PTah
a4a224b284
- Migration 003; windowed host+type+rule correlation on ingest
- GET /problems filters; GET /problems/{id} with event timeline; ack/resolve 409 guard
- Tests and SAC_PROBLEM_CORRELATION_WINDOW_MINUTES config
Co-authored-by: Cursor <cursoragent@cursor.com>
39 lines
1.7 KiB
Python
39 lines
1.7 KiB
Python
from datetime import datetime
|
|
|
|
from sqlalchemy import DateTime, ForeignKey, Integer, String, Text, func
|
|
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
|
|
|
from app.database import Base
|
|
|
|
|
|
class Problem(Base):
|
|
__tablename__ = "problems"
|
|
|
|
id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
|
|
host_id: Mapped[int | None] = mapped_column(ForeignKey("hosts.id"), index=True)
|
|
title: Mapped[str] = mapped_column(String(256))
|
|
summary: Mapped[str] = mapped_column(Text)
|
|
severity: Mapped[str] = mapped_column(String(16), index=True)
|
|
status: Mapped[str] = mapped_column(String(32), index=True, default="open")
|
|
rule_id: Mapped[str | None] = mapped_column(String(64))
|
|
fingerprint: Mapped[str] = mapped_column(String(128), index=True)
|
|
event_count: Mapped[int] = mapped_column(Integer, default=1)
|
|
last_seen_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), index=True)
|
|
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
|
|
updated_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
|
|
)
|
|
|
|
host: Mapped["Host | None"] = relationship()
|
|
event_links: Mapped[list["ProblemEvent"]] = relationship(back_populates="problem")
|
|
|
|
|
|
class ProblemEvent(Base):
|
|
__tablename__ = "problem_events"
|
|
|
|
problem_id: Mapped[int] = mapped_column(ForeignKey("problems.id", ondelete="CASCADE"), primary_key=True)
|
|
event_id: Mapped[int] = mapped_column(ForeignKey("events.id", ondelete="CASCADE"), primary_key=True)
|
|
|
|
problem: Mapped["Problem"] = relationship(back_populates="event_links")
|
|
event: Mapped["Event"] = relationship()
|