@oneuptime/common 12.0.15 → 12.0.16

package/Tests/Server/Utils/Monitor/Criteria/LogMonitorCriteria.test.ts

@@ -1,11 +1,19 @@
 import LogMonitorCriteria from "../../../../../Server/Utils/Monitor/Criteria/LogMonitorCriteria";
+import LogCountBaselineService from "../../../../../Server/Services/LogCountBaselineService";
+import { CountBaselineSummary } from "../../../../../Server/Utils/Monitor/Criteria/CountAnomaly";
 import {
+  AnomalyDetectionSensitivity,
   CheckOn,
   CriteriaFilter,
   FilterType,
 } from "../../../../../Types/Monitor/CriteriaFilter";
 import LogMonitorResponse from "../../../../../Types/Monitor/LogMonitor/LogMonitorResponse";
 import DataToProcess from "../../../../../Server/Utils/Monitor/DataToProcess";
+import MonitorStep from "../../../../../Types/Monitor/MonitorStep";
+import MonitorStepLogMonitor, {
+  MonitorStepLogMonitorUtil,
+} from "../../../../../Types/Monitor/MonitorStepLogMonitor";
+import LogSeverity from "../../../../../Types/Log/LogSeverity";
 import ObjectID from "../../../../../Types/ObjectID";
 
 /*
@@ -192,4 +200,232 @@ describe("LogMonitorCriteria.isMonitorInstanceCriteriaFilterMet", () => {
       ).toBeNull();
     });
   });
+
+  /*
+   * Anomaly filters on LogCount: the evaluator normalizes the observed
+   * count to logs-per-minute (the LogCountBaseline sample unit) and
+   * compares it to the same-hour-of-week baseline of the monitor's
+   * scope, mirroring the Metric/SNMP baseline paths — including the
+   * Learning cold-start and zero-variance guards. Full matrix coverage
+   * of the shared math lives in CountAnomaly.test.ts and the trace
+   * sibling in TraceMonitorCriteria.test.ts.
+   */
+  describe("LogCount anomaly filters", () => {
+    let getBaselineSpy: jest.SpyInstance;
+
+    beforeEach(() => {
+      getBaselineSpy = jest.spyOn(LogCountBaselineService, "getBaseline");
+    });
+
+    afterEach(() => {
+      getBaselineSpy.mockRestore();
+    });
+
+    function buildBaseline(
+      overrides: Partial<CountBaselineSummary>,
+    ): CountBaselineSummary {
+      return {
+        sampleCount: 120,
+        mean: 20,
+        stddev: 5,
+        median: 19,
+        madSigma: 4,
+        minObserved: 8,
+        maxObserved: 33,
+        isReliable: true,
+        windowDays: 14,
+        hourOfWeek: 8,
+        ...overrides,
+      };
+    }
+
+    function buildMonitorStep(
+      overrides: Partial<MonitorStepLogMonitor>,
+    ): MonitorStep {
+      const monitorStep: MonitorStep = new MonitorStep();
+      monitorStep.data = {
+        id: ObjectID.generate().toString(),
+        monitorCriteria: { data: undefined } as never,
+      } as unknown as MonitorStep["data"];
+      monitorStep.data!.logMonitor = {
+        ...MonitorStepLogMonitorUtil.getDefault(),
+        ...overrides,
+      };
+      return monitorStep;
+    }
+
+    function evaluateAnomaly(input: {
+      logCount: number;
+      criteriaFilter: CriteriaFilter;
+      monitorStep?: MonitorStep | undefined;
+    }): Promise<string | null> {
+      return LogMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
+        dataToProcess: buildResponse(input.logCount),
+        criteriaFilter: input.criteriaFilter,
+        monitorStep: input.monitorStep,
+      });
+    }
+
+    test("AnomalouslyHigh fires when the log rate exceeds mean + 3σ (Medium default)", async () => {
+      // mean 20/min, σ 5 → 3σ band is [5, 35]; 90 logs in 60s = 90/min.
+      getBaselineSpy.mockResolvedValue(buildBaseline({}));
+
+      const result: string | null = await evaluateAnomaly({
+        logCount: 90,
+        criteriaFilter: {
+          checkOn: CheckOn.LogCount,
+          filterType: FilterType.AnomalouslyHigh,
+          value: undefined,
+        },
+      });
+
+      expect(result).toBeTruthy();
+      expect(result).toContain("above the same-hour baseline");
+      expect(result).toContain("90.00 logs/min");
+    });
+
+    test("no fire when the log rate is inside the expected band", async () => {
+      getBaselineSpy.mockResolvedValue(buildBaseline({}));
+
+      expect(
+        await evaluateAnomaly({
+          logCount: 25,
+          criteriaFilter: {
+            checkOn: CheckOn.LogCount,
+            filterType: FilterType.AnomalouslyLow,
+            value: undefined,
+          },
+        }),
+      ).toBeNull();
+    });
+
+    test("AnomalouslyLow fires when the log rate drops below mean - 3σ", async () => {
+      // mean 60/min, σ 10 → low band edge 30; 0 logs breaches low.
+      getBaselineSpy.mockResolvedValue(buildBaseline({ mean: 60, stddev: 10 }));
+
+      const result: string | null = await evaluateAnomaly({
+        logCount: 0,
+        criteriaFilter: {
+          checkOn: CheckOn.LogCount,
+          filterType: FilterType.AnomalouslyLow,
+          value: undefined,
+        },
+      });
+
+      expect(result).toBeTruthy();
+      expect(result).toContain("below the same-hour baseline");
+    });
+
+    test("observed count is normalized by the monitor's evaluation window", async () => {
+      getBaselineSpy.mockResolvedValue(buildBaseline({}));
+
+      // 100 logs over 300s = 20/min — exactly the mean, inside the band.
+      expect(
+        await evaluateAnomaly({
+          logCount: 100,
+          criteriaFilter: {
+            checkOn: CheckOn.LogCount,
+            filterType: FilterType.AnomalouslyHigh,
+            value: undefined,
+          },
+          monitorStep: buildMonitorStep({ lastXSecondsOfLogs: 300 }),
+        }),
+      ).toBeNull();
+    });
+
+    test("baseline lookup is keyed by project, services, severities and anomaly options", async () => {
+      getBaselineSpy.mockResolvedValue(buildBaseline({}));
+
+      const serviceId: ObjectID = ObjectID.generate();
+      const monitorStep: MonitorStep = buildMonitorStep({
+        telemetryServiceIds: [serviceId],
+        severityTexts: [LogSeverity.Error, LogSeverity.Fatal],
+      });
+
+      const dataToProcess: DataToProcess = buildResponse(90);
+
+      await LogMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
+        dataToProcess,
+        criteriaFilter: {
+          checkOn: CheckOn.LogCount,
+          filterType: FilterType.AnomalouslyHigh,
+          value: undefined,
+          metricMonitorOptions: {
+            anomalyDetection: {
+              sensitivity: AnomalyDetectionSensitivity.Low,
+              windowDays: 90,
+              minSamples: 20,
+            },
+          },
+        },
+        monitorStep,
+      });
+
+      expect(getBaselineSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          projectId: (dataToProcess as LogMonitorResponse).projectId.toString(),
+          telemetryServiceIds: [serviceId.toString()],
+          severityTexts: [LogSeverity.Error, LogSeverity.Fatal],
+          windowDays: 90,
+          minSamples: 20,
+        }),
+      );
+    });
+
+    test("Learning state (unreliable or missing baseline) never fires", async () => {
+      getBaselineSpy.mockResolvedValue(buildBaseline({ isReliable: false }));
+      expect(
+        await evaluateAnomaly({
+          logCount: 10000,
+          criteriaFilter: {
+            checkOn: CheckOn.LogCount,
+            filterType: FilterType.AnomalouslyHigh,
+            value: undefined,
+          },
+        }),
+      ).toBeNull();
+
+      getBaselineSpy.mockResolvedValue(null);
+      expect(
+        await evaluateAnomaly({
+          logCount: 10000,
+          criteriaFilter: {
+            checkOn: CheckOn.LogCount,
+            filterType: FilterType.AnomalouslyHigh,
+            value: undefined,
+          },
+        }),
+      ).toBeNull();
+    });
+
+    test("zero-variance baseline never fires", async () => {
+      getBaselineSpy.mockResolvedValue(
+        buildBaseline({ stddev: 0, madSigma: 0 }),
+      );
+      expect(
+        await evaluateAnomaly({
+          logCount: 10000,
+          criteriaFilter: {
+            checkOn: CheckOn.LogCount,
+            filterType: FilterType.AnomalouslyHigh,
+            value: undefined,
+          },
+        }),
+      ).toBeNull();
+    });
+
+    test("a baseline lookup error is swallowed and never fires", async () => {
+      getBaselineSpy.mockRejectedValue(new Error("clickhouse down"));
+      expect(
+        await evaluateAnomaly({
+          logCount: 10000,
+          criteriaFilter: {
+            checkOn: CheckOn.LogCount,
+            filterType: FilterType.AnomalouslyHigh,
+            value: undefined,
+          },
+        }),
+      ).toBeNull();
+    });
+  });
 });

package/Tests/Server/Utils/Monitor/Criteria/SecurityEventsMonitorCriteria.test.ts

@@ -0,0 +1,147 @@
+import SecurityEventsMonitorCriteria from "../../../../../Server/Utils/Monitor/Criteria/SecurityEventsMonitorCriteria";
+import {
+  CheckOn,
+  CriteriaFilter,
+  FilterType,
+} from "../../../../../Types/Monitor/CriteriaFilter";
+import SecurityEventsMonitorResponse from "../../../../../Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse";
+import DataToProcess from "../../../../../Server/Utils/Monitor/DataToProcess";
+import ObjectID from "../../../../../Types/ObjectID";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * SecurityEventsMonitorCriteria is what turns the securityEventCount the
+ * worker produces into an online/offline verdict. It only understands
+ * CheckOn.SecurityEventCount — the sole check the Security Events criteria
+ * UI offers — and defers the numeric comparison to CompareCriteria.
+ */
+function buildResponse(securityEventCount: number | undefined): DataToProcess {
+  const response: Partial<SecurityEventsMonitorResponse> = {
+    projectId: ObjectID.generate(),
+    monitorId: ObjectID.generate(),
+    securityEventCount: securityEventCount as number,
+    securityEventQuery: {},
+  };
+  return response as DataToProcess;
+}
+
+function evaluate(
+  securityEventCount: number | undefined,
+  criteriaFilter: CriteriaFilter,
+): Promise<string | null> {
+  return SecurityEventsMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
+    dataToProcess: buildResponse(securityEventCount),
+    criteriaFilter,
+  });
+}
+
+describe("SecurityEventsMonitorCriteria.isMonitorInstanceCriteriaFilterMet", () => {
+  describe("SecurityEventCount GreaterThan", () => {
+    test("count above threshold → met", async () => {
+      const result: string | null = await evaluate(5, {
+        checkOn: CheckOn.SecurityEventCount,
+        filterType: FilterType.GreaterThan,
+        value: 0,
+      });
+      expect(result).toBeTruthy();
+      expect(result).toContain("Security Event Count");
+    });
+
+    test("count equal to threshold → not met", async () => {
+      expect(
+        await evaluate(3, {
+          checkOn: CheckOn.SecurityEventCount,
+          filterType: FilterType.GreaterThan,
+          value: 3,
+        }),
+      ).toBeNull();
+    });
+
+    test("count below threshold → not met", async () => {
+      expect(
+        await evaluate(0, {
+          checkOn: CheckOn.SecurityEventCount,
+          filterType: FilterType.GreaterThan,
+          value: 0,
+        }),
+      ).toBeNull();
+    });
+  });
+
+  describe("SecurityEventCount LessThan", () => {
+    test("count below threshold → met", async () => {
+      expect(
+        await evaluate(2, {
+          checkOn: CheckOn.SecurityEventCount,
+          filterType: FilterType.LessThan,
+          value: 5,
+        }),
+      ).toBeTruthy();
+    });
+
+    test("count at threshold → not met", async () => {
+      expect(
+        await evaluate(5, {
+          checkOn: CheckOn.SecurityEventCount,
+          filterType: FilterType.LessThan,
+          value: 5,
+        }),
+      ).toBeNull();
+    });
+  });
+
+  describe("SecurityEventCount EqualTo", () => {
+    test("zero events equal to 0 → met", async () => {
+      expect(
+        await evaluate(0, {
+          checkOn: CheckOn.SecurityEventCount,
+          filterType: FilterType.EqualTo,
+          value: 0,
+        }),
+      ).toBeTruthy();
+    });
+
+    test("some events not equal to 0 → not met", async () => {
+      expect(
+        await evaluate(7, {
+          checkOn: CheckOn.SecurityEventCount,
+          filterType: FilterType.EqualTo,
+          value: 0,
+        }),
+      ).toBeNull();
+    });
+  });
+
+  describe("edge cases", () => {
+    test("a missing securityEventCount is treated as 0", async () => {
+      // undefined securityEventCount → 0; "equal to 0" is therefore met.
+      expect(
+        await evaluate(undefined, {
+          checkOn: CheckOn.SecurityEventCount,
+          filterType: FilterType.EqualTo,
+          value: 0,
+        }),
+      ).toBeTruthy();
+    });
+
+    test("a string threshold is coerced to a number", async () => {
+      expect(
+        await evaluate(10, {
+          checkOn: CheckOn.SecurityEventCount,
+          filterType: FilterType.GreaterThan,
+          value: "5",
+        }),
+      ).toBeTruthy();
+    });
+
+    test("a non-SecurityEventCount checkOn returns null (unhandled)", async () => {
+      expect(
+        await evaluate(100, {
+          checkOn: CheckOn.LogCount,
+          filterType: FilterType.GreaterThan,
+          value: 0,
+        }),
+      ).toBeNull();
+    });
+  });
+});

package/Tests/Server/Utils/Monitor/Criteria/TraceMonitorCriteria.test.ts

@@ -1,11 +1,20 @@
 import TraceMonitorCriteria from "../../../../../Server/Utils/Monitor/Criteria/TraceMonitorCriteria";
+import SpanCountBaselineService from "../../../../../Server/Services/SpanCountBaselineService";
+import { CountBaselineSummary } from "../../../../../Server/Utils/Monitor/Criteria/CountAnomaly";
 import {
+  AnomalyDetectionMethod,
+  AnomalyDetectionSensitivity,
   CheckOn,
   CriteriaFilter,
   FilterType,
 } from "../../../../../Types/Monitor/CriteriaFilter";
 import TraceMonitorResponse from "../../../../../Types/Monitor/TraceMonitor/TraceMonitorResponse";
 import DataToProcess from "../../../../../Server/Utils/Monitor/DataToProcess";
+import MonitorStep from "../../../../../Types/Monitor/MonitorStep";
+import MonitorStepTraceMonitor, {
+  MonitorStepTraceMonitorUtil,
+} from "../../../../../Types/Monitor/MonitorStepTraceMonitor";
+import { SpanStatus } from "../../../../../Models/AnalyticsModels/Span";
 import ObjectID from "../../../../../Types/ObjectID";
 
 /*
@@ -84,3 +93,268 @@ describe("TraceMonitorCriteria.isMonitorInstanceCriteriaFilterMet", () => {
     ).toBeNull();
   });
 });
+
+/*
+ * Anomaly filters on SpanCount: the evaluator normalizes the observed
+ * count to spans-per-minute (the SpanCountBaseline sample unit) and
+ * compares it to the same-hour-of-week baseline of the monitor's scope,
+ * mirroring the Metric/SNMP baseline paths — including the Learning
+ * cold-start and zero-variance guards.
+ */
+describe("TraceMonitorCriteria SpanCount anomaly filters", () => {
+  let getBaselineSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    getBaselineSpy = jest.spyOn(SpanCountBaselineService, "getBaseline");
+  });
+
+  afterEach(() => {
+    getBaselineSpy.mockRestore();
+  });
+
+  function buildBaseline(
+    overrides: Partial<CountBaselineSummary>,
+  ): CountBaselineSummary {
+    return {
+      sampleCount: 120,
+      mean: 20,
+      stddev: 5,
+      median: 19,
+      madSigma: 4,
+      minObserved: 8,
+      maxObserved: 33,
+      isReliable: true,
+      windowDays: 14,
+      hourOfWeek: 8,
+      ...overrides,
+    };
+  }
+
+  function buildMonitorStep(
+    overrides: Partial<MonitorStepTraceMonitor>,
+  ): MonitorStep {
+    const monitorStep: MonitorStep = new MonitorStep();
+    monitorStep.data = {
+      id: ObjectID.generate().toString(),
+      monitorCriteria: { data: undefined } as never,
+    } as unknown as MonitorStep["data"];
+    monitorStep.data!.traceMonitor = {
+      ...MonitorStepTraceMonitorUtil.getDefault(),
+      ...overrides,
+    };
+    return monitorStep;
+  }
+
+  function evaluateAnomaly(input: {
+    spanCount: number;
+    criteriaFilter: CriteriaFilter;
+    monitorStep?: MonitorStep | undefined;
+  }): Promise<string | null> {
+    return TraceMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
+      dataToProcess: buildResponse(input.spanCount),
+      criteriaFilter: input.criteriaFilter,
+      monitorStep: input.monitorStep,
+    });
+  }
+
+  test("AnomalouslyHigh fires when the span rate exceeds mean + 3σ (Medium default)", async () => {
+    // mean 20/min, σ 5 → 3σ band is [5, 35]; 90 spans in 60s = 90/min.
+    getBaselineSpy.mockResolvedValue(buildBaseline({}));
+
+    const result: string | null = await evaluateAnomaly({
+      spanCount: 90,
+      criteriaFilter: {
+        checkOn: CheckOn.SpanCount,
+        filterType: FilterType.AnomalouslyHigh,
+        value: undefined,
+      },
+    });
+
+    expect(result).toBeTruthy();
+    expect(result).toContain("above the same-hour baseline");
+    expect(result).toContain("90.00 spans/min");
+    expect(result).toContain("sensitivity Medium");
+  });
+
+  test("no fire when the span rate is inside the expected band", async () => {
+    getBaselineSpy.mockResolvedValue(buildBaseline({}));
+
+    expect(
+      await evaluateAnomaly({
+        spanCount: 25,
+        criteriaFilter: {
+          checkOn: CheckOn.SpanCount,
+          filterType: FilterType.AnomalouslyHigh,
+          value: undefined,
+        },
+      }),
+    ).toBeNull();
+  });
+
+  test("observed count is normalized by the monitor's evaluation window", async () => {
+    getBaselineSpy.mockResolvedValue(buildBaseline({}));
+
+    const monitorStep: MonitorStep = buildMonitorStep({
+      lastXSecondsOfSpans: 300,
+    });
+
+    // 100 spans over 300s = 20/min — exactly the mean, inside the band.
+    expect(
+      await evaluateAnomaly({
+        spanCount: 100,
+        criteriaFilter: {
+          checkOn: CheckOn.SpanCount,
+          filterType: FilterType.AnomalouslyHigh,
+          value: undefined,
+        },
+        monitorStep,
+      }),
+    ).toBeNull();
+
+    // 300 spans over 300s = 60/min — well above mean + 3σ = 35.
+    const result: string | null = await evaluateAnomaly({
+      spanCount: 300,
+      criteriaFilter: {
+        checkOn: CheckOn.SpanCount,
+        filterType: FilterType.AnomalouslyHigh,
+        value: undefined,
+      },
+      monitorStep,
+    });
+    expect(result).toBeTruthy();
+    expect(result).toContain("300 over the last 300 seconds");
+    expect(result).toContain("60.00 spans/min");
+  });
+
+  test("AnomalouslyLow fires when the span rate drops below mean - 3σ", async () => {
+    // mean 60/min, σ 10 → low band edge 30; 0 spans breaches low.
+    getBaselineSpy.mockResolvedValue(buildBaseline({ mean: 60, stddev: 10 }));
+
+    const result: string | null = await evaluateAnomaly({
+      spanCount: 0,
+      criteriaFilter: {
+        checkOn: CheckOn.SpanCount,
+        filterType: FilterType.AnomalouslyLow,
+        value: undefined,
+      },
+    });
+
+    expect(result).toBeTruthy();
+    expect(result).toContain("below the same-hour baseline");
+  });
+
+  test("baseline lookup is keyed by project, services, statuses and anomaly options", async () => {
+    getBaselineSpy.mockResolvedValue(buildBaseline({}));
+
+    const serviceId: ObjectID = ObjectID.generate();
+    const monitorStep: MonitorStep = buildMonitorStep({
+      telemetryServiceIds: [serviceId],
+      spanStatuses: [SpanStatus.Error],
+    });
+
+    const dataToProcess: DataToProcess = buildResponse(90);
+
+    await TraceMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
+      dataToProcess,
+      criteriaFilter: {
+        checkOn: CheckOn.SpanCount,
+        filterType: FilterType.AnomalouslyHigh,
+        value: undefined,
+        metricMonitorOptions: {
+          anomalyDetection: {
+            sensitivity: AnomalyDetectionSensitivity.High,
+            windowDays: 28,
+            minSamples: 10,
+          },
+        },
+      },
+      monitorStep,
+    });
+
+    expect(getBaselineSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        projectId: (dataToProcess as TraceMonitorResponse).projectId.toString(),
+        telemetryServiceIds: [serviceId.toString()],
+        spanStatusCodes: [SpanStatus.Error],
+        windowDays: 28,
+        minSamples: 10,
+      }),
+    );
+  });
+
+  test("Learning state (unreliable or missing baseline) never fires", async () => {
+    getBaselineSpy.mockResolvedValue(buildBaseline({ isReliable: false }));
+    expect(
+      await evaluateAnomaly({
+        spanCount: 10000,
+        criteriaFilter: {
+          checkOn: CheckOn.SpanCount,
+          filterType: FilterType.AnomalouslyHigh,
+          value: undefined,
+        },
+      }),
+    ).toBeNull();
+
+    getBaselineSpy.mockResolvedValue(null);
+    expect(
+      await evaluateAnomaly({
+        spanCount: 10000,
+        criteriaFilter: {
+          checkOn: CheckOn.SpanCount,
+          filterType: FilterType.AnomalouslyHigh,
+          value: undefined,
+        },
+      }),
+    ).toBeNull();
+  });
+
+  test("zero-variance baseline never fires", async () => {
+    getBaselineSpy.mockResolvedValue(buildBaseline({ stddev: 0, madSigma: 0 }));
+    expect(
+      await evaluateAnomaly({
+        spanCount: 10000,
+        criteriaFilter: {
+          checkOn: CheckOn.SpanCount,
+          filterType: FilterType.AnomalouslyHigh,
+          value: undefined,
+        },
+      }),
+    ).toBeNull();
+  });
+
+  test("MedianMad method compares against the median and reports it", async () => {
+    // median 19, MAD-σ 4 → 3σ band edge 31; 90/min breaches high.
+    getBaselineSpy.mockResolvedValue(buildBaseline({}));
+
+    const result: string | null = await evaluateAnomaly({
+      spanCount: 90,
+      criteriaFilter: {
+        checkOn: CheckOn.SpanCount,
+        filterType: FilterType.AnomalouslyHigh,
+        value: undefined,
+        metricMonitorOptions: {
+          anomalyDetection: {
+            method: AnomalyDetectionMethod.MedianMad,
+          },
+        },
+      },
+    });
+
+    expect(result).toBeTruthy();
+    expect(result).toContain("median 19.00 spans/min");
+  });
+
+  test("a baseline lookup error is swallowed and never fires", async () => {
+    getBaselineSpy.mockRejectedValue(new Error("clickhouse down"));
+    expect(
+      await evaluateAnomaly({
+        spanCount: 10000,
+        criteriaFilter: {
+          checkOn: CheckOn.SpanCount,
+          filterType: FilterType.AnomalouslyHigh,
+          value: undefined,
+        },
+      }),
+    ).toBeNull();
+  });
+});