feat: Problems correlation fingerprint, count, last_seen (d1-2)

- Migration 003; windowed host+type+rule correlation on ingest - GET /problems filters; GET /problems/{id} with event timeline; ack/resolve 409 guard - Tests and SAC_PROBLEM_CORRELATION_WINDOW_MINUTES config Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-28 09:46:12 +10:00
parent 8eb40cf75d
commit a4a224b284
10 changed files with 365 additions and 126 deletions
@@ -1,99 +1,174 @@
-from datetime import datetime
-
-from fastapi import APIRouter, Depends, HTTPException, Query
-from pydantic import BaseModel
-from sqlalchemy import func, select
-from sqlalchemy.orm import Session, joinedload
-
-from app.auth.jwt_auth import get_current_user
-from app.database import get_db
-from app.models import Problem
-
-router = APIRouter(prefix="/problems", tags=["problems"])
-
-
-class ProblemSummary(BaseModel):
-    id: int
-    host_id: int | None
-    hostname: str | None
-    title: str
-    summary: str
-    severity: str
-    status: str
-    rule_id: str | None
-    created_at: datetime
-    updated_at: datetime
-
-    model_config = {"from_attributes": True}
-
-
-class ProblemListResponse(BaseModel):
-    items: list[ProblemSummary]
-    total: int
-    page: int
-    page_size: int
-
-
-@router.get("", response_model=ProblemListResponse)
-def list_problems(
-    page: int = Query(1, ge=1),
-    page_size: int = Query(50, ge=1, le=200),
-    status: str | None = Query(None),
-    db: Session = Depends(get_db),
-    _user: str = Depends(get_current_user),
-) -> ProblemListResponse:
-    stmt = select(Problem).options(joinedload(Problem.host))
-    count_stmt = select(func.count()).select_from(Problem)
-    if status:
-        stmt = stmt.where(Problem.status == status)
-        count_stmt = count_stmt.where(Problem.status == status)
-
-    total = db.scalar(count_stmt) or 0
-    rows = db.scalars(
-        stmt.order_by(Problem.updated_at.desc()).offset((page - 1) * page_size).limit(page_size)
-    ).all()
-
-    items = [
-        ProblemSummary(
-            id=p.id,
-            host_id=p.host_id,
-            hostname=p.host.hostname if p.host else None,
-            title=p.title,
-            summary=p.summary,
-            severity=p.severity,
-            status=p.status,
-            rule_id=p.rule_id,
-            created_at=p.created_at,
-            updated_at=p.updated_at,
-        )
-        for p in rows
-    ]
-    return ProblemListResponse(items=items, total=total, page=page, page_size=page_size)
-
-
-@router.post("/{problem_id}/ack")
-def ack_problem(
-    problem_id: int,
-    db: Session = Depends(get_db),
-    _user: str = Depends(get_current_user),
-) -> dict:
-    problem = db.get(Problem, problem_id)
-    if problem is None:
-        raise HTTPException(status_code=404, detail="Problem not found")
-    problem.status = "acknowledged"
-    db.commit()
-    return {"id": problem.id, "status": problem.status}
-
-
-@router.post("/{problem_id}/resolve")
-def resolve_problem(
-    problem_id: int,
-    db: Session = Depends(get_db),
-    _user: str = Depends(get_current_user),
-) -> dict:
-    problem = db.get(Problem, problem_id)
-    if problem is None:
-        raise HTTPException(status_code=404, detail="Problem not found")
-    problem.status = "resolved"
-    db.commit()
-    return {"id": problem.id, "status": problem.status}
+from datetime import datetime
+
+
+
+from fastapi import APIRouter, Depends, HTTPException, Query
+
+from pydantic import BaseModel
+
+from sqlalchemy import func, select
+
+from sqlalchemy.orm import Session, joinedload
+
+
+
+from app.auth.jwt_auth import get_current_user
+
+from app.database import get_db
+
+from app.models import Event, Host, Problem, ProblemEvent
+
+
+
+router = APIRouter(prefix="/problems", tags=["problems"])
+
+
+
+
+
+class ProblemSummary(BaseModel):
+
+    id: int
+
+    host_id: int | None
+
+    hostname: str | None
+
+    title: str
+
+    summary: str
+
+    severity: str
+
+    status: str
+
+    rule_id: str | None
+
+    fingerprint: str
+
+    event_count: int
+
+    last_seen_at: datetime
+
+    created_at: datetime
+
+    updated_at: datetime
+
+
+
+
+
+class ProblemListResponse(BaseModel):
+
+    items: list[ProblemSummary]
+
+    total: int
+
+    page: int
+
+    page_size: int
+
+
+
+
+
+class ProblemEventItem(BaseModel):
+
+    id: int
+
+    event_id: str
+
+    occurred_at: datetime
+
+    type: str
+
+    severity: str
+
+    title: str
+
+    summary: str
+
+
+
+
+
+class ProblemDetail(ProblemSummary):
+
+    events: list[ProblemEventItem]
+
+
+
+
+
+def _problem_summary(p: Problem) -> ProblemSummary:
+
+    return ProblemSummary(
+
+        id=p.id,
+
+        host_id=p.host_id,
+
+        hostname=p.host.hostname if p.host else None,
+
+        title=p.title,
+
+        summary=p.summary,
+
+        severity=p.severity,
+
+        status=p.status,
+
+        rule_id=p.rule_id,
+
+        fingerprint=p.fingerprint,
+
+        event_count=p.event_count,
+
+        last_seen_at=p.last_seen_at,
+
+        created_at=p.created_at,
+
+        updated_at=p.updated_at,
+
+    )
+
+
+
+
+
+@router.get("", response_model=ProblemListResponse)
+
+def list_problems(
+
+    page: int = Query(1, ge=1),
+
+    page_size: int = Query(50, ge=1, le=200),
+
+    status: str | None = Query(None),
+
+    severity: str | None = Query(None),
+
+    host_id: int | None = Query(None),
+
+    hostname: str | None = Query(None),
+
+    db: Session = Depends(get_db),
+
+    _user: str = Depends(get_current_user),
+
+) -> ProblemListResponse:
+
+    stmt = select(Problem).join(Host, isouter=True).options(joinedload(Problem.host))
+
+    count_stmt = select(func.count()).select_from(Problem).join(Host, isouter=True)
+
+
+
+    if status:
+
+        stmt = stmt.where(Problem.status == status)
+
+        count_stmt = count_stmt.where(Problem.status == status)
+
+    if severity:
+
@@ -53,6 +53,9 @@ class Settings(BaseSettings):
    # Порог «живости» агента: agent.heartbeat раз в ~12 ч (ssh-monitor)
    sac_heartbeat_stale_minutes: int = 780

+    # Окно корреляции Problems: host + type + rule в одном open Problem
+    sac_problem_correlation_window_minutes: int = 60
+

@lru_cache
 def get_settings() -> Settings:
@@ -1,6 +1,6 @@
 from datetime import datetime

-from sqlalchemy import DateTime, ForeignKey, String, Text, func
+from sqlalchemy import DateTime, ForeignKey, Integer, String, Text, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship

 from app.database import Base
@@ -16,6 +16,9 @@ class Problem(Base):
    severity: Mapped[str] = mapped_column(String(16), index=True)
    status: Mapped[str] = mapped_column(String(32), index=True, default="open")
    rule_id: Mapped[str | None] = mapped_column(String(64))
+    fingerprint: Mapped[str] = mapped_column(String(128), index=True)
+    event_count: Mapped[int] = mapped_column(Integer, default=1)
+    last_seen_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), index=True)
    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
    updated_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
@@ -1,11 +1,13 @@
-"""Auto-create Problems from ingested events (MVP rules)."""
+"""Auto-create Problems from ingested events (MVP rules + correlation)."""
+
+from datetime import datetime, timedelta, timezone

 from sqlalchemy import select
 from sqlalchemy.orm import Session

+from app.config import get_settings
 from app.models import Event, Problem, ProblemEvent

-# event types that always open a problem
 PROBLEM_TYPES = frozenset(
    {
        "ssh.ip.banned",
@@ -16,41 +18,63 @@ PROBLEM_TYPES = frozenset(
 HIGH_SEVERITIES = frozenset({"high", "critical"})


-def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, bool]:
-    if event.severity not in HIGH_SEVERITIES and event.type not in PROBLEM_TYPES:
-        return None, False
+def problem_rule_id(event: Event) -> str | None:
+    if event.severity in HIGH_SEVERITIES:
+        return "high_severity"
+    if event.type in PROBLEM_TYPES:
+        return f"type:{event.type}"
+    return None

-    rule_id = "high_severity" if event.severity in HIGH_SEVERITIES else f"type:{event.type}"

-    existing = db.scalar(
-        select(Problem)
-        .join(ProblemEvent)
-        .where(
-            Problem.status == "open",
-            Problem.rule_id == rule_id,
-            Problem.host_id == event.host_id,
+def problem_fingerprint(host_id: int, event_type: str, rule_id: str) -> str:
+    return f"h{host_id}:t{event_type}:r{rule_id}"
+
+
+def _correlation_cutoff(now: datetime) -> datetime:
+    minutes = get_settings().sac_problem_correlation_window_minutes
+    return now - timedelta(minutes=minutes)
+
+
+def _append_event(db: Session, problem: Problem, event: Event) -> None:
+    linked = db.scalar(
+        select(ProblemEvent).where(
+            ProblemEvent.problem_id == problem.id,
            ProblemEvent.event_id == event.id,
        )
-        .limit(1)
    )
-    if existing:
-        return existing, False
+    if linked is not None:
+        return
+    db.add(ProblemEvent(problem_id=problem.id, event_id=event.id))
+    problem.event_count = (problem.event_count or 0) + 1
+    problem.last_seen_at = event.occurred_at
+    problem.updated_at = datetime.now(timezone.utc)
+    if event.severity in HIGH_SEVERITIES and problem.severity not in HIGH_SEVERITIES:
+        problem.severity = event.severity
+    db.flush()
+
+
+def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, bool]:
+    rule_id = problem_rule_id(event)
+    if rule_id is None:
+        return None, False
+
+    fingerprint = problem_fingerprint(event.host_id, event.type, rule_id)
+    now = datetime.now(timezone.utc)
+    cutoff = _correlation_cutoff(now)

-    # dedupe: one open problem per host+rule (append event link)
    open_problem = db.scalar(
        select(Problem)
        .where(
            Problem.status == "open",
-            Problem.rule_id == rule_id,
+            Problem.fingerprint == fingerprint,
            Problem.host_id == event.host_id,
+            Problem.last_seen_at >= cutoff,
        )
-        .order_by(Problem.created_at.desc())
+        .order_by(Problem.last_seen_at.desc())
        .limit(1)
    )
    if open_problem:
-        db.add(ProblemEvent(problem_id=open_problem.id, event_id=event.id))
-        open_problem.updated_at = event.received_at
-        db.flush()
+        _append_event(db, open_problem, event)
        return open_problem, False

    problem = Problem(
@@ -60,6 +84,9 @@ def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, boo
        severity=event.severity,
        status="open",
        rule_id=rule_id,
+        fingerprint=fingerprint,
+        event_count=1,
+        last_seen_at=event.occurred_at,
    )
    db.add(problem)
    db.flush()