feat: graf (#5286)

Author: shahargl

keep/providers/grafana_provider/grafana_provider.py

@@ -241,10 +241,17 @@ def calculate_fingerprint(alert: dict) -> str:
         """
         Calculate fingerprint for alert.
         """
+
+        # First, try to get fingerprint from alert
+        fingerprint = alert.get("fingerprint", "")
+        if fingerprint:
+            logger.debug("Fingerprint provided in alert")
+            return fingerprint
+        
         labels = alert.get("labels", {})
         fingerprint = labels.get("fingerprint", "")
         if fingerprint:
-            logger.debug("Fingerprint provided in alert")
+            logger.debug("Fingerprint provided in alert labels")
             return fingerprint
 
         fingerprint_string = None

keep/providers/kibana_provider/kibana_provider.py

@@ -614,6 +614,8 @@ def _format_alert(
                 logger.warning("Could not find name in SIEM Kibana alert")
                 name = "SIEM Kibana Alert"
 
+            fingerprint = event.get("kibana", {}).get("alert", {}).get("id", "")
+
             status = event.get("kibana", {}).get("alert", {}).get("status", "")
             if not status:
                 logger.warning("Could not find status in SIEM Kibana alert")
@@ -640,6 +642,8 @@ def _format_alert(
                     "Could not extract service in SIEM Kibana alert", extra={"service": service}
                 )
                 service = None
+
+            
             alert_dto = AlertDto(
                 name=name,
                 description=description,
@@ -650,6 +654,9 @@ def _format_alert(
                 url=url,
                 **event,
             )
+            if fingerprint:
+                alert_dto.fingerprint = fingerprint
+                
             logger.info("Finished to parse SIEM Kibana alert")
             return alert_dto
         # Check if this is the new webhook format

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "keep"
-version = "0.47.6"
+version = "0.47.7"
 description = "Alerting. for developers, by developers."
 authors = ["Keep Alerting LTD"]
 packages = [{include = "keep"}]