Skip to content

Commit 251a6be

Browse files
c3s4rfredc3s4rfred
authored
Merge pull request #887 from utmstack/bugfix/v10.5.15/False-positive-alerts-displayed-in-dashboard-overview
Bugfix/v10.5.15/false positive alerts displayed in dashboard overview
2 parents 7d4a656 + 717da6d commit 251a6be

File tree

6 files changed

+29
-30
lines changed

6 files changed

+29
-30
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
# UTMStack 10.5.15 Release Notes
1+
# UTMStack 10.5.16 Release Notes
22
## Bugfix
3-
- Sorting not working on any column in index management view
3+
- False positive alerts displayed in Dashboard Overview

‎backend/src/main/java/com/park/utmstack/config/Constants.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,13 +70,16 @@ public final class Constants {
7070
// ----------------------------------------------------------------------------------
7171
public static final String alertIdKeyword = "id.keyword";
7272
public static final String alertStatus = "status";
73+
public static final String alertTags = "tags";
7374
public static final String alertIsIncident = "isIncident";
7475
public static final String alertNameKeyword = "name.keyword";
7576
public static final String alertSeverityLabel = "severityLabel.keyword";
7677
public static final String alertCategoryKeyword = "category.keyword";
7778
public static final String alertDataSourceKeyword = "dataSource.keyword";
7879
public static final int LOG_ANALYZER_TOTAL_RESULTS = 10000;
7980

81+
public static final String FALSE_POSITIVE_TAG = "False positive";
82+
8083
/**
8184
* Environment variables
8285
*/

‎backend/src/main/java/com/park/utmstack/service/overview/OverviewService.java‎

Lines changed: 17 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,7 @@
2323
import org.springframework.stereotype.Service;
2424
import org.springframework.util.CollectionUtils;
2525

26-
import java.util.ArrayList;
27-
import java.util.Arrays;
28-
import java.util.List;
29-
import java.util.Map;
26+
import java.util.*;
3027
import java.util.stream.Collectors;
3128

3229
@Service
@@ -60,11 +57,8 @@ public List<CardType> countAlertsTodayAndLastWeek() throws DashboardOverviewExce
6057
return result;
6158
}
6259

63-
List<FilterType> filters = new ArrayList<>();
64-
filters.add(new FilterType(Constants.alertStatus, OperatorType.IS_NOT, AlertStatus.AUTOMATIC_REVIEW.getCode()));
65-
6660
SearchRequest sr = SearchRequest.of(s -> s.index(Constants.SYS_INDEX_PATTERN.get(SystemIndexPattern.ALERTS))
67-
.query(SearchUtil.toQuery(filters)).aggregations(AGG_NAME, Aggregation.of(agg -> agg
61+
.query(SearchUtil.toQuery(this.getDefaultFilters(Collections.emptyList()))).aggregations(AGG_NAME, Aggregation.of(agg -> agg
6862
.dateRange(dr -> dr.field(Constants.timestamp)
6963
.keyed(true).timeZone("UTC")
7064
.ranges(r -> r.key(TODAY_KEY).from(f -> f.expr("now/d")).to(t -> t.expr("now")))
@@ -90,11 +84,7 @@ public TableType topAlerts(String from, String to, Integer top) throws Dashboard
9084
if (!elasticsearchService.indexExist(Constants.SYS_INDEX_PATTERN.get(SystemIndexPattern.ALERTS)))
9185
return new TableType();
9286

93-
List<FilterType> filters = new ArrayList<>();
94-
filters.add(new FilterType(Constants.alertStatus, OperatorType.IS_NOT, AlertStatus.AUTOMATIC_REVIEW.getCode()));
95-
filters.add(new FilterType(Constants.timestamp, OperatorType.IS_BETWEEN, List.of(from, to)));
96-
97-
SearchRequest rq = SearchRequest.of(s -> s.size(0).query(SearchUtil.toQuery(filters))
87+
SearchRequest rq = SearchRequest.of(s -> s.size(0).query(SearchUtil.toQuery(this.getDefaultFilters(List.of(from, to))))
9888
.index(Constants.SYS_INDEX_PATTERN.get(SystemIndexPattern.ALERTS))
9989
.aggregations(AGG_NAME, agg -> agg.terms(t -> t.field(Constants.alertNameKeyword)
10090
.size(top).order(List.of(Map.of("_count", SortOrder.Desc))))));
@@ -124,11 +114,7 @@ public PieType countAlertsBySeverity(String from, String to, Integer top) throws
124114
if (!elasticsearchService.indexExist(Constants.SYS_INDEX_PATTERN.get(SystemIndexPattern.ALERTS)))
125115
return new PieType();
126116

127-
List<FilterType> filters = new ArrayList<>();
128-
filters.add(new FilterType(Constants.alertStatus, OperatorType.IS_NOT, AlertStatus.AUTOMATIC_REVIEW.getCode()));
129-
filters.add(new FilterType(Constants.timestamp, OperatorType.IS_BETWEEN, List.of(from, to)));
130-
131-
SearchRequest rq = SearchRequest.of(s -> s.size(0).query(SearchUtil.toQuery(filters))
117+
SearchRequest rq = SearchRequest.of(s -> s.size(0).query(SearchUtil.toQuery(this.getDefaultFilters(List.of(from, to))))
132118
.index(Constants.SYS_INDEX_PATTERN.get(SystemIndexPattern.ALERTS))
133119
.aggregations(AGG_NAME, agg -> agg.terms(t -> t.field(Constants.alertSeverityLabel)
134120
.size(top).order(List.of(Map.of("_count", SortOrder.Desc))))));
@@ -160,11 +146,7 @@ public BarType topAlertsByCategory(String from, String to, Integer top) throws D
160146
if (!elasticsearchService.indexExist(Constants.SYS_INDEX_PATTERN.get(SystemIndexPattern.ALERTS)))
161147
return new BarType();
162148

163-
List<FilterType> filters = new ArrayList<>();
164-
filters.add(new FilterType(Constants.alertStatus, OperatorType.IS_NOT, AlertStatus.AUTOMATIC_REVIEW.getCode()));
165-
filters.add(new FilterType(Constants.timestamp, OperatorType.IS_BETWEEN, List.of(from, to)));
166-
167-
SearchRequest rq = SearchRequest.of(s -> s.size(0).query(SearchUtil.toQuery(filters))
149+
SearchRequest rq = SearchRequest.of(s -> s.size(0).query(SearchUtil.toQuery(this.getDefaultFilters(List.of(from, to))))
168150
.index(Constants.SYS_INDEX_PATTERN.get(SystemIndexPattern.ALERTS))
169151
.aggregations(AGG_NAME, agg -> agg.terms(t -> t.field(Constants.alertCategoryKeyword)
170152
.size(top).order(List.of(Map.of("_count", SortOrder.Desc))))));
@@ -308,4 +290,16 @@ public TableType topWindowsEvents(String from, String to, Integer top) throws Da
308290
throw new DashboardOverviewException(ctx + ": " + e.getMessage());
309291
}
310292
}
293+
294+
private List<FilterType> getDefaultFilters(List<String> dateRange){
295+
List<FilterType> filters = new ArrayList<>();
296+
filters.add(new FilterType(Constants.alertStatus, OperatorType.IS_NOT, AlertStatus.AUTOMATIC_REVIEW.getCode()));
297+
filters.add(new FilterType(Constants.alertTags, OperatorType.IS_NOT, Constants.FALSE_POSITIVE_TAG));
298+
299+
if(!CollectionUtils.isEmpty(dateRange)){
300+
filters.add(new FilterType(Constants.timestamp, OperatorType.IS_BETWEEN, dateRange));
301+
}
302+
303+
return filters;
304+
}
311305
}

‎backend/src/main/java/com/park/utmstack/util/AlertUtil.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import org.opensearch.client.opensearch.core.SearchResponse;
1111
import org.springframework.stereotype.Component;
1212

13+
import java.time.LocalDateTime;
1314
import java.util.ArrayList;
1415
import java.util.List;
1516

@@ -32,6 +33,7 @@ public Long countAlertsByStatus(int status) {
3233

3334
List<FilterType> filters = new ArrayList<>();
3435
filters.add(new FilterType(Constants.alertStatus, OperatorType.IS, status));
36+
filters.add(new FilterType(Constants.alertTags, OperatorType.IS_NOT, Constants.FALSE_POSITIVE_TAG));
3537

3638
SearchRequest.Builder srb = new SearchRequest.Builder();
3739
srb.query(SearchUtil.toQuery(filters))

‎backend/src/main/java/com/park/utmstack/web/rest/overview/OverviewResource.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,11 @@ public ResponseEntity<List<CardType>> countAlertsTodayAndLastWeek() {
6666
public ResponseEntity<List<CardType>> countAlertsByStatus(@RequestParam String from, @RequestParam String to) {
6767
final String ctx = CLASS_NAME + ".countAlertsByStatus";
6868
try {
69-
FilterType timestampFilter = new FilterType(Constants.timestamp, OperatorType.IS_BETWEEN, Arrays.asList(from, to));
70-
FilterType statusFilter = new FilterType(Constants.alertStatus, OperatorType.IS_NOT, 1);
7169
List<FilterType> filters = new ArrayList<>();
72-
filters.add(timestampFilter);
73-
filters.add(statusFilter);
70+
filters.add(new FilterType(Constants.timestamp, OperatorType.IS_BETWEEN, Arrays.asList(from, to)));
71+
filters.add(new FilterType(Constants.alertStatus, OperatorType.IS_NOT, 1));
72+
filters.add(new FilterType(Constants.alertTags, OperatorType.IS_NOT, Constants.FALSE_POSITIVE_TAG));
73+
7474
return ResponseEntity.ok(alertService.countAlertsByStatus(filters));
7575
} catch (Exception e) {
7676
String msg = ctx + ": " + e.getMessage();

‎version.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
version: 10.5.15
1+
version: 10.5.16

0 commit comments

Comments
 (0)