746 threshold siem alert error (#758)
* Improve error handling in alert processing by skipping hits with missing origin_context * Bump version to 0.1.47
taylor_socfortress committed
Mar 10, 2026 at 11:50 UTC
b0a95c5a1cbd95399c246a535a7c02012a02449b
2 files changed
+10
-13
backend/app/connectors/wazuh_indexer/services/alerts.py
+9
-12
@@ -554,22 +554,19 @@ async def fetch_alerts_from_graylog(index_prefix: str, size: int, timerange: str
554
555
556
async def process_alert_hits(hits: List[Dict], es_client: AsyncElasticsearch) -> List[Dict]:
557
- """
558
- Processes the hits from the Graylog alert search response.
559
-
560
- Args:
561
- es_client: The Elasticsearch client.
562
- hits (List[Dict]): The hits from the search response.
563
-
564
- Returns:
565
- List[Dict]: A list of detailed alerts.
566
- """
557
alerts_dict = defaultdict(lambda: {"total_alerts": 0, "alerts": []})
558
559
tasks = []
560
for hit in hits:
571
- origin_context = hit["_source"]["origin_context"]
572
- index_name, index_id = await get_original_alert_id(origin_context)
561
+ origin_context = hit.get("_source", {}).get("origin_context")
562
+ if not origin_context:
563
+ logger.warning(f"Skipping alert hit with missing or null origin_context: {hit.get('_id', 'unknown')}")
564
+ continue
565
+ try:
566
+ index_name, index_id = await get_original_alert_id(origin_context)
567
+ except Exception as e:
568
+ logger.warning(f"Skipping alert hit due to error parsing origin_context '{origin_context}': {e}")
569
+ continue
570
logger.info(f"Fetching alert details for index {index_name} and id {index_id}")
571
task = get_single_alert_details(es_client, index_name, index_id)
572
tasks.append(task)
backend/app/version/services/version.py
+1
-1
@@ -7,7 +7,7 @@ from loguru import logger
7
from packaging.version import Version
8
9
# Current version - update this with each release
10
-CURRENT_VERSION = "0.1.46"
10
+CURRENT_VERSION = "0.1.47"
11
VERSION_CHECK_URL = "https://api.github.com/repos/socfortress/CoPilot/releases/latest"
12
13