@oneuptime/common 12.0.5 → 12.0.7

package/Server/Utils/LLM/LLMService.ts

@@ -4,11 +4,12 @@ import Headers from "../../../Types/API/Headers";
 import URL from "../../../Types/API/URL";
 import { JSONArray, JSONObject } from "../../../Types/JSON";
 import JSONFunctions from "../../../Types/JSONFunctions";
-import API from "../../../Utils/API";
+import API, { RequestOptions } from "../../../Utils/API";
 import LlmType from "../../../Types/LLM/LlmType";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import logger, { LogAttributes } from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
+import DataSourceEgressGuard from "../DataSource/EgressGuard";
 
 export interface LLMToolDefinition {
   name: string;
@@ -653,6 +654,38 @@ export default class LLMService {
    * the offending parameter in the 400 — one parameter per response, hence the
    * loop.
    */
+  /*
+   * Request options for a call to a tenant-configured LLM endpoint.
+   *
+   * LlmProvider.baseUrl is writable by any project member while reading the
+   * apiKey is Owner/Admin-only, so an unguarded request lets a member repoint
+   * a provider at a host they control and collect the decrypted key out of the
+   * auth header — and, because provider error bodies are reflected back
+   * through the LLM provider API, use the same lever as a blind-free read
+   * primitive against the internal network.
+   *
+   * The address the guard checked is pinned into the socket, and redirects are
+   * refused: pinning covers only the validated host, so a 3xx would walk
+   * around it. Private ranges stay reachable on self-hosted installs, because
+   * a self-hosted Ollama on 10.x is the documented deployment.
+   */
+  private static async buildGuardedRequestOptions(
+    requestUrl: string,
+    options: RequestOptions,
+  ): Promise<RequestOptions> {
+    const { httpAgent, httpsAgent } =
+      await DataSourceEgressGuard.assertUrlAllowedAndPin(requestUrl, {
+        targetLabel: "LLM provider",
+      });
+
+    return {
+      ...options,
+      doNotFollowRedirects: true,
+      httpAgent,
+      httpsAgent,
+    };
+  }
+
   private static async postOpenAIChatCompletion(data: {
     requestUrl: string;
     headers: Headers;
@@ -674,6 +707,18 @@ export default class LLMService {
      */
     const attemptedTokenLimitParams: Set<TokenLimitParam> = new Set();
 
+    /*
+     * Validated once, before the first request: the adaptation loop below
+     * re-posts to the same URL, so re-resolving per attempt would only add
+     * DNS round trips (and a rebind window between them).
+     */
+    const requestOptions: RequestOptions =
+      await this.buildGuardedRequestOptions(data.requestUrl, {
+        retries: data.request.requestRetries ?? 2,
+        exponentialBackoff: true,
+        timeout: data.request.requestTimeoutInMs ?? 120000,
+      });
+
     const post: () => Promise<
       HTTPResponse<JSONObject> | HTTPErrorResponse
     > = (): Promise<HTTPResponse<JSONObject> | HTTPErrorResponse> => {
@@ -693,11 +738,7 @@ export default class LLMService {
         url: URL.fromString(data.requestUrl),
         data: body,
         headers: data.headers,
-        options: {
-          retries: data.request.requestRetries ?? 2,
-          exponentialBackoff: true,
-          timeout: data.request.requestTimeoutInMs ?? 120000,
-        },
+        options: requestOptions,
       });
     };
 
@@ -1214,20 +1255,22 @@ export default class LLMService {
       requestData["tools"] = anthropicTools;
     }
 
+    const anthropicRequestUrl: string = `${baseUrl}/messages`;
+
     const response: HTTPErrorResponse | HTTPResponse<JSONObject> =
       await API.post<JSONObject>({
-        url: URL.fromString(`${baseUrl}/messages`),
+        url: URL.fromString(anthropicRequestUrl),
         data: requestData,
         headers: {
           "x-api-key": config.apiKey,
           "anthropic-version": "2023-06-01",
           "Content-Type": "application/json",
         },
-        options: {
+        options: await this.buildGuardedRequestOptions(anthropicRequestUrl, {
           retries: request.requestRetries ?? 2,
           exponentialBackoff: true,
           timeout: request.requestTimeoutInMs ?? 120000,
-        },
+        }),
       });
 
     const anthropicLogAttributes: LogAttributes = {
@@ -1355,18 +1398,20 @@ export default class LLMService {
       requestData["tools"] = this.toOpenAITools(request.tools);
     }
 
+    const ollamaRequestUrl: string = `${config.baseUrl}/api/chat`;
+
     const response: HTTPErrorResponse | HTTPResponse<JSONObject> =
       await API.post<JSONObject>({
-        url: URL.fromString(`${config.baseUrl}/api/chat`),
+        url: URL.fromString(ollamaRequestUrl),
         data: requestData,
         headers: {
           "Content-Type": "application/json",
         },
-        options: {
+        options: await this.buildGuardedRequestOptions(ollamaRequestUrl, {
           retries: request.requestRetries ?? 2,
           exponentialBackoff: true,
           timeout: request.requestTimeoutInMs ?? 300000, // Ollama may be slower
-        },
+        }),
       });
 
     const ollamaLogAttributes: LogAttributes = {

package/Server/Utils/Monitor/MonitorAlert.ts

@@ -36,6 +36,9 @@ import MonitorClusterContextUtil, {
   MonitorClusterContext,
 } from "./MonitorClusterContext";
 import MonitorTemplateUtil from "./MonitorTemplateUtil";
+import MonitorDependencySuppression, {
+  DependencySuppressionResult,
+} from "./MonitorDependencySuppression";
 import { JSONObject } from "../../../Types/JSON";
 import OneUptimeDate from "../../../Types/Date";
 import MonitorEvaluationSummary from "../../../Types/Monitor/MonitorEvaluationSummary";
@@ -240,6 +243,14 @@ export default class MonitorAlert {
      * evaluating. See MonitorMaintenanceSuppression.
      */
     suppressedSeriesFingerprints?: Set<string> | undefined;
+    /**
+     * Alert-dependency suppression: when set and isSuppressed, a parent
+     * monitor this monitor depends on is currently in a suppressing
+     * status, so ALL alert creation for this evaluation is skipped. Only
+     * creation — already-open alerts still follow the normal resolve
+     * path above. See MonitorDependencySuppression.
+     */
+    dependencySuppression?: DependencySuppressionResult | undefined;
     /**
      * Event-driven monitors (incoming-request / webhook fan-out) must not
      * use the metric snapshot model where a series absent from this tick's
@@ -288,6 +299,35 @@ export default class MonitorAlert {
       return;
     }
 
+    /*
+     * Alert-dependency suppression: a parent monitor is in a suppressing
+     * status (offline by default), so skip creating any alert for this
+     * evaluation. Placed after the open-alert resolve pass above on
+     * purpose — an alert raised before the parent went down must still
+     * resolve normally; only new creation is silenced.
+     */
+    if (input.dependencySuppression?.isSuppressed) {
+      const suppressionReason: string =
+        MonitorDependencySuppression.buildSuppressionReason(
+          input.dependencySuppression.suppressingParents,
+        );
+
+      logger.debug(
+        `${input.monitor.id?.toString()} - Skipping alert creation: ${suppressionReason}.`,
+        alertLogAttributes,
+      );
+
+      input.evaluationSummary?.events.push({
+        type: "alert-skipped",
+        title: "Alert suppressed by monitor dependency",
+        message: `Skipped creating alerts because ${suppressionReason}. This monitor's status still updates normally; open alerts still auto-resolve.`,
+        relatedCriteriaId: input.criteriaInstance.data?.id,
+        at: OneUptimeDate.getCurrentDate(),
+      });
+
+      return;
+    }
+
     /*
      * Proxmox/Ceph monitors: resolve the monitored cluster once per
      * evaluation (lookup-only, from the step config's clusterIdentifier)

package/Server/Utils/Monitor/MonitorDependencySuppression.ts

@@ -0,0 +1,192 @@
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import MonitorStatus from "../../../Models/DatabaseModels/MonitorStatus";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import ObjectID from "../../../Types/ObjectID";
+import MonitorDependencyRule, {
+  DependencySuppressionResult,
+  ParentMonitorStatusRef,
+  SuppressingParent,
+} from "../../../Utils/Monitor/MonitorDependencyRule";
+import MonitorService from "../../Services/MonitorService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import logger from "../Logger";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+
+/*
+ * Re-exported so server-side callers (and the existing tests) keep a
+ * single import site; the rule itself lives in
+ * Common/Utils/Monitor/MonitorDependencyRule so the dashboard can share
+ * it without importing server modules.
+ */
+export type {
+  DependencySuppressionResult,
+  ParentMonitorStatusRef,
+  SuppressingParent,
+};
+
+/*
+ * Alert-dependency suppression (the per-monitor counterpart of the
+ * per-series MonitorMaintenanceSuppression): when a monitor declares
+ * `dependsOnMonitors` and any of those parents is currently in a
+ * suppressing status, alert/incident *creation* for this monitor is
+ * skipped for the evaluation. The monitor itself keeps evaluating — its
+ * status timeline, metrics, and the resolve path for already-open
+ * alerts/incidents are untouched. That keeps the child visibly Offline on
+ * status pages (and lets grand-children observe the outage through the
+ * child's real status, which is what makes one-hop checks transitive)
+ * while silencing the redundant paging.
+ *
+ * Which parent statuses suppress: the monitor's
+ * `suppressAlertsWhenParentMonitorStatuses` list when configured,
+ * otherwise any status flagged `isOfflineState`. The decision itself is
+ * MonitorDependencyRule.getSuppressingParents, shared with the dashboard
+ * banner.
+ */
+export default class MonitorDependencySuppression {
+  /*
+   * Resolve the suppression decision for one evaluation. Zero queries on
+   * the common path — a monitor with no dependencies returns immediately —
+   * and exactly one query (the parents' current statuses) otherwise. This
+   * sits on the hottest Postgres path in the product, so the monitor's
+   * dependency ids must arrive pre-selected on the monitor row rather than
+   * being re-read here.
+   */
+  @CaptureSpan()
+  public static async getDependencySuppression(input: {
+    monitor: Monitor;
+  }): Promise<DependencySuppressionResult> {
+    const monitorId: string = (
+      input.monitor.id ||
+      input.monitor._id ||
+      ""
+    ).toString();
+
+    const parentIds: Array<ObjectID> = (input.monitor.dependsOnMonitors || [])
+      .map((parent: Monitor) => {
+        return (parent.id || parent._id)?.toString() || "";
+      })
+      .filter((id: string) => {
+        /*
+         * A self-edge should never exist (validation rejects it, uuids
+         * compared case-insensitively), but if one was persisted through
+         * an older payload shape it must not let a monitor suppress its
+         * own offline alerts — that would silence exactly the outage the
+         * monitor exists to report.
+         */
+        return id.length > 0 && id.toLowerCase() !== monitorId.toLowerCase();
+      })
+      .map((id: string) => {
+        return new ObjectID(id);
+      });
+
+    if (parentIds.length === 0) {
+      return { isSuppressed: false, suppressingParents: [] };
+    }
+
+    const parents: Array<Monitor> = await MonitorService.findBy({
+      query: {
+        _id: QueryHelper.any(parentIds),
+      },
+      select: {
+        _id: true,
+        name: true,
+        currentMonitorStatus: {
+          _id: true,
+          name: true,
+          isOfflineState: true,
+        },
+        /*
+         * The parents' own parent ids, for the runtime mutual-cycle guard
+         * below. Selected here so the guard costs no extra query.
+         */
+        dependsOnMonitors: {
+          _id: true,
+        },
+      },
+      skip: 0,
+      limit: LIMIT_PER_PROJECT,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const parentRefs: Array<ParentMonitorStatusRef> = [];
+
+    for (const parent of parents) {
+      /*
+       * Runtime mutual-cycle guard: write-time validation walks the graph
+       * before persisting, but two concurrent updates can each pass
+       * validation and jointly commit a cycle (A depends on B, B depends
+       * on A). If that cycle suppressed, a shared outage would take both
+       * monitors offline and page NOBODY. Fail open instead: a parent
+       * that itself depends on this monitor is ignored for suppression,
+       * so a raced-in cycle degrades to normal (noisy) paging rather than
+       * a silent blackout.
+       */
+      const isMutualCycle: boolean = (parent.dependsOnMonitors || []).some(
+        (grandParent: Monitor) => {
+          const grandParentId: string = (
+            grandParent.id ||
+            grandParent._id ||
+            ""
+          ).toString();
+
+          return (
+            grandParentId.length > 0 &&
+            grandParentId.toLowerCase() === monitorId.toLowerCase()
+          );
+        },
+      );
+
+      if (isMutualCycle) {
+        logger.warn(
+          `${monitorId} - Monitor dependency cycle detected at evaluation time with parent ${parent.id?.toString()} ("${parent.name}"). The parent is ignored for suppression so alerts still fire. Remove one side of the cycle.`,
+        );
+        continue;
+      }
+
+      parentRefs.push({
+        monitorId: parent.id?.toString() || "",
+        monitorName: parent.name || "Unnamed monitor",
+        statusId: parent.currentMonitorStatus?.id?.toString(),
+        statusName: parent.currentMonitorStatus?.name,
+        isOfflineState: Boolean(parent.currentMonitorStatus?.isOfflineState),
+      });
+    }
+
+    const configuredSuppressionStatusIds: Set<string> = new Set<string>(
+      (input.monitor.suppressAlertsWhenParentMonitorStatuses || [])
+        .map((status: MonitorStatus) => {
+          return (status.id || status._id)?.toString() || "";
+        })
+        .filter((id: string) => {
+          return id.length > 0;
+        }),
+    );
+
+    const suppressingParents: Array<SuppressingParent> =
+      this.getSuppressingParents({
+        parents: parentRefs,
+        configuredSuppressionStatusIds,
+      });
+
+    return {
+      isSuppressed: suppressingParents.length > 0,
+      suppressingParents,
+    };
+  }
+
+  // Delegates kept so callers and tests have one server-side entry point.
+  public static getSuppressingParents(input: {
+    parents: Array<ParentMonitorStatusRef>;
+    configuredSuppressionStatusIds: Set<string>;
+  }): Array<SuppressingParent> {
+    return MonitorDependencyRule.getSuppressingParents(input);
+  }
+
+  public static buildSuppressionReason(
+    suppressingParents: Array<SuppressingParent>,
+  ): string {
+    return MonitorDependencyRule.buildSuppressionReason(suppressingParents);
+  }
+}

package/Server/Utils/Monitor/MonitorIncident.ts

@@ -44,6 +44,9 @@ import logger, { LogAttributes } from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import DataToProcess from "./DataToProcess";
 import MonitorTemplateUtil from "./MonitorTemplateUtil";
+import MonitorDependencySuppression, {
+  DependencySuppressionResult,
+} from "./MonitorDependencySuppression";
 import { JSONObject } from "../../../Types/JSON";
 import OneUptimeDate from "../../../Types/Date";
 import MonitorEvaluationSummary from "../../../Types/Monitor/MonitorEvaluationSummary";
@@ -288,6 +291,14 @@ export default class MonitorIncident {
      * are suppressed at creation time. See MonitorMaintenanceSuppression.
      */
     suppressedSeriesFingerprints?: Set<string> | undefined;
+    /**
+     * Alert-dependency suppression: when set and isSuppressed, a parent
+     * monitor this monitor depends on is currently in a suppressing
+     * status, so ALL incident creation for this evaluation is skipped.
+     * Only creation — already-open incidents still follow the normal
+     * resolve path above. See MonitorDependencySuppression.
+     */
+    dependencySuppression?: DependencySuppressionResult | undefined;
     /**
      * Event-driven monitors (incoming-request / webhook fan-out) must not
      * use the metric snapshot model where a series absent from this tick's
@@ -342,6 +353,35 @@ export default class MonitorIncident {
       return;
     }
 
+    /*
+     * Alert-dependency suppression: a parent monitor is in a suppressing
+     * status (offline by default), so skip creating any incident for this
+     * evaluation. Placed after the open-incident resolve pass above on
+     * purpose — an incident raised before the parent went down must still
+     * resolve normally; only new creation is silenced.
+     */
+    if (input.dependencySuppression?.isSuppressed) {
+      const suppressionReason: string =
+        MonitorDependencySuppression.buildSuppressionReason(
+          input.dependencySuppression.suppressingParents,
+        );
+
+      logger.debug(
+        `${input.monitor.id?.toString()} - Skipping incident creation: ${suppressionReason}.`,
+        incidentLogAttributes,
+      );
+
+      input.evaluationSummary?.events.push({
+        type: "incident-skipped",
+        title: "Incident suppressed by monitor dependency",
+        message: `Skipped creating incidents because ${suppressionReason}. This monitor's status still updates normally; open incidents still auto-resolve.`,
+        relatedCriteriaId: input.criteriaInstance.data?.id,
+        at: OneUptimeDate.getCurrentDate(),
+      });
+
+      return;
+    }
+
     /*
      * Proxmox/Ceph monitors: resolve the monitored cluster once per
      * evaluation (lookup-only, from the step config's clusterIdentifier)

package/Server/Utils/Monitor/MonitorMetricUtil.ts

@@ -1,6 +1,7 @@
 import logger from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import TelemetryUtil from "../Telemetry/Telemetry";
+import MetricResourceAttributeUtil from "../../../Utils/Metrics/MetricResourceAttributeUtil";
 import MetricService from "../../Services/MetricService";
 import GlobalConfigService from "../../Services/GlobalConfigService";
 import GlobalConfig from "../../../Models/DatabaseModels/GlobalConfig";
@@ -8,6 +9,7 @@ import DataToProcess from "./DataToProcess";
 import { MetricPointType } from "../../../Models/AnalyticsModels/Metric";
 import ServiceType from "../../../Types/Telemetry/ServiceType";
 import MetricType from "../../../Models/DatabaseModels/MetricType";
+import Label from "../../../Models/DatabaseModels/Label";
 import BasicInfrastructureMetrics, {
   NetworkInterfaceMetrics,
 } from "../../../Types/Infrastructure/BasicMetrics";
@@ -234,6 +236,47 @@ export default class MonitorMetricUtil {
     data.metricNameServiceNameMap[data.metricName] = metricType;
   }
 
+  /**
+   * Stamp every metric row produced by one monitor check with the monitor's
+   * label and custom field attributes.
+   *
+   * Done as a single pass over the finished rows rather than threaded through
+   * the ~30 emission sites below: every metric from one check describes the
+   * same monitor, so there is nothing per-metric to decide, and one pass is
+   * far easier to keep correct than thirty call sites.
+   *
+   * Resource attributes are merged LAST. Custom code monitors let a user
+   * supply their own attribute names, and those must not be able to shadow the
+   * oneuptime.* namespace.
+   */
+  public static applyResourceAttributesToMetricRows(data: {
+    metricRows: Array<JSONObject>;
+    labels?: Array<Label> | undefined;
+    customFields?: JSONObject | undefined;
+  }): void {
+    const resourceAttributes: JSONObject =
+      MetricResourceAttributeUtil.getResourceAttributes({
+        labels: data.labels,
+        customFields: data.customFields,
+      });
+
+    if (Object.keys(resourceAttributes).length === 0) {
+      // Nothing to stamp; leave the rows (and their attributeKeys) untouched.
+      return;
+    }
+
+    for (const metricRow of data.metricRows) {
+      const attributes: JSONObject =
+        MetricResourceAttributeUtil.mergeResourceAttributes(
+          (metricRow["attributes"] as JSONObject) || {},
+          resourceAttributes,
+        );
+
+      metricRow["attributes"] = attributes;
+      metricRow["attributeKeys"] = TelemetryUtil.getAttributeKeys(attributes);
+    }
+  }
+
   @CaptureSpan()
   public static async saveMonitorMetrics(data: {
     monitorId: ObjectID;
@@ -241,6 +284,15 @@ export default class MonitorMetricUtil {
     dataToProcess: DataToProcess;
     probeName: string | undefined;
     monitorName: string | undefined;
+    /*
+     * The monitor's own taxonomy, passed in by the caller which has already
+     * loaded the monitor — this is the hottest Postgres path in the product,
+     * so nothing here re-reads it. Both are optional: callers that do not
+     * select them simply record no oneuptime.label.* / oneuptime.customField.*
+     * attributes.
+     */
+    monitorLabels?: Array<Label> | undefined;
+    monitorCustomFields?: JSONObject | undefined;
   }): Promise<void> {
     if (!data.monitorId) {
       return;
@@ -1340,6 +1392,12 @@ export default class MonitorMetricUtil {
       metricNameServiceNameMap[prefixedName] = metricType;
     }
 
+    this.applyResourceAttributesToMetricRows({
+      metricRows: metricRows,
+      labels: data.monitorLabels,
+      customFields: data.monitorCustomFields,
+    });
+
     if (metricRows.length > 0) {
       await MetricService.insertJsonRows(metricRows);
     }

package/Server/Utils/Monitor/MonitorResource.ts

@@ -45,6 +45,9 @@ import MonitorSummaryCapture from "./MonitorSummaryCapture";
 import MonitorSummarySnapshot from "../../../Types/Monitor/MonitorSummarySnapshot";
 import IncomingRequestIncidentGrouping from "./IncomingRequestIncidentGrouping";
 import MonitorMaintenanceSuppression from "./MonitorMaintenanceSuppression";
+import MonitorDependencySuppression, {
+  DependencySuppressionResult,
+} from "./MonitorDependencySuppression";
 import MonitorStatusTimelineUtil from "./MonitorStatusTimeline";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import ExceptionMessages from "../../../Types/Exception/ExceptionMessages";
@@ -138,6 +141,33 @@ export default class MonitorResourceUtil {
         _id: true,
         name: true,
         minimumProbeAgreement: true,
+        /*
+         * Recorded as oneuptime.label.* / oneuptime.customField.* attributes on
+         * every monitor metric this result produces, so response time and
+         * uptime are groupable by a project's own taxonomy. Selected here
+         * rather than re-read inside MonitorMetricUtil: this is the hottest
+         * Postgres path in the product and it already loads the monitor.
+         */
+        labels: {
+          _id: true,
+          name: true,
+        },
+        customFields: true,
+        /*
+         * Alert-dependency suppression inputs. Selected here for the same
+         * reason as labels: this query already loads the monitor on the
+         * hottest path, and both lists are empty for the overwhelming
+         * majority of monitors, in which case suppression costs nothing.
+         * Ids only — names are fetched by the suppression util's own
+         * parents query, so selecting them here would just duplicate the
+         * joined row payload on every evaluation.
+         */
+        dependsOnMonitors: {
+          _id: true,
+        },
+        suppressAlertsWhenParentMonitorStatuses: {
+          _id: true,
+        },
       },
       props: {
         isRoot: true,
@@ -480,6 +510,8 @@ export default class MonitorResourceUtil {
           dataToProcess: dataToProcess,
           probeName: probeName || undefined,
           monitorName: monitorName || undefined,
+          monitorLabels: monitor.labels || undefined,
+          monitorCustomFields: monitor.customFields || undefined,
         });
       } catch (err) {
         logger.error("Unable to save metrics");
@@ -903,6 +935,22 @@ export default class MonitorResourceUtil {
             matchesPerSeries: response.perSeriesMatches,
           });
 
+        /*
+         * Alert-dependency suppression: if any parent monitor this monitor
+         * depends on is currently in a suppressing status (offline by
+         * default), skip creating incidents/alerts for this evaluation.
+         * Deliberately computed AFTER the status timeline update above —
+         * the child's own status must keep tracking reality (status pages,
+         * transitive dependency checks); only the redundant paging is
+         * silenced. The resolve path for already-open incidents/alerts is
+         * likewise untouched. Zero queries when the monitor has no
+         * dependencies configured.
+         */
+        const dependencySuppression: DependencySuppressionResult =
+          await MonitorDependencySuppression.getDependencySuppression({
+            monitor: monitor,
+          });
+
         /*
          * Freeze the Monitor Summary as it stands right now, before any
          * incident or alert is created from it. Both creators store the
@@ -931,6 +979,7 @@ export default class MonitorResourceUtil {
           },
           matchesPerSeries: response.perSeriesMatches,
           suppressedSeriesFingerprints,
+          dependencySuppression,
           /*
            * Incoming-request grouping is event-driven: a webhook describes
            * only the keys in its payload, so absence from this tick is not
@@ -955,6 +1004,7 @@ export default class MonitorResourceUtil {
           },
           matchesPerSeries: response.perSeriesMatches,
           suppressedSeriesFingerprints,
+          dependencySuppression,
           /*
            * Incoming-request grouping is event-driven (see the incident
            * create call above): skip the snapshot absence-resolve pass for