From 9a2701258900a477a1dd35a8aa1b0909493237f1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20S=C3=A1nchez?= Date: Tue, 28 Jul 2026 10:04:08 -0600 Subject: [PATCH 1/3] fix[frontend](adversary): fixed filter select colors --- frontend/src/features/alerts/lib/alert-meta.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/src/features/alerts/lib/alert-meta.ts b/frontend/src/features/alerts/lib/alert-meta.ts index d7225d427..95b03ede6 100644 --- a/frontend/src/features/alerts/lib/alert-meta.ts +++ b/frontend/src/features/alerts/lib/alert-meta.ts @@ -73,7 +73,7 @@ export const TS = '@timestamp' export const PAGE_SIZE_DEFAULT = 20 export const SELECT_CLS = - 'h-9 cursor-pointer rounded-md border border-input bg-background/40 px-2 text-sm transition-colors focus-visible:border-ring focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring' + 'h-9 cursor-pointer rounded-md border border-input bg-popover px-2 text-sm text-popover-foreground transition-colors focus-visible:border-ring focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring' export function relativeTime(iso?: string) { if (!iso) return '—' From d895775087708f5f3d23ab93f791d78a4e04a685 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20S=C3=A1nchez?= Date: Tue, 28 Jul 2026 10:17:37 -0600 Subject: [PATCH 2/3] fix[frontend](adversary): added sankey auto dimension handler to avoud extremelly grouped data --- .../features/adversaries/components/adversaries-sankey.tsx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/frontend/src/features/adversaries/components/adversaries-sankey.tsx b/frontend/src/features/adversaries/components/adversaries-sankey.tsx index bbe4e481f..15e2b77b3 100644 --- a/frontend/src/features/adversaries/components/adversaries-sankey.tsx +++ b/frontend/src/features/adversaries/components/adversaries-sankey.tsx @@ -167,8 +167,13 @@ export function AdversariesSankey({ data }: { data: AdversaryResponse[] }) { { key: 'adversaries.col.victims', color: COLUMN_COLOR.victim }, ] + return ( -
+
{headers.map((h, i) => (
Date: Tue, 28 Jul 2026 12:20:51 -0600 Subject: [PATCH 3/3] fix[backend](adversary): reduced retrievered fields on adversary alerts request to avoid data overhead --- backend/modules/alerts/usecase/adversary.go | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/backend/modules/alerts/usecase/adversary.go b/backend/modules/alerts/usecase/adversary.go index c3a8abee8..0ea2d51ff 100644 --- a/backend/modules/alerts/usecase/adversary.go +++ b/backend/modules/alerts/usecase/adversary.go @@ -16,6 +16,12 @@ import ( // adversaryIndexPattern is the OpenSearch index the adversary aggregation reads. const adversaryIndexPattern = "v11-alert-*" +// alertSourceIncludes trims top_hits _source to only fields the frontend renders +// plus `id` (needed by parseAdversaryAggs to correlate children to parents). +// Cuts per-doc payload from full alerts (KBs) to ~4 scalar fields, keeping the +// circuit-breaking parent breaker from tripping on wide time ranges. +var alertSourceIncludes = []string{"id", "name", "target", "severity"} + // adversaryBucketAggs is the set of sub-aggregations run under each adversary // bucket (by host or by IP) — shared so both grouping strategies fetch the // same shape of data. @@ -49,6 +55,9 @@ func adversaryBucketAggs() map[string]any { "sort": []map[string]any{ {"@timestamp": map[string]any{"order": "desc"}}, }, + "_source": map[string]any{ + "includes": alertSourceIncludes, + }, }, }, }, @@ -66,6 +75,9 @@ func adversaryBucketAggs() map[string]any { "sort": []map[string]any{ {"@timestamp": map[string]any{"order": "desc"}}, }, + "_source": map[string]any{ + "includes": alertSourceIncludes, + }, }, }, }, @@ -93,8 +105,9 @@ func (u *adversaryUsecase) FetchAdversaryAlerts( } body := map[string]any{ - "size": 0, - "query": common_models.FiltersToQuery(filters), + "size": 0, + "timeout": "30s", + "query": common_models.FiltersToQuery(filters), "aggs": map[string]any{ // Group by adversary.host when present — internally-identified // attackers (compromised hosts, agents) carry a hostname.