feat: Problems API, ingest hook, and UI

backend/app/services/problems.py

@@ -0,0 +1,68 @@
+"""Auto-create Problems from ingested events (MVP rules)."""
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.models import Event, Problem, ProblemEvent
+
+# event types that always open a problem
+PROBLEM_TYPES = frozenset(
+    {
+        "ssh.ip.banned",
+        "ssh.bruteforce.mass",
+    }
+)
+
+HIGH_SEVERITIES = frozenset({"high", "critical"})
+
+
+def maybe_create_problem(db: Session, event: Event) -> Problem | None:
+    if event.severity not in HIGH_SEVERITIES and event.type not in PROBLEM_TYPES:
+        return None
+
+    rule_id = "high_severity" if event.severity in HIGH_SEVERITIES else f"type:{event.type}"
+
+    existing = db.scalar(
+        select(Problem)
+        .join(ProblemEvent)
+        .where(
+            Problem.status == "open",
+            Problem.rule_id == rule_id,
+            Problem.host_id == event.host_id,
+            ProblemEvent.event_id == event.id,
+        )
+        .limit(1)
+    )
+    if existing:
+        return existing
+
+    # dedupe: one open problem per host+rule (append event link)
+    open_problem = db.scalar(
+        select(Problem)
+        .where(
+            Problem.status == "open",
+            Problem.rule_id == rule_id,
+            Problem.host_id == event.host_id,
+        )
+        .order_by(Problem.created_at.desc())
+        .limit(1)
+    )
+    if open_problem:
+        db.add(ProblemEvent(problem_id=open_problem.id, event_id=event.id))
+        open_problem.updated_at = event.received_at
+        db.flush()
+        return open_problem
+
+    problem = Problem(
+        host_id=event.host_id,
+        title=event.title,
+        summary=event.summary,
+        severity=event.severity,
+        status="open",
+        rule_id=rule_id,
+    )
+    db.add(problem)
+    db.flush()
+    db.add(ProblemEvent(problem_id=problem.id, event_id=event.id))
+    db.flush()
+    return problem