ui: enhance ux/ui

Dockerfile

@@ -1,5 +1,5 @@
 # --- UI build stage: static JS/CSS is platform-independent ---
-FROM --platform=$BUILDPLATFORM node:20-alpine AS ui-build
+FROM --platform=$BUILDPLATFORM node:26-alpine AS ui-build
 WORKDIR /ui
 COPY ui/package.json ui/package-lock.json* ./
 RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
@@ -27,7 +27,7 @@ COPY --from=ui-build /ui/dist ./ui/dist
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -installsuffix cgo -o /build/run cmd/main.go
 
 # --- Final image ---
-FROM alpine:3.21
+FROM alpine:3.24
 RUN apk add --no-cache ca-certificates tzdata
 WORKDIR /app
 COPY --from=build /build/config config

config/config.yaml

@@ -196,16 +196,23 @@ agent:
   catalog:
     persist_interval: 30s
     auto_promote_after: 100      # in detect mode, this many sightings = "known"
-    # Spike detection: a known pattern is re-flagged when its tick-level
-    # frequency suddenly exceeds the EWMA (Exponentially Weighted Moving Average) baseline by `spike_multiplier`.
-    # Two safety floors keep noise out:
-    #   - spike_min_frequency: tick must have at least this many matches
-    #     (avoids triggering on tiny absolute counts).
-    #   - spike_min_baseline_count: pattern must have been seen this many
-    #     times overall (avoids treating a barely-seen pattern's first big
-    #     tick as a spike).
-    # Set spike_multiplier: 0 to disable spike detection entirely.
-    spike_multiplier: 5.0
+    # Spike detection: a known pattern is re-flagged when its per-second match
+    # RATE jumps well above the learned normal. The bar is a z-score, so it
+    # self-scales to each pattern's own volatility — a burst on a high-volume
+    # pattern trips even though its baseline is large.
+    #   - spike_z: fire when the rate is this many standard deviations above
+    #     the learned baseline.
+    #   - spike_abs_ceiling: a hard safety net — a tick with at least this many
+    #     matches always surfaces (0 = disabled / opt-in).
+    #   - spike_sustain_ticks: require this many CONSECUTIVE spiking ticks
+    #     before firing (1 = fire on the first tick, no debounce).
+    #   - spike_min_frequency: absolute noise floor — the tick must have at
+    #     least this many matches.
+    #   - spike_min_baseline_count: warmup gate — the pattern must have been
+    #     seen this many times before the z-score is trusted.
+    spike_z: 3.0
+    spike_abs_ceiling: 0
+    spike_sustain_ticks: 1
     spike_min_frequency: 5
     spike_min_baseline_count: 20
 

examples/docker-compose/cloudwatch/config/config.yaml

@@ -56,7 +56,23 @@ agent:
   catalog:
     persist_interval: 30s
     auto_promote_after: 50
-    spike_multiplier: 5.0
+    # Spike detection: a known pattern is re-flagged when its per-second match
+    # RATE jumps well above the learned normal. The bar is a z-score, so it
+    # self-scales to each pattern's own volatility — a burst on a high-volume
+    # pattern trips even though its baseline is large.
+    #   - spike_z: fire when the rate is this many standard deviations above
+    #     the learned baseline.
+    #   - spike_abs_ceiling: a hard safety net — a tick with at least this many
+    #     matches always surfaces (0 = disabled / opt-in).
+    #   - spike_sustain_ticks: require this many CONSECUTIVE spiking ticks
+    #     before firing (1 = fire on the first tick, no debounce).
+    #   - spike_min_frequency: absolute noise floor — the tick must have at
+    #     least this many matches.
+    #   - spike_min_baseline_count: warmup gate — the pattern must have been
+    #     seen this many times before the z-score is trusted.
+    spike_z: 3.0
+    spike_abs_ceiling: 0
+    spike_sustain_ticks: 1
     spike_min_frequency: 5
     spike_min_baseline_count: 20
 

examples/docker-compose/elasticsearch/config/config.yaml

@@ -56,7 +56,23 @@ agent:
   catalog:
     persist_interval: 30s
     auto_promote_after: 50
-    spike_multiplier: 5.0
+    # Spike detection: a known pattern is re-flagged when its per-second match
+    # RATE jumps well above the learned normal. The bar is a z-score, so it
+    # self-scales to each pattern's own volatility — a burst on a high-volume
+    # pattern trips even though its baseline is large.
+    #   - spike_z: fire when the rate is this many standard deviations above
+    #     the learned baseline.
+    #   - spike_abs_ceiling: a hard safety net — a tick with at least this many
+    #     matches always surfaces (0 = disabled / opt-in).
+    #   - spike_sustain_ticks: require this many CONSECUTIVE spiking ticks
+    #     before firing (1 = fire on the first tick, no debounce).
+    #   - spike_min_frequency: absolute noise floor — the tick must have at
+    #     least this many matches.
+    #   - spike_min_baseline_count: warmup gate — the pattern must have been
+    #     seen this many times before the z-score is trusted.
+    spike_z: 3.0
+    spike_abs_ceiling: 0
+    spike_sustain_ticks: 1
     spike_min_frequency: 5
     spike_min_baseline_count: 20
 

examples/docker-compose/file/config/config.yaml

@@ -56,7 +56,23 @@ agent:
   catalog:
     persist_interval: 30s
     auto_promote_after: 50
-    spike_multiplier: 5.0
+    # Spike detection: a known pattern is re-flagged when its per-second match
+    # RATE jumps well above the learned normal. The bar is a z-score, so it
+    # self-scales to each pattern's own volatility — a burst on a high-volume
+    # pattern trips even though its baseline is large.
+    #   - spike_z: fire when the rate is this many standard deviations above
+    #     the learned baseline.
+    #   - spike_abs_ceiling: a hard safety net — a tick with at least this many
+    #     matches always surfaces (0 = disabled / opt-in).
+    #   - spike_sustain_ticks: require this many CONSECUTIVE spiking ticks
+    #     before firing (1 = fire on the first tick, no debounce).
+    #   - spike_min_frequency: absolute noise floor — the tick must have at
+    #     least this many matches.
+    #   - spike_min_baseline_count: warmup gate — the pattern must have been
+    #     seen this many times before the z-score is trusted.
+    spike_z: 3.0
+    spike_abs_ceiling: 0
+    spike_sustain_ticks: 1
     spike_min_frequency: 5
     spike_min_baseline_count: 20
 

examples/docker-compose/graylog/config/config.yaml

@@ -56,7 +56,23 @@ agent:
   catalog:
     persist_interval: 30s
     auto_promote_after: 50
-    spike_multiplier: 5.0
+    # Spike detection: a known pattern is re-flagged when its per-second match
+    # RATE jumps well above the learned normal. The bar is a z-score, so it
+    # self-scales to each pattern's own volatility — a burst on a high-volume
+    # pattern trips even though its baseline is large.
+    #   - spike_z: fire when the rate is this many standard deviations above
+    #     the learned baseline.
+    #   - spike_abs_ceiling: a hard safety net — a tick with at least this many
+    #     matches always surfaces (0 = disabled / opt-in).
+    #   - spike_sustain_ticks: require this many CONSECUTIVE spiking ticks
+    #     before firing (1 = fire on the first tick, no debounce).
+    #   - spike_min_frequency: absolute noise floor — the tick must have at
+    #     least this many matches.
+    #   - spike_min_baseline_count: warmup gate — the pattern must have been
+    #     seen this many times before the z-score is trusted.
+    spike_z: 3.0
+    spike_abs_ceiling: 0
+    spike_sustain_ticks: 1
     spike_min_frequency: 5
     spike_min_baseline_count: 20
 

examples/docker-compose/loki/config/config.yaml

@@ -56,7 +56,23 @@ agent:
   catalog:
     persist_interval: 30s
     auto_promote_after: 50
-    spike_multiplier: 5.0
+    # Spike detection: a known pattern is re-flagged when its per-second match
+    # RATE jumps well above the learned normal. The bar is a z-score, so it
+    # self-scales to each pattern's own volatility — a burst on a high-volume
+    # pattern trips even though its baseline is large.
+    #   - spike_z: fire when the rate is this many standard deviations above
+    #     the learned baseline.
+    #   - spike_abs_ceiling: a hard safety net — a tick with at least this many
+    #     matches always surfaces (0 = disabled / opt-in).
+    #   - spike_sustain_ticks: require this many CONSECUTIVE spiking ticks
+    #     before firing (1 = fire on the first tick, no debounce).
+    #   - spike_min_frequency: absolute noise floor — the tick must have at
+    #     least this many matches.
+    #   - spike_min_baseline_count: warmup gate — the pattern must have been
+    #     seen this many times before the z-score is trusted.
+    spike_z: 3.0
+    spike_abs_ceiling: 0
+    spike_sustain_ticks: 1
     spike_min_frequency: 5
     spike_min_baseline_count: 20
 

examples/docker-compose/metrics/config/config.yaml

@@ -65,7 +65,23 @@ agent:
   catalog:
     persist_interval: 30s
     auto_promote_after: 50
-    spike_multiplier: 5.0
+    # Spike detection: a known pattern is re-flagged when its per-second match
+    # RATE jumps well above the learned normal. The bar is a z-score, so it
+    # self-scales to each pattern's own volatility — a burst on a high-volume
+    # pattern trips even though its baseline is large.
+    #   - spike_z: fire when the rate is this many standard deviations above
+    #     the learned baseline.
+    #   - spike_abs_ceiling: a hard safety net — a tick with at least this many
+    #     matches always surfaces (0 = disabled / opt-in).
+    #   - spike_sustain_ticks: require this many CONSECUTIVE spiking ticks
+    #     before firing (1 = fire on the first tick, no debounce).
+    #   - spike_min_frequency: absolute noise floor — the tick must have at
+    #     least this many matches.
+    #   - spike_min_baseline_count: warmup gate — the pattern must have been
+    #     seen this many times before the z-score is trusted.
+    spike_z: 3.0
+    spike_abs_ceiling: 0
+    spike_sustain_ticks: 1
     spike_min_frequency: 5
     spike_min_baseline_count: 20
 

examples/docker-compose/splunk/config/config.yaml

@@ -56,7 +56,23 @@ agent:
   catalog:
     persist_interval: 30s
     auto_promote_after: 50
-    spike_multiplier: 5.0
+    # Spike detection: a known pattern is re-flagged when its per-second match
+    # RATE jumps well above the learned normal. The bar is a z-score, so it
+    # self-scales to each pattern's own volatility — a burst on a high-volume
+    # pattern trips even though its baseline is large.
+    #   - spike_z: fire when the rate is this many standard deviations above
+    #     the learned baseline.
+    #   - spike_abs_ceiling: a hard safety net — a tick with at least this many
+    #     matches always surfaces (0 = disabled / opt-in).
+    #   - spike_sustain_ticks: require this many CONSECUTIVE spiking ticks
+    #     before firing (1 = fire on the first tick, no debounce).
+    #   - spike_min_frequency: absolute noise floor — the tick must have at
+    #     least this many matches.
+    #   - spike_min_baseline_count: warmup gate — the pattern must have been
+    #     seen this many times before the z-score is trusted.
+    spike_z: 3.0
+    spike_abs_ceiling: 0
+    spike_sustain_ticks: 1
     spike_min_frequency: 5
     spike_min_baseline_count: 20
 

examples/metrics-source/config/config.yaml

@@ -68,7 +68,23 @@ agent:
   catalog:
     persist_interval: 30s
     auto_promote_after: 50
-    spike_multiplier: 5.0
+    # Spike detection: a known pattern is re-flagged when its per-second match
+    # RATE jumps well above the learned normal. The bar is a z-score, so it
+    # self-scales to each pattern's own volatility — a burst on a high-volume
+    # pattern trips even though its baseline is large.
+    #   - spike_z: fire when the rate is this many standard deviations above
+    #     the learned baseline.
+    #   - spike_abs_ceiling: a hard safety net — a tick with at least this many
+    #     matches always surfaces (0 = disabled / opt-in).
+    #   - spike_sustain_ticks: require this many CONSECUTIVE spiking ticks
+    #     before firing (1 = fire on the first tick, no debounce).
+    #   - spike_min_frequency: absolute noise floor — the tick must have at
+    #     least this many matches.
+    #   - spike_min_baseline_count: warmup gate — the pattern must have been
+    #     seen this many times before the z-score is trusted.
+    spike_z: 3.0
+    spike_abs_ceiling: 0
+    spike_sustain_ticks: 1
     spike_min_frequency: 5
     spike_min_baseline_count: 20
 

go.mod

@@ -17,13 +17,13 @@ require (
 	github.com/cloudwego/eino-ext/components/model/qwen v0.1.9
 	github.com/go-git/go-git/v5 v5.19.1
 	github.com/go-redis/redis/v8 v8.11.5
-	github.com/gofiber/fiber/v2 v2.52.13
+	github.com/gofiber/fiber/v2 v2.52.14
 	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/slack-go/slack v0.27.0
 	github.com/spf13/viper v1.21.0
-	golang.org/x/image v0.39.0
-	golang.org/x/time v0.6.0
+	golang.org/x/image v0.43.0
+	golang.org/x/time v0.15.0
 	google.golang.org/genai v1.62.0
 )
 

go.sum

@@ -166,8 +166,8 @@ github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
 github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/gofiber/fiber/v2 v2.52.13 h1:TOKP64iqC9b5P49VrBW5tHhUOvDyrtJ0xePEfzJbCbk=
-github.com/gofiber/fiber/v2 v2.52.13/go.mod h1:YEcBbO/FB+5M1IZNBP9FO3J9281zgPAreiI1oqg8nDw=
+github.com/gofiber/fiber/v2 v2.52.14 h1:Of3L+9qVFaQNwPlcmEdl5IIodHz8BSE0j37R7rWu4pE=
+github.com/gofiber/fiber/v2 v2.52.14/go.mod h1:YEcBbO/FB+5M1IZNBP9FO3J9281zgPAreiI1oqg8nDw=
 github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -386,8 +386,8 @@ golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGb
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
-golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
-golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -433,8 +433,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
 golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
-golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
-golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=

helm/versus-incident/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: versus-incident
 description: A Helm chart for Versus Incident Management System
 type: application
-version: 1.4.4
-appVersion: "1.4.4"
+version: 1.4.9
+appVersion: "1.4.9"
 
 # Dependencies
 dependencies:

pkg/agent/brain.go

@@ -143,7 +143,7 @@ func (w *Worker) brainFor(name string) (core.SignalLearner, core.SignalDetector)
 	if b, ok := w.brains[name]; ok {
 		return b.learner, b.detector
 	}
-	lb := newLogBrain(name, w.miner, w.catalog, w.matcherForSource(name), w.services, w.ewmaAlpha, w.cfg.Catalog, w.redactor)
+	lb := newLogBrain(name, w.miner, w.catalog, w.matcherForSource(name), w.services, w.ewmaAlpha, w.cfg.Catalog, w.redactor, w.pollInterval.Seconds())
 	w.brains[name] = typedBrain{learner: lb, detector: lb}
 	return lb, lb
 }