Add SLA-breach KPI, pytest integration suite, and CI

- SLA: per-severity response targets (CRITICAL 15m, HIGH 1h, MEDIUM 4h, LOW 24h);
  /api/stats now returns breach count/rate/per-severity; dashboard shows a
  SLA Breach Rate stat card
- tests/: 9 pytest integration tests (Flask test client + PostgreSQL) covering
  pages, alert queue, stats, SLA metrics, and classify validation/404
- .github/workflows/ci.yml: GitHub Actions with a Postgres service container
- requirements-dev.txt

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Romil2112

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: soc_test
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/soc_test
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: pip install -r requirements-dev.txt
+
+      - name: Run tests
+        run: pytest tests/ -v

README.md

@@ -2,6 +2,7 @@
 
 Flask-based Security Operations Center analyst dashboard with real-time alert queue, MTTR tracking, and Chart.js visualizations.
 
+![CI](https://github.com/Romil2112/SOC-Dashboard/actions/workflows/ci.yml/badge.svg)
 ![Python](https://img.shields.io/badge/Python-3.12-3776AB?logo=python&logoColor=white)
 ![Flask](https://img.shields.io/badge/Flask-3.x-000000?logo=flask&logoColor=white)
 ![PostgreSQL](https://img.shields.io/badge/PostgreSQL-16-4169E1?logo=postgresql&logoColor=white)
@@ -38,6 +39,7 @@ as a clear, hands-on teaching tool for the alert-triage workflow.
 - **One-click triage:** True Positive / False Positive / Escalate buttons per alert
 - **Analyst name saved to `localStorage`** — no login required for the demo
 - **MTTR tracking** per analyst per day, with a 7-day trend chart
+- **SLA breach tracking:** per-severity response targets (CRITICAL 15m → LOW 24h) with a live breach-rate KPI
 - **Color-coded performance table:** green < 5 min, yellow 5–15 min, red > 15 min
 - **Alerts by category** doughnut chart (brute force, malware, phishing, port scan, anomaly)
 - **Alerts by severity** bar chart (CRITICAL / HIGH / MEDIUM / LOW)
@@ -72,7 +74,8 @@ as a clear, hands-on teaching tool for the alert-triage workflow.
 | PostgreSQL | Schema design, JSONB-ready tables, timestamp-based MTTR aggregation |
 | JavaScript | Fetch API polling, localStorage, dynamic DOM updates, Chart.js integration |
 | Bootstrap 5 | Responsive dark-themed UI, badge system, card layout |
-| SOC Domain Knowledge | Alert triage workflow, MTTR KPI, severity classification, analyst performance tracking |
+| SOC Domain Knowledge | Alert triage workflow, MTTR + SLA-breach KPIs, severity classification, analyst performance tracking |
+| Testing / CI | pytest integration suite (Flask test client + PostgreSQL) run via GitHub Actions with a Postgres service container |
 | Docker | Multi-service Compose with health-checked PostgreSQL and volume mounts |
 | Agentic AI Development | Built end-to-end using Claude Code with structured prompt engineering |
 

app.py

@@ -1,5 +1,6 @@
 """SOC Analyst Dashboard — Flask + psycopg2 (no ORM)."""
 import os
+from datetime import datetime, timezone
 
 import psycopg2
 import psycopg2.extras
@@ -24,6 +25,42 @@
     "escalate": "escalated",
 }
 
+# Per-severity response-time SLA targets (seconds). An alert breaches SLA when
+# its time-to-triage (or current age, if still open) exceeds the target.
+SLA_SECONDS = {
+    "CRITICAL": 15 * 60,       # 15 minutes
+    "HIGH":     60 * 60,       # 1 hour
+    "MEDIUM":   4 * 60 * 60,   # 4 hours
+    "LOW":      24 * 60 * 60,  # 24 hours
+}
+
+
+def compute_sla(rows):
+    """Given rows of {severity, resp, created_at}, return SLA breach metrics.
+
+    resp = recorded triage response time (seconds) or None if still open
+    (in which case the alert's current age is used).
+    """
+    now_ts = datetime.now(timezone.utc)
+    considered = breaches = 0
+    by_severity = {}
+    for r in rows:
+        target = SLA_SECONDS.get(r["severity"])
+        if target is None:
+            continue
+        considered += 1
+        elapsed = r["resp"] if r["resp"] is not None else (now_ts - r["created_at"]).total_seconds()
+        if elapsed > target:
+            breaches += 1
+            by_severity[r["severity"]] = by_severity.get(r["severity"], 0) + 1
+    rate = round(100 * breaches / considered, 1) if considered else 0.0
+    return {
+        "breaches": breaches,
+        "considered": considered,
+        "breach_rate": rate,
+        "by_severity": by_severity,
+    }
+
 
 def get_conn():
     """Open a new connection with dict-style rows."""
@@ -187,6 +224,21 @@ def api_stats():
         )
         mttr_by_analyst = [serialize(r) for r in cur.fetchall()]
 
+        # SLA inputs: each alert's severity, age, and (earliest) triage response time.
+        cur.execute(
+            """
+            SELECT a.severity,
+                   a.created_at,
+                   (SELECT min(aa.response_time_seconds)
+                      FROM analyst_actions aa
+                     WHERE aa.alert_id = a.id) AS resp
+            FROM alerts a
+            """
+        )
+        sla_rows = cur.fetchall()
+
+    sla = compute_sla(sla_rows)
+
     return jsonify(
         {
             "total": total,
@@ -195,6 +247,7 @@ def api_stats():
             "by_category": by_category,
             "by_severity": by_severity,
             "mttr_by_analyst": mttr_by_analyst,
+            "sla": sla,
         }
     )
 

requirements-dev.txt

@@ -0,0 +1,2 @@
+-r requirements.txt
+pytest>=7.0

static/dashboard.js

@@ -125,6 +125,7 @@ async function loadStats() {
 
   setText("stat-closed-today", closedToday);
   setText("stat-mttr-today", mttrMin);
+  setText("stat-sla-breach", stats.sla ? `${stats.sla.breach_rate}%` : "—");
 
   updateCharts(stats);
   return stats;

templates/dashboard.html

@@ -4,39 +4,47 @@
 
 {% block content %}
 <!-- Row 1: stat cards -->
-<div class="row g-3 mb-4">
-  <div class="col-md-3">
+<div class="row row-cols-2 row-cols-md-5 g-3 mb-4">
+  <div class="col">
     <div class="card stat-card bg-dark border-secondary text-light h-100">
       <div class="card-body">
         <div class="text-secondary small text-uppercase">Total Alerts</div>
         <div class="display-6" id="stat-total">—</div>
       </div>
     </div>
   </div>
-  <div class="col-md-3">
+  <div class="col">
     <div class="card stat-card bg-dark border-secondary text-light h-100">
       <div class="card-body">
         <div class="text-secondary small text-uppercase">Open</div>
         <div class="display-6 text-warning" id="stat-open">—</div>
       </div>
     </div>
   </div>
-  <div class="col-md-3">
+  <div class="col">
     <div class="card stat-card bg-dark border-secondary text-light h-100">
       <div class="card-body">
         <div class="text-secondary small text-uppercase">Closed Today</div>
         <div class="display-6 text-info" id="stat-closed-today">—</div>
       </div>
     </div>
   </div>
-  <div class="col-md-3">
+  <div class="col">
     <div class="card stat-card bg-dark border-secondary text-light h-100">
       <div class="card-body">
         <div class="text-secondary small text-uppercase">Avg MTTR Today (min)</div>
         <div class="display-6 text-success" id="stat-mttr-today">—</div>
       </div>
     </div>
   </div>
+  <div class="col">
+    <div class="card stat-card bg-dark border-secondary text-light h-100">
+      <div class="card-body">
+        <div class="text-secondary small text-uppercase">SLA Breach Rate</div>
+        <div class="display-6 text-danger" id="stat-sla-breach">—</div>
+      </div>
+    </div>
+  </div>
 </div>
 
 <!-- Row 2: charts -->

tests/conftest.py

@@ -0,0 +1,57 @@
+"""Pytest fixtures: a fresh schema + deterministic alert data per test.
+
+Requires a reachable PostgreSQL. Locally:
+    docker run -d --name soc-pg -e POSTGRES_PASSWORD=postgres \
+        -e POSTGRES_DB=soc_test -p 5433:5432 postgres:16
+    export DATABASE_URL=postgresql://postgres:postgres@localhost:5433/soc_test
+CI sets DATABASE_URL to a postgres service container.
+"""
+import os
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+
+# Must be set before importing app (it reads DATABASE_URL at import time).
+os.environ.setdefault(
+    "DATABASE_URL", "postgresql://postgres:postgres@localhost:5433/soc_test"
+)
+
+import psycopg2  # noqa: E402
+
+SCHEMA = (ROOT / "schema.sql").read_text()
+
+# Deterministic fixtures. SLA targets: CRITICAL 900s, HIGH 3600s, LOW 86400s.
+#   alert 1: CRITICAL, triaged in 100s   -> within SLA
+#   alert 2: CRITICAL, triaged in 2000s  -> BREACH
+#   alert 3: LOW, open, aged 2 days       -> BREACH (overdue)
+#   alert 4: HIGH, open, just created     -> within SLA
+# => 2 breaches / 4 considered = 50%
+FIXTURES = """
+INSERT INTO alerts (id, title, category, severity, status, created_at) VALUES
+    (1, 'crit fast',     'brute_force', 'CRITICAL', 'true_positive', now() - interval '1 hour'),
+    (2, 'crit slow',     'malware',     'CRITICAL', 'true_positive', now() - interval '1 hour'),
+    (3, 'low old open',  'anomaly',     'LOW',      'open',          now() - interval '2 days'),
+    (4, 'high new open', 'phishing',    'HIGH',     'open',          now());
+INSERT INTO analyst_actions (alert_id, analyst_name, action, response_time_seconds) VALUES
+    (1, 'alice', 'classify_tp', 100),
+    (2, 'bob',   'classify_tp', 2000);
+"""
+
+
+@pytest.fixture()
+def client():
+    import app as soc_app
+
+    conn = psycopg2.connect(os.environ["DATABASE_URL"])
+    conn.autocommit = True
+    with conn.cursor() as cur:
+        cur.execute(SCHEMA)
+        cur.execute(FIXTURES)
+    conn.close()
+
+    soc_app.app.config.update(TESTING=True)
+    return soc_app.app.test_client()

tests/test_app.py

@@ -0,0 +1,75 @@
+"""Integration tests for the SOC dashboard API (Flask test client + Postgres)."""
+import json
+
+
+def test_pages_render(client):
+    assert client.get("/").status_code == 200
+    assert client.get("/analyst").status_code == 200
+
+
+def test_open_alerts_only_and_severity_sorted(client):
+    rows = client.get("/api/alerts").get_json()
+    assert [r["id"] for r in rows] == [4, 3]          # HIGH before LOW; only open
+    assert all(r["status"] == "open" for r in rows)
+
+
+def test_all_alerts_returns_everything(client):
+    rows = client.get("/api/alerts/all").get_json()
+    assert len(rows) == 4
+
+
+def test_stats_counts(client):
+    s = client.get("/api/stats").get_json()
+    assert s["total"] == 4
+    assert s["open"] == 2
+    assert s["closed"] == 2
+    assert s["by_severity"]["CRITICAL"] == 2
+
+
+def test_stats_sla_breach_metrics(client):
+    sla = client.get("/api/stats").get_json()["sla"]
+    assert sla["considered"] == 4
+    assert sla["breaches"] == 2          # crit-slow + low-overdue
+    assert sla["breach_rate"] == 50.0
+    assert sla["by_severity"].get("CRITICAL") == 1
+    assert sla["by_severity"].get("LOW") == 1
+
+
+def test_classify_updates_status_and_closes_alert(client):
+    resp = client.post(
+        "/api/alerts/4/classify",
+        data=json.dumps({"analyst": "carol", "action": "classify_tp"}),
+        content_type="application/json",
+    )
+    assert resp.status_code == 200
+    assert resp.get_json()["status"] == "true_positive"
+    # alert 4 should no longer appear in the open queue
+    open_ids = [r["id"] for r in client.get("/api/alerts").get_json()]
+    assert 4 not in open_ids
+
+
+def test_classify_requires_analyst(client):
+    resp = client.post(
+        "/api/alerts/4/classify",
+        data=json.dumps({"action": "classify_tp"}),
+        content_type="application/json",
+    )
+    assert resp.status_code == 400
+
+
+def test_classify_rejects_unknown_action(client):
+    resp = client.post(
+        "/api/alerts/4/classify",
+        data=json.dumps({"analyst": "carol", "action": "nope"}),
+        content_type="application/json",
+    )
+    assert resp.status_code == 400
+
+
+def test_classify_unknown_alert_404(client):
+    resp = client.post(
+        "/api/alerts/9999/classify",
+        data=json.dumps({"analyst": "carol", "action": "classify_tp"}),
+        content_type="application/json",
+    )
+    assert resp.status_code == 404