[codex] reduce noisy repeated alerts with cooldown

README.md

@@ -1,72 +1,74 @@
-# telemetry-lab
-
-[![CI](https://github.com/stacknil/telemetry-lab/actions/workflows/ci.yml/badge.svg)](https://github.com/stacknil/telemetry-lab/actions/workflows/ci.yml)
-
-Small prototypes for telemetry analytics, monitoring, and detection-oriented signal processing.
-
-## Current demo
-
-`telemetry-window-demo` turns timestamped event streams into sliding-window telemetry features, simple rule-based alerts, and operator-friendly CSV and PNG outputs.
-
-## MVP workflow
-
-1. Install the package and its minimal dependencies:
-
-   ```bash
-   python -m pip install -e .
-   ```
-
-2. Run the bundled sample pipeline end-to-end:
-
-   ```bash
-   python -m telemetry_window_demo.cli run --config configs/default.yaml
-   ```
-
-The sample config reads `data/raw/sample_events.jsonl` and regenerates outputs in `data/processed/`.
-
-## Current behavior
-
-Default sample input:
-
-- JSONL event stream under `data/raw/sample_events.jsonl`
-
-Runtime input support:
-
-- `.jsonl` (default sample/demo format)
-- `.csv` (also supported by the loader)
-
-Required fields for both formats on every row/record:
-
-- `timestamp`
-- `event_type`
-- `source`
-- `target`
-- `status`
-
+# telemetry-lab
+
+[![CI](https://github.com/stacknil/telemetry-lab/actions/workflows/ci.yml/badge.svg)](https://github.com/stacknil/telemetry-lab/actions/workflows/ci.yml)
+
+Small prototypes for telemetry analytics, monitoring, and detection-oriented signal processing.
+
+## Current demo
+
+`telemetry-window-demo` turns timestamped event streams into sliding-window telemetry features, simple rule-based alerts, and operator-friendly CSV and PNG outputs.
+
+## MVP workflow
+
+1. Install the package and its minimal dependencies:
+
+   ```bash
+   python -m pip install -e .
+   ```
+
+2. Run the bundled sample pipeline end-to-end:
+
+   ```bash
+   python -m telemetry_window_demo.cli run --config configs/default.yaml
+   ```
+
+The sample config reads `data/raw/sample_events.jsonl` and regenerates outputs in `data/processed/`.
+
+## Current behavior
+
+Default sample input:
+
+- JSONL event stream under `data/raw/sample_events.jsonl`
+
+Runtime input support:
+
+- `.jsonl` (default sample/demo format)
+- `.csv` (also supported by the loader)
+
+Required fields for both formats on every row/record:
+
+- `timestamp`
+- `event_type`
+- `source`
+- `target`
+- `status`
+
 With the bundled sample data, the default run currently produces:
 
 - `41` normalized events
 - `24` windows
-- `53` alerts
-
-## Outputs
-
-Running the default command regenerates:
-
-- `data/processed/features.csv`
-- `data/processed/alerts.csv`
-- `data/processed/event_count_timeline.png`
-- `data/processed/error_rate_timeline.png`
-- `data/processed/alerts_timeline.png`
-
-## Scope
-
-This repository is a portfolio prototype, not a production monitoring system.
-
-## Limitations
-
-- No real-time ingestion
-- No streaming state management
-- No alert routing or case management
-- No dashboard or service deployment
-- Sample-data driven only
+- `12` alerts after applying a `60` second per-rule cooldown
+
+The default config suppresses repeated alerts with the same `rule_name` until `60` seconds have elapsed since that rule's last emitted alert. Different rules can still alert on the same window.
+
+## Outputs
+
+Running the default command regenerates:
+
+- `data/processed/features.csv`
+- `data/processed/alerts.csv`
+- `data/processed/event_count_timeline.png`
+- `data/processed/error_rate_timeline.png`
+- `data/processed/alerts_timeline.png`
+
+## Scope
+
+This repository is a portfolio prototype, not a production monitoring system.
+
+## Limitations
+
+- No real-time ingestion
+- No streaming state management
+- No alert routing or case management
+- No dashboard or service deployment
+- Sample-data driven only

configs/default.yaml

@@ -1,46 +1,47 @@
-input_path: data/raw/sample_events.jsonl
-output_dir: data/processed
-
-time:
-  timestamp_col: timestamp
-  window_size_seconds: 60
-  step_size_seconds: 10
-
-features:
-  count_event_types:
-    - login_fail
-    - login_success
-    - config_change
-    - malware_alert
-    - policy_denied
-  error_statuses:
-    - fail
-    - blocked
-  severity_levels:
-    - high
-    - critical
-
+input_path: data/raw/sample_events.jsonl
+output_dir: data/processed
+
+time:
+  timestamp_col: timestamp
+  window_size_seconds: 60
+  step_size_seconds: 10
+
+features:
+  count_event_types:
+    - login_fail
+    - login_success
+    - config_change
+    - malware_alert
+    - policy_denied
+  error_statuses:
+    - fail
+    - blocked
+  severity_levels:
+    - high
+    - critical
+
 rules:
+  cooldown_seconds: 60
   high_error_rate:
     threshold: 0.30
     severity: medium
-  login_fail_burst:
-    threshold: 8
-    severity: high
-  high_severity_spike:
-    threshold: 3
-    severity: high
-  persistent_high_error:
-    threshold: 0.25
-    consecutive_windows: 2
-    severity: medium
-  source_spread_spike:
-    absolute_threshold: 10
-    multiplier: 1.3
-    severity: medium
-  rare_event_repeat:
-    threshold: 2
-    event_types:
-      - malware_alert
-      - policy_denied
-    severity: high
+  login_fail_burst:
+    threshold: 8
+    severity: high
+  high_severity_spike:
+    threshold: 3
+    severity: high
+  persistent_high_error:
+    threshold: 0.25
+    consecutive_windows: 2
+    severity: medium
+  source_spread_spike:
+    absolute_threshold: 10
+    multiplier: 1.3
+    severity: medium
+  rare_event_repeat:
+    threshold: 2
+    event_types:
+      - malware_alert
+      - policy_denied
+    severity: high

data/processed/alerts.csv

@@ -1,54 +1,13 @@
-alert_time,rule_name,severity,window_start,window_end,message
-2026-03-10T10:01:10Z,high_error_rate,medium,2026-03-10T10:00:10Z,2026-03-10T10:01:10Z,error_rate 0.60 exceeded 0.30
-2026-03-10T10:01:10Z,persistent_high_error,medium,2026-03-10T10:00:10Z,2026-03-10T10:01:10Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:01:20Z,high_error_rate,medium,2026-03-10T10:00:20Z,2026-03-10T10:01:20Z,error_rate 0.77 exceeded 0.30
-2026-03-10T10:01:20Z,login_fail_burst,high,2026-03-10T10:00:20Z,2026-03-10T10:01:20Z,"login_fail_count reached 10, threshold is 8"
-2026-03-10T10:01:20Z,persistent_high_error,medium,2026-03-10T10:00:20Z,2026-03-10T10:01:20Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:01:20Z,source_spread_spike,medium,2026-03-10T10:00:20Z,2026-03-10T10:01:20Z,unique_sources rose from 8 to 11 (1.38x)
-2026-03-10T10:01:30Z,high_error_rate,medium,2026-03-10T10:00:30Z,2026-03-10T10:01:30Z,error_rate 0.83 exceeded 0.30
-2026-03-10T10:01:30Z,login_fail_burst,high,2026-03-10T10:00:30Z,2026-03-10T10:01:30Z,"login_fail_count reached 10, threshold is 8"
-2026-03-10T10:01:30Z,persistent_high_error,medium,2026-03-10T10:00:30Z,2026-03-10T10:01:30Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:01:40Z,high_error_rate,medium,2026-03-10T10:00:40Z,2026-03-10T10:01:40Z,error_rate 0.93 exceeded 0.30
-2026-03-10T10:01:40Z,login_fail_burst,high,2026-03-10T10:00:40Z,2026-03-10T10:01:40Z,"login_fail_count reached 12, threshold is 8"
-2026-03-10T10:01:40Z,persistent_high_error,medium,2026-03-10T10:00:40Z,2026-03-10T10:01:40Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:01:50Z,high_error_rate,medium,2026-03-10T10:00:50Z,2026-03-10T10:01:50Z,error_rate 0.93 exceeded 0.30
-2026-03-10T10:01:50Z,login_fail_burst,high,2026-03-10T10:00:50Z,2026-03-10T10:01:50Z,"login_fail_count reached 12, threshold is 8"
-2026-03-10T10:01:50Z,persistent_high_error,medium,2026-03-10T10:00:50Z,2026-03-10T10:01:50Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:02:00Z,high_error_rate,medium,2026-03-10T10:01:00Z,2026-03-10T10:02:00Z,error_rate 0.87 exceeded 0.30
-2026-03-10T10:02:00Z,login_fail_burst,high,2026-03-10T10:01:00Z,2026-03-10T10:02:00Z,"login_fail_count reached 12, threshold is 8"
-2026-03-10T10:02:00Z,persistent_high_error,medium,2026-03-10T10:01:00Z,2026-03-10T10:02:00Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:02:10Z,high_error_rate,medium,2026-03-10T10:01:10Z,2026-03-10T10:02:10Z,error_rate 0.86 exceeded 0.30
-2026-03-10T10:02:10Z,login_fail_burst,high,2026-03-10T10:01:10Z,2026-03-10T10:02:10Z,"login_fail_count reached 11, threshold is 8"
-2026-03-10T10:02:10Z,persistent_high_error,medium,2026-03-10T10:01:10Z,2026-03-10T10:02:10Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:02:20Z,high_error_rate,medium,2026-03-10T10:01:20Z,2026-03-10T10:02:20Z,error_rate 0.83 exceeded 0.30
-2026-03-10T10:02:20Z,high_severity_spike,high,2026-03-10T10:01:20Z,2026-03-10T10:02:20Z,high_severity_count reached 3
-2026-03-10T10:02:20Z,login_fail_burst,high,2026-03-10T10:01:20Z,2026-03-10T10:02:20Z,"login_fail_count reached 8, threshold is 8"
-2026-03-10T10:02:20Z,persistent_high_error,medium,2026-03-10T10:01:20Z,2026-03-10T10:02:20Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:02:30Z,high_error_rate,medium,2026-03-10T10:01:30Z,2026-03-10T10:02:30Z,error_rate 0.83 exceeded 0.30
-2026-03-10T10:02:30Z,high_severity_spike,high,2026-03-10T10:01:30Z,2026-03-10T10:02:30Z,high_severity_count reached 5
-2026-03-10T10:02:30Z,persistent_high_error,medium,2026-03-10T10:01:30Z,2026-03-10T10:02:30Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:02:30Z,rare_event_repeat_malware_alert,high,2026-03-10T10:01:30Z,2026-03-10T10:02:30Z,malware_alert repeated 3 times in one window
-2026-03-10T10:02:40Z,high_error_rate,medium,2026-03-10T10:01:40Z,2026-03-10T10:02:40Z,error_rate 0.64 exceeded 0.30
-2026-03-10T10:02:40Z,high_severity_spike,high,2026-03-10T10:01:40Z,2026-03-10T10:02:40Z,high_severity_count reached 4
-2026-03-10T10:02:40Z,persistent_high_error,medium,2026-03-10T10:01:40Z,2026-03-10T10:02:40Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:02:40Z,rare_event_repeat_malware_alert,high,2026-03-10T10:01:40Z,2026-03-10T10:02:40Z,malware_alert repeated 3 times in one window
-2026-03-10T10:02:50Z,high_error_rate,medium,2026-03-10T10:01:50Z,2026-03-10T10:02:50Z,error_rate 0.67 exceeded 0.30
-2026-03-10T10:02:50Z,high_severity_spike,high,2026-03-10T10:01:50Z,2026-03-10T10:02:50Z,high_severity_count reached 4
-2026-03-10T10:02:50Z,persistent_high_error,medium,2026-03-10T10:01:50Z,2026-03-10T10:02:50Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:02:50Z,rare_event_repeat_malware_alert,high,2026-03-10T10:01:50Z,2026-03-10T10:02:50Z,malware_alert repeated 3 times in one window
-2026-03-10T10:03:00Z,high_error_rate,medium,2026-03-10T10:02:00Z,2026-03-10T10:03:00Z,error_rate 0.82 exceeded 0.30
-2026-03-10T10:03:00Z,high_severity_spike,high,2026-03-10T10:02:00Z,2026-03-10T10:03:00Z,high_severity_count reached 3
-2026-03-10T10:03:00Z,persistent_high_error,medium,2026-03-10T10:02:00Z,2026-03-10T10:03:00Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:03:00Z,rare_event_repeat_malware_alert,high,2026-03-10T10:02:00Z,2026-03-10T10:03:00Z,malware_alert repeated 3 times in one window
-2026-03-10T10:03:10Z,high_error_rate,medium,2026-03-10T10:02:10Z,2026-03-10T10:03:10Z,error_rate 0.70 exceeded 0.30
-2026-03-10T10:03:10Z,high_severity_spike,high,2026-03-10T10:02:10Z,2026-03-10T10:03:10Z,high_severity_count reached 3
-2026-03-10T10:03:10Z,persistent_high_error,medium,2026-03-10T10:02:10Z,2026-03-10T10:03:10Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:03:10Z,rare_event_repeat_malware_alert,high,2026-03-10T10:02:10Z,2026-03-10T10:03:10Z,malware_alert repeated 3 times in one window
-2026-03-10T10:03:20Z,high_error_rate,medium,2026-03-10T10:02:20Z,2026-03-10T10:03:20Z,error_rate 0.56 exceeded 0.30
-2026-03-10T10:03:20Z,high_severity_spike,high,2026-03-10T10:02:20Z,2026-03-10T10:03:20Z,high_severity_count reached 3
-2026-03-10T10:03:20Z,persistent_high_error,medium,2026-03-10T10:02:20Z,2026-03-10T10:03:20Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:03:20Z,rare_event_repeat_malware_alert,high,2026-03-10T10:02:20Z,2026-03-10T10:03:20Z,malware_alert repeated 2 times in one window
-2026-03-10T10:03:30Z,high_error_rate,medium,2026-03-10T10:02:30Z,2026-03-10T10:03:30Z,error_rate 0.38 exceeded 0.30
-2026-03-10T10:03:30Z,persistent_high_error,medium,2026-03-10T10:02:30Z,2026-03-10T10:03:30Z,error_rate stayed above 0.25 for 2 windows
-2026-03-10T10:03:40Z,high_error_rate,medium,2026-03-10T10:02:40Z,2026-03-10T10:03:40Z,error_rate 0.43 exceeded 0.30
-2026-03-10T10:03:40Z,persistent_high_error,medium,2026-03-10T10:02:40Z,2026-03-10T10:03:40Z,error_rate stayed above 0.25 for 2 windows
+alert_time,rule_name,severity,window_start,window_end,message
+2026-03-10T10:01:10Z,high_error_rate,medium,2026-03-10T10:00:10Z,2026-03-10T10:01:10Z,error_rate 0.60 exceeded 0.30
+2026-03-10T10:01:10Z,persistent_high_error,medium,2026-03-10T10:00:10Z,2026-03-10T10:01:10Z,error_rate stayed above 0.25 for 2 windows
+2026-03-10T10:01:20Z,login_fail_burst,high,2026-03-10T10:00:20Z,2026-03-10T10:01:20Z,"login_fail_count reached 10, threshold is 8"
+2026-03-10T10:01:20Z,source_spread_spike,medium,2026-03-10T10:00:20Z,2026-03-10T10:01:20Z,unique_sources rose from 8 to 11 (1.38x)
+2026-03-10T10:02:10Z,high_error_rate,medium,2026-03-10T10:01:10Z,2026-03-10T10:02:10Z,error_rate 0.86 exceeded 0.30
+2026-03-10T10:02:10Z,persistent_high_error,medium,2026-03-10T10:01:10Z,2026-03-10T10:02:10Z,error_rate stayed above 0.25 for 2 windows
+2026-03-10T10:02:20Z,high_severity_spike,high,2026-03-10T10:01:20Z,2026-03-10T10:02:20Z,high_severity_count reached 3
+2026-03-10T10:02:20Z,login_fail_burst,high,2026-03-10T10:01:20Z,2026-03-10T10:02:20Z,"login_fail_count reached 8, threshold is 8"
+2026-03-10T10:02:30Z,rare_event_repeat_malware_alert,high,2026-03-10T10:01:30Z,2026-03-10T10:02:30Z,malware_alert repeated 3 times in one window
+2026-03-10T10:03:10Z,high_error_rate,medium,2026-03-10T10:02:10Z,2026-03-10T10:03:10Z,error_rate 0.70 exceeded 0.30
+2026-03-10T10:03:10Z,persistent_high_error,medium,2026-03-10T10:02:10Z,2026-03-10T10:03:10Z,error_rate stayed above 0.25 for 2 windows
+2026-03-10T10:03:20Z,high_severity_spike,high,2026-03-10T10:02:20Z,2026-03-10T10:03:20Z,high_severity_count reached 3