feat(alerts): enhance update alert status logic to support false positive tagging

Author: mjabascal10

backend/src/main/java/com/park/utmstack/service/UtmAlertService.java

@@ -27,4 +27,7 @@ void updateStatus(List<String> alertIds, int status, String statusObservation) t
     void convertToIncident(List<String> eventIds, String incidentName, Integer incidentId, String incidentSource) throws ElasticsearchIndexDocumentUpdateException;
 
     List<AlertType> getAlertsByIds(List<String> ids) throws UtmElasticsearchException;
+
+    void updateStatusAndTag(List<String> alertIds, int status, String statusObservation) throws UtmElasticsearchException,
+            IOException, ElasticsearchIndexDocumentUpdateException;
 }

backend/src/main/java/com/park/utmstack/service/impl/UtmAlertServiceImpl.java

@@ -175,6 +175,7 @@ public void updateStatus(List<String> alertIds, int status, String statusObserva
             String attemptMsg = String.format("Attempt to update status to %1$s for alerts with ids: %2$s",
                 AlertStatus.getByCode(status).getName(), alertsIds);
             eventService.createEvent(attemptMsg, ApplicationEventType.ALERT_STATUS_UPDATE_ATTEMPT, extra);
+
             String ruleScript = "ctx._source.status=%1$s;" +
                     "ctx._source.statusLabel='%2$s';" +
                     "ctx._source.statusObservation=\"%3$s\";";
@@ -200,6 +201,42 @@ public void updateStatus(List<String> alertIds, int status, String statusObserva
         }
     }
 
+    public void updateStatusAndTag(List<String> alertIds, int status, String statusObservation) {
+
+        updateStatus(alertIds, status, statusObservation);
+
+        if (status == AlertStatus.COMPLETED.getCode()) {
+            String alertsIds = String.join(",", alertIds);
+            Map<String, Object> extra = Map.of(
+                    "alertIds", alertsIds,
+                    "newStatus", status
+            );
+
+            String attemptMsg = String.format("Attempt to mark alerts as false positive for ids: %s", alertsIds);
+            eventService.createEvent(attemptMsg, ApplicationEventType.ALERT_STATUS_UPDATE_ATTEMPT, extra);
+
+            // Script para modificar el tag
+            String script = String.format("if (ctx._source.tags == null) { ctx._source.tags = []; } " +
+                    "if (!ctx._source.tags.contains('%s')) { ctx._source.tags.add('%s'); }", Constants.FALSE_POSITIVE_TAG, Constants.FALSE_POSITIVE_TAG);
+
+            List<FilterType> filters = new ArrayList<>();
+            filters.add(new FilterType(Constants.alertIdKeyword, OperatorType.IS_ONE_OF_TERMS_OR, alertIds));
+            filters.add(new FilterType(Constants.alertParentIdKeyword, OperatorType.IS_ONE_OF_TERMS_OR, alertIds));
+
+            elasticsearchService.updateByQuery(
+                    SearchUtil.toQuery(filters),
+                    Constants.SYS_INDEX_PATTERN.get(SystemIndexPattern.ALERTS),
+                    script
+            );
+
+            String successMsg = String.format(
+                    "Alerts with ids %s marked as false positive", alertsIds
+            );
+            eventService.createEvent(successMsg, ApplicationEventType.ALERT_NOTE_UPDATE_SUCCESS, extra);
+        }
+    }
+
+
     @Override
     public void updateTags(List<String> alertIds, List<String> tags, Boolean createRule) throws
             ElasticsearchIndexDocumentUpdateException {

backend/src/main/java/com/park/utmstack/util/exceptions/ElasticsearchIndexDocumentUpdateException.java

@@ -4,4 +4,4 @@ public class ElasticsearchIndexDocumentUpdateException extends RuntimeException
     public ElasticsearchIndexDocumentUpdateException(String message) {
         super(message);
     }
-}
+}

backend/src/main/java/com/park/utmstack/web/rest/UtmAlertResource.java

@@ -6,7 +6,9 @@
 import com.park.utmstack.service.application_events.ApplicationEventService;
 import com.park.utmstack.util.AlertUtil;
 import com.park.utmstack.util.ResponseUtil;
+import com.park.utmstack.util.enums.AlertStatus;
 import com.park.utmstack.web.rest.util.HeaderUtil;
+import lombok.Data;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpStatus;
@@ -50,6 +52,9 @@ public UtmAlertResource(UtmAlertService utmAlertService,
     )
     public ResponseEntity<Void> updateAlertStatus(@RequestBody UpdateAlertStatusRequestBody rq) throws IOException {
         final String ctx = CLASSNAME + ".updateAlertStatus";
+        if (rq.getStatus() == AlertStatus.COMPLETED.getCode() && rq.isAddFalsePositiveTag()) {
+            utmAlertService.updateStatusAndTag(rq.getAlertIds(), rq.getStatus(), rq.getStatusObservation());
+        }
         utmAlertService.updateStatus(rq.getAlertIds(), rq.getStatus(), rq.getStatusObservation());
 
         return ResponseEntity.ok().build();
@@ -145,36 +150,14 @@ public void setCreateRule(Boolean createRule) {
         }
     }
 
+    @Data
     public static class UpdateAlertStatusRequestBody {
         @NotNull
         private List<String> alertIds;
         private String statusObservation;
         @NotNull
         private int status;
-
-        public List<String> getAlertIds() {
-            return alertIds;
-        }
-
-        public void setAlertIds(List<String> alertIds) {
-            this.alertIds = alertIds;
-        }
-
-        public String getStatusObservation() {
-            return statusObservation;
-        }
-
-        public void setStatusObservation(String statusObservation) {
-            this.statusObservation = statusObservation;
-        }
-
-        public int getStatus() {
-            return status;
-        }
-
-        public void setStatus(int status) {
-            this.status = status;
-        }
+        boolean addFalsePositiveTag;
     }
 
     public static class UpdateAlertSolutionRequestBody {