correlation alerts

src/main/java/org/opensearch/securityanalytics/model/CorrelationAlert.java

@@ -0,0 +1,61 @@
+package org.opensearch.securityanalytics.model;
+
+import org.opensearch.commons.alerting.model.ActionExecutionResult;
+import org.opensearch.commons.alerting.model.Alert;
+import org.opensearch.commons.authuser.User;
+
+import java.time.Instant;
+import java.util.List;
+
+/**
+ * Model for docs store in .opensearch-sap-correlation-alerts index.
+ * Correlation alerts are created when a detector finding triggers correlation
+ */
+public class CorrelationAlert {
+
+    private final String id;
+    private final Instant startTime;
+    private final Instant acknowledgedTime;
+    private final Instant lastNotificationTime;
+    private final Instant endTime;
+    private final String correlationId;
+    private final List<ActionExecutionResult> actionExecutionResult;
+    private final Integer version;
+    private final Integer schemaVersion;
+    private final String triggerName;
+    private final String triggerId;
+    private final String errorMessage;
+    private final List<String> correlatedFindingIds;
+    private final List<String> correlationRuleNames;
+    private final User user;
+    private final String severity;
+    private final Alert.State state;
+
+
+    public CorrelationAlert(String id, Instant startTime, Instant acknowledgedTime,
+                            Instant lastNotificationTime, Instant endTime, String correlationId,
+                            List<ActionExecutionResult> actionExecutionResult, Integer version, Integer schemaVersion,
+                            String triggerName, String triggerId, String errorMessage,
+                            List<String> correlatedFindingIds, List<String> correlationRuleNames, User user,
+                            String severity, Alert.State state) {
+        this.id = id;
+        this.startTime = startTime;
+        this.acknowledgedTime = acknowledgedTime;
+        this.lastNotificationTime = lastNotificationTime;
+        this.endTime = endTime;
+        this.correlationId = correlationId;
+        this.actionExecutionResult = actionExecutionResult;
+        this.version = version;
+        this.schemaVersion = schemaVersion;
+        this.triggerName = triggerName;
+        this.triggerId = triggerId;
+        this.errorMessage = errorMessage;
+        this.correlatedFindingIds = correlatedFindingIds;
+        this.correlationRuleNames = correlationRuleNames;
+        this.user = user;
+        this.severity = severity;
+        this.state = state;
+    }
+
+
+}

src/main/resources/mappings/correlation_alert_mapping.json

@@ -0,0 +1,123 @@
+{
+  "mappings": {
+    "dynamic": "strict",
+    "_meta": {
+      "schema_version": 1
+    },
+    "properties": {
+      "acknowledged_time": {
+        "type": "date"
+      },
+      "action_execution_results": {
+        "type": "nested",
+        "properties": {
+          "action_id": {
+            "type": "keyword"
+          },
+          "last_execution_time": {
+            "type": "date"
+          },
+          "throttled_count": {
+            "type": "integer"
+          }
+        }
+      },
+      "end_time": {
+        "type": "date"
+      },
+      "error_message": {
+        "type": "text"
+      },
+      "correlated_finding_ids": {
+        "type": "text",
+        "fields": {
+          "keyword": {
+            "type": "keyword"
+          }
+        }
+      },
+      "id": {
+        "type": "keyword"
+      },
+      "last_notification_time": {
+        "type": "date"
+      },
+      "correlation_id": {
+        "type": "keyword"
+      },
+      "correlation_rule_name": {
+        "type": "text",
+        "fields": {
+          "keyword": {
+            "type": "keyword",
+            "ignore_above": 256
+          }
+        }
+      },
+      "user": {
+        "properties": {
+          "backend_roles": {
+            "type": "text",
+            "fields": {
+              "keyword": {
+                "type": "keyword"
+              }
+            }
+          },
+          "custom_attribute_names": {
+            "type": "text",
+            "fields": {
+              "keyword": {
+                "type": "keyword"
+              }
+            }
+          },
+          "name": {
+            "type": "text",
+            "fields": {
+              "keyword": {
+                "type": "keyword",
+                "ignore_above": 256
+              }
+            }
+          },
+          "roles": {
+            "type": "text",
+            "fields": {
+              "keyword": {
+                "type": "keyword"
+              }
+            }
+          }
+        }
+      },
+      "schema_version": {
+        "type": "integer"
+      },
+      "severity": {
+        "type": "keyword"
+      },
+      "start_time": {
+        "type": "date"
+      },
+      "state": {
+        "type": "keyword"
+      },
+      "trigger_id": {
+        "type": "keyword"
+      },
+      "trigger_name": {
+        "type": "text",
+        "fields": {
+          "keyword": {
+            "type": "keyword",
+            "ignore_above": 256
+          }
+        }
+      },
+      "version": {
+        "type": "long"
+      }
+    }
+  }
+}