Security Alert Evaluator
Component Detail
Service Layer
medium complexity
backend
1
Dependencies
1
Dependents
1
Entities
0
Integrations
Description
Evaluates computed security metrics against configurable threshold rules to generate actionable alerts. Assigns severity levels and deduplicates alerts across evaluation cycles. Persists active alerts for dashboard display and supports future server-sent event or polling delivery.
security-alert-evaluator
Responsibilities
- Evaluate metrics against threshold rules (e.g., failed logins > 10 in 5 min)
- Assign severity level (low, medium, high, critical) to each triggered rule
- Deduplicate alerts to avoid flooding the dashboard across polling cycles
- Persist active alerts and expose GET /api/v1/admin/security/alerts
Interfaces
evaluateMetrics(metrics: SecurityMetrics, orgId: string): SecurityAlert[]
getActiveAlerts(orgId: string | null): Promise<SecurityAlert[]>
dismissAlert(alertId: string, adminId: string): Promise<void>
getAlertHistory(orgId: string, limit: number): Promise<SecurityAlert[]>
updateThresholds(orgId: string, rules: ThresholdRule[]): Promise<void>