feat(correlation-rules): add rule_group_by_def to support grouping in correlation rules

Author: mjabascal10

backend/src/main/java/com/park/utmstack/domain/correlation/rules/UtmCorrelationRules.java

@@ -110,6 +110,10 @@ public class UtmCorrelationRules implements Serializable {
     @Setter(AccessLevel.NONE)
     private List<SearchRequest> afterEvents;
 
+    @JsonIgnore
+    @Column(name = "rule_group_by_def")
+    private String ruleGroupByDef;
+
     @JsonIgnore
     @Column(name = "rule_deduplicate_by_def")
     private String deduplicateByDef;
@@ -136,6 +140,28 @@ public void setDeduplicateBy(List<String> deduplicateBy) throws UtmSerialization
         this.deduplicateBy = deduplicateBy;
     }
 
+    @Transient
+    @JsonSerialize
+    @JsonDeserialize
+    @Getter(AccessLevel.NONE)
+    @Setter(AccessLevel.NONE)
+    private List<String> groupBy;
+
+    public List<String> getGroupBy() throws UtmSerializationException {
+        if (StringUtils.hasText(deduplicateByDef))
+            groupBy = UtilSerializer.jsonDeserializeList(String.class, ruleGroupByDef);
+        return groupBy == null ? new ArrayList<>() : groupBy;
+    }
+
+    public void setGroupBy(List<String> groupBy) throws UtmSerializationException {
+        if (CollectionUtils.isEmpty(groupBy))
+            this.ruleGroupByDef = null;
+        else
+            this.ruleGroupByDef = UtilSerializer.jsonSerialize(groupBy);
+
+        this.groupBy = groupBy;
+    }
+
     @ManyToMany(fetch = FetchType.EAGER)
     @JoinTable(name = "utm_group_rules_data_type",
             joinColumns = @JoinColumn(name = "rule_id"),

backend/src/main/java/com/park/utmstack/service/dto/correlation/UtmCorrelationRulesDTO.java

@@ -62,5 +62,7 @@ public class UtmCorrelationRulesDTO implements Serializable {
 
     private List<String> deduplicateBy;
 
+    private List<String> groupBy;
+
 }
 

backend/src/main/java/com/park/utmstack/service/dto/correlation/UtmCorrelationRulesMapper.java

@@ -35,6 +35,7 @@ public UtmCorrelationRulesDTO toDto(UtmCorrelationRules entity) {
             dto.setRuleActive(entity.getRuleActive());
             dto.setAfterEvents(entity.getAfterEvents());
             dto.setDeduplicateBy(entity.getDeduplicateBy());
+            dto.setGroupBy(entity.getGroupBy());
             return dto;
         } catch (UtmSerializationException e) {
             logger.error("Error serializing rule references", e);
@@ -62,6 +63,7 @@ public UtmCorrelationRules toEntity(UtmCorrelationRulesDTO dto) {
             entity.setRuleLastUpdate(Instant.now(Clock.systemUTC()));
             entity.setAfterEvents(dto.getAfterEvents());
             entity.setDeduplicateBy(dto.getDeduplicateBy());
+            entity.setGroupBy(dto.getGroupBy());
 
             return entity;
         } catch (UtmSerializationException e) {

backend/src/main/resources/config/liquibase/changelog/20260120001_add_rule_group_by_to_correlation_rules.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
+
+    <changeSet id="20260119001" author="manuel">
+
+        <addColumn tableName="utm_correlation_rules">
+            <column name="rule_group_by_def" type="text"/>
+        </addColumn>
+
+        <update tableName="utm_correlation_rules">
+            <column name="rule_group_by_def" valueComputed="rule_deduplicate_by_def"/>
+        </update>
+
+        <update tableName="utm_correlation_rules">
+            <column name="rule_deduplicate_by_def" value=""/>
+        </update>
+
+    </changeSet>
+</databaseChangeLog>

backend/src/main/resources/config/liquibase/master.xml

@@ -307,6 +307,8 @@
 
     <include file="/config/liquibase/changelog/20260119001_update_menu_url_for_soc_ai.xml" relativeToChangelogFile="false"/>
 
+    <include file="/config/liquibase/changelog/20260120001_add_rule_group_by_to_correlation_rules.xml" relativeToChangelogFile="false"/>
+