def create_incident(
organization,
type,
title,
query,
date_started,
date_detected=None,
detection_uuid=None,
projects=None,
groups=None,
user=None,
):
if date_detected is None:
date_detected = date_started
if groups:
group_projects = [g.project for g in groups]
if projects is None:
projects = []
projects = list(set(projects + group_projects))
with transaction.atomic():
incident = Incident.objects.create(
organization=organization,
detection_uuid=detection_uuid,
status=IncidentStatus.OPEN.value,
type=type.value,
title=title,
query=query,
date_started=date_started,
date_detected=date_detected,
)
if projects:
IncidentProject.objects.bulk_create([
IncidentProject(incident=incident, project=project)
for project in projects
])
if groups:
IncidentGroup.objects.bulk_create([
IncidentGroup(incident=incident, group=group)
for group in groups
])
if type == IncidentType.CREATED:
activity_status = IncidentActivityType.CREATED
else:
activity_status = IncidentActivityType.DETECTED
event_stats_snapshot = create_initial_event_stats_snapshot(incident)
create_incident_activity(
incident,
activity_status,
event_stats_snapshot=event_stats_snapshot,
user=user,
)
return incident
def create_incident(
organization,
type,
title,
query,
aggregation,
date_started,
date_detected=None,
# TODO: Probably remove detection_uuid?
detection_uuid=None,
projects=None,
groups=None,
user=None,
alert_rule=None,
):
if groups:
group_projects = [g.project for g in groups]
if projects is None:
projects = []
projects = list(set(projects + group_projects))
if date_detected is None:
date_detected = date_started
with transaction.atomic():
incident = Incident.objects.create(
organization=organization,
detection_uuid=detection_uuid,
status=IncidentStatus.OPEN.value,
type=type.value,
title=title,
query=query,
aggregation=aggregation.value,
date_started=date_started,
date_detected=date_detected,
alert_rule=alert_rule,
)
if projects:
IncidentProject.objects.bulk_create(
[IncidentProject(incident=incident, project=project) for project in projects]
)
if groups:
IncidentGroup.objects.bulk_create(
[IncidentGroup(incident=incident, group=group) for group in groups]
)
create_incident_activity(incident, IncidentActivityType.DETECTED, user=user)
analytics.record(
"incident.created",
incident_id=incident.id,
organization_id=incident.organization_id,
incident_type=type.value,
)
return incident
def create_incident(
organization,
status,
title,
query,
date_started,
date_detected=None,
detection_uuid=None,
projects=None,
groups=None,
):
if date_detected is None:
date_detected = date_started
if groups:
group_projects = [g.project for g in groups]
if projects is None:
projects = []
projects = list(set(projects + group_projects))
with transaction.atomic():
incident = Incident.objects.create(
organization=organization,
detection_uuid=detection_uuid,
status=status.value,
title=title,
query=query,
date_started=date_started,
date_detected=date_detected,
)
if projects:
IncidentProject.objects.bulk_create([
IncidentProject(incident=incident, project=project) for project in projects
])
if groups:
IncidentGroup.objects.bulk_create([
IncidentGroup(incident=incident, group=group) for group in groups
])
return incident
def create_incident(
organization,
type_,
title,
query,
aggregation,
date_started,
date_detected=None,
# TODO: Probably remove detection_uuid?
detection_uuid=None,
projects=None,
groups=None,
user=None,
alert_rule=None,
):
if groups:
group_projects = [g.project for g in groups]
if projects is None:
projects = []
projects = list(set(projects + group_projects))
if date_detected is None:
date_detected = date_started
with transaction.atomic():
incident = Incident.objects.create(
organization=organization,
detection_uuid=detection_uuid,
status=IncidentStatus.OPEN.value,
type=type_.value,
title=title,
query=query,
aggregation=aggregation.value,
date_started=date_started,
date_detected=date_detected,
alert_rule=alert_rule,
)
if projects:
incident_projects = [
IncidentProject(incident=incident, project=project)
for project in projects
]
IncidentProject.objects.bulk_create(incident_projects)
# `bulk_create` doesn't send `post_save` signals, so we manually fire them here.
for incident_project in incident_projects:
post_save.send(sender=type(incident_project),
instance=incident_project,
created=True)
if groups:
IncidentGroup.objects.bulk_create([
IncidentGroup(incident=incident, group=group)
for group in groups
])
create_incident_activity(incident,
IncidentActivityType.DETECTED,
user=user)
analytics.record(
"incident.created",
incident_id=incident.id,
organization_id=incident.organization_id,
incident_type=type_.value,
)
return incident
def create_incident(
organization,
type,
title,
query,
aggregation,
date_started=None,
date_detected=None,
# TODO: Probably remove detection_uuid?
detection_uuid=None,
projects=None,
groups=None,
user=None,
alert_rule=None,
):
if groups:
group_projects = [g.project for g in groups]
if projects is None:
projects = []
projects = list(set(projects + group_projects))
if date_started is None:
date_started = calculate_incident_start(query, projects, groups)
if date_detected is None:
date_detected = date_started
with transaction.atomic():
incident = Incident.objects.create(
organization=organization,
detection_uuid=detection_uuid,
status=IncidentStatus.OPEN.value,
type=type.value,
title=title,
query=query,
aggregation=aggregation.value,
date_started=date_started,
date_detected=date_detected,
alert_rule=alert_rule,
)
if projects:
IncidentProject.objects.bulk_create([
IncidentProject(incident=incident, project=project)
for project in projects
])
if groups:
IncidentGroup.objects.bulk_create([
IncidentGroup(incident=incident, group=group)
for group in groups
])
if type == IncidentType.CREATED:
activity_status = IncidentActivityType.CREATED
else:
activity_status = IncidentActivityType.DETECTED
event_stats_snapshot = create_initial_event_stats_snapshot(incident)
create_incident_activity(incident,
activity_status,
event_stats_snapshot=event_stats_snapshot,
user=user)
analytics.record(
"incident.created",
incident_id=incident.id,
organization_id=incident.organization_id,
incident_type=type.value,
)
tasks.calculate_incident_suspects.apply_async(
kwargs={"incident_id": incident.id})
return incident
