feat: problem rules v1 brute-force, privilege spike, host silence (d1-3)

- Threshold rules on ingest; heartbeat auto-resolves host silence

- Config thresholds in sac-api.env; unit tests

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/problems.py

@@ -1,36 +1,24 @@
-"""Auto-create Problems from ingested events (MVP rules + correlation)."""
+"""Auto-create Problems from ingested events (rules + correlation)."""
 
-from datetime import datetime, timedelta, timezone
+from datetime import datetime, timezone
 
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
 from app.config import get_settings
 from app.models import Event, Problem, ProblemEvent
-
-PROBLEM_TYPES = frozenset(
-    {
-        "ssh.ip.banned",
-        "ssh.bruteforce.mass",
-    }
+from app.services.host_health import HEARTBEAT_TYPE
+from app.services.problem_rules import (
+    RuleMatch,
+    build_fingerprint,
+    pick_rule_match,
+    resolve_host_silence_problems,
 )
 
-HIGH_SEVERITIES = frozenset({"high", "critical"})
-
-
-def problem_rule_id(event: Event) -> str | None:
-    if event.severity in HIGH_SEVERITIES:
-        return "high_severity"
-    if event.type in PROBLEM_TYPES:
-        return f"type:{event.type}"
-    return None
-
-
-def problem_fingerprint(host_id: int, event_type: str, rule_id: str) -> str:
-    return f"h{host_id}:t{event_type}:r{rule_id}"
-
 
 def _correlation_cutoff(now: datetime) -> datetime:
+    from datetime import timedelta
+
     minutes = get_settings().sac_problem_correlation_window_minutes
     return now - timedelta(minutes=minutes)
 
@@ -48,17 +36,20 @@ def _append_event(db: Session, problem: Problem, event: Event) -> None:
     problem.event_count = (problem.event_count or 0) + 1
     problem.last_seen_at = event.occurred_at
     problem.updated_at = datetime.now(timezone.utc)
-    if event.severity in HIGH_SEVERITIES and problem.severity not in HIGH_SEVERITIES:
+    if event.severity in {"high", "critical"} and problem.severity not in {"high", "critical"}:
         problem.severity = event.severity
     db.flush()
 
 
-def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, bool]:
-    rule_id = problem_rule_id(event)
-    if rule_id is None:
-        return None, False
-
-    fingerprint = problem_fingerprint(event.host_id, event.type, rule_id)
+def open_or_append_problem(
+    db: Session, event: Event, match: RuleMatch
+) -> tuple[Problem, bool]:
+    fingerprint = build_fingerprint(
+        event.host_id,
+        match.correlation_type,
+        match.rule_id,
+        match.fingerprint_suffix,
+    )
     now = datetime.now(timezone.utc)
     cutoff = _correlation_cutoff(now)
 
@@ -75,15 +66,18 @@ def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, boo
     )
     if open_problem:
         _append_event(db, open_problem, event)
+        if match.severity in {"high", "critical"} and open_problem.severity not in {"high", "critical"}:
+            open_problem.severity = match.severity
+            open_problem.summary = match.summary
         return open_problem, False
 
     problem = Problem(
         host_id=event.host_id,
-        title=event.title,
-        summary=event.summary,
-        severity=event.severity,
+        title=match.title,
+        summary=match.summary,
+        severity=match.severity,
         status="open",
-        rule_id=rule_id,
+        rule_id=match.rule_id,
         fingerprint=fingerprint,
         event_count=1,
         last_seen_at=event.occurred_at,
@@ -93,3 +87,15 @@ def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, boo
     db.add(ProblemEvent(problem_id=problem.id, event_id=event.id))
     db.flush()
     return problem, True
+
+
+def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, bool]:
+    if event.type == HEARTBEAT_TYPE:
+        resolve_host_silence_problems(db, event.host_id)
+        return None, False
+
+    match = pick_rule_match(db, event)
+    if match is None:
+        return None, False
+
+    return open_or_append_problem(db, event, match)