feat(security): a Detections page for audit log detections

apps/landing/src/content/docs/alerting/alert-rules.md

@@ -203,6 +203,32 @@ The response lists the value and status of each window per group in `series`, an
 
 `POST /v2/alerts/rules/test` evaluates a rule once against current data. Set `send_notification` to `true` to also deliver a test notification. See the [API reference](/docs/reference/api) for every endpoint and field.
 
+## Audit log detections
+
+A **detection** is an alert rule that counts audit events. It fires when a set number of matching events arrive within a window, for example 5 or more failed sign-ins in 10 minutes. It is not one of the query modes above: organization admins create, edit and delete detections under **Security → Detections**, and the alert rules API does not create or change them.
+
+A detection matches events by **Platform**, **Category** and **Outcome**, each of which can stay on **Any**, and optionally by one exact **Action**, written as the platform names it, such as `team.member.role.updated`. With no filters it counts every audit event. It cannot match on who acted: a detection never names a person.
+
+| Field    | Values                                      |
+| -------- | ------------------------------------------- |
+| Count    | 1 to 100,000 events                         |
+| Window   | 5 minutes to 24 hours                       |
+| Severity | Warning or Critical                         |
+| Notify   | Up to 20 notification destinations, or none |
+
+An organization can have up to 50 detections. Each one is checked every minute.
+
+There are two ways to start one:
+
+- Open **Security → Detections** and click **New detection**. While the organization has no detections, the page lists five ready-made ones: a member added or removed, a permission or role changed, a credential created, rotated or revoked, a burst of refused requests, and repeated sign-in failures. Picking one fills in the editor. Nothing is created until you save.
+- Filter the audit log under **Security → Audit log** and click **Alert on these events**. The editor opens with the platform, category and outcome you filtered by. An actor filter is not carried over.
+
+When a detection fires it opens an [incident](/docs/alerting/incidents) and notifies its [destinations](/docs/alerting/notification-destinations). The notification carries the number of matching events, never an event or who caused it. A detection with no destination still opens the incident, and nobody is notified.
+
+Every member of the organization can see a detection's name and that it fired. The events it counted are in the audit log, which only organization admins can read.
+
+Deleting a detection also deletes the incidents it opened, open ones included.
+
 ## Troubleshooting
 
 - **The rule never fires.** Open the rule and look at its **Checks**. **Skipped** checks mean the window had no data or fewer samples than **Minimum samples**. In the editor, the chart says how many windows would be skipped and why. Check the service names and environments against what is arriving.

apps/web/src/lab/entries/security.ts

@@ -6,12 +6,18 @@ import * as AuditLogPage from "../../page/security/audit-log/model"
 import * as AuditLogUpdate from "../../page/security/audit-log/update"
 import { view as auditLogView } from "../../page/security/audit-log/view"
 import * as DependenciesPage from "../../page/security/dependencies/model"
+import * as DetectionFormPage from "../../page/security/detection-form/model"
+import * as DetectionFormUpdate from "../../page/security/detection-form/update"
+import { view as detectionFormView } from "../../page/security/detection-form/view"
+import * as DetectionsPage from "../../page/security/detections/model"
+import * as DetectionsUpdate from "../../page/security/detections/update"
+import { view as detectionsView } from "../../page/security/detections/view"
 import * as DependenciesUpdate from "../../page/security/dependencies/update"
 import { view as dependenciesView } from "../../page/security/dependencies/view"
 import * as FindingPage from "../../page/security/finding/model"
 import * as FindingUpdate from "../../page/security/finding/update"
 import { breadcrumbsOf as findingCrumbs, view as findingView } from "../../page/security/finding/view"
-import { breadcrumbsOf as tabsCrumbs } from "../../page/security/kit/layout"
+import { breadcrumbsOf as tabsCrumbs, detectionFormCrumbs } from "../../page/security/kit/layout"
 import * as RunPage from "../../page/security/run/model"
 import * as RunUpdate from "../../page/security/run/update"
 import { breadcrumbsOf as runCrumbs, view as runView } from "../../page/security/run/view"
@@ -34,6 +40,8 @@ const Model = Schema.Struct({
 	finding: Schema.NullOr(FindingPage.Model),
 	telemetry: Schema.NullOr(TelemetryPage.Model),
 	auditLog: Schema.NullOr(AuditLogPage.Model),
+	detections: Schema.NullOr(DetectionsPage.Model),
+	detectionForm: Schema.NullOr(DetectionFormPage.Model),
 	dependencies: Schema.NullOr(DependenciesPage.Model),
 })
 type Model = typeof Model.Type
@@ -44,6 +52,8 @@ const Message = defineMessageUnion({
 	GotFindingMessage: { message: FindingPage.Message },
 	GotTelemetryMessage: { message: TelemetryPage.Message },
 	GotAuditLogMessage: { message: AuditLogPage.Message },
+	GotDetectionsMessage: { message: DetectionsPage.Message },
+	GotDetectionFormMessage: { message: DetectionFormPage.Message },
 	GotDependenciesMessage: { message: DependenciesPage.Message },
 })
 type Message = typeof Message.Type
@@ -71,6 +81,8 @@ const init = (input: typeof Flags.Type) => {
 		finding: null,
 		telemetry: null,
 		auditLog: null,
+		detections: null,
+		detectionForm: null,
 		dependencies: null,
 	}
 	switch (built._tag) {
@@ -109,6 +121,20 @@ const init = (input: typeof Flags.Type) => {
 					Message.GotAuditLogMessage({ message }),
 				),
 			}
+		case "Detections":
+			return {
+				model: { ...empty, detections: built.step.model },
+				commands: Command.mapMessages(built.step.commands, (message) =>
+					Message.GotDetectionsMessage({ message }),
+				),
+			}
+		case "DetectionForm":
+			return {
+				model: { ...empty, detectionForm: built.step.model },
+				commands: Command.mapMessages(built.step.commands, (message) =>
+					Message.GotDetectionFormMessage({ message }),
+				),
+			}
 		case "Dependencies":
 			return {
 				model: { ...empty, dependencies: built.step.model },
@@ -171,6 +197,26 @@ const update = (model: Model, message: Message) =>
 				),
 			}
 		},
+		GotDetectionsMessage: ({ message: inner }) => {
+			if (model.detections === null) return { model }
+			const next = DetectionsUpdate.update(model.detections, inner, context)
+			return {
+				model: { ...model, detections: next.model },
+				commands: Command.mapMessages(Arr.filter(next.commands ?? [], isLocalCommand), (child) =>
+					Message.GotDetectionsMessage({ message: child }),
+				),
+			}
+		},
+		GotDetectionFormMessage: ({ message: inner }) => {
+			if (model.detectionForm === null) return { model }
+			const next = DetectionFormUpdate.update(model.detectionForm, inner, context)
+			return {
+				model: { ...model, detectionForm: next.model },
+				commands: Command.mapMessages(Arr.filter(next.commands ?? [], isLocalCommand), (child) =>
+					Message.GotDetectionFormMessage({ message: child }),
+				),
+			}
+		},
 		GotDependenciesMessage: ({ message: inner }) => {
 			if (model.dependencies === null) return { model }
 			const next = DependenciesUpdate.update(model.dependencies, inner, context)
@@ -224,15 +270,33 @@ const view = (model: Model, h: HtmlBuilder<Message>): Html =>
 								viewInputs: { context },
 								toParentMessage: (message) => Message.GotDependenciesMessage({ message }),
 							})
-						: model.auditLog !== null
+						: model.detections !== null
 							? h.submodel({
-									slotId: "security-lab-audit-log",
-									model: model.auditLog,
-									view: auditLogView,
+									slotId: "security-lab-detections",
+									model: model.detections,
+									view: detectionsView,
 									viewInputs: { context },
-									toParentMessage: (message) => Message.GotAuditLogMessage({ message }),
+									toParentMessage: (message) => Message.GotDetectionsMessage({ message }),
 								})
-							: h.empty
+							: model.detectionForm !== null
+								? h.submodel({
+										slotId: "security-lab-detection-form",
+										model: model.detectionForm,
+										view: detectionFormView,
+										viewInputs: { context },
+										toParentMessage: (message) =>
+											Message.GotDetectionFormMessage({ message }),
+									})
+								: model.auditLog !== null
+									? h.submodel({
+											slotId: "security-lab-audit-log",
+											model: model.auditLog,
+											view: auditLogView,
+											viewInputs: { context },
+											toParentMessage: (message) =>
+												Message.GotAuditLogMessage({ message }),
+										})
+									: h.empty
 
 export const lab = defineShellLab("Security Center", {
 	Model,
@@ -256,5 +320,9 @@ export const lab = defineShellLab("Security Center", {
 							? tabsCrumbs("dependencies")
 							: model.auditLog !== null
 								? tabsCrumbs("auditLog")
-								: [],
+								: model.detections !== null
+									? tabsCrumbs("detections")
+									: model.detectionForm !== null
+										? detectionFormCrumbs()
+										: [],
 })

apps/web/src/lab/security-detections-fixture.ts

@@ -0,0 +1,98 @@
+import {
+	AlertDestinationId,
+	AlertRuleId,
+	type AuditDetection,
+	type AuditDetectionListResponse,
+} from "@maple/domain/http"
+import type { AlertDestinationRow } from "@maple/web-data/collections/alerts"
+import { Array as Arr, Schema } from "effect"
+
+// Audit log detections for the Security hub's lab and scene tests: the shapes the list has to
+// draw (an exact action, no filters at all, one switched off, one that notifies nobody).
+
+const HOUR = 3_600_000
+
+const ruleId = Schema.decodeSync(AlertRuleId)
+const destinationId = Schema.decodeSync(AlertDestinationId)
+
+export const SECURITY_CHANNEL_ID = destinationId("0199b001-0000-7000-8000-000000000001")
+export const ON_CALL_ID = destinationId("0199b001-0000-7000-8000-000000000002")
+
+/** The org's alert destinations, as the live sync delivers them. */
+export const detectionDestinationsOf = (orgId: string, nowMs: number): ReadonlyArray<AlertDestinationRow> =>
+	Arr.map(
+		[
+			{ id: SECURITY_CHANNEL_ID, name: "#security", type: "slack" },
+			{ id: ON_CALL_ID, name: "Security on-call", type: "pagerduty" },
+		],
+		(destination) => ({
+			...destination,
+			org_id: orgId,
+			enabled: true,
+			config_json: { summary: destination.name, channelLabel: null },
+			last_tested_at: null,
+			last_test_error: null,
+			disabled_at: null,
+			disabled_reason: null,
+			created_at: new Date(nowMs - 30 * 24 * HOUR).toISOString(),
+			updated_at: new Date(nowMs - 30 * 24 * HOUR).toISOString(),
+		}),
+	)
+
+type Seed = Pick<AuditDetection, "name" | "filters" | "threshold" | "windowMinutes" | "severity"> &
+	Partial<Pick<AuditDetection, "enabled" | "destinationIds">>
+
+const SEEDS: ReadonlyArray<Seed> = [
+	{
+		name: "Role changes on Vercel",
+		filters: { provider: "vercel", action: "team.member.role.updated" },
+		threshold: 1,
+		windowMinutes: 5,
+		severity: "warning",
+	},
+	{
+		name: "Burst of refused requests",
+		filters: { outcome: "denied" },
+		threshold: 10,
+		windowMinutes: 10,
+		severity: "critical",
+		destinationIds: [SECURITY_CHANNEL_ID, ON_CALL_ID],
+	},
+	{
+		name: "Credential changes on Google Cloud",
+		filters: { provider: "gcp", category: "credential" },
+		threshold: 1,
+		windowMinutes: 5,
+		severity: "warning",
+		destinationIds: [],
+	},
+	{
+		name: "Repeated sign-in failures",
+		filters: { category: "authentication", outcome: "failure" },
+		threshold: 5,
+		windowMinutes: 10,
+		severity: "critical",
+		enabled: false,
+	},
+	{
+		name: "Unusual audit volume",
+		filters: {},
+		threshold: 500,
+		windowMinutes: 60,
+		severity: "warning",
+	},
+]
+
+/** The detections of an org that set a few up, newest first. */
+export const detectionsOf = (nowMs: number): AuditDetectionListResponse => ({
+	detections: Arr.map(SEEDS, (seed, index) => ({
+		id: ruleId(`0199b002-0000-7000-8000-00000000000${index + 1}`),
+		enabled: true,
+		destinationIds: [SECURITY_CHANNEL_ID],
+		createdAt: nowMs - (index + 1) * 26 * HOUR,
+		updatedAt: nowMs - (index + 1) * 5 * HOUR,
+		...seed,
+	})),
+})
+
+export const noDetections: AuditDetectionListResponse = { detections: [] }