3.0.14.0": "bin/qianxin-skyeye-v3.0.14.0.js"
+  },
+  "scripts": {
+    "test": "node --test test/qianxin-skyeye-v3.0.14.0.test.js"
+  },
+  "dependencies": {
+    "@chaitin-ai/octobus-sdk": "^0.5.0"
+  }
+}
diff --git a/services/qianxin__skyeye_v3.0.14.0/proto/qianxin_skyeye_v3_0_14_0.proto b/services/qianxin__skyeye_v3.0.14.0/proto/qianxin_skyeye_v3_0_14_0.proto
@@ -0,0 +1,105 @@
+syntax = "proto3";
+
+package QianXin_SkyEye_V3_0_14_0;
+
+option go_package = "miner/grpc-service/QianXin_SkyEye_V3_0_14_0";
+
+service QianXin_SkyEye_V3_0_14_0 {
+  rpc QueryAlarmList(QueryAlarmListRequest) returns (QueryAlarmListResponse) {}
+  rpc QueryAlarmPacket(QueryAlarmPacketRequest) returns (QueryAlarmPacketResponse) {}
+  rpc DownloadAlarmPcap(DownloadAlarmPcapRequest) returns (DownloadAlarmPcapResponse) {}
+  rpc QueryNetworkLog(QueryNetworkLogRequest) returns (QueryNetworkLogResponse) {}
+}
+
+message QueryAlarmListRequest {
+  string start_time = 1;
+  string end_time = 2;
+  optional string threat_type = 3;
+  optional int32 hazard_level = 4;
+  optional string host_state = 5;
+  optional string status = 6;
+  optional string data_source = 7;
+  optional string alarm_sip = 8;
+  optional string attack_sip = 9;
+  optional string attack_stage = 10;
+  optional string asset_group = 11;
+  optional string attack_dimension = 12;
+  optional string alarm_id = 13;
+  optional string focus_label = 14;
+  optional int32 is_alarm_black_ip = 15;
+  optional string black_ip = 16;
+  optional int32 is_white = 17;
+  optional string threat_name = 18;
+  optional int32 is_accurate = 19;
+  optional int32 offset = 20;
+  optional int32 limit = 21;
+  optional string order_by = 22;
+}
+
+message QueryAlarmListResponse {
+  int32 response_code = 1;
+  string verbose_msg = 2;
+  string data = 3;
+}
+
+message QueryAlarmPacketRequest {
+  string alarm_sip = 1;
+  string attack_sip = 2;
+  string start_time = 3;
+  string end_time = 4;
+  string alarm_id = 5;
+  optional string skyeye_type = 6;
+  optional string ioc = 7;
+  optional string branch_id = 8;
+  optional string host_state = 9;
+}
+
+message QueryAlarmPacketResponse {
+  int32 response_code = 1;
+  string verbose_msg = 2;
+  string data = 3;
+}
+
+message DownloadAlarmPcapRequest {
+  string alarm_sip = 1;
+  string attack_sip = 2;
+  string start_time = 3;
+  string end_time = 4;
+  optional string skyeye_type = 5;
+  optional string ioc = 6;
+  optional string type = 7;
+  optional string branch_id = 8;
+}
+
+message DownloadAlarmPcapResponse {
+  int32 response_code = 1;
+  string verbose_msg = 2;
+  string data = 3;
+}
+
+message QueryNetworkLogRequest {
+  string start_time = 1;
+  string end_time = 2;
+  string index = 3;
+  string category = 4;
+  string mode = 5;
+  string offset = 6;
+  string limit = 7;
+  optional string branch_id = 8;
+  optional string keyword = 9;
+  optional string asset_group_ids = 10;
+  optional string stime = 11;
+  optional string etime = 12;
+  optional string interval = 13;
+  optional string page = 14;
+  optional string size = 15;
+  optional string key_fields = 16;
+  optional string graph_conf = 17;
+  optional string curBranch = 18;
+}
+
+message QueryNetworkLogResponse {
+  int32 response_code = 1;
+  string verbose_msg = 2;
+  string data = 3;
+}
diff --git a/services/qianxin__skyeye_v3.0.14.0/secret.schema.json b/services/qianxin__skyeye_v3.0.14.0/secret.schema.json
@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "skyeye_login_key": {
+      "type": "string",
+      "description": "SkyEye login key for dynamic authentication (preferred over csrf_token)."
+    },
+    "login_key": {
+      "type": "string",
+      "description": "Alias for skyeye_login_key."
+    },
+    "skyeye_csrf_token": {
+      "type": "string",
+      "description": "SkyEye CSRF token (legacy, use login_key instead)."
+    },
+    "csrf_token": {
+      "type": "string",
+      "description": "Alias for skyeye_csrf_token."
+    }
+  }
+}
diff --git a/services/qianxin__skyeye_v3.0.14.0/service.json b/services/qianxin__skyeye_v3.0.14.0/service.json
@@ -0,0 +1,37 @@
+{
+  "schema": "chaitin.octobus.service.v1",
+  "name": "qianxin-skyeye-v3.0.14.0",
+  "displayName": "QianXin SkyEye V3.0.14.0",
+  "description": "OctoBus package for QianXin SkyEye (TianYan) V3.0.14.0 alarm queries, payload retrieval, pcap download, and network log search.",
+  "runtime": {
+    "mode": "long-running"
+  },
+  "proto": {
+    "roots": ["proto"],
+    "files": ["proto/qianxin_skyeye_v3_0_14_0.proto"]
+  },
+  "configSchema": "config.schema.json",
+  "secretSchema": "secret.schema.json",
+  "sdk": {
+    "cli": {
+      "commands": {
+        "QianXin_SkyEye_V3_0_14_0.QianXin_SkyEye_V3_0_14_0/QueryAlarmList": {
+          "name": "query-alarm-list",
+          "description": "Query QianXin SkyEye alarm list."
+        },
+        "QianXin_SkyEye_V3_0_14_0.QianXin_SkyEye_V3_0_14_0/QueryAlarmPacket": {
+          "name": "query-alarm-packet",
+          "description": "Query QianXin SkyEye alarm payload content."
+        },
+        "QianXin_SkyEye_V3_0_14_0.QianXin_SkyEye_V3_0_14_0/DownloadAlarmPcap": {
+          "name": "download-alarm-pcap",
+          "description": "Download QianXin SkyEye alarm pcap."
+        },
+        "QianXin_SkyEye_V3_0_14_0.QianXin_SkyEye_V3_0_14_0/QueryNetworkLog": {
+          "name": "query-network-log",
+          "description": "Query QianXin SkyEye network log."
+        }
+      }
+    }
+  }
+}