From c51797c2f011f8856513d62e58f5f8d9f59a971b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20S=C3=A1nchez?= Date: Wed, 22 Jul 2026 13:35:27 -0600 Subject: [PATCH 1/4] fix[backend](alerting_rules): added disable branch on audit log alerting rule status change --- backend/modules/eventprocessing/handler/correlation_rule.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/backend/modules/eventprocessing/handler/correlation_rule.go b/backend/modules/eventprocessing/handler/correlation_rule.go index c26a3780b..dbf68cbea 100644 --- a/backend/modules/eventprocessing/handler/correlation_rule.go +++ b/backend/modules/eventprocessing/handler/correlation_rule.go @@ -141,7 +141,11 @@ func (h *CorrelationRuleHandler) ActivateDeactivate(c *gin.Context) { } changed, err := h.usecase.SetActive(c.Request.Context(), relPath, active) - audit.Record(c, audit_connectors.Event{Action: "correlation_rule.activate"}, audit_domain.CORRELATION_RULE_UPDATE_ATTEMPT, audit_domain.CORRELATION_RULE_UPDATE_SUCCESS, err) + action := "correlation_rule.activate" + if !active { + action = "correlation_rule.deactivate" + } + audit.Record(c, audit_connectors.Event{Action: action}, audit_domain.CORRELATION_RULE_UPDATE_ATTEMPT, audit_domain.CORRELATION_RULE_UPDATE_SUCCESS, err) if err != nil { writeCorrelationError(c, err) return From 6e5a1329e5de744993c1f5da1313c9ab5da882cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20S=C3=A1nchez?= Date: Wed, 22 Jul 2026 14:33:37 -0600 Subject: [PATCH 2/4] fix[backend](alerting_rules): added last modified time modification so EP reloads the disabled/enabled rule --- backend/modules/eventprocessing/usecase/rule_store.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/backend/modules/eventprocessing/usecase/rule_store.go b/backend/modules/eventprocessing/usecase/rule_store.go index f9863bd3a..e77aa7f66 100644 --- a/backend/modules/eventprocessing/usecase/rule_store.go +++ b/backend/modules/eventprocessing/usecase/rule_store.go @@ -368,6 +368,14 @@ func (s *RuleStore) SetEnabled(relPath string, enabled bool) (bool, error) { return false, err } sr.enabled = enabled + + dir := s.userDir + if sr.system { + dir = s.systemDir + } + now := time.Now() + _ = os.Chtimes(filepath.Join(dir, relPath), now, now) + return true, nil } From c271423492f0bd4ccf0ff5e3390ffd6dfd1d740a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20S=C3=A1nchez?= Date: Wed, 22 Jul 2026 14:42:45 -0600 Subject: [PATCH 3/4] chore[](): updated go deps --- backend/go.mod | 2 +- backend/go.sum | 4 ++-- plugins/gcp/go.mod | 2 +- plugins/gcp/go.sum | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/backend/go.mod b/backend/go.mod index f4c0db230..1058d1480 100644 --- a/backend/go.mod +++ b/backend/go.mod @@ -29,7 +29,7 @@ require ( github.com/tidwall/gjson v1.19.0 github.com/utmstack/license-manager-sdk v0.1.0 golang.org/x/crypto v0.54.0 - google.golang.org/api v0.289.0 + google.golang.org/api v0.290.0 google.golang.org/grpc v1.82.1 google.golang.org/protobuf v1.36.11 gopkg.in/yaml.v3 v3.0.1 diff --git a/backend/go.sum b/backend/go.sum index 59461374d..a05315023 100644 --- a/backend/go.sum +++ b/backend/go.sum @@ -488,8 +488,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.289.0 h1:DmH0c6NigNFmsvsohM9bxv+MzVhag3aGHnojA5fFQjc= -google.golang.org/api v0.289.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8= +google.golang.org/api v0.290.0 h1:eMw0Xo+IfbbMlKmW7aHvpyQRv9RCXuWx/vs8AD+0x9A= +google.golang.org/api v0.290.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= diff --git a/plugins/gcp/go.mod b/plugins/gcp/go.mod index c8ef0e71e..dbece3db7 100644 --- a/plugins/gcp/go.mod +++ b/plugins/gcp/go.mod @@ -8,7 +8,7 @@ require ( github.com/google/uuid v1.6.0 github.com/threatwinds/go-sdk v1.1.26 golang.org/x/crypto v0.54.0 - google.golang.org/api v0.289.0 + google.golang.org/api v0.290.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/plugins/gcp/go.sum b/plugins/gcp/go.sum index 7bf748ac0..ef4b00b40 100644 --- a/plugins/gcp/go.sum +++ b/plugins/gcp/go.sum @@ -252,8 +252,8 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.289.0 h1:DmH0c6NigNFmsvsohM9bxv+MzVhag3aGHnojA5fFQjc= -google.golang.org/api v0.289.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8= +google.golang.org/api v0.290.0 h1:eMw0Xo+IfbbMlKmW7aHvpyQRv9RCXuWx/vs8AD+0x9A= +google.golang.org/api v0.290.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= From 51c4f0fcc7069e742d24b48e7c3e085a671322e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20S=C3=A1nchez?= Date: Wed, 22 Jul 2026 14:47:46 -0600 Subject: [PATCH 4/4] fix[backend](alerting_rules): added last modified time modification on pipeline writter to respect project architecture --- backend/modules/eventprocessing/usecase/pipeline_writer.go | 7 +++++++ backend/modules/eventprocessing/usecase/rule_store.go | 3 +-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/backend/modules/eventprocessing/usecase/pipeline_writer.go b/backend/modules/eventprocessing/usecase/pipeline_writer.go index fd7c8d1ef..bd2ea2005 100644 --- a/backend/modules/eventprocessing/usecase/pipeline_writer.go +++ b/backend/modules/eventprocessing/usecase/pipeline_writer.go @@ -5,6 +5,7 @@ import ( "path/filepath" "sort" "sync" + "time" "gopkg.in/yaml.v3" ) @@ -102,6 +103,12 @@ func (w *pipelineWriter) SetRuleDisabled(identity string, disabled bool) error { return w.writeTenantsLocked() } +// PokeRuleReload bumps a rule file's mtime without changing its content. +func (w *pipelineWriter) PokeRuleReload(absPath string) { + now := time.Now() + _ = os.Chtimes(absPath, now, now) +} + // DisabledRuleSet returns a snapshot of the currently disabled rule identities. func (w *pipelineWriter) DisabledRuleSet() map[string]bool { w.mu.Lock() diff --git a/backend/modules/eventprocessing/usecase/rule_store.go b/backend/modules/eventprocessing/usecase/rule_store.go index e77aa7f66..95814ba01 100644 --- a/backend/modules/eventprocessing/usecase/rule_store.go +++ b/backend/modules/eventprocessing/usecase/rule_store.go @@ -373,8 +373,7 @@ func (s *RuleStore) SetEnabled(relPath string, enabled bool) (bool, error) { if sr.system { dir = s.systemDir } - now := time.Now() - _ = os.Chtimes(filepath.Join(dir, relPath), now, now) + s.writer.PokeRuleReload(filepath.Join(dir, relPath)) return true, nil }