fix(security): persist scheduled Wazuh lifecycle defaults

apps/api/src/jobs/awooop_ansible_candidate_backfill_job.py

@@ -666,6 +666,8 @@ def _public_safe_wazuh_scheduled_incident_record(
             ensure_ascii=False,
         ),
         "proposal_ids": "[]",
+        "ttl_days": 7,
+        "vectorized": False,
         "alertname": alertname,
         "notification_type": "TYPE-5S" if ingress_lane else "TYPE-2",
         "alert_category": "security",
@@ -691,6 +693,7 @@ async def ensure_iwooos_wazuh_scheduled_incident(
                 INSERT INTO incidents (
                     incident_id, project_id, status, severity,
                     signals, affected_services, proposal_ids,
+                    ttl_days, vectorized,
                     alertname, notification_type, alert_category,
                     created_at, updated_at
                 ) VALUES (
@@ -698,6 +701,7 @@ async def ensure_iwooos_wazuh_scheduled_incident(
                     CAST(:signals AS json),
                     CAST(:affected_services AS json),
                     CAST(:proposal_ids AS json),
+                    :ttl_days, :vectorized,
                     :alertname, :notification_type, :alert_category,
                     :created_at, :updated_at
                 )
@@ -714,6 +718,8 @@ async def ensure_iwooos_wazuh_scheduled_incident(
                     alertname,
                     notification_type,
                     alert_category,
+                    ttl_days,
+                    vectorized,
                     json_array_length(signals) AS signal_count,
                     json_array_length(affected_services) AS affected_service_count
                 FROM incidents
@@ -734,6 +740,8 @@ async def ensure_iwooos_wazuh_scheduled_incident(
         and row.get("alertname") == record["alertname"]
         and row.get("notification_type") == record["notification_type"]
         and row.get("alert_category") == "security"
+        and int(row.get("ttl_days") or 0) == 7
+        and row.get("vectorized") is False
         and int(row.get("signal_count") or 0) > 0
         and int(row.get("affected_service_count") or 0) > 0
     )

apps/api/tests/test_wazuh_alertmanager_integration.py

@@ -464,6 +464,8 @@ async def test_wazuh_scheduled_incident_bind_is_idempotent_and_public_safe(
                 "alertname": "WazuhAlertmanagerIntegrationConvergence",
                 "notification_type": "TYPE-5S",
                 "alert_category": "security",
+                "ttl_days": 7,
+                "vectorized": False,
                 "signal_count": 1,
                 "affected_service_count": 2,
             }
@@ -496,6 +498,9 @@ async def test_wazuh_scheduled_incident_bind_is_idempotent_and_public_safe(
     inserted = calls[0][1]
     assert inserted["notification_type"] == "TYPE-5S"
     assert inserted["severity"] == "P1"
+    assert inserted["ttl_days"] == 7
+    assert inserted["vectorized"] is False
+    assert "ttl_days, vectorized" in calls[0][0]
     encoded = json.dumps(inserted, default=str, sort_keys=True)
     assert "sensor-agent" in encoded
     assert "raw" not in encoded.lower()