galaxy-report-service's saved-query-scheduler Nacos config documents a deployment-conditional HBase cell-level TTL policy for stored report results: unset (i.e. permanent retention) for "TSG" deployments versus a 7-day default for "CN" deployments, plus a hardcoded MariaDB root credential for the backing `cn_olap` database in the same config file.
存入Hbase的cell级别生存时间 根据部署环境填写：1.TSG 不设置(永久有效); 2.CN 7(默认7天) 单位：Day
Defense implications
- Data-retention posture is not uniform across Geedge/MESA deployments -- some (export/'TSG'-labeled) configurations default to indefinite retention of query results, which matters for any downstream FOIA/discovery or retrospective-deanonymization threat modeling of historical traffic.
Cited artifacts
mesalab_git—galaxy/platform/galaxy-report-service.bundle:config/nacos/config/fixed-127.0.0.1_8848-dev_nacos/data/config-data-tenant/dev/Galaxy/saved-query-scheduler.yml(config)
Provenance pointers only — no leak content is rehosted. Raw material: Enlace Hacktivista.
Related findings
Release 24.04 (28 APR 2024) adds province/city-granularity ("administrative area") geo-tagging to every session and security-event log for both client and server -- client_country/client_super_administrative_area/ client_administrative_area/client_sub_administrative_area and the server-side equivalents -- plus Client ASN/Server ASN as dedicated Statistics Rule Metric datasets, confirming sub-national geolocation is a standard enrichment field across TSG's logging pipeline, not a specialized lookup.
The app_recommend Flink job (Recommendation.java, job name "RECOMMENDATION-APP-CIP") keys incoming traffic by (app_label, client_ip), computes a sliding-window top-N of active client IPs per identified application via TopnHotItem's priority queue, and HbaseSink persists the result as an app-to-client-IP-list association -- row key MD5(app_label), columns app_label/client_ip_list/last_update_time -- in HBase. This is the source of the "Recommend App Active Client IP" troubleshooting lookup referenced in galaxy-troubleshooting-api's Release 21.12 changelog.
galaxy-troubleshooting-api's Postman collection defines a full "DoS Threat Map" dashboard API suite (folder-scoped request names: dos-threat-map-top- source-countries, dos-threat-map-top-destination-countries, dos-threat-map- top-victims, dos-threat-map-attack-type, dos-threat-map-severity, dos-threat- map-destination-ip-distribution, dos-threat-map-attack-connection, dos-threat-map-attack-volume-summary, dos-threat-map-attack-volume-trend), plus a separate DNS-amplification "Resolver" detection dataset and a per-victim-IP historical traffic-trend query -- confirming Galaxy exposes operator-facing DDoS-detection/geolocation dashboards built on top of TSG telemetry, distinct from its censorship/content-blocking function.
The `session_record` schema includes explicit boolean-style flag columns ssl_esni_flag and ssl_ech_flag, confirming that TSG/Galaxy tags every session with whether Encrypted SNI or Encrypted ClientHello was used -- giving the operator session-level visibility into ECH/ESNI adoption even where it cannot decrypt the underlying SNI.
galaxy-troubleshooting-api's Release 22.08 (31 AUG 2022) changelog adds four dedicated "recommend" endpoints that resolve IMSI, IMEI, phone number, and APN to GTP tunnel-endpoint ID (TEID) -- i.e. mobile-core identity-to-tunnel correlation exposed as a first-class, individually testable API surface at Galaxy's OLAP layer, corroborating the tsg_olap subtree's relationship-gtpc-user component. A "Top Subscribers" report existed on the same platform until it was explicitly removed in Release 24.04 (28 APR 2024).
The same `session_record` schema includes a literal `mail_password` column alongside mail_account/mail_from/mail_to/mail_cc/mail_bcc/mail_subject/ mail_attachment_name and a full per-session `mail_eml_file` capture, plus `ftp_account` and `ftp_url` -- confirming Galaxy's OLAP layer stores cleartext mail and FTP credentials and full message content per session, not just connection metadata.