@oneuptime/common 12.0.15 → 12.0.16

package/Server/Utils/Monitor/Criteria/LogMonitorCriteria.ts

@@ -1,17 +1,38 @@
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 import DataToProcess from "../DataToProcess";
 import CompareCriteria from "./CompareCriteria";
+import CountAnomaly, {
+  CountAnomalyEvaluation,
+  CountBaselineSummary,
+} from "./CountAnomaly";
 import {
+  AnomalyDetectionMethod,
+  AnomalyDetectionSensitivity,
   CheckOn,
   CriteriaFilter,
+  CriteriaFilterUtil,
 } from "../../../../Types/Monitor/CriteriaFilter";
 import LogMonitorResponse from "../../../../Types/Monitor/LogMonitor/LogMonitorResponse";
+import MonitorStep from "../../../../Types/Monitor/MonitorStep";
+import MonitorStepLogMonitor from "../../../../Types/Monitor/MonitorStepLogMonitor";
+import OneUptimeDate from "../../../../Types/Date";
+import ObjectID from "../../../../Types/ObjectID";
+import LogCountBaselineService from "../../../Services/LogCountBaselineService";
+import { MetricBaselineService as MetricBaselineServiceClass } from "../../../Services/MetricBaselineService";
+import logger from "../../Logger";
 
 export default class LogMonitorCriteria {
   @CaptureSpan()
   public static async isMonitorInstanceCriteriaFilterMet(input: {
     dataToProcess: DataToProcess;
     criteriaFilter: CriteriaFilter;
+    /*
+     * The monitor step carries the log query (services / severities /
+     * evaluation window) the anomaly path scopes its baseline lookup
+     * to. Optional for backward compatibility — static threshold
+     * filters never need it.
+     */
+    monitorStep?: MonitorStep | undefined;
   }): Promise<string | null> {
     // Server Monitoring Checks
 
@@ -19,6 +40,22 @@ export default class LogMonitorCriteria {
       input.criteriaFilter.value;
 
     if (input.criteriaFilter.checkOn === CheckOn.LogCount) {
+      /*
+       * Anomaly filters skip the static threshold entirely: the
+       * observed log rate is compared to this monitor's scope in the
+       * same-hour-of-week LogCountBaseline, mirroring the metric
+       * monitor's baseline path.
+       */
+      if (
+        CriteriaFilterUtil.isAnomalyFilterType(input.criteriaFilter.filterType)
+      ) {
+        return await LogMonitorCriteria.evaluateLogCountAnomaly({
+          logResponse: input.dataToProcess as LogMonitorResponse,
+          criteriaFilter: input.criteriaFilter,
+          monitorStep: input.monitorStep,
+        });
+      }
+
       threshold = CompareCriteria.convertToNumber(threshold);
 
       const currentLogCount: number =
@@ -33,4 +70,99 @@ export default class LogMonitorCriteria {
 
     return null;
   }
+
+  /*
+   * Anomaly path for log counts: normalizes the observed count to a
+   * per-minute rate (the baseline's sample unit) and compares it to the
+   * rolling same-hour-of-week baseline of the monitor's scope (services
+   * and severities; body/attribute filters are not baselined — the
+   * baseline is that scope's full volume, a documented superset).
+   *
+   * Missing or unreliable baselines mean the rule is still learning —
+   * never alert from a thin baseline. Zero-variance baselines are
+   * skipped too: any deviation at all would fire.
+   */
+  private static async evaluateLogCountAnomaly(input: {
+    logResponse: LogMonitorResponse;
+    criteriaFilter: CriteriaFilter;
+    monitorStep?: MonitorStep | undefined;
+  }): Promise<string | null> {
+    const logMonitorStep: MonitorStepLogMonitor | undefined =
+      input.monitorStep?.data?.logMonitor;
+
+    const windowSeconds: number =
+      logMonitorStep?.lastXSecondsOfLogs &&
+      logMonitorStep.lastXSecondsOfLogs > 0
+        ? logMonitorStep.lastXSecondsOfLogs
+        : 60;
+
+    const logCount: number = input.logResponse.logCount || 0;
+    const observedPerMinute: number = (logCount * 60) / windowSeconds;
+
+    const sensitivity: AnomalyDetectionSensitivity =
+      (input.criteriaFilter.metricMonitorOptions?.anomalyDetection
+        ?.sensitivity as AnomalyDetectionSensitivity | undefined) ||
+      AnomalyDetectionSensitivity.Medium;
+    const sigmaCount: number =
+      MetricBaselineServiceClass.sigmaForSensitivity(sensitivity);
+    const method: AnomalyDetectionMethod =
+      (input.criteriaFilter.metricMonitorOptions?.anomalyDetection?.method as
+        | AnomalyDetectionMethod
+        | undefined) || AnomalyDetectionMethod.MeanStddev;
+
+    let baseline: CountBaselineSummary | null = null;
+    try {
+      baseline = await LogCountBaselineService.getBaseline({
+        projectId: input.logResponse.projectId.toString(),
+        telemetryServiceIds: logMonitorStep?.telemetryServiceIds?.map(
+          (id: ObjectID) => {
+            return id.toString();
+          },
+        ),
+        severityTexts: logMonitorStep?.severityTexts,
+        hourOfWeek: MetricBaselineServiceClass.computeHourOfWeek(
+          OneUptimeDate.getCurrentDate(),
+        ),
+        windowDays:
+          input.criteriaFilter.metricMonitorOptions?.anomalyDetection
+            ?.windowDays,
+        minSamples:
+          input.criteriaFilter.metricMonitorOptions?.anomalyDetection
+            ?.minSamples,
+      });
+    } catch (err) {
+      logger.error("Error fetching log count baseline for anomaly criteria");
+      logger.error(err);
+      return null;
+    }
+
+    if (!baseline || !baseline.isReliable) {
+      // Cold start: the baseline is still learning; nothing to compare to.
+      return null;
+    }
+
+    const evaluation: CountAnomalyEvaluation | null = CountAnomaly.evaluate({
+      observedPerMinute,
+      stats: baseline,
+      sigmaCount,
+      method,
+      filterType: input.criteriaFilter.filterType,
+    });
+
+    if (!evaluation || !evaluation.breaches) {
+      return null;
+    }
+
+    const direction: string = evaluation.observedSigma >= 0 ? "above" : "below";
+
+    return (
+      `Log count ${logCount} over the last ${windowSeconds} seconds ` +
+      `(${observedPerMinute.toFixed(2)} logs/min) is ` +
+      `${Math.abs(evaluation.observedSigma).toFixed(2)}σ ${direction} the same-hour baseline ` +
+      `(${method === AnomalyDetectionMethod.MedianMad ? "median" : "mean"} ` +
+      `${evaluation.center.toFixed(2)} logs/min, σ ${evaluation.spread.toFixed(2)}, ` +
+      `${baseline.sampleCount} samples over ${baseline.windowDays} days, ` +
+      `sensitivity ${sensitivity}).`
+    );
+  }
 }

package/Server/Utils/Monitor/Criteria/SecurityEventsMonitorCriteria.ts

@@ -0,0 +1,35 @@
+import CaptureSpan from "../../Telemetry/CaptureSpan";
+import DataToProcess from "../DataToProcess";
+import CompareCriteria from "./CompareCriteria";
+import {
+  CheckOn,
+  CriteriaFilter,
+} from "../../../../Types/Monitor/CriteriaFilter";
+import SecurityEventsMonitorResponse from "../../../../Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse";
+
+export default class SecurityEventsMonitorCriteria {
+  @CaptureSpan()
+  public static async isMonitorInstanceCriteriaFilterMet(input: {
+    dataToProcess: DataToProcess;
+    criteriaFilter: CriteriaFilter;
+  }): Promise<string | null> {
+    let threshold: number | string | undefined | null =
+      input.criteriaFilter.value;
+
+    if (input.criteriaFilter.checkOn === CheckOn.SecurityEventCount) {
+      threshold = CompareCriteria.convertToNumber(threshold);
+
+      const currentCount: number =
+        (input.dataToProcess as SecurityEventsMonitorResponse)
+          .securityEventCount || 0;
+
+      return CompareCriteria.compareCriteriaNumbers({
+        value: currentCount,
+        threshold: threshold as number,
+        criteriaFilter: input.criteriaFilter,
+      });
+    }
+
+    return null;
+  }
+}

package/Server/Utils/Monitor/Criteria/TraceMonitorCriteria.ts

@@ -2,16 +2,37 @@ import TraceMonitorResponse from "../../../../Types/Monitor/TraceMonitor/TraceMo
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 import DataToProcess from "../DataToProcess";
 import CompareCriteria from "./CompareCriteria";
+import CountAnomaly, {
+  CountAnomalyEvaluation,
+  CountBaselineSummary,
+} from "./CountAnomaly";
 import {
+  AnomalyDetectionMethod,
+  AnomalyDetectionSensitivity,
   CheckOn,
   CriteriaFilter,
+  CriteriaFilterUtil,
 } from "../../../../Types/Monitor/CriteriaFilter";
+import MonitorStep from "../../../../Types/Monitor/MonitorStep";
+import MonitorStepTraceMonitor from "../../../../Types/Monitor/MonitorStepTraceMonitor";
+import OneUptimeDate from "../../../../Types/Date";
+import ObjectID from "../../../../Types/ObjectID";
+import SpanCountBaselineService from "../../../Services/SpanCountBaselineService";
+import { MetricBaselineService as MetricBaselineServiceClass } from "../../../Services/MetricBaselineService";
+import logger from "../../Logger";
 
 export default class TraceMonitorCriteria {
   @CaptureSpan()
   public static async isMonitorInstanceCriteriaFilterMet(input: {
     dataToProcess: DataToProcess;
     criteriaFilter: CriteriaFilter;
+    /*
+     * The monitor step carries the trace query (services / statuses /
+     * evaluation window) the anomaly path scopes its baseline lookup
+     * to. Optional for backward compatibility — static threshold
+     * filters never need it.
+     */
+    monitorStep?: MonitorStep | undefined;
   }): Promise<string | null> {
     // Server Monitoring Checks
 
@@ -19,6 +40,22 @@ export default class TraceMonitorCriteria {
       input.criteriaFilter.value;
 
     if (input.criteriaFilter.checkOn === CheckOn.SpanCount) {
+      /*
+       * Anomaly filters skip the static threshold entirely: the
+       * observed span rate is compared to this monitor's scope in the
+       * same-hour-of-week SpanCountBaseline, mirroring the metric
+       * monitor's baseline path.
+       */
+      if (
+        CriteriaFilterUtil.isAnomalyFilterType(input.criteriaFilter.filterType)
+      ) {
+        return await TraceMonitorCriteria.evaluateSpanCountAnomaly({
+          traceResponse: input.dataToProcess as TraceMonitorResponse,
+          criteriaFilter: input.criteriaFilter,
+          monitorStep: input.monitorStep,
+        });
+      }
+
       threshold = CompareCriteria.convertToNumber(threshold);
 
       const currentSpanCount: number =
@@ -33,4 +70,99 @@ export default class TraceMonitorCriteria {
 
     return null;
   }
+
+  /*
+   * Anomaly path for span counts: normalizes the observed count to a
+   * per-minute rate (the baseline's sample unit) and compares it to the
+   * rolling same-hour-of-week baseline of the monitor's scope (services
+   * and span statuses; attribute/name filters are not baselined — the
+   * baseline is that scope's full volume, a documented superset).
+   *
+   * Missing or unreliable baselines mean the rule is still learning —
+   * never alert from a thin baseline. Zero-variance baselines are
+   * skipped too: any deviation at all would fire.
+   */
+  private static async evaluateSpanCountAnomaly(input: {
+    traceResponse: TraceMonitorResponse;
+    criteriaFilter: CriteriaFilter;
+    monitorStep?: MonitorStep | undefined;
+  }): Promise<string | null> {
+    const traceMonitorStep: MonitorStepTraceMonitor | undefined =
+      input.monitorStep?.data?.traceMonitor;
+
+    const windowSeconds: number =
+      traceMonitorStep?.lastXSecondsOfSpans &&
+      traceMonitorStep.lastXSecondsOfSpans > 0
+        ? traceMonitorStep.lastXSecondsOfSpans
+        : 60;
+
+    const spanCount: number = input.traceResponse.spanCount || 0;
+    const observedPerMinute: number = (spanCount * 60) / windowSeconds;
+
+    const sensitivity: AnomalyDetectionSensitivity =
+      (input.criteriaFilter.metricMonitorOptions?.anomalyDetection
+        ?.sensitivity as AnomalyDetectionSensitivity | undefined) ||
+      AnomalyDetectionSensitivity.Medium;
+    const sigmaCount: number =
+      MetricBaselineServiceClass.sigmaForSensitivity(sensitivity);
+    const method: AnomalyDetectionMethod =
+      (input.criteriaFilter.metricMonitorOptions?.anomalyDetection?.method as
+        | AnomalyDetectionMethod
+        | undefined) || AnomalyDetectionMethod.MeanStddev;
+
+    let baseline: CountBaselineSummary | null = null;
+    try {
+      baseline = await SpanCountBaselineService.getBaseline({
+        projectId: input.traceResponse.projectId.toString(),
+        telemetryServiceIds: traceMonitorStep?.telemetryServiceIds?.map(
+          (id: ObjectID) => {
+            return id.toString();
+          },
+        ),
+        spanStatusCodes: traceMonitorStep?.spanStatuses,
+        hourOfWeek: MetricBaselineServiceClass.computeHourOfWeek(
+          OneUptimeDate.getCurrentDate(),
+        ),
+        windowDays:
+          input.criteriaFilter.metricMonitorOptions?.anomalyDetection
+            ?.windowDays,
+        minSamples:
+          input.criteriaFilter.metricMonitorOptions?.anomalyDetection
+            ?.minSamples,
+      });
+    } catch (err) {
+      logger.error("Error fetching span count baseline for anomaly criteria");
+      logger.error(err);
+      return null;
+    }
+
+    if (!baseline || !baseline.isReliable) {
+      // Cold start: the baseline is still learning; nothing to compare to.
+      return null;
+    }
+
+    const evaluation: CountAnomalyEvaluation | null = CountAnomaly.evaluate({
+      observedPerMinute,
+      stats: baseline,
+      sigmaCount,
+      method,
+      filterType: input.criteriaFilter.filterType,
+    });
+
+    if (!evaluation || !evaluation.breaches) {
+      return null;
+    }
+
+    const direction: string = evaluation.observedSigma >= 0 ? "above" : "below";
+
+    return (
+      `Span count ${spanCount} over the last ${windowSeconds} seconds ` +
+      `(${observedPerMinute.toFixed(2)} spans/min) is ` +
+      `${Math.abs(evaluation.observedSigma).toFixed(2)}σ ${direction} the same-hour baseline ` +
+      `(${method === AnomalyDetectionMethod.MedianMad ? "median" : "mean"} ` +
+      `${evaluation.center.toFixed(2)} spans/min, σ ${evaluation.spread.toFixed(2)}, ` +
+      `${baseline.sampleCount} samples over ${baseline.windowDays} days, ` +
+      `sensitivity ${sensitivity}).`
+    );
+  }
 }

package/Server/Utils/Monitor/DataToProcess.ts

@@ -3,6 +3,7 @@ import IncomingEmailMonitorRequest from "../../../Types/Monitor/IncomingEmailMon
 import ServerMonitorResponse from "../../../Types/Monitor/ServerMonitor/ServerMonitorResponse";
 import ProbeMonitorResponse from "../../../Types/Probe/ProbeMonitorResponse";
 import LogMonitorResponse from "../../../Types/Monitor/LogMonitor/LogMonitorResponse";
+import SecurityEventsMonitorResponse from "../../../Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse";
 import TraceMonitorResponse from "../../../Types/Monitor/TraceMonitor/TraceMonitorResponse";
 import MetricMonitorResponse from "../../../Types/Monitor/MetricMonitor/MetricMonitorResponse";
 import ExceptionMonitorResponse from "../../../Types/Monitor/ExceptionMonitor/ExceptionMonitorResponse";
@@ -14,6 +15,7 @@ type DataToProcess =
   | IncomingEmailMonitorRequest
   | ServerMonitorResponse
   | LogMonitorResponse
+  | SecurityEventsMonitorResponse
   | TraceMonitorResponse
   | MetricMonitorResponse
   | ExceptionMonitorResponse

package/Server/Utils/Monitor/MonitorCriteriaDataExtractor.ts

@@ -3,6 +3,7 @@ import ProbeMonitorResponse from "../../../Types/Probe/ProbeMonitorResponse";
 import ServerMonitorResponse from "../../../Types/Monitor/ServerMonitor/ServerMonitorResponse";
 import IncomingMonitorRequest from "../../../Types/Monitor/IncomingMonitor/IncomingMonitorRequest";
 import LogMonitorResponse from "../../../Types/Monitor/LogMonitor/LogMonitorResponse";
+import SecurityEventsMonitorResponse from "../../../Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse";
 import TraceMonitorResponse from "../../../Types/Monitor/TraceMonitor/TraceMonitorResponse";
 import MetricMonitorResponse from "../../../Types/Monitor/MetricMonitor/MetricMonitorResponse";
 import CustomCodeMonitorResponse from "../../../Types/Monitor/CustomCodeMonitor/CustomCodeMonitorResponse";
@@ -61,6 +62,19 @@ export default class MonitorCriteriaDataExtractor {
     return null;
   }
 
+  public static getSecurityEventsMonitorResponse(
+    dataToProcess: DataToProcess,
+  ): SecurityEventsMonitorResponse | null {
+    if (
+      (dataToProcess as SecurityEventsMonitorResponse).securityEventCount !==
+      undefined
+    ) {
+      return dataToProcess as SecurityEventsMonitorResponse;
+    }
+
+    return null;
+  }
+
   public static getTraceMonitorResponse(
     dataToProcess: DataToProcess,
   ): TraceMonitorResponse | null {

package/Server/Utils/Monitor/MonitorCriteriaEvaluator.ts

@@ -10,6 +10,7 @@ import SSLMonitorCriteria from "./Criteria/SSLMonitorCriteria";
 import ServerMonitorCriteria from "./Criteria/ServerMonitorCriteria";
 import SyntheticMonitoringCriteria from "./Criteria/SyntheticMonitor";
 import LogMonitorCriteria from "./Criteria/LogMonitorCriteria";
+import SecurityEventsMonitorCriteria from "./Criteria/SecurityEventsMonitorCriteria";
 import MetricMonitorCriteria, {
   MetricSeriesEvaluationResult,
 } from "./Criteria/MetricMonitorCriteria";
@@ -763,6 +764,7 @@ ${contextBlock}
         await LogMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitorStep: input.monitorStep,
         });
 
       if (logMonitorResult) {
@@ -770,6 +772,18 @@ ${contextBlock}
       }
     }
 
+    if (input.monitor.monitorType === MonitorType.SecurityEvents) {
+      const securityEventsMonitorResult: string | null =
+        await SecurityEventsMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
+          dataToProcess: input.dataToProcess,
+          criteriaFilter: input.criteriaFilter,
+        });
+
+      if (securityEventsMonitorResult) {
+        return securityEventsMonitorResult;
+      }
+    }
+
     if (
       input.monitor.monitorType === MonitorType.Metrics ||
       input.monitor.monitorType === MonitorType.Kubernetes ||
@@ -798,6 +812,7 @@ ${contextBlock}
         await TraceMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,
           criteriaFilter: input.criteriaFilter,
+          monitorStep: input.monitorStep,
         });
 
       if (traceMonitorResult) {

package/Server/Utils/Monitor/MonitorCriteriaObservationBuilder.ts

@@ -18,6 +18,7 @@ import SslMonitorResponse from "../../../Types/Monitor/SSLMonitor/SslMonitorResp
 import SyntheticMonitorResponse from "../../../Types/Monitor/SyntheticMonitors/SyntheticMonitorResponse";
 import CustomCodeMonitorResponse from "../../../Types/Monitor/CustomCodeMonitor/CustomCodeMonitorResponse";
 import LogMonitorResponse from "../../../Types/Monitor/LogMonitor/LogMonitorResponse";
+import SecurityEventsMonitorResponse from "../../../Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse";
 import TraceMonitorResponse from "../../../Types/Monitor/TraceMonitor/TraceMonitorResponse";
 import ExceptionMonitorResponse from "../../../Types/Monitor/ExceptionMonitor/ExceptionMonitorResponse";
 import SnmpMonitorResponse, {
@@ -162,6 +163,10 @@ export default class MonitorCriteriaObservationBuilder {
         return MonitorCriteriaObservationBuilder.describeLogCountObservation(
           input,
         );
+      case CheckOn.SecurityEventCount:
+        return MonitorCriteriaObservationBuilder.describeSecurityEventCountObservation(
+          input,
+        );
       case CheckOn.SpanCount:
         return MonitorCriteriaObservationBuilder.describeSpanCountObservation(
           input,
@@ -1099,6 +1104,21 @@ export default class MonitorCriteriaObservationBuilder {
     return `Log count was ${logResponse.logCount}.`;
   }
 
+  private static describeSecurityEventCountObservation(input: {
+    dataToProcess: DataToProcess;
+  }): string | null {
+    const securityEventsResponse: SecurityEventsMonitorResponse | null =
+      MonitorCriteriaDataExtractor.getSecurityEventsMonitorResponse(
+        input.dataToProcess,
+      );
+
+    if (!securityEventsResponse) {
+      return null;
+    }
+
+    return `Security event count was ${securityEventsResponse.securityEventCount}.`;
+  }
+
   private static describeSpanCountObservation(input: {
     dataToProcess: DataToProcess;
   }): string | null {

package/Server/Utils/Monitor/MonitorResource.ts

@@ -35,6 +35,7 @@ import MonitorStatus from "../../../Models/DatabaseModels/MonitorStatus";
 import MonitorStatusTimeline from "../../../Models/DatabaseModels/MonitorStatusTimeline";
 import OneUptimeDate from "../../../Types/Date";
 import LogMonitorResponse from "../../../Types/Monitor/LogMonitor/LogMonitorResponse";
+import SecurityEventsMonitorResponse from "../../../Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse";
 import MetricMonitorResponse from "../../../Types/Monitor/MetricMonitor/MetricMonitorResponse";
 import TelemetryType from "../../../Types/Telemetry/TelemetryType";
 import TraceMonitorResponse from "../../../Types/Monitor/TraceMonitor/TraceMonitorResponse";
@@ -864,6 +865,21 @@ export default class MonitorResourceUtil {
           );
         }
 
+        if (
+          dataToProcess &&
+          (dataToProcess as SecurityEventsMonitorResponse).securityEventQuery
+        ) {
+          telemetryQuery = {
+            telemetryQuery: (dataToProcess as SecurityEventsMonitorResponse)
+              .securityEventQuery,
+            telemetryType: TelemetryType.SecurityEvent,
+            metricViewData: null,
+          };
+          logger.debug(
+            `${dataToProcess.monitorId.toString()} - Security event query found.`,
+          );
+        }
+
         if (
           dataToProcess &&
           (dataToProcess as TraceMonitorResponse).spanQuery

package/Server/Utils/Monitor/MonitorStepResourceIdentity.ts

@@ -216,6 +216,7 @@ export default class MonitorStepResourceIdentity {
      */
     const idLists: Array<Array<ObjectID> | undefined> = [
       stepData.logMonitor?.telemetryServiceIds,
+      stepData.securityEventsMonitor?.telemetryServiceIds,
       stepData.traceMonitor?.telemetryServiceIds,
       stepData.exceptionMonitor?.telemetryServiceIds,
       stepData.profileMonitor?.telemetryServiceIds,

package/Server/Utils/Monitor/MonitorStepsReferenceExtractor.ts

@@ -39,6 +39,7 @@ export enum MonitorStepsReferenceModel {
  */
 const TELEMETRY_SERVICE_STEP_FIELDS: Array<string> = [
   "logMonitor",
+  "securityEventsMonitor",
   "traceMonitor",
   "exceptionMonitor",
   "profileMonitor",