PapaTramp/security-alert-center
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Problems correlation fingerprint, count, last_seen (d1-2)

Browse Source 
- Migration 003; windowed host+type+rule correlation on ingest

- GET /problems filters; GET /problems/{id} with event timeline; ack/resolve 409 guard

- Tests and SAC_PROBLEM_CORRELATION_WINDOW_MINUTES config

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
PTah
2026-05-28 09:46:12 +10:00
parent 8eb40cf75d
commit a4a224b284
10 changed files with 365 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/work-plan.md
+4 -4
View File
@@ -82,7 +82,7 @@
### День 1
- [x] `d1-1` Ingest: `event_id` UUID обязателен, UNIQUE индекс, коды duplicate, логи, docs/schema
- [ ] `d1-2` MVP Problems: модель, корреляция `host+type+окно`, API `GET/ack/resolve`
- [x] `d1-2` MVP Problems: модель, корреляция `host+type+окно`, API `GET/ack/resolve`
- [ ] `d1-3` Правила v1: `brute-force burst`, `privilege spike`, `host silence`
### День 2
@@ -109,9 +109,9 @@
- [x] `09:00–10:00` миграция `event_id` + UNIQUE, валидация ingest
- [x] `10:00–11:00` поведение duplicate (`201/409`) и логирование reject
- [x] `11:00–12:00` обновить `event-schema-v1.json` и `agent-integration.md` (в т.ч. `host.display_name` для агентов)
- [ ] `13:00–14:30` модель Problems + миграция
- [ ] `14:30–16:00` корреляция при ingest (`fingerprint`, `count`, `last_seen`)
- [ ] `16:00–17:30` API `GET /problems`, `ack`, `resolve` + smoke
- [x] `13:00–14:30` модель Problems + миграция
- [x] `14:30–16:00` корреляция при ingest (`fingerprint`, `count`, `last_seen`)
- [x] `16:00–17:30` API `GET /problems`, `ack`, `resolve` + smoke
- [ ] `18:00–19:00` правила `brute/privilege/silence` + unit tests
#### День 2