Api v2 create alert filter

[Elise17]

Implementation of endpoint POST /api/v2/alerts-filters to create an alert filter.

• Deprecated POST /filters/add

Note: this PR is accompanied by the documentation dfir-iris/iris-doc-src#86.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• api_*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch api_v2_create_alert_filter

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull Request Overview

This PR implements a new API v2 endpoint for creating alert filters (POST /api/v2/alerts-filters) while deprecating the legacy endpoint (POST /filters/add). The changes include adding a v2 customer management endpoint, refactoring database functions, and adding support for retrieving related alerts.

Key changes:

• New REST API v2 endpoints for alert filters and customer management
• Database function refactoring to improve reusability and remove unused return values
• Addition of related alerts functionality with query parameter support

Reviewed Changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
source/app/blueprints/rest/v2/alerts_filters.py	New v2 endpoint implementation for alert filter creation
source/app/blueprints/rest/v2/manage_routes/customers.py	New v2 endpoint for customer creation
source/app/blueprints/rest/filters_routes.py	Deprecated legacy filter endpoint
source/app/blueprints/rest/manage/manage_customers_routes.py	Updated legacy customer endpoint to use refactored functions
source/app/business/alerts_filters.py	Business logic for alert filter creation
source/app/business/customers.py	Business logic for customer creation
source/app/blueprints/rest/v2/alerts.py	Added related alerts endpoint
source/app/datamgmt/client/client_db.py	Refactored create_client to accept Client object
source/app/datamgmt/manage/manage_users_db.py	Removed unused return value
source/app/datamgmt/case/case_events_db.py	Added get_events_by_case helper function
source/app/datamgmt/case/case_assets_db.py	Added get_assets_by_case helper function
tests/tests_rest_alerts_filters.py	Test coverage for new alert filter endpoint
tests/tests_rest_customers.py	Test coverage for new customer endpoint
tests/tests_rest_alerts.py	Test coverage for related alerts endpoint

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

There is an unnecessary space before the opening bracket. Change request_data ['created_by'] to request_data['created_by'] for consistent Python spacing conventions.

Suggested change

	request_data ['created_by'] = iris_current_user.id
	request_data['created_by'] = iris_current_user.id

[Copilot]

[nitpick] The _load helper method was removed, but calling self._schema.load() directly is repeated in multiple places (lines 50, 70). Consider keeping the helper method to maintain consistency and reduce duplication.

[Copilot]

The filter condition CaseEventsAssets.case_id == case_identifier is applied before the join, but CaseAssets is the primary query entity. The join may produce incorrect results. The filter should be applied after establishing the join relationship or use CaseAssets.case_id directly if that's the intended filter.

Suggested change

	).filter(
	CaseEventsAssets.case_id == case_identifier,
	).join(CaseEventsAssets.asset).all()
	).join(
	CaseEventsAssets.asset
	).filter(
	CaseEventsAssets.case_id == case_identifier
	).all()