Passing thread_ts to slack sink

Author: itisallgood

helm/robusta/values.yaml

@@ -23,7 +23,7 @@ automountServiceAccountToken: true
 
 enableHolmesGPT: false
 
-# see https://docs.robusta.dev/master/user-guide/configuration.html#global-config and https://docs.robusta.dev/master/configuration/additional-settings.html#global-config
+# see https://docs.robusta.dev/master/setup-robusta/additional-settings.html#global-config
 globalConfig:
   check_prometheus_flags: true
   grafana_url: ""
@@ -35,7 +35,7 @@ globalConfig:
   custom_annotations: []
   custom_severity_map: {}
 
-# see https://docs.robusta.dev/master/user-guide/configuration/additional-settings.html#relabel-prometheus-alerts
+# see https://docs.robusta.dev/master/setup-robusta/additional-settings.html#relabel-prometheus-alerts
 alertRelabel: []
 
 # safe actions to enable authenticated users to run

src/robusta/core/model/base_params.py

@@ -84,6 +84,10 @@ class HolmesParams(ActionParams):
 
     holmes_url: Optional[str]
     model: Optional[str]
+    # Additional internal context that helps runner to send investigation to appropriate sinks
+    # for now it is used only for passing thread_ts to slack sink internally;
+    robusta_context: Optional[Dict[str, Any]] = None 
+
     @validator("holmes_url", allow_reuse=True)
     def validate_protocol(cls, v):
         if v and not v.startswith("http"):  # if the user configured url without http(s)
@@ -114,6 +118,7 @@ class AIInvestigateParams(HolmesParams):
     stream: bool = False
 
 
+
 class HolmesToolsResult(BaseModel):
     """
     :var name: Name of the tool.

src/robusta/core/playbooks/internal/ai_integration.py

@@ -44,6 +44,7 @@ def build_investigation_title(params: AIInvestigateParams) -> str:
 
 @action
 def ask_holmes(event: ExecutionBaseEvent, params: AIInvestigateParams):
+    logging.info(f"DIMA Received request to ask holmes with params: {params}")
     holmes_url = HolmesDiscovery.find_holmes_url(params.holmes_url)
     if not holmes_url:
         raise ActionException(ErrorCodes.HOLMES_DISCOVERY_FAILED, "Robusta couldn't connect to the Holmes client.")
@@ -101,7 +102,16 @@ def ask_holmes(event: ExecutionBaseEvent, params: AIInvestigateParams):
             finding.add_enrichment(
                 [HolmesResultsBlock(holmes_result=holmes_result)], enrichment_type=EnrichmentType.ai_analysis
             )
-
+            runner_context = getattr(params, "robusta_context", None) # Safely get the context dict
+            if runner_context and "thread_ts" in runner_context:
+                original_thread_ts = runner_context.get("thread_ts")
+                if original_thread_ts:                    
+                    finding.robusta_context["thread_ts"] = original_thread_ts
+                    logging.info(f"Added message_ts={original_thread_ts} to finding {finding.id} annotations.")
+                else:
+                    logging.warning(f"message_ts found in robusta_context for finding {finding.id} but it is empty.")
+            else:
+                 logging.debug(f"No message_ts found in robusta_context for finding {finding.id}. Context: {runner_context}")
             event.add_finding(finding)
 
     except Exception as e:

src/robusta/core/reporting/base.py

@@ -9,6 +9,7 @@
 from typing import Any, Dict, List, Optional, Union
 from urllib.parse import urlencode
 
+from pydantic import Field
 from pydantic.main import BaseModel
 from strenum import StrEnum
 
@@ -292,6 +293,7 @@ def __init__(
         self.starts_at = starts_at if starts_at else datetime.now()
         self.ends_at = ends_at
         self.dirty = False
+        self.robusta_context: Dict[str, Any] = {}
 
     @property
     def attribute_map(self) -> Dict[str, Union[str, Dict[str, str]]]:

src/robusta/core/reporting/callbacks.py

@@ -5,7 +5,7 @@
 from robusta.core.playbooks.actions_registry import Action
 from robusta.core.reporting import CallbackChoice
 from robusta.core.reporting.action_requests import ActionRequestBody, ExternalActionRequest, sign_action_request
-
+import logging
 
 class ExternalActionRequestBuilder(BaseModel):
     @classmethod
@@ -43,6 +43,7 @@ def create_for_func(
             sinks=[sink],
             origin="callback",
         )
+        logging.info(f"Created action request body: {body}")
         return ExternalActionRequest(
             body=body,
             signature=sign_action_request(body, signing_key),

src/robusta/integrations/receiver.py

@@ -49,10 +49,16 @@ class ValidationResponse(BaseModel):
     error_msg: Optional[str] = None
 
 
+class SlackContainer(BaseModel):
+    channel_id: str
+    message_ts: str
+
+
 class SlackExternalActionRequest(ExternalActionRequest):
     # Optional Slack Params
     slack_username: Optional[str] = None
     slack_message: Optional[Any] = None
+    slack_container: Optional[SlackContainer] = None
 
 
 class SlackActionRequest(BaseModel):
@@ -73,6 +79,7 @@ class SlackUserID(BaseModel):
 class SlackActionsMessage(BaseModel):
     actions: List[SlackActionRequest]
     user: Optional[SlackUserID]
+    container: Optional[SlackContainer]
 
 
 class ActionRequestReceiver:
@@ -168,15 +175,18 @@ def __exec_external_request(self, action_request: ExternalActionRequest, validat
 
         if hasattr(action_request, 'slack_message'):
             action_request.body.action_params["slack_message"] = action_request.slack_message
+        
+        if action_request.slack_container and action_request.slack_container.message_ts:
+            thread_ts = action_request.slack_container.message_ts
+            action_request.body.action_params["robusta_context"] = {"thread_ts": thread_ts}
 
         response = self.event_handler.run_external_action(
             action_request.body.action_name,
             action_request.body.action_params,
-            action_request.body.sinks,
+             action_request.body.sinks,
             sync_response,
             action_request.no_sinks,
         )
-
         if sync_response:
             http_code = 200 if response.get("success") else 500
             self.ws.send(data=json.dumps(self.__sync_response(http_code, action_request.request_id, response)))
@@ -238,6 +248,7 @@ def _parse_slack_message(message: Union[str, bytes, bytearray]) -> SlackActionsM
         for action in slack_actions_message.actions:
             action.value.slack_username = slack_actions_message.user.username
             action.value.slack_message = json_slack_message
+            action.value.slack_container = slack_actions_message.container
         return slack_actions_message
 
     def on_message(self, ws: websocket.WebSocketApp, message: str) -> None:

src/robusta/integrations/slack/sender.py

@@ -107,7 +107,8 @@ def __get_action_block_for_choices(self, sink: str, choices: Dict[str, CallbackC
                     ).json(),
                 }
             )
-
+            logging.info(f"Created action block: {buttons}")
+            
         return [{"type": "actions", "elements": buttons}]
 
     def __to_slack_links(self, links: List[LinkProp]) -> List[SlackBlock]:
@@ -524,10 +525,18 @@ def send_finding_to_slack(
             finding.subject.labels,
             finding.subject.annotations,
         )
-
+        robusta_context = getattr(finding, "robusta_context", None)
+        effective_thread_ts = thread_ts # Default to the one passed in (e.g., from grouping)
+        if robusta_context:
+            annotation_ts = robusta_context.get("thread_ts")
+            if annotation_ts: # Make sure it's not None or empty
+                effective_thread_ts = annotation_ts # Prioritize the annotation!
+                logging.info(f"Using thread_ts from annotation for AI analysis finding {finding.id}: {effective_thread_ts}")
+            else:
+                logging.warning(f"Found empty message_ts annotation for AI analysis finding {finding.id}, using original thread_ts: {thread_ts}")
         if finding.finding_type == FindingType.AI_ANALYSIS:
             # holmes analysis message needs special handling
-            self.send_holmes_analysis(finding, slack_channel, platform_enabled, thread_ts)
+            self.send_holmes_analysis(finding, slack_channel, platform_enabled, effective_thread_ts)
             return ""  # [arik] Looks like the return value here is not used, needs to be removed
 
         status: FindingStatus = (