feat: Telegram notifications from SAC on ingest

Send Telegram alerts for high/critical events and new Problems.
Configurable via TELEGRAM_* env vars; ingest never fails on send errors.
This commit is contained in:
2026-05-27 12:21:03 +10:00
parent 5fce00faae
commit eeba3a704d
9 changed files with 102 additions and 9 deletions
+5 -5
View File
@@ -16,9 +16,9 @@ PROBLEM_TYPES = frozenset(
HIGH_SEVERITIES = frozenset({"high", "critical"})
def maybe_create_problem(db: Session, event: Event) -> Problem | None:
def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, bool]:
if event.severity not in HIGH_SEVERITIES and event.type not in PROBLEM_TYPES:
return None
return None, False
rule_id = "high_severity" if event.severity in HIGH_SEVERITIES else f"type:{event.type}"
@@ -34,7 +34,7 @@ def maybe_create_problem(db: Session, event: Event) -> Problem | None:
.limit(1)
)
if existing:
return existing
return existing, False
# dedupe: one open problem per host+rule (append event link)
open_problem = db.scalar(
@@ -51,7 +51,7 @@ def maybe_create_problem(db: Session, event: Event) -> Problem | None:
db.add(ProblemEvent(problem_id=open_problem.id, event_id=event.id))
open_problem.updated_at = event.received_at
db.flush()
return open_problem
return open_problem, False
problem = Problem(
host_id=event.host_id,
@@ -65,4 +65,4 @@ def maybe_create_problem(db: Session, event: Event) -> Problem | None:
db.flush()
db.add(ProblemEvent(problem_id=problem.id, event_id=event.id))
db.flush()
return problem
return problem, True