[Makisuo]

Fifth layer of the unified audit log, on top of #2532: the Detections page. An org admin can now create the alerts the previous layer made possible.

What it adds

• Detections in the Security hub rail, under Audit log (/security/detections). Admins only, with the same three access states as the audit log: asking, allowed, and an admins-only notice.
• The list. Each row says what the detection matches in words, when it fires ("5 or more in 10 minutes"), its severity and who it notifies. A detection that notifies no one is marked, because it opens incidents nobody is told about. The switch, edit and delete act on the API's answer; nothing is flipped optimistically. Delete says that the detection's incidents go with it.
• The empty state is the on-ramp. Five ready-made detections (member added or removed, permission or role changed, credential changed, a burst of refused requests, repeated sign-in failures). Choosing one opens the editor filled in; nothing is created until it is saved. The same starting points are in the editor's "Start from" select.
• The editor is a form page like the SLO and uptime monitor editors, with the same destination picker. It checks the request against the API's own schema before sending and shows the server's message for a duplicate name, an unknown destination or the cap.
• From the audit log. With filters applied, "Alert on these events" opens the editor with the platform, category and outcome carried over. The actor filter is not carried, and the label says so ("from any actor"): a detection cannot name a person.
• Docs: a section on the alert rules page saying what a detection is, who can create one and what members see.

The page states once what the backend guarantees: every member can see a detection's name and that it fired; only org admins see the events it counted.

Screenshots

The list
No detections yet
New detection
The server refuses a duplicate name
A member
Light theme
Phone width

Audit log with filters applied. The "before" is this build with the control switched off, so its rail already shows the new entry.

Before	After

Verified

• Web: the lab, the Security pages, the routes and the sample-URL list, 36 files and 456 tests. The two new suites have 19 tests (list) and 17 (editor): the access states, what each row says, the on-ramp opening a prefilled editor, create and edit against a stubbed API, the toggle, delete with confirmation, the server's invalid message, and the audit log control carrying the filters.
• bun run --cwd apps/web typecheck, ui:index:check and ui:patterns:check pass. oxlint -c .oxlintrc.effect.json is clean on the changed files.

Not verified: the page has only run against lab fixtures, not a signed-in app with a real API. The delete dialog and the open destination menu are covered by scene tests but have no screenshot.

Known rough edges, left as they are: on a phone the severity badge wraps under the condition, so rows are tall; a failed load still shows the "New detection" button.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d6a8b13a-3c89-4c0c-a8c4-7966db7fc566

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[maple-review-bot]

Warning

The review of 3fac3b1 could not finish. Maple was restarted while it ran, more than once. Ask again with @maple review. Comment @maple-review-bot review to try again.

[github-actions]

🍁 Maple PR preview

The preview is ready:

Service	Preview URL
Web	app-pr-2534.maple.dev
API	api-pr-2534.maple.dev

Web-only preview (preview:web): seeded demo data, no ingest gateway or Electric sync. Add preview for the full stack.

Smoke test: passed

Sign in with the PR preview form on the sign-in page and the preview access key (PREVIEW_SIGNIN_KEY in Infisical), or run bun run preview:signin 2534 for a signed-in link.

Deployed from 3fac3b1 · View workflow run