API access for get_incident_alerts

keep/api/core/db.py

@@ -2839,6 +2839,7 @@ def get_incident_alerts_and_links_by_incident_id(
     limit: Optional[int] = None,
     offset: Optional[int] = None,
     session: Optional[Session] = None,
+    include_unlinked: bool = False,
 ) -> tuple[List[tuple[Alert, AlertToIncident]], int]:
     with existed_or_new_session(session) as session:
         query = (
@@ -2849,12 +2850,15 @@ def get_incident_alerts_and_links_by_incident_id(
             .join(AlertToIncident, AlertToIncident.alert_id == Alert.id)
             .join(Incident, AlertToIncident.incident_id == Incident.id)
             .filter(
-                AlertToIncident.deleted_at.is_(None),
                 AlertToIncident.tenant_id == tenant_id,
                 Incident.id == incident_id,
             )
             .order_by(col(Alert.timestamp).desc())
         )
+        if not include_unlinked:
+            query = query.filter(
+                AlertToIncident.deleted_at.is_(None),
+            )
 
     total_count = query.count()
 
@@ -2950,6 +2954,7 @@ def add_alerts_to_incident_by_incident_id(
     tenant_id: str,
     incident_id: str | UUID,
     alert_ids: List[UUID],
+    is_created_by_ai: bool = False,
     session: Optional[Session] = None,
 ) -> Optional[Incident]:
     with existed_or_new_session(session) as session:
@@ -2961,13 +2966,14 @@ def add_alerts_to_incident_by_incident_id(
 
         if not incident:
             return None
-        return add_alerts_to_incident(tenant_id, incident, alert_ids, session)
+        return add_alerts_to_incident(tenant_id, incident, alert_ids, is_created_by_ai, session)
 
 
 def add_alerts_to_incident(
     tenant_id: str,
     incident: Incident,
     alert_ids: List[UUID],
+    is_created_by_ai: bool = False,
     session: Optional[Session] = None,
 ) -> Optional[Incident]:
     logger.info(
@@ -3008,7 +3014,7 @@ def add_alerts_to_incident(
 
             alert_to_incident_entries = [
                 AlertToIncident(
-                    alert_id=alert_id, incident_id=incident.id, tenant_id=tenant_id
+                    alert_id=alert_id, incident_id=incident.id, tenant_id=tenant_id, is_created_by_ai=is_created_by_ai
                 )
                 for alert_id in new_alert_ids
             ]

keep/api/routes/incidents.py

@@ -356,6 +356,7 @@ def get_incident_alerts(
     incident_id: UUID,
     limit: int = 25,
     offset: int = 0,
+    include_unlinked: bool = False,
     authenticated_entity: AuthenticatedEntity = Depends(
         IdentityManagerFactory.get_auth_verifier(["read:incidents"])
     ),
@@ -384,6 +385,7 @@ def get_incident_alerts(
         incident_id=incident_id,
         limit=limit,
         offset=offset,
+        include_unlinked=include_unlinked,
     )
 
     enriched_alerts_dto = convert_db_alerts_to_dto_alerts(db_alerts_and_links)
@@ -493,6 +495,7 @@ def get_incident_workflows(
 async def add_alerts_to_incident(
     incident_id: UUID,
     alert_ids: List[UUID],
+    is_created_by_ai: bool = False,
     authenticated_entity: AuthenticatedEntity = Depends(
         IdentityManagerFactory.get_auth_verifier(["write:incident"])
     ),
@@ -510,7 +513,7 @@ async def add_alerts_to_incident(
     if not incident:
         raise HTTPException(status_code=404, detail="Incident not found")
 
-    add_alerts_to_incident_by_incident_id(tenant_id, incident_id, alert_ids)
+    add_alerts_to_incident_by_incident_id(tenant_id, incident_id, alert_ids, is_created_by_ai)
     try:
         logger.info("Pushing enriched alert to elasticsearch")
         elastic_client = ElasticClient(tenant_id)

tests/test_incidents.py

@@ -13,6 +13,7 @@
     get_incident_by_id,
     get_last_incidents,
     remove_alerts_to_incident_by_incident_id,
+    get_incident_alerts_by_incident_id
 )
 from keep.api.core.db_utils import get_json_extract_field
 from keep.api.core.dependencies import SINGLE_TENANT_UUID
@@ -84,6 +85,13 @@ def test_add_remove_alert_to_incidents(db_session, setup_stress_alerts_no_elasti
         SINGLE_TENANT_UUID, incident.id, [a.id for a in service_0]
     )
 
+    # Removing shouldn't impact links between alert and incident if include_unlinked=True
+    assert len(get_incident_alerts_by_incident_id(
+        incident_id=incident.id,
+        tenant_id=incident.tenant_id,
+        include_unlinked=True
+    )[0]) == 100
+
     incident = get_incident_by_id(SINGLE_TENANT_UUID, incident.id)
 
     assert len(incident.alerts) == 90