feat[backend](alerts): added echoes alerts

Author: AlexSanchez-bit

backend/modules/alerts/connectors/repository.go

@@ -19,6 +19,7 @@ type AlertRepository interface {
 	CountOpenAlerts(ctx context.Context) (int64, error)
 	CountByStatus(ctx context.Context, status int) (int64, error)
 	SearchByIDs(ctx context.Context, alertIDs []string) ([]domain.UtmAlert, error)
+	ListEchoes(ctx context.Context, parentID string, from, size int, sortBy, sortOrder string) ([]domain.UtmAlert, int64, error)
 	GetRawByID(ctx context.Context, alertID string) (json.RawMessage, error)
 	RelatedLogRefs(ctx context.Context, steps []domain.CorrelationStep, anchorTS time.Time, maxSize int) (refs []domain.LogRef, truncated bool, err error)
 }

backend/modules/alerts/connectors/usecase.go

@@ -25,6 +25,7 @@ type AlertUsecase interface {
 	ConvertToIncident(ctx context.Context, userLogin string, req dto.ConvertToIncidentRequest) error
 	CountOpenAlerts(ctx context.Context) (*dto.CountOpenAlertsResponse, error)
 	RelatedLogs(ctx context.Context, alertID string) (*dto.RelatedLogsResponse, error)
+	ListEchoes(ctx context.Context, parentID string, page, size int, sortBy, sortOrder string) ([]domain.UtmAlert, int64, error)
 	SetCorrelationResolver(r CorrelationResolver)
 }
 

backend/modules/alerts/handler/alerts.go

@@ -185,3 +185,37 @@ func (h *AlertHandler) CountOpenAlerts(c *gin.Context) {
 	// Java returns bare Long — match that contract.
 	c.JSON(http.StatusOK, resp.Count)
 }
+
+// @Summary     List echoes of an alert
+// @Description Returns the child alerts (parentId == :id) of a parent alert, paginated and sorted.
+// @Tags        Alerts
+// @Security    BearerAuth
+// @Produce     json
+// @Param       id        path  string true  "Parent alert id"
+// @Param       page      query int    false "Page number (1-based, default 1)"
+// @Param       size      query int    false "Page size (default 20, max 100)"
+// @Param       sortBy    query string false "Sort field (default @timestamp)"
+// @Param       sortOrder query string false "Sort order: asc|desc (default desc)"
+// @Success     200 {array} domain.UtmAlert
+// @Header      200 {string} X-Total-Count "Total matching echoes"
+// @Failure     400 {object} map[string]string
+// @Failure     500 {object} map[string]string
+// @Router      /utm-alerts/{id}/echoes [get]
+func (h *AlertHandler) ListEchoes(c *gin.Context) {
+	parentID := c.Param("id")
+	if parentID == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "missing alert id"})
+		return
+	}
+	page := queryInt(c, "page", 1)
+	size := queryInt(c, "size", 20)
+	sortBy := c.Query("sortBy")
+	sortOrder := c.DefaultQuery("sortOrder", "desc")
+
+	items, total, err := h.usecase.ListEchoes(c.Request.Context(), parentID, page, size, sortBy, sortOrder)
+	if err != nil {
+		writeAlertError(c, err)
+		return
+	}
+	writePagedArray(c, items, total)
+}

backend/modules/alerts/repository/alert_os.go

@@ -201,3 +201,20 @@ func (r *osAlertRepo) SearchByIDs(ctx context.Context, alertIDs []string) ([]dom
 	return alerts, nil
 }
 
+func (r *osAlertRepo) ListEchoes(ctx context.Context, parentID string, from, size int, sortBy, sortOrder string) ([]domain.UtmAlert, int64, error) {
+	query := termQuery("parentId.keyword", parentID)
+	raws, total, err := osSearchPage(ctx, alertIndex, query, from, size, sortBy, sortOrder)
+	if err != nil {
+		return nil, 0, err
+	}
+	alerts := make([]domain.UtmAlert, 0, len(raws))
+	for _, raw := range raws {
+		var a domain.UtmAlert
+		if err := json.Unmarshal(raw, &a); err != nil {
+			continue
+		}
+		alerts = append(alerts, a)
+	}
+	return alerts, total, nil
+}
+

backend/modules/alerts/repository/osquery.go

@@ -100,6 +100,37 @@ func osSearchSources(ctx context.Context, index string, query map[string]any, si
 	return docs, nil
 }
 
+// osSearchPage runs a paged + sorted search and returns the raw source docs
+// alongside the matching total count.
+func osSearchPage(ctx context.Context, index string, query map[string]any, from, size int, sortBy, sortOrder string) ([]json.RawMessage, int64, error) {
+	body := map[string]any{
+		"from":             from,
+		"size":             size,
+		"track_total_hits": true,
+	}
+	if query != nil {
+		body["query"] = query
+	}
+	if sortBy != "" {
+		body["sort"] = []map[string]any{
+			{sortBy: map[string]any{"order": sortOrder}},
+		}
+	}
+	res, err := osdk.RawSearch(ctx, []string{index}, body)
+	if err != nil {
+		return nil, 0, err
+	}
+	docs := make([]json.RawMessage, 0, len(res.Hits.Hits))
+	for _, h := range res.Hits.Hits {
+		b, err := json.Marshal(h.Source)
+		if err != nil {
+			return nil, 0, err
+		}
+		docs = append(docs, b)
+	}
+	return docs, res.Hits.Total.Value, nil
+}
+
 func osCount(ctx context.Context, index string, query map[string]any) (int64, error) {
 	body := map[string]any{"size": 0, "track_total_hits": true}
 	if query != nil {

backend/modules/alerts/routes.go

@@ -24,6 +24,7 @@ func RegisterRoutes(api *gin.RouterGroup, m *Module, userAuth gin.HandlerFunc) {
 
 	ag.GET("/count-open-alerts", read, h.CountOpenAlerts)
 	ag.GET("/related-logs", read, h.RelatedLogs)
+	ag.GET("/:id/echoes", read, h.ListEchoes)
 
 	tg := api.Group("/utm-alert-tags", userAuth)
 	tg.POST("", write, th.Create)

backend/modules/alerts/usecase/alert.go

@@ -160,6 +160,29 @@ func (u *alertUsecase) CountOpenAlerts(ctx context.Context) (*dto.CountOpenAlert
 	return &dto.CountOpenAlertsResponse{Count: count}, nil
 }
 
+func (u *alertUsecase) ListEchoes(ctx context.Context, parentID string, page, size int, sortBy, sortOrder string) ([]domain.UtmAlert, int64, error) {
+	if parentID == "" {
+		return nil, 0, domain.ErrMissingAlertID
+	}
+	if page < 1 {
+		page = 1
+	}
+	if size < 1 {
+		size = 20
+	}
+	if size > 100 {
+		size = 100
+	}
+	if sortBy == "" {
+		sortBy = "@timestamp"
+	}
+	if sortOrder != "asc" && sortOrder != "desc" {
+		sortOrder = "desc"
+	}
+	from := (page - 1) * size
+	return u.repo.ListEchoes(ctx, parentID, from, size, sortBy, sortOrder)
+}
+
 // ---------------------------------------------------------------------------
 // Internal helpers for HistoryEntry construction
 // ---------------------------------------------------------------------------