Work / Nexus / Changelog / Day 11
Day 11: Alerts That Speak Console
Gateway GET /api/v1/alerts now maps Wazuh documents to SOCAlert camelCase, filters by severity/source/time, and hardens triage 404/504. Properties 5–7 covered.
Day 11 is a Build day: stop handing the Console raw Wazuh blobs.
What shipped
SOCAlert models. src/models/alerts.py — SOCAlert, AlertsResponse, TriageResponse with camelCase aliases (ruleName, affectedHost, athenaScenario).
Mapping + filters. src/services/alerts.py maps Wazuh rule.level → severity, rule groups → wazuh/suricata, and pulls X-Athena-Scenario from top-level, data, or HTTP headers. Filters run after map so severity/source/from/to work even when the upstream query is coarse. Limit clamps to [1, 500] (default 100).
Triage. /alerts/{id}/triage returns typed triage JSON, 404 when missing, 504 on timeout, 502 otherwise.
Tests. Eleven Gateway tests green — Properties 5–7 via Hypothesis, plus route 200/502/404/504 cases.
What I am not claiming
Wazuh Manager is not up in this environment. The client still calls /alerts; live SOC traffic waits for the baseline stack (Day 14+). The SOCAlert map also covers the original Day 32 brief; Indexer-vs-Manager path differences can still be hardened later without reopening the Console contract.
Next is Day 12: approvals from athena-agents.