Feature/triage malicious events #3204

ayushaga14 · 2025-09-19T04:45:58Z

No description provided.

gauravakto · 2025-09-19T07:34:00Z

apps/dashboard/src/main/java/com/akto/action/threat_detection/DashboardMaliciousEvent.java

+  public String getStatus() {
+    return status;
+  }
+
+  public void setStatus(String status) {
+    this.status = status;
+  }


just check once existing data should not fail...

When I added the new metadata field, there were issues in loading threat dashboard because old data did not have this field.

gauravakto · 2025-09-19T07:47:54Z

apps/dashboard/src/main/java/com/akto/action/threat_detection/SuspectSampleDataAction.java

 import com.akto.dto.type.URLMethods;
 import com.akto.proto.generated.threat_detection.service.dashboard_service.v1.FetchAlertFiltersResponse;
 import com.akto.proto.generated.threat_detection.service.dashboard_service.v1.ListMaliciousRequestsResponse;
+import com.akto.proto.generated.threat_detection.service.dashboard_service.v1.UpdateMaliciousEventStatusRequest;


Next time we can give this to intern. We need to clean up this mess...

Use DAO, DTO like dashboard.

See how can we utilise grpc more effectively

gauravakto · 2025-09-19T09:38:19Z

apps/threat-detection-backend/src/main/java/com/akto/threat/backend/router/DashboardRouter.java

+                Map<String, Object> request = null;
+                try {
+                    request = new com.fasterxml.jackson.databind.ObjectMapper().readValue(
+                        reqBody.asString(), Map.class);
+                } catch (Exception e) {


Why the difference ? 2 apis are proto based these are json based ?

gauravakto · 2025-09-19T09:42:49Z

...t-detection-backend/src/main/java/com/akto/threat/backend/service/MaliciousEventService.java

+    // Handle status filter
+    if (filter.hasStatusFilter()) {
+      String statusFilter = filter.getStatusFilter();
+      if ("UNDER_REVIEW".equals(statusFilter)) {


Use Constants instead of strings "UNDER_REVEIW"? Some where in libs maybe so it can be used everywhere ?

gauravakto · 2025-09-19T09:45:24Z

...t-detection-backend/src/main/java/com/akto/threat/backend/service/MaliciousEventService.java

+
+      MaliciousEventModel.Status eventStatus = MaliciousEventModel.Status.valueOf(status.toUpperCase());
+
+      Bson filter = Filters.eq("_id", eventId);
+      Bson update = Updates.set("status", eventStatus.toString());
+
+      boolean updateSuccess = coll.updateOne(filter, update).getModifiedCount() > 0;      
+      return updateSuccess;
+    } catch (Exception e) {
+      logger.error("Error updating malicious event status", e);
+      return false;
+    }
+  }
+
+  public int bulkUpdateMaliciousEventStatus(String accountId, List<String> eventIds, String status) {
+    int updatedCount = 0;
+    try {
+      logger.info("Bulk updating events for account " + accountId + " with IDs: " + eventIds + " to status: " + status);
+


Use findAndModify instead to keep the query atomic.

Create a single API for these in case of single event Updation we cam simply send one eventId in the list

gauravakto · 2025-09-19T09:47:55Z

...t-detection-backend/src/main/java/com/akto/threat/backend/service/MaliciousEventService.java

+      }
+
+      // Handle status filter (for current tab)
+      String statusFilter = (String) filter.get("statusFilter");


Repeated code, create function out of this.

gauravakto · 2025-09-19T09:50:36Z

...t-detection-backend/src/main/java/com/akto/threat/backend/service/MaliciousEventService.java

+  public int bulkDeleteMaliciousEvents(String accountId, List<String> eventIds) {
+    try {
+      MongoCollection<MaliciousEventModel> coll =
+          this.mongoClient
+              .getDatabase(accountId)
+              .getCollection(
+                  MongoDBCollection.ThreatDetection.MALICIOUS_EVENTS, MaliciousEventModel.class);
+
+      Document query = new Document("_id", new Document("$in", eventIds));
+      long deletedCount = coll.deleteMany(query).getDeletedCount();
+
+      logger.info("Deleted " + deletedCount + " malicious events");
+      return (int) deletedCount;
+    } catch (Exception e) {
+      logger.error("Error bulk deleting malicious events", e);
+      return 0;
+    }
+  }
+
+  public int bulkDeleteFilteredEvents(String accountId, Map<String, Object> filter) {
+    try {
+      MongoCollection<MaliciousEventModel> coll =
+          this.mongoClient
+              .getDatabase(accountId)


These two APIs bulkDeleteMaliciousEvents, bulkDeleteFilteredEvents are also unnecessary, since most of the code is repeated.

Just send an key action: UPDATE/DELETE from the FE and use that.

More APIs, more code maintainence, more bugs. 😛

gauravakto · 2025-09-19T10:25:45Z

...d/web/polaris_web/web/src/apps/dashboard/pages/threat_detection/components/SampleDetails.jsx

+        try {
+            const response = await threatDetectionApi.updateMaliciousEventStatus(eventId, newStatus);
+            if (response?.updateSuccess) {
+                console.log(`Event successfully marked as ${newStatus.toLowerCase()}`);


console log remove

gauravakto · 2025-09-19T10:26:04Z

...d/web/polaris_web/web/src/apps/dashboard/pages/threat_detection/components/SampleDetails.jsx

+                const statusText = newStatus === 'UNDER_REVIEW' ? 'marked for review' :
+                                 newStatus === 'IGNORED' ? 'ignored' : 'reactivated';
+                func.setToast(true, false, `Event ${statusText} successfully`);


constants for strings

gauravakto · 2025-09-19T10:26:55Z

...rd/web/polaris_web/web/src/apps/dashboard/pages/threat_detection/components/SusDataTable.jsx

+    console.log(`Selected IDs for ${label.ing}:`, selectedIds);
+
+    if (!selectedIds || selectedIds.length === 0) {
+      console.error(`No IDs selected for ${label.ing}`);


remove consoles from everywhere

gauravakto · 2025-09-19T10:30:12Z

.../threat-detection-backend/src/main/java/com/akto/threat/backend/cache/IgnoredEventCache.java

+        return url + ":" + filterId;
+    }
+
+    public static boolean isIgnoredInCache(String accountId, String url, String filterId) {


Edge case: can handle maybe ? On deletion or status change from ignored to active remove from cache as well ?

cache will reload in 5 mins anyways, so decided to not put any additional logic since we could wait for that duration. Can add if needed

gauravakto

Please check.

We should have at most 2 APIs.

bulkUpdateEvents -> eventIds !=null then do the eventIds based. Else do filterBased.

bulkDeleteEvents -> Same

Move the filterHandling common in update and delete to one function

Merge the bulkUpdateEvents and bulkUpdateFilteredEvents into one bulkUpdateEvents

bulkDeleteEvents.

gauravakto · 2025-09-19T10:35:45Z

...t-detection-backend/src/main/java/com/akto/threat/backend/service/MaliciousEventService.java

+      // Get all matching events for cache management
+      List<MaliciousEventModel> eventsToUpdate = new ArrayList<>();
+      try (MongoCursor<MaliciousEventModel> cursor = coll.find(query).cursor()) {


we not doing anything with eventsToUpdate then why fetch them ??

gauravakto · 2025-09-22T04:49:45Z

apps/dashboard/src/main/java/com/akto/action/threat_detection/SuspectSampleDataAction.java

+    if (this.eventId != null && !this.eventId.isEmpty()) {
+      // Single event update
+      requestBuilder.setEventId(this.eventId);
+    } else if (this.eventIds != null && !this.eventIds.isEmpty()) {
+      // Bulk update by IDs
+      requestBuilder.addAllEventIds(this.eventIds);


Nitpick: can ignore.

Why not just use the eventIds ? In case of one id the list size will be 1

gauravakto · 2025-09-22T04:59:17Z

...t-detection-backend/src/main/java/com/akto/threat/backend/service/MaliciousEventService.java

+      MongoCollection<MaliciousEventModel> coll =
+          this.mongoClient
+              .getDatabase(accountId)
+              .getCollection(


re-use in functions. most code is same.

gauravakto · 2025-09-22T05:02:16Z

apps/dashboard/src/main/java/com/akto/action/threat_detection/SuspectSampleDataAction.java

+
+    if (this.eventId != null && !this.eventId.isEmpty()) {
+      // Single event delete
+      requestBuilder.addEventIds(this.eventId);
+    } else if (this.eventIds != null && !this.eventIds.isEmpty()) {
+      // Bulk delete by IDs
+      requestBuilder.addAllEventIds(this.eventIds);
+    } else {
+      // Delete by filter
+      Filter.Builder filterBuilder = buildFilterFromParams();
+      requestBuilder.setFilter(filterBuilder);


move common parts to function ?

gauravakto · 2025-09-22T05:02:29Z

apps/dashboard/src/main/java/com/akto/action/threat_detection/SuspectSampleDataAction.java

+  }
+
+  public String getStatus() {
+    return status;
+  }
+
+  public void setStatus(String status) {
+    this.status = status;
+  }
+
+  public boolean isUpdateSuccess() {


lombok getter seter.

ayushaga14 added 8 commits September 12, 2025 16:47

add triage option and introduce tabs in activity table

3de0b6f

avoid window reload on state change

0132c94

avoid window reload on state change

5cec1ab

add bulk triage selector

66b8dff

add under review, ignored states

b784741

ui changes and add test

4981221

fix

2bd17d8

remove logs

b59993b

gauravakto reviewed Sep 19, 2025

View reviewed changes

remove unused ui changes

d301553

gauravakto reviewed Sep 19, 2025

View reviewed changes

ayushaga14 added 2 commits September 19, 2025 13:21

remove repetitve ui code

e3b5c5d

remove repetitve ui code

c7cda56

gauravakto reviewed Sep 19, 2025

View reviewed changes

gauravakto requested changes Sep 19, 2025

View reviewed changes

gauravakto reviewed Sep 19, 2025

View reviewed changes

ayushaga14 added 6 commits September 19, 2025 17:40

resolve comments

ca00f44

remove unused code

570bc6b

remove ui logs

55b3e92

add check on url, attack type filter

a59fa48

backemrge

279b541

fix struts definition

54db882

gauravakto reviewed Sep 22, 2025

View reviewed changes

Resolve comments

be6d0d0

gauravakto approved these changes Sep 22, 2025

View reviewed changes

ayushaga14 merged commit 69fc56c into master Sep 22, 2025
2 of 3 checks passed

Feature/triage malicious events #3204

Feature/triage malicious events #3204

Uh oh!

Conversation

ayushaga14 commented Sep 19, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gauravakto Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gauravakto Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gauravakto left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

gauravakto Sep 19, 2025 •

edited

Loading

gauravakto Sep 19, 2025 •

edited

Loading