PTah
a4a224b284
- Migration 003; windowed host+type+rule correlation on ingest
- GET /problems filters; GET /problems/{id} with event timeline; ack/resolve 409 guard
- Tests and SAC_PROBLEM_CORRELATION_WINDOW_MINUTES config
Co-authored-by: Cursor <cursoragent@cursor.com>
96 lines
2.7 KiB
Python
96 lines
2.7 KiB
Python
"""Auto-create Problems from ingested events (MVP rules + correlation)."""
|
|
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
from sqlalchemy import select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.config import get_settings
|
|
from app.models import Event, Problem, ProblemEvent
|
|
|
|
PROBLEM_TYPES = frozenset(
|
|
{
|
|
"ssh.ip.banned",
|
|
"ssh.bruteforce.mass",
|
|
}
|
|
)
|
|
|
|
HIGH_SEVERITIES = frozenset({"high", "critical"})
|
|
|
|
|
|
def problem_rule_id(event: Event) -> str | None:
|
|
if event.severity in HIGH_SEVERITIES:
|
|
return "high_severity"
|
|
if event.type in PROBLEM_TYPES:
|
|
return f"type:{event.type}"
|
|
return None
|
|
|
|
|
|
def problem_fingerprint(host_id: int, event_type: str, rule_id: str) -> str:
|
|
return f"h{host_id}:t{event_type}:r{rule_id}"
|
|
|
|
|
|
def _correlation_cutoff(now: datetime) -> datetime:
|
|
minutes = get_settings().sac_problem_correlation_window_minutes
|
|
return now - timedelta(minutes=minutes)
|
|
|
|
|
|
def _append_event(db: Session, problem: Problem, event: Event) -> None:
|
|
linked = db.scalar(
|
|
select(ProblemEvent).where(
|
|
ProblemEvent.problem_id == problem.id,
|
|
ProblemEvent.event_id == event.id,
|
|
)
|
|
)
|
|
if linked is not None:
|
|
return
|
|
db.add(ProblemEvent(problem_id=problem.id, event_id=event.id))
|
|
problem.event_count = (problem.event_count or 0) + 1
|
|
problem.last_seen_at = event.occurred_at
|
|
problem.updated_at = datetime.now(timezone.utc)
|
|
if event.severity in HIGH_SEVERITIES and problem.severity not in HIGH_SEVERITIES:
|
|
problem.severity = event.severity
|
|
db.flush()
|
|
|
|
|
|
def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, bool]:
|
|
rule_id = problem_rule_id(event)
|
|
if rule_id is None:
|
|
return None, False
|
|
|
|
fingerprint = problem_fingerprint(event.host_id, event.type, rule_id)
|
|
now = datetime.now(timezone.utc)
|
|
cutoff = _correlation_cutoff(now)
|
|
|
|
open_problem = db.scalar(
|
|
select(Problem)
|
|
.where(
|
|
Problem.status == "open",
|
|
Problem.fingerprint == fingerprint,
|
|
Problem.host_id == event.host_id,
|
|
Problem.last_seen_at >= cutoff,
|
|
)
|
|
.order_by(Problem.last_seen_at.desc())
|
|
.limit(1)
|
|
)
|
|
if open_problem:
|
|
_append_event(db, open_problem, event)
|
|
return open_problem, False
|
|
|
|
problem = Problem(
|
|
host_id=event.host_id,
|
|
title=event.title,
|
|
summary=event.summary,
|
|
severity=event.severity,
|
|
status="open",
|
|
rule_id=rule_id,
|
|
fingerprint=fingerprint,
|
|
event_count=1,
|
|
last_seen_at=event.occurred_at,
|
|
)
|
|
db.add(problem)
|
|
db.flush()
|
|
db.add(ProblemEvent(problem_id=problem.id, event_id=event.id))
|
|
db.flush()
|
|
return problem, True
|