detect-clickhouse-bulk-export

Detect single-principal bulk row export out of a ClickHouse cluster. Reads OCSF 1.8 API Activity (class 6003) records carrying `actor.user.uid`, `api.operation`, and ClickHouse-shaped `unmapped.clickhouse.{query_kind,read_bytes,read_rows,written_bytes,written_rows,query,exception}` fields, groups them by principal across a sliding window, and emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1567 Exfiltration Over Web Service whenever cumulative `read_bytes` for queries whose SQL text matches an external-export pattern (`INTO OUTFILE`, `INSERT INTO FUNCTION s3(`, `URL(`) crosses the configured byte threshold. Use when you suspect a compromised ClickHouse account or service principal is dumping rows to S3, an external HTTP endpoint, or a local OUTFILE. Do NOT use on raw ClickHouse `system.query_log` rows — normalize them through the upstream ClickHouse ingest pipeline first. Do NOT use as a generic data-loss detector for non-ClickHouse warehouses.