Skip to content

Conversation

@mifu67
Copy link
Contributor

@mifu67 mifu67 commented Jun 2, 2025

Update the dual write and update helpers to handle anomaly detection alerts. Anomaly detection alerts have a different kind of detector trigger and do not have explicit resolution detector triggers. Additionally, add support to the dual update helpers for switching between the two alert types.

@mifu67 mifu67 requested a review from ceorourke June 2, 2025 22:10
@mifu67 mifu67 requested review from a team as code owners June 2, 2025 22:10
@github-actions github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Jun 2, 2025
@codecov
Copy link

codecov bot commented Jun 2, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #92693      +/-   ##
==========================================
+ Coverage   87.89%   87.94%   +0.04%     
==========================================
  Files       10298    10266      -32     
  Lines      591309   590606     -703     
  Branches    23008    22814     -194     
==========================================
- Hits       519733   519400     -333     
+ Misses      71140    70764     -376     
- Partials      436      442       +6     

Copy link
Member

@ceorourke ceorourke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mostly LGTM just some questions

Comment on lines +720 to +721
# changing detector priority level for anomaly detection alerts is handled by the data condition
# so we should delete the explicit resolution condition if it exists
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this mean this was a regular alert that was changed to become an anomaly detection alert?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that's what is happening here

Comment on lines +722 to +723
if alert_rule.detection_type == AlertRuleDetectionType.DYNAMIC:
if resolve_condition is not None:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if alert_rule.detection_type == AlertRuleDetectionType.DYNAMIC:
if resolve_condition is not None:
if alert_rule.detection_type == AlertRuleDetectionType.DYNAMIC and resolve_condition is not None:

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wrote it this way because we should always return before the resolve detector trigger logic for anomaly detection alerts!

updated_detector_trigger_fields["comparison"] = alert_rule_trigger.alert_threshold
alert_rule = alert_rule_trigger.alert_rule

# if we're changing to anomaly detection, replace the detector trigger with the new type
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

how do we know it wasn't already one? I guess it doesn't hurt but we could check if comparison already has this stuff

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't have a record of what was changed on the alert, so anomaly detection trigger changes should always set the comparison field. I think the comment is a bit misleading.

Comment on lines +228 to +234
resolve_data_condition = DataCondition.objects.get(
comparison=DetectorPriorityLevel.HIGH,
condition_result=True,
condition_group__in=workflow_dcgs,
type=Condition.ISSUE_PRIORITY_DEESCALATING,
)
assert resolve_data_condition.condition_group == data_condition.condition_group
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought we wouldn't have the resolve data condition for a dynamic rule?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the issue de-escalation action filter 😅 sorry, bit confusing.

@mifu67 mifu67 merged commit 7ae8fb2 into master Jun 9, 2025
62 checks passed
@mifu67 mifu67 deleted the mifu67/aci/anomaly-detection-dual-write branch June 9, 2025 16:56
andrewshie-sentry pushed a commit that referenced this pull request Jun 19, 2025
Update the dual write and update helpers to handle anomaly detection
alerts. Anomaly detection alerts have a different kind of detector
trigger and do not have explicit resolution detector triggers.
Additionally, add support to the dual update helpers for switching
between the two alert types.
@github-actions github-actions bot locked and limited conversation to collaborators Jun 25, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants