YunZhi UEBA Receiver

接收 SiteLLM YunZhi UEBA 回调事件的轻量级服务，支持实时和批量两种发送模式的验证。

快速开始

# 1. 安装依赖
 # pip install fastapi uvicorn jinja2 httpx python-dotenv pydantic
pip install yunzhi-ueba-receiver

# 2. 配置 (可选)
# 编辑 .env 文件，修改端口和 API Key

YUNZHI_RECEIVER_PORT=9090
YUNZHI_RECEIVER_API_KEY=test-key
YUNZHI_RECEIVER_DB_PATH=../ueba_events.db
YUNZHI_RECEIVER_LOG_LEVEL=INFO
YUNZHI_RECEIVER_MAX_EVENTS=100000
YUNZHI_RECEIVER_REFRESH_MS=5000


# 3. 启动服务
python -m receiver.main

服务启动后：

• API 端点: http://localhost:9090
• Web UI: 浏览器打开 http://localhost:9090
• 健康检查: GET /api/health

配置

测试

# 启动接收端后，另一个终端运行：
python scripts/test_sender.py --receiver-url http://localhost:9090 --api-key test-key

与 siteLLM 对接

UI上添加日志回调或在 siteLLM 的 config.yaml 中配置：

Realtime 模式

litellm_params:
  callbacks:
    - yunzhi_ueba

yunzhi_ueba_callback_config:
  YUNZHI_UEBA_API_BASE: "http://localhost:9090"
  YUNZHI_UEBA_API_KEY: "test-key"
  YUNZHI_UEBA_MODE: "realtime"

Batch 模式

yunzhi_ueba_callback_config:
  YUNZHI_UEBA_API_BASE: "http://localhost:9090"
  YUNZHI_UEBA_API_KEY: "test-key"
  YUNZHI_UEBA_MODE: "batch"
  YUNZHI_UEBA_BATCH_SIZE: 20
  YUNZHI_UEBA_FLUSH_INTERVAL: 30

API 文档

POST /api/events — 接收事件

请求体：

{
  "events": [
    {
      "event": "completion",
      "topic": "UEBA-Agent",
      "sitellm_payload": { ...完整 StandardLoggingPayload... }
    }
  ]
}

响应：

{"received": 1, "errors": []}

GET /api/query — 查询事件

参数：model, provider, status, session_id, user, startTime, endTime, page, limit

GET /api/health — 健康检查

响应：{"status": "healthy"}