fix[frontend](rules/custom_rules): changed legacy afterEvents by correlation

AlexSanchez-bit · AlexSanchez-bit · commit 308623af90e4 · 2026-07-03T12:03:08.000-06:00
diff --git a/frontend/src/features/alerting-rules/components/rule-form.tsx b/frontend/src/features/alerting-rules/components/rule-form.tsx
@@ -35,7 +35,7 @@ export interface RuleFormState {
   ruleActive: boolean
   dataTypes: string[]
   definition: string
-  afterEvents: AfterStep[]
+  correlation: AfterStep[]
   groupBy: string[]
   deduplicateBy: string[]
   references: string[]
@@ -59,9 +59,9 @@ function parseConditions(w: unknown): Condition[] {
     return { field: String(o.field ?? ''), operator: String(o.operator ?? 'filter_term'), value: valueToStr(o.value) }
   })
 }
-function parseSteps(after: unknown): AfterStep[] {
-  if (!Array.isArray(after)) return []
-  return after.map((s) => {
+function parseSteps(raw: unknown): AfterStep[] {
+  if (!Array.isArray(raw)) return []
+  return raw.map((s) => {
     const o = (s ?? {}) as Record<string, unknown>
     return {
       indexPattern: String(o.indexPattern ?? ''),
@@ -86,7 +86,7 @@ export function ruleToForm(r?: CorrelationRule): RuleFormState {
     ruleActive: r?.ruleActive ?? true,
     dataTypes: (r?.dataTypes ?? []).filter((d) => d.included).map((d) => d.dataType),
     definition: r?.definition ?? '',
-    afterEvents: parseSteps(r?.afterEvents),
+    correlation: parseSteps(r?.correlation ?? r?.afterEvents),
     groupBy: strArray(r?.groupBy),
     deduplicateBy: strArray(r?.deduplicateBy),
     references: strArray(r?.references),
@@ -122,7 +122,7 @@ export function formToInput(f: RuleFormState, relPath?: string): SaveRuleInput {
     description: f.description.trim(),
     references: f.references.filter(Boolean),
     definition: f.definition,
-    afterEvents: stepsToJson(f.afterEvents),
+    correlation: stepsToJson(f.correlation),
     groupBy: f.groupBy.filter(Boolean),
     deduplicateBy: f.deduplicateBy.filter(Boolean),
     ruleActive: f.ruleActive,
@@ -134,7 +134,7 @@ export function formToInput(f: RuleFormState, relPath?: string): SaveRuleInput {
 
 export function RuleForm({ form, setForm, dataTypeOptions, t }: { form: RuleFormState; setForm: Dispatch<SetStateAction<RuleFormState>>; dataTypeOptions: DataTypeOption[]; t: TFunction }) {
   const set = <K extends keyof RuleFormState>(k: K, v: RuleFormState[K]) => setForm((f) => ({ ...f, [k]: v }))
-  const setSteps = (steps: AfterStep[]) => set('afterEvents', steps)
+  const setSteps = (steps: AfterStep[]) => set('correlation', steps)
 
   // `where` condition: visual builder ⇄ raw CEL. Visual is the source when it
   // parses; otherwise we fall back to code for hand-written/advanced CEL.
@@ -221,21 +221,21 @@ export function RuleForm({ form, setForm, dataTypeOptions, t }: { form: RuleForm
         )}
       </div>
 
-      <Section title={t('alertingRules.editor.afterEvents')}>
-        <p className="mb-3 text-[11px] text-muted-foreground">{t('alertingRules.editor.afterEventsHint')}</p>
+      <Section title={t('alertingRules.editor.correlationSteps')}>
+        <p className="mb-3 text-[11px] text-muted-foreground">{t('alertingRules.editor.correlationStepsHint')}</p>
         <div className="space-y-3">
-          {form.afterEvents.map((step, i) => (
+          {form.correlation.map((step, i) => (
             <StepCard
               key={i}
               step={step}
               index={i}
               t={t}
-              onChange={(s) => setSteps(form.afterEvents.map((x, idx) => (idx === i ? s : x)))}
-              onRemove={() => setSteps(form.afterEvents.filter((_, idx) => idx !== i))}
+              onChange={(s) => setSteps(form.correlation.map((x, idx) => (idx === i ? s : x)))}
+              onRemove={() => setSteps(form.correlation.filter((_, idx) => idx !== i))}
             />
           ))}
           <button
-            onClick={() => setSteps([...form.afterEvents, { indexPattern: 'v11-log-*', within: '2m', count: 1, with: [], or: [] }])}
+            onClick={() => setSteps([...form.correlation, { indexPattern: 'v11-log-*', within: '2m', count: 1, with: [], or: [] }])}
             className="flex w-full items-center justify-center gap-1.5 rounded-md border border-dashed border-border py-2 text-xs text-muted-foreground hover:border-primary/40 hover:text-foreground"
           >
             <Plus size={13} /> {t('alertingRules.editor.addStep')}
@@ -256,7 +256,7 @@ export function RuleForm({ form, setForm, dataTypeOptions, t }: { form: RuleForm
   )
 }
 
-/* ─── afterEvents builder pieces ───────────────────────────────────────── */
+/* ─── correlation steps builder pieces ────────────────────────────────── */
 
 function StepCard({ step, index, onChange, onRemove, t }: { step: AfterStep; index: number; onChange: (s: AfterStep) => void; onRemove: () => void; t: TFunction }) {
   const patch = (p: Partial<AfterStep>) => onChange({ ...step, ...p })
diff --git a/frontend/src/features/alerting-rules/lib/rule-yaml.ts b/frontend/src/features/alerting-rules/lib/rule-yaml.ts
@@ -75,7 +75,7 @@ export function ruleFormToYaml(f: RuleFormState): string {
   if (f.description) doc.description = f.description
   doc.where = f.definition
 
-  const steps = f.afterEvents
+  const steps = f.correlation
     .filter((s) => s.indexPattern.trim())
     .map((s) => {
       const step: Record<string, unknown> = {
@@ -88,7 +88,7 @@ export function ruleFormToYaml(f: RuleFormState): string {
       if (ors.length) step.or = ors.map((g) => ({ with: condsToYaml(g.with) }))
       return step
     })
-  if (steps.length) doc.afterEvents = steps
+  if (steps.length) doc.correlation = steps
   if (f.groupBy.length) doc.groupBy = f.groupBy
   if (f.deduplicateBy.length) doc.deduplicateBy = f.deduplicateBy
 
@@ -126,7 +126,7 @@ export function yamlToRuleForm(content: string): RuleParseResult {
     ruleActive: doc.active !== false,
     dataTypes: strArray(doc.dataTypes),
     definition: str(where),
-    afterEvents: parseSteps(doc.afterEvents),
+    correlation: parseSteps(doc.correlation ?? doc.afterEvents),
     groupBy: strArray(doc.groupBy),
     deduplicateBy: strArray(doc.deduplicateBy),
     references: strArray(doc.references),
diff --git a/frontend/src/features/alerting-rules/pages/AlertingRulesPage.tsx b/frontend/src/features/alerting-rules/pages/AlertingRulesPage.tsx
@@ -529,7 +529,7 @@ function RuleDrawer({
 }
 
 function RuleView({ rule, df, t }: { rule: CorrelationRule; df: ReturnType<typeof useDateFormat>; t: TFunction }) {
-  const steps = ruleToForm(rule).afterEvents
+  const steps = ruleToForm(rule).correlation
   return (
     <div className="space-y-4">
       {rule.description && <Section title={t('alertingRules.view.description')}><RuleDescription text={rule.description} /></Section>}
@@ -547,7 +547,7 @@ function RuleView({ rule, df, t }: { rule: CorrelationRule; df: ReturnType<typeo
         <DefinitionView definition={rule.definition} t={t} />
       </Section>
       {steps.length > 0 && (
-        <Section title={t('alertingRules.view.afterEvents')}>
+        <Section title={t('alertingRules.view.correlationSteps')}>
           <AfterEventsView steps={steps} t={t} />
         </Section>
       )}
@@ -607,7 +607,7 @@ function CelNodeView({ node, t, depth }: { node: CelNode; t: TFunction; depth: n
 }
 
 /** Read-only cards for the correlation (after-events) steps. */
-function AfterEventsView({ steps, t }: { steps: ReturnType<typeof ruleToForm>['afterEvents']; t: TFunction }) {
+function AfterEventsView({ steps, t }: { steps: ReturnType<typeof ruleToForm>['correlation']; t: TFunction }) {
   return (
     <div className="space-y-2">
       {steps.map((s, i) => (
diff --git a/frontend/src/features/alerting-rules/services/alerting-rules-http.service.ts b/frontend/src/features/alerting-rules/services/alerting-rules-http.service.ts
@@ -46,8 +46,10 @@ export interface ImportRulesResponse {
 
 /**
  * A correlation (alerting) rule. Identity is `relPath` (YAML-direct). `definition`
- * is the CEL `where` condition (a JSON-encoded string); `afterEvents`/`references`/
+ * is the CEL `where` condition (a JSON-encoded string); `correlation`/`references`/
  * `groupBy`/`deduplicateBy` are arbitrary JSON the backend stores verbatim.
+ * `afterEvents` is the legacy name for `correlation` — still populated by older
+ * backends/rule files, read as a fallback.
  */
 export interface CorrelationRule {
   relPath: string
@@ -61,7 +63,8 @@ export interface CorrelationRule {
   description: string
   references: unknown
   definition: string
-  afterEvents: unknown
+  correlation?: unknown
+  afterEvents?: unknown // legacy: pre-rename field name
   groupBy: unknown
   deduplicateBy: unknown
   ruleLastUpdate?: string
@@ -82,7 +85,7 @@ export interface SaveRuleInput {
   description: string
   references: unknown
   definition: string
-  afterEvents: unknown
+  correlation: unknown
   groupBy: unknown
   deduplicateBy: unknown
   ruleActive: boolean
diff --git a/frontend/src/shared/i18n/locales/de.json b/frontend/src/shared/i18n/locales/de.json
@@ -4213,7 +4213,7 @@
       "updated": "Aktualisiert",
       "relPath": "Pfad",
       "definition": "Bedingung (CEL)",
-      "afterEvents": "Korrelationsschritte",
+      "correlationSteps": "Korrelationsschritte",
       "correlation": "Korrelation",
       "groupBy": "Gruppieren nach",
       "deduplicateBy": "Deduplizieren nach",
@@ -4236,8 +4236,8 @@
       "definitionSection": "Definition",
       "where": "Bedingung (CEL)",
       "whereHint": "CEL-Ausdruck je Ereignis ausgewertet",
-      "afterEvents": "Korrelationsschritte (afterEvents)",
-      "afterEventsHint": "JSON-Array",
+      "correlationSteps": "Korrelationsschritte",
+      "correlationStepsHint": "JSON-Array",
       "jsonArray": "JSON-Array",
       "nameRequired": "Name ist erforderlich",
       "definitionRequired": "Die Bedingung ist erforderlich",
diff --git a/frontend/src/shared/i18n/locales/en.json b/frontend/src/shared/i18n/locales/en.json
@@ -4465,7 +4465,7 @@
       "updated": "Updated",
       "relPath": "Path",
       "definition": "Condition (CEL)",
-      "afterEvents": "Correlation steps",
+      "correlationSteps": "Correlation steps",
       "correlation": "Correlation",
       "groupBy": "Group by",
       "deduplicateBy": "Deduplicate by",
@@ -4488,8 +4488,8 @@
       "definitionSection": "Definition",
       "where": "Condition (CEL)",
       "whereHint": "CEL expression evaluated per event",
-      "afterEvents": "Correlation steps (afterEvents)",
-      "afterEventsHint": "JSON array",
+      "correlationSteps": "Correlation steps",
+      "correlationStepsHint": "JSON array",
       "jsonArray": "JSON array",
       "nameRequired": "Name is required",
       "definitionRequired": "The condition is required",
diff --git a/frontend/src/shared/i18n/locales/es.json b/frontend/src/shared/i18n/locales/es.json
@@ -4389,7 +4389,7 @@
       "updated": "Actualizada",
       "relPath": "Ruta",
       "definition": "Condición (CEL)",
-      "afterEvents": "Pasos de correlación",
+      "correlationSteps": "Pasos de correlación",
       "correlation": "Correlación",
       "groupBy": "Agrupar por",
       "deduplicateBy": "Deduplicar por",
@@ -4412,8 +4412,8 @@
       "definitionSection": "Definición",
       "where": "Condición (CEL)",
       "whereHint": "Expresión CEL evaluada por evento",
-      "afterEvents": "Pasos de correlación (afterEvents)",
-      "afterEventsHint": "array JSON",
+      "correlationSteps": "Pasos de correlación",
+      "correlationStepsHint": "array JSON",
       "jsonArray": "array JSON",
       "nameRequired": "El nombre es obligatorio",
       "definitionRequired": "La condición es obligatoria",
diff --git a/frontend/src/shared/i18n/locales/fr.json b/frontend/src/shared/i18n/locales/fr.json
@@ -4213,7 +4213,7 @@
       "updated": "Mise à jour",
       "relPath": "Chemin",
       "definition": "Condition (CEL)",
-      "afterEvents": "Étapes de corrélation",
+      "correlationSteps": "Étapes de corrélation",
       "correlation": "Corrélation",
       "groupBy": "Grouper par",
       "deduplicateBy": "Dédupliquer par",
@@ -4236,8 +4236,8 @@
       "definitionSection": "Définition",
       "where": "Condition (CEL)",
       "whereHint": "Expression CEL évaluée par événement",
-      "afterEvents": "Étapes de corrélation (afterEvents)",
-      "afterEventsHint": "tableau JSON",
+      "correlationSteps": "Étapes de corrélation",
+      "correlationStepsHint": "tableau JSON",
       "jsonArray": "tableau JSON",
       "nameRequired": "Le nom est requis",
       "definitionRequired": "La condition est requise",
diff --git a/frontend/src/shared/i18n/locales/it.json b/frontend/src/shared/i18n/locales/it.json
@@ -4213,7 +4213,7 @@
       "updated": "Aggiornata",
       "relPath": "Percorso",
       "definition": "Condizione (CEL)",
-      "afterEvents": "Passi di correlazione",
+      "correlationSteps": "Passi di correlazione",
       "correlation": "Correlazione",
       "groupBy": "Raggruppa per",
       "deduplicateBy": "Deduplica per",
@@ -4236,8 +4236,8 @@
       "definitionSection": "Definizione",
       "where": "Condizione (CEL)",
       "whereHint": "Espressione CEL valutata per evento",
-      "afterEvents": "Passi di correlazione (afterEvents)",
-      "afterEventsHint": "array JSON",
+      "correlationSteps": "Passi di correlazione",
+      "correlationStepsHint": "array JSON",
       "jsonArray": "array JSON",
       "nameRequired": "Il nome è obbligatorio",
       "definitionRequired": "La condizione è obbligatoria",
diff --git a/frontend/src/shared/i18n/locales/pt.json b/frontend/src/shared/i18n/locales/pt.json
@@ -4389,7 +4389,7 @@
       "updated": "Atualizada",
       "relPath": "Caminho",
       "definition": "Condição (CEL)",
-      "afterEvents": "Passos de correlação",
+      "correlationSteps": "Passos de correlação",
       "correlation": "Correlação",
       "groupBy": "Agrupar por",
       "deduplicateBy": "Deduplicar por",
@@ -4412,8 +4412,8 @@
       "definitionSection": "Definição",
       "where": "Condição (CEL)",
       "whereHint": "Expressão CEL avaliada por evento",
-      "afterEvents": "Passos de correlação (afterEvents)",
-      "afterEventsHint": "array JSON",
+      "correlationSteps": "Passos de correlação",
+      "correlationStepsHint": "array JSON",
       "jsonArray": "array JSON",
       "nameRequired": "O nome é obrigatório",
       "definitionRequired": "A condição é obrigatória",
diff --git a/frontend/src/shared/i18n/locales/ru.json b/frontend/src/shared/i18n/locales/ru.json
@@ -4023,7 +4023,7 @@
       "updated": "Обновлено",
       "relPath": "Путь",
       "definition": "Условие (CEL)",
-      "afterEvents": "Шаги корреляции",
+      "correlationSteps": "Шаги корреляции",
       "correlation": "Корреляция",
       "groupBy": "Группировать по",
       "deduplicateBy": "Дедупликация по",
@@ -4046,8 +4046,8 @@
       "definitionSection": "Определение",
       "where": "Условие (CEL)",
       "whereHint": "Выражение CEL, вычисляемое для каждого события",
-      "afterEvents": "Шаги корреляции (afterEvents)",
-      "afterEventsHint": "JSON-массив",
+      "correlationSteps": "Шаги корреляции",
+      "correlationStepsHint": "JSON-массив",
       "jsonArray": "JSON-массив",
       "nameRequired": "Название обязательно",
       "definitionRequired": "Условие обязательно",
