@oneuptime/common 12.0.16 → 12.0.18

package/Models/DatabaseModels/DetectionRule.ts

@@ -1,6 +1,7 @@
 import Project from "./Project";
 import User from "./User";
 import AlertSeverity from "./AlertSeverity";
+import IncidentSeverity from "./IncidentSeverity";
 import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 import Route from "../../Types/API/Route";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
@@ -293,6 +294,41 @@ export default class DetectionRule extends BaseModel {
   })
   public shouldWriteDetectionFinding?: boolean = undefined;
 
+  /*
+   * Default FALSE, unlike shouldCreateAlert. An incident is the heavy
+   * machinery — workspace channels, SLAs, on-call escalation, status-page
+   * visibility — and a rule imported from a community Sigma pack must not
+   * open one per match group unless somebody chose that. The evaluator
+   * gates on === true for the same reason: an unset column must read as
+   * off, not as "probably on".
+   */
+  @ColumnAccessControl({
+    create: createPermissions,
+    read: readPermissions,
+    update: updatePermissions,
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.Boolean,
+    canReadOnRelationQuery: true,
+    title: "Create Incidents",
+    description:
+      "Whether matches also open OneUptime incidents. Off by default: incidents drive on-call, SLAs and status pages, so opt in per rule.",
+    defaultValue: false,
+    /*
+     * Without this, checkRequiredFields 400s any create payload that
+     * omits the flag — including every API client written before the
+     * column existed — and the DB DEFAULT false can never apply.
+     */
+    isDefaultValueColumn: true,
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public shouldCreateIncident?: boolean = undefined;
+
   @ColumnAccessControl({
     create: createPermissions,
     read: readPermissions,
@@ -337,6 +373,51 @@ export default class DetectionRule extends BaseModel {
   })
   public alertSeverityId?: ObjectID = undefined;
 
+  @ColumnAccessControl({
+    create: createPermissions,
+    read: readPermissions,
+    update: updatePermissions,
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "incidentSeverityId",
+    type: TableColumnType.Entity,
+    modelType: IncidentSeverity,
+    title: "Incident Severity",
+    description:
+      "Severity of incidents opened by this rule. Defaults from the Sigma rule's level, mapped onto this project's incident severities, when unset.",
+  })
+  @ManyToOne(
+    () => {
+      return IncidentSeverity;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "incidentSeverityId" })
+  public incidentSeverity?: IncidentSeverity = undefined;
+
+  @ColumnAccessControl({
+    create: createPermissions,
+    read: readPermissions,
+    update: updatePermissions,
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Incident Severity ID",
+    description:
+      "ID of the incident severity for incidents opened by this rule.",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public incidentSeverityId?: ObjectID = undefined;
+
   /*
    * Evaluator-owned state. Written only by the detection engine cron,
    * never by users.

package/Server/Infrastructure/Postgres/SchemaMigrations/1788600000000-AddDetectionRuleIncidentColumns.ts

@@ -0,0 +1,39 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Detection rules gain an incident option: shouldCreateIncident (default
+ * FALSE, unlike shouldCreateAlert's default true — incidents drive on-call,
+ * SLAs and status pages, so a rule must opt in) and an optional per-rule
+ * IncidentSeverity override, mirroring the alertSeverityId column. SET NULL
+ * on severity delete matches the alert pair: losing a severity should
+ * degrade the rule to level-based mapping, not delete it.
+ */
+export class AddDetectionRuleIncidentColumns1788600000000
+  implements MigrationInterface
+{
+  public name: string = "AddDetectionRuleIncidentColumns1788600000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD "shouldCreateIncident" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD "incidentSeverityId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD CONSTRAINT "FK_b1cda3642956897cd47dec5fcf8" FOREIGN KEY ("incidentSeverityId") REFERENCES "IncidentSeverity"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP CONSTRAINT "FK_b1cda3642956897cd47dec5fcf8"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP COLUMN "incidentSeverityId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP COLUMN "shouldCreateIncident"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -539,6 +539,7 @@ import { AddLlmCostBudget1788200000000 } from "./1788200000000-AddLlmCostBudget"
 import { AddLlmModelPrice1788300000000 } from "./1788300000000-AddLlmModelPrice";
 import { AddMarketingConversionAttribution1788400000000 } from "./1788400000000-AddMarketingConversionAttribution";
 import { RemoveLlmCostBudgetAlertColumns1788500000000 } from "./1788500000000-RemoveLlmCostBudgetAlertColumns";
+import { AddDetectionRuleIncidentColumns1788600000000 } from "./1788600000000-AddDetectionRuleIncidentColumns";
 import { MigrationName1787142779538 } from "./1787142779538-MigrationName";
 import { MigrationName1787156982416 } from "./1787156982416-MigrationName";
 
@@ -1086,4 +1087,5 @@ export default [
   AddLlmModelPrice1788300000000,
   AddMarketingConversionAttribution1788400000000,
   RemoveLlmCostBudgetAlertColumns1788500000000,
+  AddDetectionRuleIncidentColumns1788600000000,
 ];

package/Server/Services/BillingService.ts

@@ -2074,6 +2074,14 @@ export class BillingService extends BaseService {
       return "price_1U0iWJANuQdJ93r7iVAXwhdP";
     }
 
+    if (productType === ProductType.SecurityEvents) {
+      if (this.isTestEnvironment()) {
+        return "price_1U7efaANuQdJ93r74hFVOgdS";
+      }
+
+      return "price_1U7edTANuQdJ93r7hR9jpBfv";
+    }
+
     throw new BadDataException(
       "Plan with productType " + productType + " not found",
     );

package/Server/Utils/SecurityEvent/DetectionRuleEvaluator.ts

@@ -1,10 +1,13 @@
 import DetectionRule from "../../../Models/DatabaseModels/DetectionRule";
 import Alert from "../../../Models/DatabaseModels/Alert";
 import AlertSeverity from "../../../Models/DatabaseModels/AlertSeverity";
+import Incident from "../../../Models/DatabaseModels/Incident";
+import IncidentSeverity from "../../../Models/DatabaseModels/IncidentSeverity";
 import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
 import OneUptimeDate from "../../../Types/Date";
 import ObjectID from "../../../Types/ObjectID";
 import SortOrder from "../../../Types/BaseDatabase/SortOrder";
+import Includes from "../../../Types/BaseDatabase/Includes";
 import { JSONObject } from "../../../Types/JSON";
 import NormalizedSecurityEvent from "../../../Types/SecurityEvent/NormalizedSecurityEvent";
 import OcsfSeverity, {
@@ -12,10 +15,21 @@ import OcsfSeverity, {
 } from "../../../Types/SecurityEvent/OcsfSeverity";
 import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
 import SigmaRule, { SigmaLevel } from "../../../Types/SecurityEvent/SigmaRule";
+import {
+  DETECTION_FINDING_CLASS_NAME,
+  DETECTION_FINDING_CLASS_UID,
+  DETECTION_GROUP_VALUE_ATTRIBUTE,
+  DETECTION_MATCH_COUNT_ATTRIBUTE,
+  DETECTION_RULE_ID_ATTRIBUTE,
+  DETECTION_RULE_NAME_ATTRIBUTE,
+  DETECTION_SIGMA_ID_ATTRIBUTE,
+} from "../../../Types/SecurityEvent/DetectionFindingConstants";
 import SigmaRuleParser from "../../../Utils/SecurityEvent/Sigma/SigmaRuleParser";
 import MetricSeriesFingerprint from "../../../Utils/Metrics/MetricSeriesFingerprint";
 import AlertService from "../../Services/AlertService";
 import AlertSeverityService from "../../Services/AlertSeverityService";
+import IncidentService from "../../Services/IncidentService";
+import IncidentSeverityService from "../../Services/IncidentSeverityService";
 import DetectionRuleService from "../../Services/DetectionRuleService";
 import OTelIngestService, {
   TelemetryServiceMetadata,
@@ -32,7 +46,6 @@ import SigmaClickhouseCompiler, {
 } from "./Sigma/SigmaClickhouseCompiler";
 import { buildSecurityEventDbRow } from "./SecurityEventRow";
 
-const DETECTION_FINDING_CLASS_UID: number = 2004;
 const DETECTIONS_SERVICE_NAME: string = "OneUptime Detections";
 
 /*
@@ -58,6 +71,7 @@ export interface DetectionRuleEvaluationResult {
   matchedGroups: number;
   totalMatches: number;
   alertsCreated: number;
+  incidentsCreated: number;
   findingsWritten: number;
   error: string | null;
 }
@@ -84,7 +98,9 @@ export default class DetectionRuleEvaluator {
         groupByField: true,
         shouldCreateAlert: true,
         shouldWriteDetectionFinding: true,
+        shouldCreateIncident: true,
         alertSeverityId: true,
+        incidentSeverityId: true,
         lastEvaluatedAt: true,
       },
       skip: 0,
@@ -189,6 +205,7 @@ export default class DetectionRuleEvaluator {
     );
 
     let alertsCreated: number = 0;
+    let incidentsCreated: number = 0;
     let findingsWritten: number = 0;
     let totalMatches: number = 0;
 
@@ -207,6 +224,22 @@ export default class DetectionRuleEvaluator {
         });
       }
 
+      /*
+       * === true, not !== false like the alert gate: incidents are the
+       * heavy machinery (on-call, SLAs, status pages), and the column
+       * defaults to false — a rule fetched without the column selected
+       * must read as off, never as "probably on".
+       */
+      if (rule.shouldCreateIncident === true) {
+        incidentsCreated = await this.openIncidentsForMatches({
+          rule,
+          parsedRule,
+          matchedGroups,
+          startTime,
+          endTime,
+        });
+      }
+
       if (rule.shouldWriteDetectionFinding !== false) {
         findingsWritten = await this.writeDetectionFindings({
           rule,
@@ -233,6 +266,7 @@ export default class DetectionRuleEvaluator {
       matchedGroups: matchedGroups.length,
       totalMatches,
       alertsCreated,
+      incidentsCreated,
       findingsWritten,
       error: null,
     };
@@ -272,9 +306,16 @@ export default class DetectionRuleEvaluator {
       },
     );
 
+    /*
+     * Scoped to THIS rule's candidate fingerprints (≤ MAX_GROUPS_PER_
+     * EVALUATION), not a scan of every open alert: a project with more
+     * open alerts than LIMIT_PER_PROJECT would otherwise age still-open
+     * detections out of the fetched window and re-open them every cycle.
+     */
     const openAlerts: Array<Alert> = await AlertService.findBy({
       query: {
         projectId,
+        seriesFingerprint: new Includes(fingerprints),
         currentAlertState: {
           isResolvedState: false,
         },
@@ -312,43 +353,152 @@ export default class DetectionRuleEvaluator {
 
       const alert: Alert = new Alert();
       alert.projectId = projectId;
-      alert.title = matchGroup.groupValue
-        ? `[Detection] ${rule.name} — ${matchGroup.groupValue}`
-        : `[Detection] ${rule.name}`;
-
-      const descriptionParts: Array<string> = [];
+      alert.title = this.buildMatchTitle(rule, matchGroup);
+      alert.description = this.buildMatchDescription({
+        rule,
+        parsedRule,
+        matchGroup,
+        startTime: data.startTime,
+        endTime: data.endTime,
+      });
+      alert.alertSeverityId = alertSeverityId;
+      alert.seriesFingerprint = fingerprint;
+      alert.isCreatedAutomatically = true;
+      alert.rootCause = `Sigma detection rule "${rule.name}" matched security events.`;
 
-      if (rule.description || parsedRule.description) {
-        descriptionParts.push(rule.description || parsedRule.description);
+      try {
+        await AlertService.create({
+          data: alert,
+          props: {
+            isRoot: true,
+          },
+        });
+        created++;
+      } catch (error) {
+        logger.error(
+          `DetectionRuleEvaluator: failed creating alert for rule ${rule.id?.toString()}:`,
+        );
+        logger.error(error);
       }
+    }
 
-      descriptionParts.push(
-        `Detection rule matched ${matchGroup.matchCount} security event${
-          matchGroup.matchCount === 1 ? "" : "s"
-        } between ${OneUptimeDate.getDateAsFormattedString(
-          data.startTime,
-        )} and ${OneUptimeDate.getDateAsFormattedString(data.endTime)}.`,
+    return created;
+  }
+
+  /*
+   * The incident twin of openAlertsForMatches: same fingerprint, same
+   * title and description, deduped against the project's UNRESOLVED
+   * incidents the same way alerts dedupe against open alerts. Kept as a
+   * separate method rather than a parameterized one because the two
+   * models genuinely differ where it matters — severity comes from
+   * IncidentSeverity, and IncidentService.create is far heavier
+   * (workspace channels, SLAs, on-call execution), so each create is
+   * wrapped so one failing project cannot sink the whole rule.
+   *
+   * Detection incidents carry no monitors, so monitor-driven auto-resolve
+   * never touches them: the fingerprint dedupe is the only thing keeping
+   * a still-firing rule from stacking incidents. Dedupe must therefore
+   * run BEFORE create — incident numbers are user-visible and consumed
+   * per create.
+   */
+  private static async openIncidentsForMatches(data: {
+    rule: DetectionRule;
+    parsedRule: SigmaRule;
+    matchedGroups: Array<DetectionMatchGroup>;
+    startTime: Date;
+    endTime: Date;
+  }): Promise<number> {
+    const { rule, parsedRule, matchedGroups } = data;
+    const projectId: ObjectID = rule.projectId!;
+
+    const incidentSeverityId: ObjectID | null =
+      await this.resolveIncidentSeverityId({
+        projectId,
+        rule,
+        parsedRule,
+      });
+
+    if (!incidentSeverityId) {
+      logger.warn(
+        `DetectionRuleEvaluator: project ${projectId.toString()} has no incident severities; skipping incident creation for rule ${rule.id?.toString()}.`,
       );
+      return 0;
+    }
 
-      if (matchGroup.sampleMessage) {
-        descriptionParts.push(`Sample event: ${matchGroup.sampleMessage}`);
-      }
+    const fingerprints: Array<string> = matchedGroups.map(
+      (matchGroup: DetectionMatchGroup): string => {
+        return this.buildFingerprint(rule.id!, matchGroup.groupValue);
+      },
+    );
 
-      if (matchGroup.sampleObservables.length > 0) {
-        descriptionParts.push(
-          `Observables: ${matchGroup.sampleObservables.slice(0, 20).join(", ")}`,
-        );
+    /*
+     * Same fingerprint-scoped dedupe as the alert path — and it matters
+     * more here: a missed fingerprint re-fires IncidentService.create's
+     * whole side-effect train and burns a user-visible incident number.
+     */
+    const openIncidents: Array<Incident> = await IncidentService.findBy({
+      query: {
+        projectId,
+        seriesFingerprint: new Includes(fingerprints),
+        currentIncidentState: {
+          isResolvedState: false,
+        },
+      },
+      select: {
+        _id: true,
+        seriesFingerprint: true,
+      },
+      skip: 0,
+      limit: LIMIT_PER_PROJECT,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const openFingerprints: Set<string> = new Set<string>(
+      openIncidents
+        .map((incident: Incident): string => {
+          return incident.seriesFingerprint || "";
+        })
+        .filter((fingerprint: string): boolean => {
+          return Boolean(fingerprint);
+        }),
+    );
+
+    let created: number = 0;
+
+    for (let index: number = 0; index < matchedGroups.length; index++) {
+      const matchGroup: DetectionMatchGroup = matchedGroups[index]!;
+      const fingerprint: string = fingerprints[index]!;
+
+      if (openFingerprints.has(fingerprint)) {
+        continue;
       }
 
-      alert.description = descriptionParts.join("\n\n");
-      alert.alertSeverityId = alertSeverityId;
-      alert.seriesFingerprint = fingerprint;
-      alert.isCreatedAutomatically = true;
-      alert.rootCause = `Sigma detection rule "${rule.name}" matched security events.`;
+      const incident: Incident = new Incident();
+      incident.projectId = projectId;
+      incident.title = this.buildMatchTitle(rule, matchGroup);
+      incident.description = this.buildMatchDescription({
+        rule,
+        parsedRule,
+        matchGroup,
+        startTime: data.startTime,
+        endTime: data.endTime,
+      });
+      incident.incidentSeverityId = incidentSeverityId;
+      incident.seriesFingerprint = fingerprint;
+      incident.isCreatedAutomatically = true;
+      incident.rootCause = `Sigma detection rule "${rule.name}" matched security events.`;
 
       try {
-        await AlertService.create({
-          data: alert,
+        /*
+         * Per-incident try/catch, like the alert path — but here it also
+         * guards IncidentService.onBeforeCreate, which throws when the
+         * project has no "created" incident state. That cannot be
+         * pre-checked the way an empty severity list can.
+         */
+        await IncidentService.create({
+          data: incident,
           props: {
             isRoot: true,
           },
@@ -356,7 +506,7 @@ export default class DetectionRuleEvaluator {
         created++;
       } catch (error) {
         logger.error(
-          `DetectionRuleEvaluator: failed creating alert for rule ${rule.id?.toString()}:`,
+          `DetectionRuleEvaluator: failed creating incident for rule ${rule.id?.toString()}:`,
         );
         logger.error(error);
       }
@@ -365,6 +515,50 @@ export default class DetectionRuleEvaluator {
     return created;
   }
 
+  private static buildMatchTitle(
+    rule: DetectionRule,
+    matchGroup: DetectionMatchGroup,
+  ): string {
+    return matchGroup.groupValue
+      ? `[Detection] ${rule.name} — ${matchGroup.groupValue}`
+      : `[Detection] ${rule.name}`;
+  }
+
+  private static buildMatchDescription(data: {
+    rule: DetectionRule;
+    parsedRule: SigmaRule;
+    matchGroup: DetectionMatchGroup;
+    startTime: Date;
+    endTime: Date;
+  }): string {
+    const { rule, parsedRule, matchGroup } = data;
+    const descriptionParts: Array<string> = [];
+
+    if (rule.description || parsedRule.description) {
+      descriptionParts.push(rule.description || parsedRule.description);
+    }
+
+    descriptionParts.push(
+      `Detection rule matched ${matchGroup.matchCount} security event${
+        matchGroup.matchCount === 1 ? "" : "s"
+      } between ${OneUptimeDate.getDateAsFormattedString(
+        data.startTime,
+      )} and ${OneUptimeDate.getDateAsFormattedString(data.endTime)}.`,
+    );
+
+    if (matchGroup.sampleMessage) {
+      descriptionParts.push(`Sample event: ${matchGroup.sampleMessage}`);
+    }
+
+    if (matchGroup.sampleObservables.length > 0) {
+      descriptionParts.push(
+        `Observables: ${matchGroup.sampleObservables.slice(0, 20).join(", ")}`,
+      );
+    }
+
+    return descriptionParts.join("\n\n");
+  }
+
   private static async writeDetectionFindings(data: {
     rule: DetectionRule;
     parsedRule: SigmaRule;
@@ -405,7 +599,7 @@ export default class DetectionRuleEvaluator {
           categoryUid,
           categoryName,
           classUid: DETECTION_FINDING_CLASS_UID,
-          className: "Detection Finding",
+          className: DETECTION_FINDING_CLASS_NAME,
           activityName: "Create",
           severityId: OcsfSeverityId[severityName],
           severityName,
@@ -439,14 +633,14 @@ export default class DetectionRuleEvaluator {
               ]
             : matchGroup.sampleObservables,
           attributes: {
-            "oneuptime.detection.rule_id": rule.id!.toString(),
-            "oneuptime.detection.rule_name": rule.name || parsedRule.title,
-            "oneuptime.detection.match_count": String(matchGroup.matchCount),
+            [DETECTION_RULE_ID_ATTRIBUTE]: rule.id!.toString(),
+            [DETECTION_RULE_NAME_ATTRIBUTE]: rule.name || parsedRule.title,
+            [DETECTION_MATCH_COUNT_ATTRIBUTE]: String(matchGroup.matchCount),
             ...(matchGroup.groupValue
-              ? { "oneuptime.detection.group_value": matchGroup.groupValue }
+              ? { [DETECTION_GROUP_VALUE_ATTRIBUTE]: matchGroup.groupValue }
               : {}),
             ...(parsedRule.id
-              ? { "oneuptime.detection.sigma_id": parsedRule.id }
+              ? { [DETECTION_SIGMA_ID_ATTRIBUTE]: parsedRule.id }
               : {}),
           },
         };
@@ -506,16 +700,81 @@ export default class DetectionRuleEvaluator {
       },
     });
 
+    return this.pickSeverityByPrecedence({
+      severities,
+      explicitSeverityId: data.rule.alertSeverityId,
+      level: data.parsedRule.level,
+    });
+  }
+
+  /*
+   * Incident severity precedence, identical in shape to the alert
+   * resolver: the rule's explicit incident severity (validated to belong
+   * to this project — IncidentService.onBeforeCreate rejects cross-project
+   * ids with a thrown exception, so pre-validating here keeps a stale id
+   * a soft fallback instead of a hard failure), else a name match on the
+   * Sigma level, else severity by rank. Null only when the project has no
+   * incident severities at all.
+   */
+  private static async resolveIncidentSeverityId(data: {
+    projectId: ObjectID;
+    rule: DetectionRule;
+    parsedRule: SigmaRule;
+  }): Promise<ObjectID | null> {
+    const severities: Array<IncidentSeverity> =
+      await IncidentSeverityService.findBy({
+        query: {
+          projectId: data.projectId,
+        },
+        select: {
+          _id: true,
+          name: true,
+        },
+        sort: {
+          order: SortOrder.Ascending,
+        },
+        skip: 0,
+        limit: LIMIT_PER_PROJECT,
+        props: {
+          isRoot: true,
+        },
+      });
+
+    return this.pickSeverityByPrecedence({
+      severities,
+      explicitSeverityId: data.rule.incidentSeverityId,
+      level: data.parsedRule.level,
+    });
+  }
+
+  /*
+   * The precedence logic both resolvers share. Severities arrive sorted
+   * by order ascending — lowest order is most severe, per the model's
+   * own convention — so "most severe" is the first element and "least
+   * severe" the last. An explicit id that is not in the list (deleted, or
+   * belonging to another project) falls through silently rather than
+   * failing the rule.
+   */
+  private static pickSeverityByPrecedence<
+    TSeverity extends {
+      id?: ObjectID | null | undefined;
+      name?: string | undefined;
+    },
+  >(data: {
+    severities: Array<TSeverity>;
+    explicitSeverityId: ObjectID | undefined;
+    level: SigmaLevel;
+  }): ObjectID | null {
+    const { severities, explicitSeverityId, level } = data;
+
     if (severities.length === 0) {
       return null;
     }
 
-    if (data.rule.alertSeverityId) {
-      const explicit: AlertSeverity | undefined = severities.find(
-        (severity: AlertSeverity): boolean => {
-          return (
-            severity.id?.toString() === data.rule.alertSeverityId?.toString()
-          );
+    if (explicitSeverityId) {
+      const explicit: TSeverity | undefined = severities.find(
+        (severity: TSeverity): boolean => {
+          return severity.id?.toString() === explicitSeverityId.toString();
         },
       );
 
@@ -524,10 +783,8 @@ export default class DetectionRuleEvaluator {
       }
     }
 
-    const level: SigmaLevel = data.parsedRule.level;
-
-    const nameMatch: AlertSeverity | undefined = severities.find(
-      (severity: AlertSeverity): boolean => {
+    const nameMatch: TSeverity | undefined = severities.find(
+      (severity: TSeverity): boolean => {
         return (severity.name || "").toLowerCase() === level.toLowerCase();
       },
     );
@@ -539,7 +796,7 @@ export default class DetectionRuleEvaluator {
     const isSevere: boolean =
       level === SigmaLevel.Critical || level === SigmaLevel.High;
 
-    const chosen: AlertSeverity = isSevere
+    const chosen: TSeverity = isSevere
       ? severities[0]!
       : severities[severities.length - 1]!;
 

package/Tests/App/Dashboard/PayAsYouGoNotices.test.tsx

@@ -120,6 +120,23 @@ describe("Pay as you go notices", () => {
       expect(card).toHaveTextContent("Starting at");
     });
 
+    it("names security events among the pillars billed at the telemetry rate", () => {
+      /*
+       * Security events ingest on the same key and meter at the same
+       * $0.10/GB as the other telemetry pillars. This sentence is the body of
+       * the consent checkbox a user has to tick to create a key, so a pillar
+       * missing from it is a pillar the user is charged for without ever
+       * having been told.
+       */
+      render(<TelemetryPayAsYouGoCard />);
+
+      expect(
+        screen.getByTestId("telemetry-pay-as-you-go-card"),
+      ).toHaveTextContent(
+        "Logs, traces, metrics, profiles and security events are billed at",
+      );
+    });
+
     it("says the charge stops when the key is deleted, so the notice is not just a threat", () => {
       render(<TelemetryPayAsYouGoCard />);