fix(security): persist scheduled Wazuh lifecycle defaults

apps/api/src/jobs/awooop_ansible_candidate_backfill_job.py

@@ -666,6 +666,8 @@ def _public_safe_wazuh_scheduled_incident_record(
             ensure_ascii=False,
         ),
         "proposal_ids": "[]",
+        "ttl_days": 7,
+        "vectorized": False,
         "alertname": alertname,
         "notification_type": "TYPE-5S" if ingress_lane else "TYPE-2",
         "alert_category": "security",
@@ -691,6 +693,7 @@ async def ensure_iwooos_wazuh_scheduled_incident(
                 INSERT INTO incidents (
                     incident_id, project_id, status, severity,
                     signals, affected_services, proposal_ids,
+                    ttl_days, vectorized,
                     alertname, notification_type, alert_category,
                     created_at, updated_at
                 ) VALUES (
@@ -698,6 +701,7 @@ async def ensure_iwooos_wazuh_scheduled_incident(
                     CAST(:signals AS json),
                     CAST(:affected_services AS json),
                     CAST(:proposal_ids AS json),
+                    :ttl_days, :vectorized,
                     :alertname, :notification_type, :alert_category,
                     :created_at, :updated_at
                 )
@@ -714,6 +718,8 @@ async def ensure_iwooos_wazuh_scheduled_incident(
                     alertname,
                     notification_type,
                     alert_category,
+                    ttl_days,
+                    vectorized,
                     json_array_length(signals) AS signal_count,
                     json_array_length(affected_services) AS affected_service_count
                 FROM incidents
@@ -734,6 +740,8 @@ async def ensure_iwooos_wazuh_scheduled_incident(
         and row.get("alertname") == record["alertname"]
         and row.get("notification_type") == record["notification_type"]
         and row.get("alert_category") == "security"
+        and int(row.get("ttl_days") or 0) == 7
+        and row.get("vectorized") is False
         and int(row.get("signal_count") or 0) > 0
         and int(row.get("affected_service_count") or 0) > 0
     )