feat: Problems correlation fingerprint, count, last_seen (d1-2)

- Migration 003; windowed host+type+rule correlation on ingest

- GET /problems filters; GET /problems/{id} with event timeline; ack/resolve 409 guard

- Tests and SAC_PROBLEM_CORRELATION_WINDOW_MINUTES config

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/problems.py

@@ -1,11 +1,13 @@
-"""Auto-create Problems from ingested events (MVP rules)."""
+"""Auto-create Problems from ingested events (MVP rules + correlation)."""
+
+from datetime import datetime, timedelta, timezone
 
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
+from app.config import get_settings
 from app.models import Event, Problem, ProblemEvent
 
-# event types that always open a problem
 PROBLEM_TYPES = frozenset(
     {
         "ssh.ip.banned",
@@ -16,41 +18,63 @@ PROBLEM_TYPES = frozenset(
 HIGH_SEVERITIES = frozenset({"high", "critical"})
 
 
-def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, bool]:
-    if event.severity not in HIGH_SEVERITIES and event.type not in PROBLEM_TYPES:
-        return None, False
+def problem_rule_id(event: Event) -> str | None:
+    if event.severity in HIGH_SEVERITIES:
+        return "high_severity"
+    if event.type in PROBLEM_TYPES:
+        return f"type:{event.type}"
+    return None
 
-    rule_id = "high_severity" if event.severity in HIGH_SEVERITIES else f"type:{event.type}"
 
-    existing = db.scalar(
-        select(Problem)
-        .join(ProblemEvent)
-        .where(
-            Problem.status == "open",
-            Problem.rule_id == rule_id,
-            Problem.host_id == event.host_id,
+def problem_fingerprint(host_id: int, event_type: str, rule_id: str) -> str:
+    return f"h{host_id}:t{event_type}:r{rule_id}"
+
+
+def _correlation_cutoff(now: datetime) -> datetime:
+    minutes = get_settings().sac_problem_correlation_window_minutes
+    return now - timedelta(minutes=minutes)
+
+
+def _append_event(db: Session, problem: Problem, event: Event) -> None:
+    linked = db.scalar(
+        select(ProblemEvent).where(
+            ProblemEvent.problem_id == problem.id,
             ProblemEvent.event_id == event.id,
         )
-        .limit(1)
     )
-    if existing:
-        return existing, False
+    if linked is not None:
+        return
+    db.add(ProblemEvent(problem_id=problem.id, event_id=event.id))
+    problem.event_count = (problem.event_count or 0) + 1
+    problem.last_seen_at = event.occurred_at
+    problem.updated_at = datetime.now(timezone.utc)
+    if event.severity in HIGH_SEVERITIES and problem.severity not in HIGH_SEVERITIES:
+        problem.severity = event.severity
+    db.flush()
+
+
+def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, bool]:
+    rule_id = problem_rule_id(event)
+    if rule_id is None:
+        return None, False
+
+    fingerprint = problem_fingerprint(event.host_id, event.type, rule_id)
+    now = datetime.now(timezone.utc)
+    cutoff = _correlation_cutoff(now)
 
-    # dedupe: one open problem per host+rule (append event link)
     open_problem = db.scalar(
         select(Problem)
         .where(
             Problem.status == "open",
-            Problem.rule_id == rule_id,
+            Problem.fingerprint == fingerprint,
             Problem.host_id == event.host_id,
+            Problem.last_seen_at >= cutoff,
         )
-        .order_by(Problem.created_at.desc())
+        .order_by(Problem.last_seen_at.desc())
         .limit(1)
     )
     if open_problem:
-        db.add(ProblemEvent(problem_id=open_problem.id, event_id=event.id))
-        open_problem.updated_at = event.received_at
-        db.flush()
+        _append_event(db, open_problem, event)
         return open_problem, False
 
     problem = Problem(
@@ -60,6 +84,9 @@ def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, boo
         severity=event.severity,
         status="open",
         rule_id=rule_id,
+        fingerprint=fingerprint,
+        event_count=1,
+        last_seen_at=event.occurred_at,
     )
     db.add(problem)
     db.flush()