feat: permission improvements, correlation alerts, and audit logging#73
Merged
TerrifiedBug merged 7 commits intomainfrom Jan 30, 2026
Merged
feat: permission improvements, correlation alerts, and audit logging#73TerrifiedBug merged 7 commits intomainfrom
TerrifiedBug merged 7 commits intomainfrom
Conversation
Backend changes: - Fix correlation alert entity_field bug in logs.py (was using sigma_field) - Add permission checks for viewer restrictions (comments, ownership) - Add PATCH endpoint for users to edit their own comments - Add logger import to alerts.py (was missing) - Grant analysts manage_settings permission for Index Patterns, Field Mappings, Health - Add updated_at field to alert comments model and schema - Create migration for alert_comments.updated_at column Frontend changes: - Add permission checks to bulk action buttons in Alerts page - Add edit/delete functionality for comments in AlertDetail - Hide add comment section for viewers (no manage_alerts permission) - Disable Take Ownership button for viewers - Show edit button only for own comments, delete only for admins - Add useAuth hook to Alerts page for permission checking
- Add MITRE tags from linked sigma rules to correlation alerts - Add links to source sigma rules in correlation alert UI - Fix "Assigned to me" pagination to show all assigned alerts - Create manage_index_config permission separate from manage_settings - Allow viewers to see Health page (read-only) - Restrict analyst Settings page access while keeping Index Patterns/Field Mappings - Fix admin delete comment button using isAdmin hook - Suppress ssl_context warning from opensearch-py
The Rule model doesn't have a tags attribute - tags are stored in the YAML content. Parse the yaml_content to extract tags from both linked sigma rules for correlation alerts.
- Add correlation rule link to CorrelationAlertDetails component - Hide separate Rule card for correlation alerts - Shows correlation rule name if available, otherwise 'View Rule'
- Add audit logging for comment add/edit/delete operations - Add audit logging for alert assign/unassign operations - Exclude alembic/versions from CodeQL analysis (reduces FPs) New audit actions: - alert.comment_add - alert.comment_edit - alert.comment_delete - alert.assign - alert.unassign
- Store rule_a_title and rule_b_title in correlation alert data - Display actual sigma rule titles instead of "Rule A"/"Rule B" - Falls back to generic labels for legacy alerts without titles
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
manage_index_configfrommanage_settingsfor better access controlChanges
Permissions
manage_index_configpermission for index pattern managementmanage_settings, Field Mappings tomanage_index_configCorrelation Alerts
Audit Logging
alert.comment_add- Track comment additionsalert.comment_edit- Track comment editsalert.comment_delete- Track comment deletionsalert.assign- Track alert ownership assignmentsalert.unassign- Track alert ownership releasesBug Fixes
CodeQL
backend/alembic/versions/**from analysis (reduces FP noise)Test plan