feat(correlation): add incident enrichments to correlation rules

[vinayaknolastname]

feat: incident enrichments on correlation rules

Closes #5227

What this adds

When a correlation rule creates a new incident, you can copy extra fields onto that incident (e.g. threshold, monitor name, team) using simple templates like {{ alert.labels.monitor }}.

Useful when the incident page needs info that only exists in the original alert or webhook (common with Grafana).

How it works (simple)

1. Alert comes in from a provider (e.g. Grafana).
2. If it matches a correlation rule and a new incident is created, Keep fills in your enrichment fields from that alert.
3. Those values show on the incident detail page.

Important:

• Only runs when a new incident is created — not when more alerts join an existing incident.
• Values come from the first alert that created the incident.
• You must turn on KEEP_STORE_RAW_ALERTS=true in .env and restart the API. Off by default.

Grafana tip

The raw webhook is stored as one big JSON blob. Deep fields are under alerts[0], not the top level.

Won't work	Use instead
{{ raw.data[0].model... }}	{{ raw.alerts[0].data[0].model... }}
{{ raw.condition }}	{{ raw.alerts[0].condition }} or {{ alert.labels.monitor }}

UI

• Correlation rule editor gets an Incident enrichments section (key + value rows).
• Section is hidden unless KEEP_STORE_RAW_ALERTS=true on the server.

What changed

• New incident_enrichments field on correlation rules (DB + API + UI).
• Rules engine renders templates and saves them on the new incident.
• Raw webhook kept in memory during processing so {{ raw.* }} templates work.
• Docs updated.

Not changed: how raw alerts are saved in the database (still one row per webhook, same as before).

Try it

1. Set KEEP_STORE_RAW_ALERTS=true in .env → restart keep api.
2. Create/edit a correlation rule → add enrichments, e.g. threshold: {{ raw.alerts[0].data[0].model.conditions[0].evaluator.params[0] }}.
3. Send a matching alert → open the new incident → check enrichment fields.
4. Send another alert to the same incident → enrichments should not change.

Checks

• Docs updated
• Tests pass

##Learning:
Learned a lot about the code base and whole structure, as i never used the keep before, directly contributing to it

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}