@oneuptime/common 12.0.14 → 12.0.16

package/Server/Utils/Monitor/Criteria/SnmpMonitorCriteria.ts

@@ -16,7 +16,7 @@ import SnmpMonitorResponse, {
 } from "../../../../Types/Monitor/SnmpMonitor/SnmpMonitorResponse";
 import SnmpTrap from "../../../../Types/Monitor/SnmpMonitor/SnmpTrap";
 import ProbeMonitorResponse from "../../../../Types/Probe/ProbeMonitorResponse";
-import EvaluateOverTime from "./EvaluateOverTime";
+import EvaluateOverTime, { OverTimeCriteriaValue } from "./EvaluateOverTime";
 import MetricBaselineService, {
   BaselineSummary,
   MetricBaselineService as MetricBaselineServiceClass,
@@ -173,6 +173,13 @@ export default class SnmpMonitorCriteria {
   public static async isMonitorInstanceCriteriaFilterMet(input: {
     dataToProcess: DataToProcess;
     criteriaFilter: CriteriaFilter;
+    /*
+     * The monitor's monitoringInterval cron. Over-time filters use it to
+     * work out how many samples a fully covered window should hold, so a
+     * monitor that has only just started is not mistaken for one whose
+     * whole window is breaching.
+     */
+    monitoringInterval?: string | undefined;
   }): Promise<string | null> {
     let threshold: number | string | undefined | null =
       input.criteriaFilter.value;
@@ -240,37 +247,36 @@ export default class SnmpMonitorCriteria {
       return null;
     }
 
-    let overTimeValue: Array<number | boolean> | number | boolean | undefined =
-      undefined;
-
-    if (
-      input.criteriaFilter.evaluateOverTime &&
-      input.criteriaFilter.evaluateOverTimeOptions
-    ) {
-      try {
-        overTimeValue = await EvaluateOverTime.getValueOverTime({
-          projectId: (input.dataToProcess as ProbeMonitorResponse).projectId,
-          monitorId: input.dataToProcess.monitorId!,
-          evaluateOverTimeOptions: input.criteriaFilter.evaluateOverTimeOptions,
-          metricType: input.criteriaFilter.checkOn,
-        });
+    const overTime: OverTimeCriteriaValue =
+      await EvaluateOverTime.getOverTimeValueForCriteriaFilter({
+        projectId: (input.dataToProcess as ProbeMonitorResponse).projectId,
+        monitorId: input.dataToProcess.monitorId!,
+        criteriaFilter: input.criteriaFilter,
+        monitoringInterval: input.monitoringInterval,
+      });
 
-        if (Array.isArray(overTimeValue) && overTimeValue.length === 0) {
-          overTimeValue = undefined;
-        }
-      } catch (err) {
-        logger.error(
-          `Error in getting over time value for ${input.criteriaFilter.checkOn}`,
-        );
-        logger.error(err);
-        overTimeValue = undefined;
-      }
+    /*
+     * The window could not back this over-time filter (nothing recorded yet,
+     * or the monitor has not been running long enough to cover it). Return
+     * the decision the no-data policy already made instead of falling
+     * through to the value that arrived with this one check - that fallback
+     * is what let "all values over the last N minutes" fire off a single
+     * bad reading.
+     */
+    if (overTime.earlyReturn) {
+      return overTime.earlyReturn.result;
     }
 
+    const overTimeValue:
+      | Array<number | boolean>
+      | number
+      | boolean
+      | undefined = overTime.value;
+
     // Check if SNMP device is online
     if (input.criteriaFilter.checkOn === CheckOn.SnmpIsOnline) {
       const currentIsOnline: boolean | Array<boolean> =
-        (overTimeValue as Array<boolean>) ||
+        (overTimeValue as Array<boolean>) ??
         (input.dataToProcess as ProbeMonitorResponse).isOnline;
 
       return CompareCriteria.compareCriteriaBoolean({
@@ -288,9 +294,9 @@ export default class SnmpMonitorCriteria {
       }
 
       const currentResponseTime: number | Array<number> =
-        (overTimeValue as Array<number>) ||
-        snmpResponse?.responseTimeInMs ||
-        (input.dataToProcess as ProbeMonitorResponse).responseTimeInMs;
+        (overTimeValue as Array<number>) ??
+        (snmpResponse?.responseTimeInMs ||
+          (input.dataToProcess as ProbeMonitorResponse).responseTimeInMs);
 
       if (currentResponseTime === null || currentResponseTime === undefined) {
         return null;

package/Server/Utils/Monitor/Criteria/TraceMonitorCriteria.ts

@@ -2,16 +2,37 @@ import TraceMonitorResponse from "../../../../Types/Monitor/TraceMonitor/TraceMo
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 import DataToProcess from "../DataToProcess";
 import CompareCriteria from "./CompareCriteria";
+import CountAnomaly, {
+  CountAnomalyEvaluation,
+  CountBaselineSummary,
+} from "./CountAnomaly";
 import {
+  AnomalyDetectionMethod,
+  AnomalyDetectionSensitivity,
   CheckOn,
   CriteriaFilter,
+  CriteriaFilterUtil,
 } from "../../../../Types/Monitor/CriteriaFilter";
+import MonitorStep from "../../../../Types/Monitor/MonitorStep";
+import MonitorStepTraceMonitor from "../../../../Types/Monitor/MonitorStepTraceMonitor";
+import OneUptimeDate from "../../../../Types/Date";
+import ObjectID from "../../../../Types/ObjectID";
+import SpanCountBaselineService from "../../../Services/SpanCountBaselineService";
+import { MetricBaselineService as MetricBaselineServiceClass } from "../../../Services/MetricBaselineService";
+import logger from "../../Logger";
 
 export default class TraceMonitorCriteria {
   @CaptureSpan()
   public static async isMonitorInstanceCriteriaFilterMet(input: {
     dataToProcess: DataToProcess;
     criteriaFilter: CriteriaFilter;
+    /*
+     * The monitor step carries the trace query (services / statuses /
+     * evaluation window) the anomaly path scopes its baseline lookup
+     * to. Optional for backward compatibility — static threshold
+     * filters never need it.
+     */
+    monitorStep?: MonitorStep | undefined;
   }): Promise<string | null> {
     // Server Monitoring Checks
 
@@ -19,6 +40,22 @@ export default class TraceMonitorCriteria {
       input.criteriaFilter.value;
 
     if (input.criteriaFilter.checkOn === CheckOn.SpanCount) {
+      /*
+       * Anomaly filters skip the static threshold entirely: the
+       * observed span rate is compared to this monitor's scope in the
+       * same-hour-of-week SpanCountBaseline, mirroring the metric
+       * monitor's baseline path.
+       */
+      if (
+        CriteriaFilterUtil.isAnomalyFilterType(input.criteriaFilter.filterType)
+      ) {
+        return await TraceMonitorCriteria.evaluateSpanCountAnomaly({
+          traceResponse: input.dataToProcess as TraceMonitorResponse,
+          criteriaFilter: input.criteriaFilter,
+          monitorStep: input.monitorStep,
+        });
+      }
+
       threshold = CompareCriteria.convertToNumber(threshold);
 
       const currentSpanCount: number =
@@ -33,4 +70,99 @@ export default class TraceMonitorCriteria {
 
     return null;
   }
+
+  /*
+   * Anomaly path for span counts: normalizes the observed count to a
+   * per-minute rate (the baseline's sample unit) and compares it to the
+   * rolling same-hour-of-week baseline of the monitor's scope (services
+   * and span statuses; attribute/name filters are not baselined — the
+   * baseline is that scope's full volume, a documented superset).
+   *
+   * Missing or unreliable baselines mean the rule is still learning —
+   * never alert from a thin baseline. Zero-variance baselines are
+   * skipped too: any deviation at all would fire.
+   */
+  private static async evaluateSpanCountAnomaly(input: {
+    traceResponse: TraceMonitorResponse;
+    criteriaFilter: CriteriaFilter;
+    monitorStep?: MonitorStep | undefined;
+  }): Promise<string | null> {
+    const traceMonitorStep: MonitorStepTraceMonitor | undefined =
+      input.monitorStep?.data?.traceMonitor;
+
+    const windowSeconds: number =
+      traceMonitorStep?.lastXSecondsOfSpans &&
+      traceMonitorStep.lastXSecondsOfSpans > 0
+        ? traceMonitorStep.lastXSecondsOfSpans
+        : 60;
+
+    const spanCount: number = input.traceResponse.spanCount || 0;
+    const observedPerMinute: number = (spanCount * 60) / windowSeconds;
+
+    const sensitivity: AnomalyDetectionSensitivity =
+      (input.criteriaFilter.metricMonitorOptions?.anomalyDetection
+        ?.sensitivity as AnomalyDetectionSensitivity | undefined) ||
+      AnomalyDetectionSensitivity.Medium;
+    const sigmaCount: number =
+      MetricBaselineServiceClass.sigmaForSensitivity(sensitivity);
+    const method: AnomalyDetectionMethod =
+      (input.criteriaFilter.metricMonitorOptions?.anomalyDetection?.method as
+        | AnomalyDetectionMethod
+        | undefined) || AnomalyDetectionMethod.MeanStddev;
+
+    let baseline: CountBaselineSummary | null = null;
+    try {
+      baseline = await SpanCountBaselineService.getBaseline({
+        projectId: input.traceResponse.projectId.toString(),
+        telemetryServiceIds: traceMonitorStep?.telemetryServiceIds?.map(
+          (id: ObjectID) => {
+            return id.toString();
+          },
+        ),
+        spanStatusCodes: traceMonitorStep?.spanStatuses,
+        hourOfWeek: MetricBaselineServiceClass.computeHourOfWeek(
+          OneUptimeDate.getCurrentDate(),
+        ),
+        windowDays:
+          input.criteriaFilter.metricMonitorOptions?.anomalyDetection
+            ?.windowDays,
+        minSamples:
+          input.criteriaFilter.metricMonitorOptions?.anomalyDetection
+            ?.minSamples,
+      });
+    } catch (err) {
+      logger.error("Error fetching span count baseline for anomaly criteria");
+      logger.error(err);
+      return null;
+    }
+
+    if (!baseline || !baseline.isReliable) {
+      // Cold start: the baseline is still learning; nothing to compare to.
+      return null;
+    }
+
+    const evaluation: CountAnomalyEvaluation | null = CountAnomaly.evaluate({
+      observedPerMinute,
+      stats: baseline,
+      sigmaCount,
+      method,
+      filterType: input.criteriaFilter.filterType,
+    });
+
+    if (!evaluation || !evaluation.breaches) {
+      return null;
+    }
+
+    const direction: string = evaluation.observedSigma >= 0 ? "above" : "below";
+
+    return (
+      `Span count ${spanCount} over the last ${windowSeconds} seconds ` +
+      `(${observedPerMinute.toFixed(2)} spans/min) is ` +
+      `${Math.abs(evaluation.observedSigma).toFixed(2)}σ ${direction} the same-hour baseline ` +
+      `(${method === AnomalyDetectionMethod.MedianMad ? "median" : "mean"} ` +
+      `${evaluation.center.toFixed(2)} spans/min, σ ${evaluation.spread.toFixed(2)}, ` +
+      `${baseline.sampleCount} samples over ${baseline.windowDays} days, ` +
+      `sensitivity ${sensitivity}).`
+    );
+  }
 }

package/Server/Utils/Monitor/DataToProcess.ts

@@ -3,6 +3,7 @@ import IncomingEmailMonitorRequest from "../../../Types/Monitor/IncomingEmailMon
 import ServerMonitorResponse from "../../../Types/Monitor/ServerMonitor/ServerMonitorResponse";
 import ProbeMonitorResponse from "../../../Types/Probe/ProbeMonitorResponse";
 import LogMonitorResponse from "../../../Types/Monitor/LogMonitor/LogMonitorResponse";
+import SecurityEventsMonitorResponse from "../../../Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse";
 import TraceMonitorResponse from "../../../Types/Monitor/TraceMonitor/TraceMonitorResponse";
 import MetricMonitorResponse from "../../../Types/Monitor/MetricMonitor/MetricMonitorResponse";
 import ExceptionMonitorResponse from "../../../Types/Monitor/ExceptionMonitor/ExceptionMonitorResponse";
@@ -14,6 +15,7 @@ type DataToProcess =
   | IncomingEmailMonitorRequest
   | ServerMonitorResponse
   | LogMonitorResponse
+  | SecurityEventsMonitorResponse
   | TraceMonitorResponse
   | MetricMonitorResponse
   | ExceptionMonitorResponse

package/Server/Utils/Monitor/MonitorCriteriaDataExtractor.ts

@@ -3,6 +3,7 @@ import ProbeMonitorResponse from "../../../Types/Probe/ProbeMonitorResponse";
 import ServerMonitorResponse from "../../../Types/Monitor/ServerMonitor/ServerMonitorResponse";
 import IncomingMonitorRequest from "../../../Types/Monitor/IncomingMonitor/IncomingMonitorRequest";
 import LogMonitorResponse from "../../../Types/Monitor/LogMonitor/LogMonitorResponse";
+import SecurityEventsMonitorResponse from "../../../Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse";
 import TraceMonitorResponse from "../../../Types/Monitor/TraceMonitor/TraceMonitorResponse";
 import MetricMonitorResponse from "../../../Types/Monitor/MetricMonitor/MetricMonitorResponse";
 import CustomCodeMonitorResponse from "../../../Types/Monitor/CustomCodeMonitor/CustomCodeMonitorResponse";
@@ -61,6 +62,19 @@ export default class MonitorCriteriaDataExtractor {
     return null;
   }
 
+  public static getSecurityEventsMonitorResponse(
+    dataToProcess: DataToProcess,
+  ): SecurityEventsMonitorResponse | null {
+    if (
+      (dataToProcess as SecurityEventsMonitorResponse).securityEventCount !==
+      undefined
+    ) {
+      return dataToProcess as SecurityEventsMonitorResponse;
+    }
+
+    return null;
+  }
+
   public static getTraceMonitorResponse(
     dataToProcess: DataToProcess,
   ): TraceMonitorResponse | null {

package/Server/Utils/Monitor/MonitorCriteriaEvaluator.ts

@@ -10,6 +10,7 @@ import SSLMonitorCriteria from "./Criteria/SSLMonitorCriteria";
 import ServerMonitorCriteria from "./Criteria/ServerMonitorCriteria";
 import SyntheticMonitoringCriteria from "./Criteria/SyntheticMonitor";
 import LogMonitorCriteria from "./Criteria/LogMonitorCriteria";
+import SecurityEventsMonitorCriteria from "./Criteria/SecurityEventsMonitorCriteria";
 import MetricMonitorCriteria, {
   MetricSeriesEvaluationResult,
 } from "./Criteria/MetricMonitorCriteria";
@@ -666,6 +667,7 @@ ${contextBlock}
         await APIRequestCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitoringInterval: input.monitor.monitoringInterval,
         });
 
       if (apiRequestCriteriaResult) {
@@ -711,6 +713,7 @@ ${contextBlock}
         await IncomingRequestCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitoringInterval: input.monitor.monitoringInterval,
         });
 
       if (incomingRequestResult) {
@@ -735,6 +738,7 @@ ${contextBlock}
         await SSLMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitoringInterval: input.monitor.monitoringInterval,
         });
 
       if (sslMonitorResult) {
@@ -747,6 +751,7 @@ ${contextBlock}
         await ServerMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitoringInterval: input.monitor.monitoringInterval,
         });
 
       if (serverMonitorResult) {
@@ -759,6 +764,7 @@ ${contextBlock}
         await LogMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitorStep: input.monitorStep,
         });
 
       if (logMonitorResult) {
@@ -766,6 +772,18 @@ ${contextBlock}
       }
     }
 
+    if (input.monitor.monitorType === MonitorType.SecurityEvents) {
+      const securityEventsMonitorResult: string | null =
+        await SecurityEventsMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
+          dataToProcess: input.dataToProcess,
+          criteriaFilter: input.criteriaFilter,
+        });
+
+      if (securityEventsMonitorResult) {
+        return securityEventsMonitorResult;
+      }
+    }
+
     if (
       input.monitor.monitorType === MonitorType.Metrics ||
       input.monitor.monitorType === MonitorType.Kubernetes ||
@@ -794,6 +812,7 @@ ${contextBlock}
         await TraceMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitorStep: input.monitorStep,
         });
 
       if (traceMonitorResult) {
@@ -830,6 +849,7 @@ ${contextBlock}
         await SnmpMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitoringInterval: input.monitor.monitoringInterval,
         });
 
       if (snmpMonitorResult) {
@@ -842,6 +862,7 @@ ${contextBlock}
         await DnsMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitoringInterval: input.monitor.monitoringInterval,
         });
 
       if (dnsMonitorResult) {
@@ -854,6 +875,7 @@ ${contextBlock}
         await DomainMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitoringInterval: input.monitor.monitoringInterval,
         });
 
       if (domainMonitorResult) {
@@ -891,6 +913,7 @@ ${contextBlock}
           {
             dataToProcess: input.dataToProcess,
             criteriaFilter: input.criteriaFilter,
+            monitoringInterval: input.monitor.monitoringInterval,
           },
         );
 

package/Server/Utils/Monitor/MonitorCriteriaObservationBuilder.ts

@@ -18,6 +18,7 @@ import SslMonitorResponse from "../../../Types/Monitor/SSLMonitor/SslMonitorResp
 import SyntheticMonitorResponse from "../../../Types/Monitor/SyntheticMonitors/SyntheticMonitorResponse";
 import CustomCodeMonitorResponse from "../../../Types/Monitor/CustomCodeMonitor/CustomCodeMonitorResponse";
 import LogMonitorResponse from "../../../Types/Monitor/LogMonitor/LogMonitorResponse";
+import SecurityEventsMonitorResponse from "../../../Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse";
 import TraceMonitorResponse from "../../../Types/Monitor/TraceMonitor/TraceMonitorResponse";
 import ExceptionMonitorResponse from "../../../Types/Monitor/ExceptionMonitor/ExceptionMonitorResponse";
 import SnmpMonitorResponse, {
@@ -162,6 +163,10 @@ export default class MonitorCriteriaObservationBuilder {
         return MonitorCriteriaObservationBuilder.describeLogCountObservation(
           input,
         );
+      case CheckOn.SecurityEventCount:
+        return MonitorCriteriaObservationBuilder.describeSecurityEventCountObservation(
+          input,
+        );
       case CheckOn.SpanCount:
         return MonitorCriteriaObservationBuilder.describeSpanCountObservation(
           input,
@@ -1099,6 +1104,21 @@ export default class MonitorCriteriaObservationBuilder {
     return `Log count was ${logResponse.logCount}.`;
   }
 
+  private static describeSecurityEventCountObservation(input: {
+    dataToProcess: DataToProcess;
+  }): string | null {
+    const securityEventsResponse: SecurityEventsMonitorResponse | null =
+      MonitorCriteriaDataExtractor.getSecurityEventsMonitorResponse(
+        input.dataToProcess,
+      );
+
+    if (!securityEventsResponse) {
+      return null;
+    }
+
+    return `Security event count was ${securityEventsResponse.securityEventCount}.`;
+  }
+
   private static describeSpanCountObservation(input: {
     dataToProcess: DataToProcess;
   }): string | null {