Skip to content

v12 - fix(rule-flood-guard): notify only the affected tenant, without namin… - #2496

Merged
yllada merged 1 commit into
release/v12.0.0from
backlog/v12-rule-flood-guard-notification-scope
Aug 20, 2026
Merged

v12 - fix(rule-flood-guard): notify only the affected tenant, without namin…#2496
yllada merged 1 commit into
release/v12.0.0from
backlog/v12-rule-flood-guard-notification-scope

Conversation

@yllada

@yllada yllada commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

The flood notification also went to the platform tenant, so the operator would
keep the visibility they had before the disable became per-tenant. In an MSSP
that means every flood in every tenant pings the operator — the same alert
fatigue this plugin exists to prevent. Only the affected tenant is notified now.

…g it

The flood notification went to the tenant whose rule was disabled and also
to the platform tenant, so the operator would keep the instance-wide
visibility they had before the disable became per-tenant. In an MSSP that
turns every flood in every tenant into a ping on the operator's bell, which
is the same alert fatigue this plugin exists to prevent. The tenant is the
one who can act on it, so the copy is gone.

With no operator copy left, naming the tenant in the message was noise: the
only reader is the affected tenant, and showing them their own UUID tells
them nothing. The message now speaks to them directly. The tenant is still
in the structured log, which is where operators read from.
@github-actions

Copy link
Copy Markdown

✅ AI review — Clean

No issues detected in this diff.

architecture (gemini-3-flash-lite) — clean

Summary: Modified rule-flood-guard plugin notification logic to no longer send copies to the platform tenant.

No findings.

bugs (gemini-3-flash-lite) — clean

Summary: Rule flood guard plugin updated to remove platform tenant notification copies.

No findings.

security (gemini-3-flash-lite) — clean

Summary: Routine refactoring of rule-flood-guard notification logic to remove platform-wide tenant broadcast.

No findings.

🔴 go-deps — pending updates

🔍 Discovered 30 Go projects

❌ Could not inspect the following projects (run 'go mod tidy' there):

## ./plugins/events
go: github.com/threatwinds/go-sdk@v1.1.27-0.20260811073440-251cb9d842cd: read "https://proxy.golang.org/github.com/threatwinds/go-sdk/@v/v1.1.27-0.20260811073440-251cb9d842cd.mod": stream error: stream ID 19; INTERNAL_ERROR; received from peer

@yllada
yllada merged commit 6a9cd68 into release/v12.0.0 Aug 20, 2026
1 check passed
@yllada
yllada deleted the backlog/v12-rule-flood-guard-notification-scope branch August 20, 2026 18:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant