[WIP] Fix missing end_time assignment for auto-resolved incidents

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

Original prompt

Bug

When an incident is auto-resolved via the resolve_on rule (e.g., ALL alerts resolved, FIRST resolved, LAST resolved), the end_time field on the Incident is not set. However, when the incident status is changed manually via change_status(), end_time IS correctly set (see keep/api/bl/incidents_bl.py lines 523-525).

This means incidents that are auto-resolved have end_time = None, which is incorrect.

Root Cause

There are 3 places where incident status is set to RESOLVED during auto-resolution but end_time is not set:

1. keep/api/bl/incidents_bl.py — resolve_incident_if_require() method (line 460)

if should_resolve:
    for attempt in range(max_retries):
        try:
            incident.status = IncidentStatus.RESOLVED.value
            # MISSING: incident.end_time = datetime.now(tz=timezone.utc)
            self.session.add(incident)
            self.session.commit()

2. keep/api/bl/enrichments_bl.py — check_incident_resolution() method (line 982)

for incident in incidents:
    if incident.resolve_on == ResolveOn.ALL.value and is_all_alerts_resolved(
        incident=incident, session=self.db_session
    ):
        incident.status = IncidentStatus.RESOLVED.value
        # MISSING: incident.end_time = datetime.datetime.now(tz=datetime.timezone.utc)
        self.db_session.add(incident)
    self.db_session.commit()

3. keep/api/routes/alerts.py — batch_enrich_alerts() function (line 982)

for alert in alerts:
    for incident in alert._incidents:
        if (
            incident.resolve_on == ResolveOn.ALL.value
            and is_all_alerts_resolved(incident=incident, session=session)
        ):
            incident.status = IncidentStatus.RESOLVED.value
            # MISSING: incident.end_time = datetime.now(tz=timezone.utc)
            session.add(incident)
        session.commit()

Fix

In all 3 locations, add incident.end_time = datetime.now(tz=timezone.utc) (or the appropriate datetime import for that file) right after setting incident.status = IncidentStatus.RESOLVED.value.

Reference: The correct pattern already exists in the change_status() method at keep/api/bl/incidents_bl.py lines 523-525:

if new_status == IncidentStatus.RESOLVED:
    end_time = datetime.now(tz=timezone.utc)
    incident.end_time = end_time

Note that incidents_bl.py already imports from datetime import datetime, timezone, enrichments_bl.py imports import datetime (so use datetime.datetime.now(tz=datetime.timezone.utc)), and alerts.py needs to import from datetime import datetime, timezone.

Files to change

• keep/api/bl/incidents_bl.py
• keep/api/bl/enrichments_bl.py
• keep/api/routes/alerts.py

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.