Fixed the incident ack/resolve behavior.

This commit is contained in:
larssand
2026-07-02 21:20:13 +02:00
parent 97d017e43c
commit 1ced15e08f
3 changed files with 23 additions and 5 deletions

File diff suppressed because one or more lines are too long

View File

@@ -52,7 +52,7 @@ def build_incidents(anomalies: list[AnomalyFinding], field_deviations: dict[str,
severity = "critical" if score >= 85 else "high" if score >= 60 else "medium" if score >= 35 else "low"
streams = sorted({stream for item in group["correlations"] for stream in item.get("streams", [])} | {str(item.get("stream_name") or item.get("stream_title") or item.get("stream_id", "")) for item in group["fields"] if item.get("stream_id") or item.get("stream_name") or item.get("stream_title")})
timeline = sorted(group["timeline"], key=lambda item: str(item.get("timestamp", "")))[:20]
incident_id = hashlib.sha256(json.dumps({"entity": entity, "streams": streams, "evidence": list(dict.fromkeys(str(item) for item in group["evidence"] if item))[:4]}, sort_keys=True).encode("utf-8")).hexdigest()[:16]
incident_id = hashlib.sha256(json.dumps({"entity": entity, "streams": streams}, sort_keys=True).encode("utf-8")).hexdigest()[:16]
incidents.append({
"id": incident_id,
"entity": entity,