@oneuptime/common 12.0.22 → 12.0.24

package/Tests/Server/Utils/Marketing/MarketingEventUtil.test.ts

@@ -40,6 +40,7 @@ jest.mock("../../../../Server/Infrastructure/Queue", () => {
 
 import MarketingEventUtil from "../../../../Server/Utils/Marketing/MarketingEventUtil";
 import Attribution from "../../../../Server/Utils/Attribution";
+import { UtmPropertyKeys } from "../../../../Types/Marketing/Attribution";
 import {
   MarketingEvent,
   MarketingEventType,
@@ -120,12 +121,54 @@ describe("MarketingEventUtil", () => {
         utmCampaign: "brand",
         utmTerm: "oneuptime",
         utmContent: "hero-b",
+        utmId: undefined,
+        utmSourcePlatform: undefined,
+        utmCreativeFormat: undefined,
+        utmMarketingTactic: undefined,
         utmUrl: "https://oneuptime.com/?gclid=x",
         clickIds: { gclid: "x" },
         firstTouch: { utmSource: "linkedin" },
       });
     });
 
+    /*
+     * THE CONTRACT, ASSERTED MECHANICALLY.
+     *
+     * The browser captures every key in UtmWireKeyToPropertyKey, the signup
+     * door stores them and the Cal embed sends them — and for four of them the
+     * outbound conversion carried nothing at all, because this payload was
+     * hand-listed and nobody updated it. Nothing errored; conversions kept
+     * arriving, just unattributable on those dimensions.
+     *
+     * Built from the contract rather than a fixture, so a key added to
+     * Common/Types/Marketing/Attribution.ts is exercised here automatically
+     * instead of quietly going missing on the wire again.
+     */
+    test("carries every UTM key the shared contract names", () => {
+      const source: Record<string, string> = {};
+
+      for (const propertyKey of UtmPropertyKeys) {
+        source[propertyKey] = `${propertyKey}-value`;
+      }
+
+      const event: MarketingEvent = MarketingEventUtil.buildEvent({
+        eventType: MarketingEventType.SignUp,
+        eventId: "sign_up:u1",
+        occurredAt: new Date(),
+        attributionSource: source,
+      });
+
+      const attribution: Record<string, unknown> =
+        event.attribution as unknown as Record<string, unknown>;
+
+      // The fixture has to exercise the keys for this to mean anything.
+      expect(UtmPropertyKeys.length).toBeGreaterThanOrEqual(9);
+
+      for (const propertyKey of UtmPropertyKeys) {
+        expect(attribution[propertyKey]).toBe(`${propertyKey}-value`);
+      }
+    });
+
     /*
      * A conversion carrying no attribution is still a conversion. The two
      * container fields default to empty objects rather than undefined so a

package/Tests/Server/Utils/Monitor/Criteria/ProfileMonitorCriteria.test.ts

@@ -200,30 +200,34 @@ describe("ProfileMonitorCriteria.isMonitorInstanceCriteriaFilterMet", () => {
   });
 
   /*
-   * The exact production shape of a "profile presence" alert: criteria
-   * "Profile Count >= 1" flips the monitor Offline the moment a matching
-   * profile is ingested. Mirrors the log-presence offline criteria and keeps
-   * the count-based criteria in lock-step.
+   * A hand-written inversion of the shipped default, not the default itself.
+   * Profiles ships the Logs polarity - profiles arriving is the sign of life,
+   * so the default offline criteria is "Profile Count == 0" (covered above)
+   * and the online one is "Profile Count > 0". Someone monitoring for the
+   * appearance of profiles rather than their absence can write "Profile
+   * Count >= 1" and point it at the offline status instead; these tests pin
+   * that the evaluator decides that rule the same way, since nothing in
+   * ProfileMonitorCriteria knows or cares which status a criteria carries.
    */
-  describe("profile-presence offline criteria (Profile Count >= 1)", () => {
-    const offlineCriteria: CriteriaFilter = {
+  describe("a user-authored profile-presence criteria (Profile Count >= 1)", () => {
+    const presenceCriteria: CriteriaFilter = {
       checkOn: CheckOn.ProfileCount,
       filterType: FilterType.GreaterThanOrEqualTo,
       value: 1,
     };
 
-    test("one matching profile → met (monitor goes offline)", async () => {
-      const result: string | null = await evaluate(1, offlineCriteria);
+    test("one matching profile → met", async () => {
+      const result: string | null = await evaluate(1, presenceCriteria);
       expect(result).toBeTruthy();
       expect(result).toContain("Profile Count");
     });
 
     test("many matching profiles → met", async () => {
-      expect(await evaluate(6718284, offlineCriteria)).toBeTruthy();
+      expect(await evaluate(6718284, presenceCriteria)).toBeTruthy();
     });
 
-    test("zero matching profiles → not met (monitor stays operational)", async () => {
-      expect(await evaluate(0, offlineCriteria)).toBeNull();
+    test("zero matching profiles → not met", async () => {
+      expect(await evaluate(0, presenceCriteria)).toBeNull();
     });
   });
 

package/Tests/Server/Utils/Monitor/NetworkInventoryUtil.test.ts

@@ -11,6 +11,10 @@ import SnmpInterface from "../../../../Types/Monitor/SnmpMonitor/SnmpInterface";
 import SnmpMonitorResponse from "../../../../Types/Monitor/SnmpMonitor/SnmpMonitorResponse";
 import LldpNeighbor from "../../../../Types/Monitor/SnmpMonitor/LldpNeighbor";
 import CdpNeighbor from "../../../../Types/Monitor/SnmpMonitor/CdpNeighbor";
+import SnmpOid from "../../../../Types/Monitor/SnmpMonitor/SnmpOid";
+import SnmpVendorTemplateUtil, {
+  SnmpVendorTemplate,
+} from "../../../../Types/Monitor/SnmpMonitor/SnmpVendorTemplate";
 
 /*
  * NetworkInventoryUtil.updateFromWalk is the single writer that keeps the
@@ -40,14 +44,21 @@ let interfaceUpdateSpy: jest.SpyInstance;
 let interfaceCreateSpy: jest.SpyInstance;
 let endpointUpsertSpy: jest.SpyInstance;
 
-function mockServices(existingInterfaces: Array<NetworkInterface> = []): void {
+function mockServices(
+  existingInterfaces: Array<NetworkInterface> = [],
+  deviceOverrides: Partial<NetworkDevice> = {},
+): void {
   /*
    * The project-membership guard resolves the device (scoped to the given
    * project) before any write; return a matching device so the write path
    * runs. The cross-project-refusal case overrides this to null.
+   * deviceOverrides seeds the columns the vendor-template auto-apply reads
+   * (autoApplyVendorHealthTemplate, snmpOids) — absent by default, exactly
+   * like a device that never opted in.
    */
   const ownedDevice: NetworkDevice = new NetworkDevice();
   ownedDevice.id = new ObjectID(DEVICE_ID);
+  Object.assign(ownedDevice, deviceOverrides);
   deviceFindSpy = jest
     .spyOn(NetworkDeviceService, "findOneBy")
     .mockResolvedValue(ownedDevice);
@@ -867,3 +878,88 @@ describe("NetworkInventoryUtil.updateFromWalk — endpoint discovery", () => {
     ]);
   });
 });
+
+describe("NetworkInventoryUtil.updateFromWalk — vendor health template auto-apply", () => {
+  /*
+   * The automatic counterpart of the dashboard's vendor-template banner:
+   * a device that opted in (auto-imported devices do) gets its EMPTY Health
+   * OID list seeded from the vendor template its sysObjectID fingerprints,
+   * on the first poll that learns the vendor. An existing list — however it
+   * got there — is the operator's and is never touched.
+   */
+  test("an opted-in device with no health OIDs is seeded from the fingerprinted vendor template", async () => {
+    mockServices([], { autoApplyVendorHealthTemplate: true });
+
+    await runWalk({
+      systemInfo: {
+        sysObjectId: CISCO_SYS_OBJECT_ID,
+      },
+    });
+
+    const update: DeviceUpdatePayload = deviceUpdatePayload();
+    const seeded: Array<SnmpOid> = update["snmpOids"] as Array<SnmpOid>;
+
+    const ciscoTemplate: SnmpVendorTemplate | undefined =
+      SnmpVendorTemplateUtil.matchBySysObjectId(CISCO_SYS_OBJECT_ID);
+
+    expect(ciscoTemplate).toBeDefined();
+    expect(seeded).toEqual(ciscoTemplate!.oids);
+    expect(seeded.length).toBeGreaterThan(0);
+  });
+
+  test("a device that never opted in is not seeded", async () => {
+    mockServices();
+
+    await runWalk({
+      systemInfo: {
+        sysObjectId: CISCO_SYS_OBJECT_ID,
+      },
+    });
+
+    expect(deviceUpdatePayload()).not.toHaveProperty("snmpOids");
+  });
+
+  test("an existing health OID list is never touched, even with the toggle on", async () => {
+    const handPickedOids: Array<SnmpOid> = [
+      { oid: "1.3.6.1.4.1.9.9.109.1.1.1.1.7.1", name: "CPU 5min" },
+    ];
+
+    mockServices([], {
+      autoApplyVendorHealthTemplate: true,
+      snmpOids: handPickedOids,
+    });
+
+    await runWalk({
+      systemInfo: {
+        sysObjectId: CISCO_SYS_OBJECT_ID,
+      },
+    });
+
+    expect(deviceUpdatePayload()).not.toHaveProperty("snmpOids");
+  });
+
+  test("a walk that learned no sysObjectID seeds nothing", async () => {
+    mockServices([], { autoApplyVendorHealthTemplate: true });
+
+    await runWalk({
+      systemInfo: {
+        sysName: "core-sw-01",
+      },
+    });
+
+    expect(deviceUpdatePayload()).not.toHaveProperty("snmpOids");
+  });
+
+  test("an enterprise with no vendor template seeds nothing", async () => {
+    mockServices([], { autoApplyVendorHealthTemplate: true });
+
+    // Enterprise 99999 has no entry in ENTERPRISE_TEMPLATE_IDS.
+    await runWalk({
+      systemInfo: {
+        sysObjectId: "1.3.6.1.4.1.99999.1.1",
+      },
+    });
+
+    expect(deviceUpdatePayload()).not.toHaveProperty("snmpOids");
+  });
+});

package/Tests/Server/Utils/SecurityEvent/DetectionRuleEvaluator.test.ts

@@ -36,11 +36,13 @@ import IncidentSeverityService from "../../../../Server/Services/IncidentSeverit
 import DetectionRuleService from "../../../../Server/Services/DetectionRuleService";
 import SecurityEventService, {
   DetectionMatchGroup,
+  FindDetectionMatchesData,
 } from "../../../../Server/Services/SecurityEventService";
 import OTelIngestService, {
   TelemetryServiceMetadata,
 } from "../../../../Server/Services/OpenTelemetryIngestService";
 import logger from "../../../../Server/Utils/Logger";
+import { Statement } from "../../../../Server/Utils/AnalyticsDatabase/Statement";
 import MetricSeriesFingerprint from "../../../../Utils/Metrics/MetricSeriesFingerprint";
 import ObjectID from "../../../../Types/ObjectID";
 import OneUptimeDate from "../../../../Types/Date";
@@ -107,6 +109,9 @@ function buildRule(
     lastEvaluatedAt?: Date;
     evaluationIntervalInMinutes?: number;
     id?: ObjectID;
+    groupByField?: string;
+    distinctCountField?: string;
+    matchCountThreshold?: number;
   } = {},
 ): DetectionRule {
   const rule: DetectionRule = new DetectionRule();
@@ -117,7 +122,15 @@ function buildRule(
   rule.sigmaRuleYaml =
     options.sigmaRuleYaml ?? sigmaYaml(options.level || "high");
   rule.evaluationIntervalInMinutes = options.evaluationIntervalInMinutes ?? 5;
-  rule.groupByField = "principalUser";
+  rule.groupByField = options.groupByField ?? "principalUser";
+
+  if (options.distinctCountField !== undefined) {
+    rule.distinctCountField = options.distinctCountField;
+  }
+
+  if (options.matchCountThreshold !== undefined) {
+    rule.matchCountThreshold = options.matchCountThreshold;
+  }
 
   if (options.shouldCreateAlert !== undefined) {
     rule.shouldCreateAlert = options.shouldCreateAlert;
@@ -156,10 +169,12 @@ function buildSeverity(idSuffix: string, name: string): AlertSeverity {
 function buildGroup(
   groupValue: string,
   matchCount: number,
+  distinctCount: number = 0,
 ): DetectionMatchGroup {
   return {
     groupValue,
     matchCount,
+    distinctCount,
     sampleMessage: `sample event for ${groupValue || "all"}`,
     sampleObservables: [groupValue, "10.0.0.9"].filter(
       (observable: string): boolean => {
@@ -297,15 +312,24 @@ function createdIncident(spies: EvaluationSpies, index: number): Incident {
   return (call as { data: Incident }).data;
 }
 
+function findMatchesArg(spies: EvaluationSpies): FindDetectionMatchesData {
+  return spies.findDetectionMatches.mock
+    .calls[0]?.[0] as FindDetectionMatchesData;
+}
+
+// The evaluator logs expected failures; keep test output clean.
+function silenceLogger(): void {
+  getJestSpyOn(logger, "error").mockImplementation((() => {
+    return undefined;
+  }) as never);
+  getJestSpyOn(logger, "warn").mockImplementation((() => {
+    return undefined;
+  }) as never);
+}
+
 describe("DetectionRuleEvaluator", () => {
   beforeEach(() => {
-    // The evaluator logs expected failures; keep test output clean.
-    getJestSpyOn(logger, "error").mockImplementation((() => {
-      return undefined;
-    }) as never);
-    getJestSpyOn(logger, "warn").mockImplementation((() => {
-      return undefined;
-    }) as never);
+    silenceLogger();
   });
 
   afterEach(() => {
@@ -1042,6 +1066,29 @@ describe("DetectionRuleEvaluator", () => {
       expect(select["shouldCreateAlert"]).toBe(true);
       expect(select["alertSeverityId"]).toBe(true);
     });
+
+    test("selects the distinct-count columns so thresholds do not silently read as 1", async () => {
+      /*
+       * Same drift as the incident columns: a rule fetched WITHOUT
+       * matchCountThreshold in the select falls back to the
+       * fire-on-any-match default, and one fetched without
+       * distinctCountField silently thresholds the raw count instead of
+       * the distinct count — neither failure trips any other assertion.
+       */
+      const rulesFindBy: Spy = getJestSpyOn(
+        DetectionRuleService,
+        "findBy",
+      ).mockResolvedValue([] as never);
+
+      await DetectionRuleEvaluator.evaluateAllDueRules();
+
+      const select: JSONObject = (
+        rulesFindBy.mock.calls[0]?.[0] as { select: JSONObject }
+      ).select;
+
+      expect(select["distinctCountField"]).toBe(true);
+      expect(select["matchCountThreshold"]).toBe(true);
+    });
   });
 
   describe("rule bookkeeping", () => {
@@ -1095,4 +1142,318 @@ describe("DetectionRuleEvaluator", () => {
       ).toBe(false);
     });
   });
+
+  describe("distinct count and match count threshold", () => {
+    /*
+     * matchCountThreshold holds a rule back until a group reaches N
+     * events, and distinctCountField switches what N counts: raw
+     * matches, or uniqExact of one field. The ClickHouse HAVING clause
+     * already enforces the threshold server-side, but the evaluator
+     * re-filters so the firing contract does not depend on which side
+     * built the rows — these tests pin that in-process filter plus the
+     * exact query contract handed to SecurityEventService.
+     */
+    test("threshold on the raw count path: only groups at/above it fire and totalMatches sums firing groups only", async () => {
+      const rule: DetectionRule = buildRule({
+        matchCountThreshold: 3,
+        shouldWriteDetectionFinding: false,
+      });
+
+      const spies: EvaluationSpies = installSpies({
+        groups: [
+          buildGroup("alice", 5),
+          buildGroup("bob", 2), // below threshold — must not fire
+          buildGroup("carol", 3), // exactly at threshold — fires
+        ],
+        severities: [buildSeverity("0001", "Default")],
+      });
+
+      const result: DetectionRuleEvaluationResult =
+        await DetectionRuleEvaluator.evaluateRule(rule);
+
+      expect(result.matchedGroups).toBe(2);
+      // 5 + 3; bob's 2 sub-threshold events are not "matches" at all.
+      expect(result.totalMatches).toBe(8);
+      expect(result.alertsCreated).toBe(2);
+
+      const alertFingerprints: Array<string | undefined> = [
+        createdAlert(spies, 0).seriesFingerprint,
+        createdAlert(spies, 1).seriesFingerprint,
+      ];
+
+      expect(alertFingerprints).toContain(expectedFingerprint("alice"));
+      expect(alertFingerprints).toContain(expectedFingerprint("carol"));
+      expect(alertFingerprints).not.toContain(expectedFingerprint("bob"));
+    });
+
+    test("an unset threshold behaves as 1 — pre-threshold rules keep firing on any match", async () => {
+      const rule: DetectionRule = buildRule({
+        shouldWriteDetectionFinding: false,
+      });
+
+      const spies: EvaluationSpies = installSpies({
+        groups: [buildGroup("alice", 1)],
+        severities: [buildSeverity("0001", "Default")],
+      });
+
+      const result: DetectionRuleEvaluationResult =
+        await DetectionRuleEvaluator.evaluateRule(rule);
+
+      expect(result.matchedGroups).toBe(1);
+      expect(result.alertsCreated).toBe(1);
+      expect(findMatchesArg(spies).minMatchCount).toBe(1);
+    });
+
+    test("a threshold of 0 behaves as 1, not as fire-on-nothing", async () => {
+      const rule: DetectionRule = buildRule({
+        matchCountThreshold: 0,
+        shouldWriteDetectionFinding: false,
+      });
+
+      const spies: EvaluationSpies = installSpies({
+        groups: [buildGroup("alice", 1)],
+        severities: [buildSeverity("0001", "Default")],
+      });
+
+      const result: DetectionRuleEvaluationResult =
+        await DetectionRuleEvaluator.evaluateRule(rule);
+
+      expect(result.matchedGroups).toBe(1);
+      expect(result.alertsCreated).toBe(1);
+      // The clamp happens before the query, not just in the re-filter.
+      expect(findMatchesArg(spies).minMatchCount).toBe(1);
+    });
+
+    test("a distinct-count rule fires on distinctCount, not matchCount", async () => {
+      const rule: DetectionRule = buildRule({
+        distinctCountField: "principalIp",
+        matchCountThreshold: 5,
+        shouldWriteDetectionFinding: false,
+      });
+
+      const spies: EvaluationSpies = installSpies({
+        groups: [
+          // 50 raw matches from only 2 IPs — noisy, not distributed.
+          buildGroup("alice", 50, 2),
+          // 6 raw matches from 5 IPs — under on raw count, fires on distinct.
+          buildGroup("bob", 6, 5),
+        ],
+        severities: [buildSeverity("0001", "Default")],
+      });
+
+      const result: DetectionRuleEvaluationResult =
+        await DetectionRuleEvaluator.evaluateRule(rule);
+
+      expect(result.matchedGroups).toBe(1);
+      expect(result.totalMatches).toBe(6);
+      expect(result.alertsCreated).toBe(1);
+      expect(createdAlert(spies, 0).seriesFingerprint).toBe(
+        expectedFingerprint("bob"),
+      );
+    });
+
+    test("a group with zero matches never fires even when distinctCount clears the threshold", async () => {
+      const rule: DetectionRule = buildRule({
+        distinctCountField: "principalIp",
+        matchCountThreshold: 5,
+        shouldWriteDetectionFinding: false,
+      });
+
+      const spies: EvaluationSpies = installSpies({
+        // Nonsense a buggy query could emit: distinct 7 over 0 rows.
+        groups: [buildGroup("alice", 0, 7)],
+        severities: [buildSeverity("0001", "Default")],
+      });
+
+      const result: DetectionRuleEvaluationResult =
+        await DetectionRuleEvaluator.evaluateRule(rule);
+
+      expect(result.matchedGroups).toBe(0);
+      expect(result.totalMatches).toBe(0);
+      expect(spies.alertCreate).not.toHaveBeenCalled();
+    });
+
+    test("a plain rule queries with a null distinct expression, its threshold, and the existing group contract", async () => {
+      const rule: DetectionRule = buildRule({
+        matchCountThreshold: 4,
+        shouldWriteDetectionFinding: false,
+      });
+
+      const spies: EvaluationSpies = installSpies();
+
+      await DetectionRuleEvaluator.evaluateRule(rule);
+
+      const args: FindDetectionMatchesData = findMatchesArg(spies);
+
+      expect(args.projectId.toString()).toBe(PROJECT_ID.toString());
+      expect(args.minMatchCount).toBe(4);
+      expect(args.distinctCountExpression).toBeNull();
+      // groupByField still compiles to an expression; maxGroups is intact.
+      expect(args.groupByExpression).toBeInstanceOf(Statement);
+      expect(args.maxGroups).toBe(100);
+    });
+
+    test("a distinct-count rule queries with a compiled Statement for the distinct field", async () => {
+      const rule: DetectionRule = buildRule({
+        distinctCountField: "principalIp",
+        matchCountThreshold: 5,
+        shouldWriteDetectionFinding: false,
+      });
+
+      const spies: EvaluationSpies = installSpies();
+
+      await DetectionRuleEvaluator.evaluateRule(rule);
+
+      const args: FindDetectionMatchesData = findMatchesArg(spies);
+
+      expect(args.distinctCountExpression).toBeInstanceOf(Statement);
+      expect(args.minMatchCount).toBe(5);
+      expect(args.groupByExpression).toBeInstanceOf(Statement);
+    });
+
+    test("a distinct rule's alert description explains the distinct count and threshold", async () => {
+      const rule: DetectionRule = buildRule({
+        distinctCountField: "principalIp",
+        matchCountThreshold: 5,
+        shouldWriteDetectionFinding: false,
+      });
+
+      const spies: EvaluationSpies = installSpies({
+        groups: [buildGroup("alice", 6, 5)],
+        severities: [buildSeverity("0001", "Default")],
+      });
+
+      await DetectionRuleEvaluator.evaluateRule(rule);
+
+      expect(createdAlert(spies, 0).description).toContain(
+        "5 distinct principalIp values across these events (rule threshold: 5).",
+      );
+    });
+
+    test("a plain rule's alert description never says distinct", async () => {
+      const rule: DetectionRule = buildRule({
+        shouldWriteDetectionFinding: false,
+      });
+
+      const spies: EvaluationSpies = installSpies({
+        groups: [buildGroup("alice", 6)],
+        severities: [buildSeverity("0001", "Default")],
+      });
+
+      await DetectionRuleEvaluator.evaluateRule(rule);
+
+      expect(createdAlert(spies, 0).description).not.toContain("distinct");
+    });
+
+    test("a distinct rule's findings carry the distinct-count attribute and message suffix", async () => {
+      const rule: DetectionRule = buildRule({
+        distinctCountField: "principalIp",
+        matchCountThreshold: 5,
+        shouldCreateAlert: false,
+      });
+
+      const spies: EvaluationSpies = installSpies({
+        groups: [buildGroup("alice", 6, 5)],
+      });
+
+      await DetectionRuleEvaluator.evaluateRule(rule);
+
+      const row: JSONObject = (
+        spies.insertJsonRows.mock.calls[0]?.[0] as Array<JSONObject>
+      )[0]!;
+
+      expect(
+        (row["attributes"] as JSONObject)["oneuptime.detection.distinct_count"],
+      ).toBe("5");
+      expect(row["message"]).toContain("(6 events, 5 distinct principalIp)");
+    });
+
+    test("a plain rule's findings carry no distinct-count attribute or message suffix", async () => {
+      const rule: DetectionRule = buildRule({
+        shouldCreateAlert: false,
+      });
+
+      const spies: EvaluationSpies = installSpies({
+        groups: [buildGroup("alice", 6)],
+      });
+
+      await DetectionRuleEvaluator.evaluateRule(rule);
+
+      const row: JSONObject = (
+        spies.insertJsonRows.mock.calls[0]?.[0] as Array<JSONObject>
+      )[0]!;
+
+      /*
+       * Absent, not "0": consumers filter on attribute presence, and a
+       * plain rule has no distinct semantics to report.
+       */
+      expect(
+        Object.prototype.hasOwnProperty.call(
+          row["attributes"] as JSONObject,
+          "oneuptime.detection.distinct_count",
+        ),
+      ).toBe(false);
+      expect(row["message"]).not.toContain("distinct");
+    });
+
+    test("flagship: distinct usernames per source IP — one qualifying group, one alert, one finding", async () => {
+      /*
+       * The scenario the feature was built for: password spraying.
+       * Group by attacker IP, count distinct usernames tried, fire at 5.
+       * One IP hammered a single account 40 times (lockout noise, not a
+       * spray); another tried 6 accounts across 9 events.
+       */
+      const rule: DetectionRule = buildRule({
+        groupByField: "principalIp",
+        distinctCountField: "principalUser",
+        matchCountThreshold: 5,
+      });
+
+      const spies: EvaluationSpies = installSpies({
+        groups: [
+          buildGroup("203.0.113.7", 9, 6),
+          buildGroup("198.51.100.4", 40, 1),
+        ],
+        severities: [buildSeverity("0001", "High")],
+      });
+
+      const result: DetectionRuleEvaluationResult =
+        await DetectionRuleEvaluator.evaluateRule(rule);
+
+      expect(result.matchedGroups).toBe(1);
+      expect(result.totalMatches).toBe(9);
+      expect(result.alertsCreated).toBe(1);
+      expect(result.findingsWritten).toBe(1);
+      expect(result.error).toBeNull();
+
+      // The query was built from the rule's three knobs.
+      const args: FindDetectionMatchesData = findMatchesArg(spies);
+      expect(args.groupByExpression).toBeInstanceOf(Statement);
+      expect(args.distinctCountExpression).toBeInstanceOf(Statement);
+      expect(args.minMatchCount).toBe(5);
+
+      const alert: Alert = createdAlert(spies, 0);
+
+      expect(alert.title).toContain("203.0.113.7");
+      expect(alert.seriesFingerprint).toBe(expectedFingerprint("203.0.113.7"));
+      expect(alert.description).toContain(
+        "6 distinct principalUser values across these events (rule threshold: 5).",
+      );
+
+      const rows: Array<JSONObject> = spies.insertJsonRows.mock
+        .calls[0]?.[0] as Array<JSONObject>;
+
+      expect(rows).toHaveLength(1);
+
+      const row: JSONObject = rows[0]!;
+      const attributes: JSONObject = row["attributes"] as JSONObject;
+
+      expect(attributes["oneuptime.detection.group_value"]).toBe("203.0.113.7");
+      expect(attributes["oneuptime.detection.match_count"]).toBe("9");
+      expect(attributes["oneuptime.detection.distinct_count"]).toBe("6");
+      expect(row["message"]).toContain(
+        "Detection: Brute Force Watch — 203.0.113.7 (9 events, 6 distinct principalUser)",
+      );
+    });
+  });
 });