45 lines
1.1 KiB
Python
45 lines
1.1 KiB
Python
import yaml
|
|
|
|
with open("correlation/rules.yaml") as f:
|
|
RULES = yaml.safe_load(f)
|
|
|
|
def correlate(alert):
|
|
service = alert["service"]
|
|
rules = RULES["services"].get(service, {})
|
|
return {
|
|
"service": service,
|
|
"severity": alert["severity"],
|
|
"metrics": alert["metrics"],
|
|
"depends_on": rules.get("depends_on", []),
|
|
"impact": rules.get("impact", [])
|
|
}
|
|
|
|
def evaluate(rules: list, metrics: dict):
|
|
incidents = []
|
|
|
|
for rule in rules:
|
|
matched = True
|
|
|
|
for metric, condition in rule["when"].items():
|
|
value = metrics.get(metric)
|
|
|
|
if value is None:
|
|
matched = False
|
|
break
|
|
|
|
if "gt" in condition and value <= condition["gt"]:
|
|
matched = False
|
|
|
|
if "lt" in condition and value >= condition["lt"]:
|
|
matched = False
|
|
|
|
if matched:
|
|
incidents.append({
|
|
"id": rule["id"],
|
|
"severity": rule["severity"],
|
|
"impact": rule["impact"],
|
|
"metrics": metrics,
|
|
})
|
|
|
|
return incidents
|