[JocLRojas]

Changes

• backend/modules/alerts/domain/alert.go: change UtmAlert.Events from []AlertEvent (a 2-field {id, timestamp} stub) to []json.RawMessage, and remove the now-unused AlertEvent type.
• backend/modules/alerts/usecase/related_logs.go: read event ids and timestamps from the raw payloads via gjson, matching the pattern already used for the parent alert's own events.

Reasoning

The alerts plugin denormalizes the full event document into the events column of utmstack.alerts (ClickHouse Array(JSON)), but the Go domain struct used by the API layer only had id and timestamp fields, so json.Unmarshal silently dropped every other field on the way out. The /echoes and alert-detail endpoints therefore returned hollow events while lastEvent — kept as raw JSON in the same struct — came through intact. That mismatch is what the alert drawer surfaced: the root alert's events looked complete (they arrived via the raw loganalyzer search endpoint or through lastEvent), while the events contributed by child alerts appeared as empty rows with only an id and a timestamp.

The slice-of-raw-JSON shape keeps the stored array byte-for-byte, so the API now returns exactly what the plugin wrote. The only consumer of the old stub in the backend (RelatedLogs) needed a one-line adjustment; the rest of the module (mailer, alertscoring, the main table via loganalyzer) does not read Events and is unaffected.

Issue

#2977

[github-actions]

✅ AI review — Minor findings

Only minor (medium/low) issues were found. Consider addressing them.

⚠️ architecture (silas-1.7-pro) — minor findings

Summary: Alert event model changed from typed AlertEvent to raw JSON, weakening the domain contract; validate API/persistence compatibility before merge.

• medium backend/modules/alerts/domain/alert.go:141 — UtmAlert.Events now uses []json.RawMessage and removes AlertEvent. If UtmAlert is exposed via HTTP or persisted as JSON, this changes the event contract. Keep AlertEvent or introduce an explicit DTO and confirm old/new payloads remain compatible.
• low backend/modules/alerts/usecase/related_logs.go:73 — Parsing raw events with gjson in the usecase can silently drop events with missing id/timestamp. Prefer a typed event or a shared validation helper if the event shape is part of the alert contract.

⚠️ bugs (silas-1.7-pro) — minor findings

Summary: No blocking bugs found; raw event handling may add empty IDs if event JSON lacks a string id.

• low backend/modules/alerts/usecase/related_logs.go:74 — ev.Get("id").String() returns empty when the event has no string id; add("") can inject an empty log ID into the related-logs query. Guard against empty IDs.

✅ security (silas-1.7-pro) — clean

Summary: No vulnerabilities introduced by the diff.

No findings.

🔴 go-deps — pending updates

🔍 Discovered 31 Go projects

📦 Dependencies with updates available:

  📁 ./plugins/gcp:
     - google.golang.org/api: v0.305.0 → v0.308.0

  📁 ./plugins/aws:
     - github.com/aws/aws-sdk-go-v2: v1.47.3 → v1.47.4
     - github.com/aws/aws-sdk-go-v2/config: v1.33.9 → v1.33.10
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.9 → v1.20.10
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.90.0 → v1.90.2

  📁 ./plugins/shared:
     - github.com/nats-io/nats.go: v1.54.0 → v1.55.0

  📁 ./backend:
     - github.com/aws/aws-sdk-go-v2/config: v1.33.9 → v1.33.10
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.9 → v1.20.10
     - github.com/aws/aws-sdk-go-v2/service/sts: v1.51.4 → v1.51.5
     - google.golang.org/api: v0.305.0 → v0.308.0

  📁 ./tools/rulecheck:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./agent-manager:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./log-input:
     - github.com/nats-io/nats.go: v1.54.0 → v1.55.0
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./agent:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.38

  📁 ./collectors/utmstack:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./collectors/forwarder:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./collectors/as400:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

❌ Please update dependencies before merging.