@oneuptime/common 14.0.6 → 14.0.7

package/Server/Services/IncidentService.ts

@@ -24,7 +24,9 @@ import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import TeamMemberService from "./TeamMemberService";
 import UserService from "./UserService";
 import URL from "../../Types/API/URL";
-import { getSloAffectedResourceMarkdownLines } from "../../Utils/Slo/SloAffectedResourceMarkdown";
+import LinkedAffectedResources, {
+  LinkedAffectedResource,
+} from "../Utils/AffectedResources/LinkedAffectedResources";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
@@ -112,9 +114,14 @@ import IncidentAIContextBuilder, {
   IncidentContextData,
 } from "../Utils/AI/IncidentAIContextBuilder";
 import IncidentAlertService, {
+  AcknowledgeDeclaredAlertsResult,
+  AlertsToAcknowledgeOnDeclare,
   LinkAlertsToIncidentResult,
 } from "./IncidentAlertService";
-import { INCIDENT_ALERT_IDS_TO_LINK_KEY } from "../../Types/Incident/IncidentAlertLink";
+import {
+  INCIDENT_ACKNOWLEDGE_ALERTS_TO_LINK_KEY,
+  INCIDENT_ALERT_IDS_TO_LINK_KEY,
+} from "../../Types/Incident/IncidentAlertLink";
 
 // key is incidentId for this dictionary.
 type UpdateCarryForward = Dictionary<{
@@ -131,6 +138,14 @@ type UpdateCarryForward = Dictionary<{
 type IncidentCreateCarryForward = {
   // Validated, deduplicated alert ids to link once the incident exists.
   alertIdsToLink: Array<ObjectID>;
+  /*
+   * Acknowledge alerts once they are linked, as the declaring user
+   * (INCIDENT_ACKNOWLEDGE_ALERTS_TO_LINK_KEY) - what stops their escalation.
+   * When asked to: the project's Acknowledged alert state, and the alerts
+   * not acknowledged yet, which the caller was checked for. Null otherwise.
+   */
+  acknowledgedAlertStateId: ObjectID | null;
+  alertIdsToAcknowledge: Array<ObjectID>;
 } | null;
 
 type IncidentUpdatePayload = {
@@ -809,14 +824,36 @@ export class Service extends DatabaseService<Model> {
     const alertIdsToLink: unknown =
       createBy.miscDataProps?.[INCIDENT_ALERT_IDS_TO_LINK_KEY];
 
-    if (alertIdsToLink !== undefined && alertIdsToLink !== null) {
-      carryForward = {
-        alertIdsToLink:
-          await IncidentAlertService.validateAlertIdsForNewIncident({
+    const validatedAlertIds: Array<ObjectID> =
+      alertIdsToLink !== undefined && alertIdsToLink !== null
+        ? await IncidentAlertService.validateAlertIdsForNewIncident({
             projectId: projectId,
             alertIds: alertIdsToLink,
             props: createBy.props,
-          }),
+          })
+        : [];
+
+    /*
+     * Asking to acknowledge the alerts is checked here too, with the alert
+     * ids, so a request that cannot be honoured (no Acknowledged alert state,
+     * or a caller who may not change these alerts' states) is refused before
+     * the incident exists rather than leaving alerts that keep paging.
+     */
+    const alertsToAcknowledge: AlertsToAcknowledgeOnDeclare | null =
+      await IncidentAlertService.validateAcknowledgeAlertsForNewIncident({
+        projectId: projectId,
+        acknowledgeAlerts:
+          createBy.miscDataProps?.[INCIDENT_ACKNOWLEDGE_ALERTS_TO_LINK_KEY],
+        alertIds: validatedAlertIds,
+        props: createBy.props,
+      });
+
+    if (validatedAlertIds.length > 0) {
+      carryForward = {
+        alertIdsToLink: validatedAlertIds,
+        acknowledgedAlertStateId:
+          alertsToAcknowledge?.acknowledgedAlertStateId || null,
+        alertIdsToAcknowledge: alertsToAcknowledge?.alertIdsToAcknowledge || [],
       };
     }
 
@@ -1272,20 +1309,10 @@ export class Service extends DatabaseService<Model> {
         labels: {
           name: true,
         },
-        monitors: {
-          name: true,
-          _id: true,
-        },
         /*
-         * Named under "Resources Affected" in the created feed item. This read
-         * runs as root, so projectId comes along and the feed names only this
-         * project's SLOs (getSloAffectedResourceMarkdownLines).
+         * The resources named under "Resources Affected" are read by the feed
+         * builder itself (LinkedAffectedResources), one relation at a time.
          */
-        serviceLevelObjectives: {
-          name: true,
-          _id: true,
-          projectId: true,
-        },
       },
       props: {
         isRoot: true,
@@ -1744,6 +1771,24 @@ export class Service extends DatabaseService<Model> {
     return carryForward?.alertIdsToLink || [];
   }
 
+  /*
+   * The alerts the declaration asked to acknowledge that were not
+   * acknowledged yet when it was checked - the only ones the caller was
+   * authorized for, so the only ones that may be written.
+   */
+  private getAlertIdsToAcknowledgeDeclaredWith(
+    onCreate: OnCreate<Model>,
+  ): Array<ObjectID> {
+    const carryForward: IncidentCreateCarryForward =
+      (onCreate.carryForward as IncidentCreateCarryForward) || null;
+
+    if (!carryForward?.acknowledgedAlertStateId) {
+      return [];
+    }
+
+    return carryForward.alertIdsToAcknowledge || [];
+  }
+
   /*
    * Who declared the incident, as "Linked by" on the links and the actor of
    * their feed entries. A user is recorded as themselves and an API key as
@@ -1778,6 +1823,13 @@ export class Service extends DatabaseService<Model> {
    * the incident's title when the incident is private, and a rule can make
    * it private after it was saved. (The alerts' owners are added to a private
    * incident later in the chain, once its workspace channels exist.)
+   *
+   * When the declaration asked for it, the alerts are then acknowledged as
+   * the declaring user, which stops their on-call escalation at the
+   * workers' next run. That is not waited for: each acknowledgement is a
+   * full state change (feed entry, Slack / Microsoft Teams post, owner
+   * notification), up to one per alert, and the page the user lands on does
+   * not show the alerts' states. It never fails the incident.
    */
   @CaptureSpan()
   private async linkAlertsDeclaredWithIncident(
@@ -1793,6 +1845,8 @@ export class Service extends DatabaseService<Model> {
 
     await privacyRulesApplied;
 
+    let linkedAlertIds: Array<ObjectID> = [];
+
     try {
       const result: LinkAlertsToIncidentResult =
         await IncidentAlertService.linkAlertsToIncident({
@@ -1806,6 +1860,11 @@ export class Service extends DatabaseService<Model> {
           },
         });
 
+      linkedAlertIds = [
+        ...result.linkedAlertIds,
+        ...result.alreadyLinkedAlertIds,
+      ];
+
       if (result.failed.length > 0) {
         logger.error(
           `${result.failed.length} of ${alertIds.length} alerts could not be linked to the incident they were declared with.`,
@@ -1824,6 +1883,44 @@ export class Service extends DatabaseService<Model> {
         } as LogAttributes,
       );
     }
+
+    const alertIdsToAcknowledge: Array<ObjectID> =
+      this.getAlertIdsToAcknowledgeDeclaredWith(onCreate);
+
+    if (alertIdsToAcknowledge.length === 0) {
+      return;
+    }
+
+    const projectId: ObjectID = createdItem.projectId;
+    const incidentId: ObjectID = createdItem.id;
+
+    IncidentAlertService.acknowledgeAlertsDeclaredWithIncident({
+      projectId: projectId,
+      incidentId: incidentId,
+      alertIds: alertIdsToAcknowledge,
+      linkedAlertIds: linkedAlertIds,
+      acknowledgedByUserId: this.getDeclaringUserId(onCreate, createdItem),
+    })
+      .then((acknowledged: AcknowledgeDeclaredAlertsResult) => {
+        if (acknowledged.failed.length > 0) {
+          logger.error(
+            `${acknowledged.failed.length} of ${alertIdsToAcknowledge.length} alerts could not be acknowledged when the incident was declared from them.`,
+            {
+              projectId: projectId.toString(),
+              incidentId: incidentId.toString(),
+            } as LogAttributes,
+          );
+        }
+      })
+      .catch((error: Error) => {
+        logger.error(
+          `Acknowledging the alerts an incident was declared from failed in IncidentService.onCreateSuccess: ${error}`,
+          {
+            projectId: projectId.toString(),
+            incidentId: incidentId.toString(),
+          } as LogAttributes,
+        );
+      });
   }
 
   @CaptureSpan()
@@ -1905,35 +2002,28 @@ ${incident.description || "No description provided."}
       }
 
       /*
-       * Monitors, then the SLOs this incident is linked to. A burn-rate
-       * incident carries no monitors on purpose, so its SLO is the only
-       * resource there is to name - and the feed's only way back to the
-       * objective that declared it. The SLO link is built inline:
-       * ServiceLevelObjectiveService cannot be imported here (it reaches
-       * this service through the burn-rate rule service).
+       * Everything the incident's Affected Resources card lists: monitors,
+       * the hosts, clusters and services it is attached to, then its SLOs. A
+       * burn-rate incident carries no monitors on purpose, so its SLO is the
+       * only resource there is to name - and the feed's only way back to the
+       * objective that declared it.
        */
-      const sloLines: Array<string> =
-        incident.serviceLevelObjectives &&
-        incident.serviceLevelObjectives.length > 0
-          ? getSloAffectedResourceMarkdownLines({
-              dashboardUrl: await DatabaseConfig.getDashboardUrl(),
-              projectId: incident.projectId!,
-              serviceLevelObjectives: incident.serviceLevelObjectives,
-            })
-          : [];
+      const resources: Array<LinkedAffectedResource> =
+        await LinkedAffectedResources.readForIncident({
+          service: this,
+          projectId: incident.projectId!,
+          incidentId: incident.id!,
+        });
 
-      if (
-        (incident.monitors && incident.monitors.length > 0) ||
-        sloLines.length > 0
-      ) {
+      if (resources.length > 0) {
         feedInfoInMarkdown += `🌎 **Resources Affected**:\n`;
 
-        for (const monitor of incident.monitors || []) {
-          feedInfoInMarkdown += `- [${monitor.name}](${(await MonitorService.getMonitorLinkInDashboard(incident.projectId!, monitor.id!)).toString()})\n`;
-        }
-
-        for (const sloLine of sloLines) {
-          feedInfoInMarkdown += `${sloLine}\n`;
+        for (const resourceLine of LinkedAffectedResources.getMarkdownLines({
+          dashboardUrl: await DatabaseConfig.getDashboardUrl(),
+          projectId: incident.projectId!,
+          resources: resources,
+        })) {
+          feedInfoInMarkdown += `${resourceLine}\n`;
         }
 
         feedInfoInMarkdown += `\n\n`;

package/Server/Services/InventoryItemService.ts

@@ -10,6 +10,8 @@ import ColumnLength from "../../Types/Database/ColumnLength";
 import QueryDeepPartialEntity from "../../Types/Database/PartialEntity";
 import CreateBy from "../Types/Database/CreateBy";
 import { OnCreate } from "../Types/Database/Hooks";
+import { AggregateRow } from "../Types/Database/AggregateBy";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Dictionary from "../../Types/Dictionary";
 import { JSONObject } from "../../Types/JSON";
@@ -22,6 +24,12 @@ import {
   MANUAL_ENTITY_IDENTITY_ATTRIBUTE,
 } from "../../Utils/Telemetry/EntityKey";
 import logger from "../Utils/Logger";
+import {
+  INVENTORY_OVERVIEW_GROUP_BY,
+  INVENTORY_OVERVIEW_SELECT,
+  InventoryOverviewCounts,
+  readInventoryOverviewGroups,
+} from "../Utils/Inventory/InventoryOverviewAggregation";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { ExtractedEntity } from "../Utils/Telemetry/TelemetryEntity";
 import {
@@ -147,6 +155,36 @@ export class InventoryItemService extends DatabaseService<Model> {
     return { createBy, carryForward: null };
   }
 
+  /**
+   * The Inventory Overview's tiles and per-type breakdown, counted over the
+   * project's whole unarchived estate. See INVENTORY_OVERVIEW_SELECT.
+   *
+   * Archived rows are excluded because every tile drills into the live Items
+   * list, which excludes them too.
+   *
+   * The GROUP BY carries no limit: capping it would cap the totals summed
+   * from it. The number of groups is bounded by the entity-type vocabulary —
+   * ingest maps to a fixed set of types, manual creates are confined to
+   * MANUAL_ENTITY_TYPES, and the column is not updatable.
+   */
+  @CaptureSpan()
+  public async getOverviewCounts(data: {
+    projectId: ObjectID;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<InventoryOverviewCounts> {
+    const rows: Array<AggregateRow> = await this.aggregateBy({
+      query: {
+        projectId: data.projectId,
+        isArchived: false,
+      },
+      groupBy: INVENTORY_OVERVIEW_GROUP_BY,
+      select: INVENTORY_OVERVIEW_SELECT,
+      props: data.props,
+    });
+
+    return readInventoryOverviewGroups(rows);
+  }
+
   /**
    * Forward-only registry reconciliation: upsert a catalog row per
    * discovered entity, bump `lastSeenAt`, merge descriptive attributes

package/Server/Services/IoTDeviceCredentialService.ts

@@ -204,14 +204,23 @@ export class Service extends DatabaseService<Model> {
       return cached;
     }
 
-    let idObject: ObjectID;
-    try {
-      idObject = new ObjectID(credentialId);
-    } catch {
+    /*
+     * Validated rather than caught. ObjectID's constructor stores whatever
+     * string it is handed and never throws, so the try/catch this replaced
+     * caught nothing: a malformed id reached Postgres as an invalid uuid
+     * literal, which errors on every attempt AND skipped the negative cache
+     * below, because the row was never absent - the query failed. credentialId
+     * is an MQTT username, so it is attacker-controlled, and that made the
+     * negative cache bypassable with random garbage. Same guard, and the same
+     * reason for it, as ProjectAuthorization's API-key check.
+     */
+    if (!ObjectID.isValidUUID(credentialId)) {
       this.contextCache.set(credentialId, null, NEGATIVE_TTL_MS);
       return null;
     }
 
+    const idObject: ObjectID = new ObjectID(credentialId);
+
     const credential: Model | null = await this.findOneBy({
       query: { _id: idObject },
       select: {

package/Server/Services/ScheduledMaintenanceService.ts

@@ -9,6 +9,10 @@ import DatabaseService from "./DatabaseService";
 import ScheduledMaintenanceCustomField from "../../Models/DatabaseModels/ScheduledMaintenanceCustomField";
 import CustomFieldMappingService from "./CustomFieldMappingService";
 import MonitorService from "./MonitorService";
+import LinkedAffectedResources, {
+  LinkedAffectedResource,
+  LinkedAffectedResourceRelation,
+} from "../Utils/AffectedResources/LinkedAffectedResources";
 import ScheduledMaintenanceOwnerTeamService from "./ScheduledMaintenanceOwnerTeamService";
 import ScheduledMaintenanceOwnerUserService from "./ScheduledMaintenanceOwnerUserService";
 import ScheduledMaintenanceStateService from "./ScheduledMaintenanceStateService";
@@ -1180,10 +1184,6 @@ ${resourcesAffected ? `**Resources Affected:** ${resourcesAffected}` : ""}
         },
         startsAt: true,
         endsAt: true,
-        monitors: {
-          name: true,
-          _id: true,
-        },
         labels: {
           name: true,
         },
@@ -1448,14 +1448,23 @@ ${scheduledMaintenance.description || "No description provided."}
         feedInfoInMarkdown += `⏳ **Scheduled Maintenance State**: ${scheduledMaintenance.currentScheduledMaintenanceState.name} \n\n`;
       }
 
-      if (
-        scheduledMaintenance.monitors &&
-        scheduledMaintenance.monitors.length > 0
-      ) {
+      // Everything the event's Affected Resources card lists, monitors first.
+      const resources: Array<LinkedAffectedResource> =
+        await LinkedAffectedResources.readForScheduledMaintenance({
+          service: this,
+          projectId: scheduledMaintenance.projectId!,
+          scheduledMaintenanceId: scheduledMaintenance.id!,
+        });
+
+      if (resources.length > 0) {
         feedInfoInMarkdown += `🌎 **Resources Affected**:\n`;
 
-        for (const monitor of scheduledMaintenance.monitors) {
-          feedInfoInMarkdown += `- [${monitor.name}](${(await MonitorService.getMonitorLinkInDashboard(scheduledMaintenance.projectId!, monitor.id!)).toString()})\n`;
+        for (const resourceLine of LinkedAffectedResources.getMarkdownLines({
+          dashboardUrl: await DatabaseConfig.getDashboardUrl(),
+          projectId: scheduledMaintenance.projectId!,
+          resources: resources,
+        })) {
+          feedInfoInMarkdown += `${resourceLine}\n`;
         }
 
         feedInfoInMarkdown += `\n\n`;
@@ -1820,47 +1829,42 @@ ${(
           shouldAddScheduledMaintenanceFeed = true;
         }
 
-        if (
-          onUpdate.updateBy.data.monitors &&
-          onUpdate.updateBy.data.monitors.length > 0 &&
-          Array.isArray(onUpdate.updateBy.data.monitors)
-        ) {
-          const monitorIds: Array<ObjectID> = (
-            onUpdate.updateBy.data.monitors as any
-          )
-            .map((monitor: Label) => {
-              if (monitor._id) {
-                return new ObjectID(monitor._id?.toString());
-              }
+        /*
+         * Any affected-resource list in the payload - not only monitors - is
+         * a change to what the event affects. The event is read back rather
+         * than the ids in the payload being looked up: the read is held to
+         * this project, and it names the whole list the card now shows.
+         */
+        const affectedResourcesChanged: boolean =
+          LinkedAffectedResources.getRelations(this.getModel()).some(
+            (relation: LinkedAffectedResourceRelation): boolean => {
+              const value: unknown = (
+                onUpdate.updateBy.data as Record<string, unknown>
+              )[relation.column];
+
+              return Array.isArray(value) && value.length > 0;
+            },
+          );
 
-              return null;
-            })
-            .filter((monitorId: ObjectID | null) => {
-              return monitorId !== null;
-            });
+        if (affectedResourcesChanged && onUpdate.updateBy.props.tenantId) {
+          const projectId: ObjectID = onUpdate.updateBy.props
+            .tenantId as ObjectID;
 
-          const monitors: Array<Label> = await MonitorService.findBy({
-            query: {
-              _id: QueryHelper.any(monitorIds),
-            },
-            select: {
-              name: true,
-            },
-            limit: LIMIT_PER_PROJECT,
-            skip: 0,
-            props: {
-              isRoot: true,
-            },
-          });
+          const resources: Array<LinkedAffectedResource> =
+            await LinkedAffectedResources.readForScheduledMaintenance({
+              service: this,
+              projectId: projectId,
+              scheduledMaintenanceId: scheduledMaintenanceId,
+            });
 
-          if (monitors.length > 0) {
+          if (resources.length > 0) {
             feedInfoInMarkdown += `\n\n**Resources Affected**:
 
-${monitors
-  .map((monitor: Monitor) => {
-    return `- ${monitor.name}`;
-  })
-  .join("\n")}
+${LinkedAffectedResources.getMarkdownLines({
+  dashboardUrl: await DatabaseConfig.getDashboardUrl(),
+  projectId: projectId,
+  resources: resources,
+}).join("\n")}
 `;
 
             shouldAddScheduledMaintenanceFeed = true;

package/Server/Services/UserNotificationRuleService.ts

@@ -10,6 +10,8 @@ import Markdown, { MarkdownContentType } from "../Types/Markdown";
 import CallService from "./CallService";
 import DatabaseService from "./DatabaseService";
 import IncidentService from "./IncidentService";
+import LinkedAffectedResources from "../Utils/AffectedResources/LinkedAffectedResources";
+import SeriesLabelDisplay from "../../Types/Monitor/SeriesContext/SeriesLabelDisplay";
 import IncidentSeverityService from "./IncidentSeverityService";
 import MailService from "./MailService";
 import ProjectCallSMSConfigService from "./ProjectCallSMSConfigService";
@@ -983,15 +985,10 @@ export class Service extends DatabaseService<Model> {
           incidentNumber: true,
           incidentNumberWithPrefix: true,
           /*
-           * AcknowledgeIncident.hbs asks for a Resources Affected row and
-           * the generator had nothing to build it from, so the row was
-           * silently dropped — the same `{{#if}}` swallow that hid the
-           * alert's Root Cause.
+           * No relations here: AcknowledgeIncident.hbs's Resources Affected
+           * row is built from every resource the incident is linked to,
+           * which generateEmailTemplateForIncidentCreated reads itself.
            */
-          monitors: {
-            _id: true,
-            name: true,
-          },
         },
       });
     }
@@ -1031,11 +1028,13 @@ export class Service extends DatabaseService<Model> {
            * select it.
            */
           rootCause: true,
-          // Same story for the template's Resources Affected row.
-          monitor: {
-            _id: true,
-            name: true,
-          },
+          /*
+           * The series a grouped monitor raised this alert for (the pod or
+           * container), which the Resources Affected row names in place of
+           * the monitor - as the alert owner emails do. The linked resources
+           * themselves are read by generateEmailTemplateForAlertCreated.
+           */
+          seriesLabels: true,
         },
       });
     }
@@ -4613,7 +4612,22 @@ export class Service extends DatabaseService<Model> {
         MarkdownContentType.Email,
       ),
       alertSeverity: alert.alertSeverity!.name!,
-      resourcesAffected: alert.monitor?.name || "No resources identified",
+      /*
+       * Every resource the alert's Affected Resources card lists. An SLO
+       * burn-rate alert has no monitor, and this used to read "No resources
+       * identified" beside a card naming its SLO.
+       */
+      resourcesAffected: LinkedAffectedResources.getText({
+        resources: await LinkedAffectedResources.readForAlert({
+          service: AlertService,
+          projectId: alert.projectId!,
+          alertId: alert.id!,
+        }),
+        seriesSummary: SeriesLabelDisplay.buildInlineSummary(
+          alert.seriesLabels,
+        ),
+        fallback: "No resources identified",
+      }),
       rootCause: await Markdown.convertToHTML(
         alert.rootCause || "No root cause identified for this alert",
         MarkdownContentType.Email,
@@ -4664,15 +4678,15 @@ export class Service extends DatabaseService<Model> {
         MarkdownContentType.Email,
       ),
       incidentSeverity: incident.incidentSeverity!.name!,
-      resourcesAffected:
-        (incident.monitors || [])
-          .map((monitor: Monitor): string => {
-            return monitor.name || "";
-          })
-          .filter((name: string): boolean => {
-            return name.length > 0;
-          })
-          .join(", ") || "No resources identified",
+      // Every resource the incident's Affected Resources card lists.
+      resourcesAffected: LinkedAffectedResources.getText({
+        resources: await LinkedAffectedResources.readForIncident({
+          service: IncidentService,
+          projectId: incident.projectId!,
+          incidentId: incident.id!,
+        }),
+        fallback: "No resources identified",
+      }),
       rootCause: await Markdown.convertToHTML(
         incident.rootCause || "No root cause identified for this incident",
         MarkdownContentType.Email,
@@ -4762,18 +4776,15 @@ export class Service extends DatabaseService<Model> {
           })
         : [];
 
-    // Get unique monitors (resources affected)
-    const monitorNames: Set<string> = new Set();
-    for (const alert of alerts) {
-      if (alert.monitor?.name) {
-        monitorNames.add(alert.monitor.name);
-      }
-    }
-
-    const resourcesAffected: string =
-      monitorNames.size > 0
-        ? Array.from(monitorNames).join(", ")
-        : "No resources identified";
+    // Every resource any alert in the episode is linked to, each named once.
+    const resourcesAffected: string = LinkedAffectedResources.getText({
+      resources: await LinkedAffectedResources.readForAlerts({
+        service: AlertService,
+        projectId: alertEpisode.projectId!,
+        alertIds: alertIds,
+      }),
+      fallback: "No resources identified",
+    });
 
     // Build alerts list HTML with proper email styling
     let alertsListHtml: string = "";
@@ -4933,24 +4944,15 @@ export class Service extends DatabaseService<Model> {
           })
         : [];
 
-    /*
-     * Unique monitors across every incident in the episode. An incident carries
-     * a list of monitors (unlike an alert, which has exactly one), so this
-     * flattens rather than reading a single relation.
-     */
-    const monitorNames: Set<string> = new Set();
-    for (const incident of incidents) {
-      for (const monitor of incident.monitors || []) {
-        if (monitor.name) {
-          monitorNames.add(monitor.name);
-        }
-      }
-    }
-
-    const resourcesAffected: string =
-      monitorNames.size > 0
-        ? Array.from(monitorNames).join(", ")
-        : "No resources identified";
+    // Every resource any incident in the episode is linked to, each named once.
+    const resourcesAffected: string = LinkedAffectedResources.getText({
+      resources: await LinkedAffectedResources.readForIncidents({
+        service: IncidentService,
+        projectId: incidentEpisode.projectId!,
+        incidentIds: incidentIds,
+      }),
+      fallback: "No resources identified",
+    });
 
     // Build incidents list HTML with proper email styling
     let incidentsListHtml: string = "";