Alerts Center

from tork_governance import TorkClient

client = TorkClient()

# Create an alert rule
alert = client.alerts.create_rule(
    name="High-Risk Policy Violations",
    description="Alert on any blocked action",
    event_types=["policy.violation"],
    conditions={
        "action": "BLOCK",
        "severity": "high"
    },
    channels=[
        {
            "type": "slack",
            "webhook_url": "https://hooks.slack.com/...",
            "channel": "#security-alerts"
        },
        {
            "type": "email",
            "recipients": ["security@company.com"]
        }
    ],
    cooldown_minutes=5  # Avoid alert storms
)

{
  "alert_id": "alert_abc123",
  "rule_id": "rule_xyz789",
  "rule_name": "High-Risk Policy Violations",
  "timestamp": "2024-01-15T10:30:00Z",
  "severity": "high",
  "event": {
    "type": "policy.violation",
    "agent_id": "agent-123",
    "policy_name": "block-medical-advice",
    "action": "BLOCK",
    "reason": "Medical advice is not permitted"
  },
  "context": {
    "user_id": "user_456",
    "session_id": "sess_789",
    "environment": "production"
  }
}

# List recent alerts
alerts = client.alerts.list(
    status="active",
    severity=["high", "critical"],
    start_time="2024-01-15T00:00:00Z",
    limit=50
)

for alert in alerts:
    print(f"[{alert.severity}] {alert.rule_name}: {alert.message}")

# Acknowledge an alert
client.alerts.acknowledge(
    alert_id="alert_abc123",
    user_id="admin@company.com",
    note="Investigating the issue"
)

# Resolve an alert
client.alerts.resolve(
    alert_id="alert_abc123",
    resolution="False positive - test transaction"
)