Merge branch 'release/v12.0.0' into backlog/v12_integration_index

Signed-off-by: Alex Sánchez  <alex.sanchez@utmstack.com>

Author: AlexSanchez-bit

backend/modules/eventprocessing/domain/correlation_rule.go

@@ -1,6 +1,8 @@
 package domain
 
-import "time"
+import (
+	"time"
+)
 
 type UtmCorrelationRules struct {
 	ID int64 `gorm:"column:id;primaryKey"`
@@ -28,7 +30,10 @@ type UtmCorrelationRules struct {
 	SystemOwner    bool       `gorm:"column:system_owner;not null"`
 
 	// Nullable JSON TEXT columns for advanced rule configuration.
+	//[deprecated] only kept for compatibility
 	AfterEventsDef   string `gorm:"column:rule_after_events_def"`
+	//
+
 	RuleGroupByDef   string `gorm:"column:rule_group_by_def"`
 	DeduplicateByDef string `gorm:"column:rule_deduplicate_by_def"`
 
@@ -38,4 +43,5 @@ type UtmCorrelationRules struct {
 	DataTypes []UtmDataTypes `gorm:"many2many:utm_group_rules_data_type;joinForeignKey:rule_id;joinReferences:data_type_id"`
 }
 
+
 func (UtmCorrelationRules) TableName() string { return "utm_correlation_rules" }

backend/modules/eventprocessing/dto/correlation_rule.go

@@ -23,6 +23,7 @@ type RuleDataTypeResponse struct {
 	SystemOwner         bool       `json:"systemOwner"`
 }
 
+
 type CreateCorrelationRuleRequest struct {
 	// JSON tags match Java UtmCorrelationRulesDTO field names for wire compatibility.
 	RuleName      string `json:"name"`
@@ -38,15 +39,17 @@ type CreateCorrelationRuleRequest struct {
 
 	RuleReferencesDef json.RawMessage `json:"references"`
 	RuleDefinitionDef json.RawMessage `json:"definition"`
-	AfterEventsDef    json.RawMessage `json:"afterEvents"`
 	RuleGroupByDef    json.RawMessage `json:"groupBy"`
 	DeduplicateByDef  json.RawMessage `json:"deduplicateBy"`
 
 	RuleActive bool `json:"ruleActive"`
+	CorrelationDef    json.RawMessage `json:"correlation"`
 
 	DataTypes []DataTypeRef `json:"dataTypes"`
 }
 
+
+
 type UpdateCorrelationRuleRequest struct {
 	// RelPath identifies the rule to update (the YAML-direct identity).
 	RelPath string `json:"relPath"`
@@ -64,15 +67,16 @@ type UpdateCorrelationRuleRequest struct {
 
 	RuleReferencesDef json.RawMessage `json:"references"`
 	RuleDefinitionDef json.RawMessage `json:"definition"`
-	AfterEventsDef    json.RawMessage `json:"afterEvents"`
 	RuleGroupByDef    json.RawMessage `json:"groupBy"`
 	DeduplicateByDef  json.RawMessage `json:"deduplicateBy"`
 
 	RuleActive bool `json:"ruleActive"`
+	CorrelationDef    json.RawMessage `json:"correlation"`
 
 	DataTypes []DataTypeRef `json:"dataTypes"`
 }
 
+
 type CorrelationRuleResponse struct {
 	// RelPath is the rule identity (replaces the legacy numeric id).
 	RelPath string `json:"relPath"`
@@ -90,7 +94,7 @@ type CorrelationRuleResponse struct {
 
 	RuleReferencesDef json.RawMessage `json:"references"`
 	RuleDefinitionDef json.RawMessage `json:"definition"`
-	AfterEventsDef    json.RawMessage `json:"afterEvents"`
+	CorrelationDef    json.RawMessage `json:"correlation"`
 	RuleGroupByDef    json.RawMessage `json:"groupBy"`
 	DeduplicateByDef  json.RawMessage `json:"deduplicateBy"`
 

backend/modules/eventprocessing/module.go

@@ -126,5 +126,5 @@ func (m *Module) GetIngestionStatsUsecase() connectors.IngestionStatsUsecase {
 }
 
 func (m *Module) AfterEventsByRuleName(name string) (json.RawMessage, bool) {
-	return m.ruleStore.AfterEventsByName(name)
+	return m.ruleStore.CorrelationsByName(name)
 }

backend/modules/eventprocessing/usecase/correlation_rule.go

@@ -24,16 +24,21 @@ func NewCorrelationRuleUsecase(store *RuleStore) connectors.CorrelationRuleUseca
 	return &correlationRuleUsecase{store: store}
 }
 
+
+
 func (u *correlationRuleUsecase) Create(_ context.Context, req dto.CreateCorrelationRuleRequest) error {
 	if len(req.DataTypes) == 0 {
 		return domain.ErrDataTypesRequired
 	}
-	if err := validateRuleContent(req.RuleDefinitionDef, req.AfterEventsDef); err != nil {
+
+	correlate:= req.CorrelationDef
+
+	if err := validateRuleContent(req.RuleDefinitionDef,correlate ); err != nil {
 		return err
 	}
 	rule := buildRule(req.RuleName, req.RuleAdversary, req.RuleConfidentiality, req.RuleIntegrity,
 		req.RuleAvailability, req.RuleCategory, req.RuleTechnique, req.RuleDescription,
-		req.RuleReferencesDef, req.RuleDefinitionDef, req.AfterEventsDef, req.RuleGroupByDef,
+		req.RuleReferencesDef, req.RuleDefinitionDef, correlate, req.RuleGroupByDef,
 		req.DeduplicateByDef, req.DataTypes)
 
 	created, err := u.store.Create(rule)
@@ -105,10 +110,10 @@ func validateImportedRule(r Rule) error {
 	if strings.TrimSpace(r.Where) == "" {
 		return domain.ErrCorrelationRuleNullDefinition
 	}
-	if r.AfterEvents == nil {
+	if r.Correlation == nil {
 		return nil
 	}
-	raw, err := json.Marshal(r.AfterEvents)
+	raw, err := json.Marshal(r.Correlation)
 	if err != nil {
 		return fmt.Errorf("%w: afterEvents is not serializable", domain.ErrCorrelationRuleInvalidContent)
 	}
@@ -131,12 +136,15 @@ func (u *correlationRuleUsecase) Update(_ context.Context, req dto.UpdateCorrela
 	if len(req.DataTypes) == 0 {
 		return domain.ErrDataTypesRequired
 	}
-	if err := validateRuleContent(req.RuleDefinitionDef, req.AfterEventsDef); err != nil {
+
+	correlate:= req.CorrelationDef
+
+	if err := validateRuleContent(req.RuleDefinitionDef, correlate); err != nil {
 		return err
 	}
 	rule := buildRule(req.RuleName, req.RuleAdversary, req.RuleConfidentiality, req.RuleIntegrity,
 		req.RuleAvailability, req.RuleCategory, req.RuleTechnique, req.RuleDescription,
-		req.RuleReferencesDef, req.RuleDefinitionDef, req.AfterEventsDef, req.RuleGroupByDef,
+		req.RuleReferencesDef, req.RuleDefinitionDef, correlate, req.RuleGroupByDef,
 		req.DeduplicateByDef, req.DataTypes)
 
 	if _, err := u.store.Update(req.RelPath, rule); err != nil {
@@ -210,7 +218,7 @@ func buildRule(name, adversary string, conf, integ, avail int, category, techniq
 		Impact:        Impact{Confidentiality: conf, Integrity: integ, Availability: avail},
 		Where:         rawToWhere(def),
 		References:    rawToAnySlice(refs),
-		AfterEvents:   rawToAny(after),
+		Correlation:   rawToAny(after),
 		GroupBy:       rawToStrSlice(groupBy),
 		DeduplicateBy: rawToStrSlice(dedup),
 	}
@@ -237,7 +245,7 @@ func storedToResponse(sr *StoredRule) *dto.CorrelationRuleResponse {
 		RuleDescription:     sr.Description,
 		RuleReferencesDef:   anyToRaw(sr.References),
 		RuleDefinitionDef:   anyToRaw(sr.Where),
-		AfterEventsDef:      anyToRaw(sr.AfterEvents),
+		CorrelationDef:      anyToRaw(sr.Correlation),
 		RuleGroupByDef:      anyToRaw(sr.GroupBy),
 		DeduplicateByDef:    anyToRaw(sr.DeduplicateBy),
 		RuleLastUpdate:      &mod,

backend/modules/eventprocessing/usecase/rule_bootstrap.go

@@ -264,6 +264,8 @@ func legacyToRule(row *domain.UtmCorrelationRules) Rule {
 	for _, dt := range row.DataTypes {
 		names = append(names, dt.DataType)
 	}
+
+
 	return Rule{
 		Name:          row.RuleName,
 		Adversary:     row.RuleAdversary,
@@ -274,7 +276,7 @@ func legacyToRule(row *domain.UtmCorrelationRules) Rule {
 		Impact:        Impact{Confidentiality: row.RuleConfidentiality, Integrity: row.RuleIntegrity, Availability: row.RuleAvailability},
 		Where:         rawToWhere(toRaw(row.RuleDefinitionDef)),
 		References:    rawToAnySlice(toRaw(row.RuleReferencesDef)),
-		AfterEvents:   rawToAny(toRaw(row.AfterEventsDef)),
+		Correlation:   rawToAny(toRaw(row.AfterEventsDef)),
 		GroupBy:       rawToStrSlice(toRaw(row.RuleGroupByDef)),
 		DeduplicateBy: rawToStrSlice(toRaw(row.DeduplicateByDef)),
 	}

backend/modules/eventprocessing/usecase/rule_model.go

@@ -38,7 +38,7 @@ type Rule struct {
 	References    []any    `yaml:"references,omitempty"`
 	Description   string   `yaml:"description,omitempty"`
 	Where         string   `yaml:"where"`
-	AfterEvents   any      `yaml:"afterEvents,omitempty"`
+	Correlation   any      `yaml:"correlation,omitempty"`
 	GroupBy       []string `yaml:"groupBy,omitempty"`
 	DeduplicateBy []string `yaml:"deduplicateBy,omitempty"`
 }

backend/modules/eventprocessing/usecase/rule_store.go

@@ -162,12 +162,12 @@ func (s *RuleStore) FindByName(name string) *StoredRule {
 	return nil
 }
 
-func (s *RuleStore) AfterEventsByName(name string) (json.RawMessage, bool) {
+func (s *RuleStore) CorrelationsByName(name string) (json.RawMessage, bool) {
 	sr := s.FindByName(name)
 	if sr == nil {
 		return nil, false
 	}
-	return anyToRaw(sr.AfterEvents), true
+	return anyToRaw(sr.Correlation), true
 }
 
 // List applies the filter, sorts by name and paginates. It returns the page

backend/modules/integrations/usecase/module.go

@@ -167,7 +167,8 @@ func (u *moduleUsecase) Create(ctx context.Context, req dto.CreateModuleRequest)
 	}
 
 	if _,err:= u.opensearch.Create(ctx,os_dto.CreateIndexPatternRequest{
-		PatternModule: &req.DataType,
+		Pattern:       req.DataType,
+		PatternModule: &req.ModuleName,
 	});err!=nil{
 		//opensearch insertion fails, rolling back database
 		if err:=u.repo.Delete(ctx,m.ID);err!=nil{

backend/modules/opensearch/usecase/index_pattern.go

@@ -49,6 +49,12 @@ func (u *indexPatternUsecase) Create(ctx context.Context, req dto.CreateIndexPat
 		return nil, errInvalidPattern
 	}
 
+	if !strings.HasPrefix(req.Pattern,constants.CUSTOM_INDEX_PREFIX) {
+		normalized := strings.ReplaceAll(strings.Trim(strings.ToLower(req.Pattern), ""), " ", "-")
+		req.Pattern = fmt.Sprintf("%s-%s-*", constants.CUSTOM_INDEX_PREFIX, normalized)
+	}
+
+
 	p := &domain.UtmIndexPattern{
 		Pattern:       req.Pattern,
 		PatternModule: req.PatternModule,

frontend/src/features/alerting-rules/components/rule-form.tsx

@@ -35,7 +35,7 @@ export interface RuleFormState {
   ruleActive: boolean
   dataTypes: string[]
   definition: string
-  afterEvents: AfterStep[]
+  correlation: AfterStep[]
   groupBy: string[]
   deduplicateBy: string[]
   references: string[]
@@ -59,9 +59,9 @@ function parseConditions(w: unknown): Condition[] {
     return { field: String(o.field ?? ''), operator: String(o.operator ?? 'filter_term'), value: valueToStr(o.value) }
   })
 }
-function parseSteps(after: unknown): AfterStep[] {
-  if (!Array.isArray(after)) return []
-  return after.map((s) => {
+function parseSteps(raw: unknown): AfterStep[] {
+  if (!Array.isArray(raw)) return []
+  return raw.map((s) => {
     const o = (s ?? {}) as Record<string, unknown>
     return {
       indexPattern: String(o.indexPattern ?? ''),
@@ -86,7 +86,7 @@ export function ruleToForm(r?: CorrelationRule): RuleFormState {
     ruleActive: r?.ruleActive ?? true,
     dataTypes: (r?.dataTypes ?? []).filter((d) => d.included).map((d) => d.dataType),
     definition: r?.definition ?? '',
-    afterEvents: parseSteps(r?.afterEvents),
+    correlation: parseSteps(r?.correlation ?? r?.afterEvents),
     groupBy: strArray(r?.groupBy),
     deduplicateBy: strArray(r?.deduplicateBy),
     references: strArray(r?.references),
@@ -122,7 +122,7 @@ export function formToInput(f: RuleFormState, relPath?: string): SaveRuleInput {
     description: f.description.trim(),
     references: f.references.filter(Boolean),
     definition: f.definition,
-    afterEvents: stepsToJson(f.afterEvents),
+    correlation: stepsToJson(f.correlation),
     groupBy: f.groupBy.filter(Boolean),
     deduplicateBy: f.deduplicateBy.filter(Boolean),
     ruleActive: f.ruleActive,
@@ -134,7 +134,7 @@ export function formToInput(f: RuleFormState, relPath?: string): SaveRuleInput {
 
 export function RuleForm({ form, setForm, dataTypeOptions, t }: { form: RuleFormState; setForm: Dispatch<SetStateAction<RuleFormState>>; dataTypeOptions: DataTypeOption[]; t: TFunction }) {
   const set = <K extends keyof RuleFormState>(k: K, v: RuleFormState[K]) => setForm((f) => ({ ...f, [k]: v }))
-  const setSteps = (steps: AfterStep[]) => set('afterEvents', steps)
+  const setSteps = (steps: AfterStep[]) => set('correlation', steps)
 
   // `where` condition: visual builder ⇄ raw CEL. Visual is the source when it
   // parses; otherwise we fall back to code for hand-written/advanced CEL.
@@ -221,21 +221,21 @@ export function RuleForm({ form, setForm, dataTypeOptions, t }: { form: RuleForm
         )}
       </div>
 
-      <Section title={t('alertingRules.editor.afterEvents')}>
-        <p className="mb-3 text-[11px] text-muted-foreground">{t('alertingRules.editor.afterEventsHint')}</p>
+      <Section title={t('alertingRules.editor.correlationSteps')}>
+        <p className="mb-3 text-[11px] text-muted-foreground">{t('alertingRules.editor.correlationStepsHint')}</p>
         <div className="space-y-3">
-          {form.afterEvents.map((step, i) => (
+          {form.correlation.map((step, i) => (
             <StepCard
               key={i}
               step={step}
               index={i}
               t={t}
-              onChange={(s) => setSteps(form.afterEvents.map((x, idx) => (idx === i ? s : x)))}
-              onRemove={() => setSteps(form.afterEvents.filter((_, idx) => idx !== i))}
+              onChange={(s) => setSteps(form.correlation.map((x, idx) => (idx === i ? s : x)))}
+              onRemove={() => setSteps(form.correlation.filter((_, idx) => idx !== i))}
             />
           ))}
           <button
-            onClick={() => setSteps([...form.afterEvents, { indexPattern: 'v11-log-*', within: '2m', count: 1, with: [], or: [] }])}
+            onClick={() => setSteps([...form.correlation, { indexPattern: 'v11-log-*', within: '2m', count: 1, with: [], or: [] }])}
             className="flex w-full items-center justify-center gap-1.5 rounded-md border border-dashed border-border py-2 text-xs text-muted-foreground hover:border-primary/40 hover:text-foreground"
           >
             <Plus size={13} /> {t('alertingRules.editor.addStep')}
@@ -256,7 +256,7 @@ export function RuleForm({ form, setForm, dataTypeOptions, t }: { form: RuleForm
   )
 }
 
-/* ─── afterEvents builder pieces ───────────────────────────────────────── */
+/* ─── correlation steps builder pieces ────────────────────────────────── */
 
 function StepCard({ step, index, onChange, onRemove, t }: { step: AfterStep; index: number; onChange: (s: AfterStep) => void; onRemove: () => void; t: TFunction }) {
   const patch = (p: Partial<AfterStep>) => onChange({ ...step, ...p })