The Galaxy big-data cluster deployment automation (ZhangJianlong/galaxy-auto-deploy-cluster) provisions Flink streaming jobs for an 'ACTIVE-DEFENCE-EVENT' log stream, a 'DOS-DETECTION-APPLICATION', and a GTP-C record stream (template name truncated 'GTPC-RE...' in the tree listing) alongside ClickHouse/Druid/Kafka/HBase, confirming the analytics platform ingests mobile-core-network GTP-C signaling in addition to DDoS-detection and active-defense event streams.
parcels/roles/init/flink/templates/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2, DOS-DETECTION-APPLICATION.j2, GTPC-RE[...] ; parcels/roles/init/dos-baseline/tasks/init_dos.yml
capabilitydeployment-config