774 alert timestamp update (#777)
* Add function to update alert creation time and integrate it into alert creation flow * precommit-fixes
taylor_socfortress committed
Mar 23, 2026 at 19:21 UTC
a218fcb47899bbd10d9cdaba758f8bff8d0fd6be
1 file changed
+26
backend/app/incidents/services/incident_alert.py
+26
@@ -145,6 +145,27 @@ def clean_alert_title(title: str) -> str:
145
return title
146
147
148
+async def update_alert_creation_time(
149
+ alert_id: int,
150
+ timefield_payload: Optional[str],
151
+ session: AsyncSession,
152
+) -> None:
153
+ """Update an existing alert's creation time to the latest trigger time."""
154
+ alert_obj = await session.get(Alert, alert_id)
155
+ if not alert_obj:
156
+ return
157
+ if timefield_payload:
158
+ try:
159
+ alert_obj.alert_creation_time = datetime.fromisoformat(timefield_payload)
160
+ except (ValueError, TypeError):
161
+ alert_obj.alert_creation_time = datetime.utcnow()
162
+ else:
163
+ alert_obj.alert_creation_time = datetime.utcnow()
164
+ session.add(alert_obj)
165
+ await session.commit()
166
+ logger.info(f"Updated alert_creation_time for alert ID {alert_id} to {alert_obj.alert_creation_time}")
167
+
168
+
169
async def get_single_alert_details(
170
alert_details: CreateAlertRequest,
171
) -> GenericAlertModel:
@@ -801,6 +822,9 @@ async def create_alert_full(
822
f"Found existing open alert ID {existing_alert_id} for Velociraptor Sigma alert with title {alert_payload.alert_title_payload}",
823
)
824
825
+ # Update the alert_creation_time to the latest trigger time
826
+ await update_alert_creation_time(existing_alert_id, alert_payload.timefield_payload, session)
827
+
828
# Check if the asset already exists for this alert (to determine if we should skip notifications)
829
asset_already_exists = False
830
if alert_payload.asset_payload:
@@ -1219,6 +1243,8 @@ async def create_alert(
1243
logger.info(
1244
f"Open alert exists for customer code {customer_code} with alert title {alert_payload.alert_title_payload} and alert ID {existing_alert}",
1245
)
1246
+ # Update the alert_creation_time to the latest trigger time
1247
+ await update_alert_creation_time(existing_alert, alert_payload.timefield_payload, session)
1248
await add_alert_to_document(
1249
CreateAlertRequest(index_name=alert_payload.index_name, alert_id=alert_payload.index_id),
1250
existing_alert,