wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(iwooos): count alertmanager receipts in security readback
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 1m28s
Details
CD Pipeline / build-and-deploy (push) Successful in 5m25s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
ogt
2026-07-09 22:36:09 +08:00
parent dced1be755
commit 13faee8fd4
3 changed files with 115 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
apps/api/src/services/iwooos_security_operating_system.py
View File

@@ -156,6 +156,7 @@ _RUNTIME_ACTION_KEYS = {
def load_latest_iwooos_security_operating_system(
security_dir: Path | None = None,
alert_receipt_readback: dict[str, Any] | None = None,
) -> dict[str, Any]:
"""Load the committed IwoooS security operating system contract."""
directory = security_dir or _DEFAULT_SECURITY_DIR
@@ -163,6 +164,7 @@ def load_latest_iwooos_security_operating_system(
_require_boundaries(snapshot)
summary = _summary(snapshot)
alert_receipt_summary = _alert_receipt_summary(alert_receipt_readback)
merged_summary = {
"reference_framework_count": _int(summary.get("reference_framework_count")),
"operating_role_count": _int(summary.get("operating_role_count")),
@@ -192,9 +194,13 @@ def load_latest_iwooos_security_operating_system(
"wazuh_registry_accepted_count": _int(
summary.get("wazuh_registry_accepted_count")
),
"alert_receipt_accepted_count": _int(
summary.get("alert_receipt_accepted_count")
"alert_receipt_accepted_count": max(
_int(summary.get("alert_receipt_accepted_count")),
alert_receipt_summary["accepted_count"],
),
"alert_receipt_observed_count": alert_receipt_summary["observed_count"],
"alert_receipt_source_status": alert_receipt_summary["source_status"],
"alert_receipt_source_error": alert_receipt_summary["source_error"],
"incident_case_accepted_count": _int(
summary.get("incident_case_accepted_count")
),
@@ -461,6 +467,37 @@ def _int(value: Any) -> int:
return value if isinstance(value, int) else 0
def _alert_receipt_summary(readback: dict[str, Any] | None) -> dict[str, Any]:
if not isinstance(readback, dict):
return {
"accepted_count": 0,
"observed_count": 0,
"source_status": "not_connected",
"source_error": None,
}
source_status = str(readback.get("source_status") or "ready")
source_error = readback.get("source_error")
events = readback.get("events")
total = readback.get("total")
observed_count = (
_int(total)
if total is not None
else len(events)
if isinstance(events, list)
else 0
)
accepted_count = (
observed_count if source_status == "ready" and observed_count > 0 else 0
)
return {
"accepted_count": accepted_count,
"observed_count": observed_count,
"source_status": source_status,
"source_error": str(source_error) if source_error else None,
}
def _strings(value: Any) -> list[str]:
if not isinstance(value, list):
return []
@@ -612,7 +649,7 @@ def _checkpoints(value: Any) -> list[dict[str, Any]]:
return items
def _boundary_markers(summary: dict[str, int]) -> list[str]:
def _boundary_markers(summary: dict[str, Any]) -> list[str]:
return [
"iwooos_security_operating_system_api_visible=true",
"iwooos_security_operation_packet_validation_api_available=true",
@@ -627,6 +664,8 @@ def _boundary_markers(summary: dict[str, int]) -> list[str]:
f"iwooos_security_operating_system_operation_packet_required_field_count={summary['operation_packet_required_field_count']}",
f"iwooos_security_operating_system_evidence_weighted_percent={summary['evidence_weighted_security_operating_system_percent']}",
f"iwooos_security_operating_system_wazuh_registry_accepted_count={summary['wazuh_registry_accepted_count']}",
f"iwooos_security_operating_system_alert_receipt_accepted_count={summary['alert_receipt_accepted_count']}",
f"iwooos_security_operating_system_alert_receipt_observed_count={summary['alert_receipt_observed_count']}",
"iwooos_security_operating_system_operation_packet_validation_no_persist=true",
"iwooos_security_operating_system_runtime_gate_count=0",
"runtime_execution_authorized=false",