fix(log-shipper): derive event severity from anomaly score and action#242
Merged
Conversation
Most CRS attack rules carry severity "critical", so copying it verbatim made nearly every blocked request register as a critical alert, collapsing the "Blocked requests" and "Critical alerts" dashboard cards into the same number. Event severity is now derived: a high anomaly score (>= 10, twice the CRS default inbound threshold) is "critical" regardless of whether the request was blocked, so DetectionOnly policies still surface real attacks; other blocked events are "error", and non-blocked events are capped at "warning". The anomaly score is also parsed from the 949110 blocking message as a fallback for coraza-spoa v0.6.1, which doesn't expose transaction.variables. Track src/log-shipper/uv.lock for reproducible installs, consistent with src/backend/uv.lock. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
bihius
added a commit
that referenced
this pull request
Jun 12, 2026
fix(log-shipper): derive event severity from anomaly score and action
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
949110blocking message as a fallback, since coraza-spoa v0.6.1 doesn't exposetransaction.variablessrc/log-shipper/uv.lockfor reproducible installs, consistent withsrc/backend/uv.lockTest plan
uv run --extra dev pytest tests/(28 passed, including new detect-only-critical and blocked-error cases)uv run --extra dev mypy app/