idxwze/SentinelOps

1{2  "checkout-latency-spike": [3    {4      "title_en": "Database connection pool exhaustion",5      "title_fr": "Epuisement du pool de connexions base de donnees",6      "confidence_score": 89,7      "risk_color": "#ef4444",8      "explanation_en": "Checkout worker concurrency increased quickly and active sessions on orders-db rose in the same window. Latency climbed before hard failures, which fits saturation rather than an immediate code crash.",9      "explanation_fr": "La concurrence des workers checkout a rapidement augmente et les sessions actives sur orders-db ont monte dans la meme fenetre. La latence a grimpe avant les echecs francs, ce qui correspond a une saturation plutot qu'a un crash de code immediat.",10      "recommended_action_en": "Inspect database pool utilization and temporarily roll back worker concurrency to confirm whether latency normalizes.",11      "recommended_action_fr": "Inspectez l'utilisation du pool base de donnees et revenez temporairement a la concurrence precedente pour confirmer si la latence se normalise."12    },13    {14      "title_en": "Payment confirmation slowdown",15      "title_fr": "Ralentissement de confirmation de paiement",16      "confidence_score": 71,17      "risk_color": "#f97316",18      "explanation_en": "Payment confirmation latency is elevated, which can lengthen checkout completion even if the checkout service itself is still processing requests.",19      "explanation_fr": "La latence de confirmation de paiement est elevee, ce qui peut allonger la finalisation du checkout meme si le service checkout continue a traiter les requetes.",20      "recommended_action_en": "Compare checkout latency against payment confirmation latency and isolate whether one payment region is materially worse.",21      "recommended_action_fr": "Comparez la latence checkout a la latence de confirmation paiement et isolez si une region paiement est nettement pire."22    },23    {24      "title_en": "Deployment regression in checkout worker",25      "title_fr": "Regression de deploiement dans le worker checkout",26      "confidence_score": 56,27      "risk_color": "#f59e0b",28      "explanation_en": "The incident started after a rollout, so code-path regression is plausible, though the telemetry currently fits contention more strongly than functional exceptions.",29      "explanation_fr": "L'incident a commence apres un deploiement, donc une regression de chemin de code est plausible, meme si la telemetrie correspond actuellement plus fortement a une contention qu'a des exceptions fonctionnelles.",30      "recommended_action_en": "Review release notes and compare exception volume between the previous and current checkout worker versions.",31      "recommended_action_fr": "Examinez les notes de version et comparez le volume d'exceptions entre les versions precedente et actuelle du worker checkout."32    }33  ],34  "authentication-failure-burst": [35    {36      "title_en": "Auth token validation mismatch",37      "title_fr": "Desalignement de validation des jetons auth",38      "confidence_score": 87,39      "risk_color": "#ef4444",40      "explanation_en": "Signing-key rotation aligns closely with the error burst, and failures cluster around token validation and session refresh rather than core gateway reachability.",41      "explanation_fr": "La rotation des cles de signature s'aligne etroitement avec la rafale d'erreurs, et les echecs se concentrent autour de la validation de jeton et du rafraichissement de session plutot que de la joignabilite du gateway.",42      "recommended_action_en": "Verify active key IDs on issuers and validators, then flush or align any stale verifier caches.",43      "recommended_action_fr": "Verifiez les ID de cle actifs sur les emetteurs et validateurs, puis videz ou alignez tout cache de validation obsolescent."44    },45    {46      "title_en": "Mobile refresh-session incompatibility",47      "title_fr": "Incompatibilite du rafraichissement de session mobile",48      "confidence_score": 68,49      "risk_color": "#f97316",50      "explanation_en": "Mobile clients are disproportionately affected, suggesting some refresh or token parsing path may lag behind the backend change.",51      "explanation_fr": "Les clients mobiles sont affectes de facon disproportionnee, ce qui suggere qu'un chemin de rafraichissement ou de parsing de jeton pourrait etre en retard sur le changement backend.",52      "recommended_action_en": "Inspect older mobile app versions and compare rejected token claims against the new validator requirements.",53      "recommended_action_fr": "Inspectez les anciennes versions mobiles et comparez les claims de jeton rejetes aux nouvelles exigences du validateur."54    },55    {56      "title_en": "Credential abuse hidden by retry noise",57      "title_fr": "Abus d'identifiants masque par le bruit des nouvelles tentatives",58      "confidence_score": 39,59      "risk_color": "#f59e0b",60      "explanation_en": "A smaller abuse pattern could be present, but the strongest telemetry currently points to validation drift rather than attacker-driven failure.",61      "explanation_fr": "Un motif d'abus plus restreint peut exister, mais la telemetrie la plus forte pointe actuellement vers une derive de validation plutot qu'un echec pilote par un attaquant.",62      "recommended_action_en": "Check ASN concentration and repeated account targeting only after validator mismatch has been ruled out.",63      "recommended_action_fr": "Verifiez la concentration ASN et le ciblage repete de comptes seulement apres avoir ecarte le desalignement de validation."64    }65  ],66  "payment-timeout-cascade": [67    {68      "title_en": "Upstream payment service timeout",69      "title_fr": "Timeout du service de paiement amont",70      "confidence_score": 91,71      "risk_color": "#ef4444",72      "explanation_en": "Provider response times began drifting before internal queue depth exploded. The orchestrator appears to be reacting to upstream slowness rather than generating it first.",73      "explanation_fr": "Les temps de reponse du fournisseur ont commence a deriver avant l'explosion de la profondeur de file interne. L'orchestrateur semble reagir a la lenteur amont plutot que la generer d'abord.",74      "recommended_action_en": "Compare provider latency by region and temporarily reduce retry pressure while contacting the upstream payment vendor.",75      "recommended_action_fr": "Comparez la latence du fournisseur par region et reduisez temporairement la pression des nouvelles tentatives tout en contactant le fournisseur paiement amont."76    },77    {78      "title_en": "Retry amplification in payment-orchestrator",79      "title_fr": "Amplification des nouvelles tentatives dans payment-orchestrator",80      "confidence_score": 84,81      "risk_color": "#f97316",82      "explanation_en": "The retry policy was loosened recently, and queue growth now accelerates with CPU, indicating the internal retry loop is magnifying provider instability.",83      "explanation_fr": "La politique de nouvelle tentative a ete assouplie recemment, et la croissance de file s'accelere maintenant avec le CPU, indiquant que la boucle interne de relance amplifie l'instabilite du fournisseur.",84      "recommended_action_en": "Cap retry concurrency and confirm whether queue depth starts decreasing within the next few minutes.",85      "recommended_action_fr": "Limitez la concurrence des nouvelles tentatives et confirmez si la profondeur de file commence a diminuer dans les prochaines minutes."86    },87    {88      "title_en": "Refund and reconciliation spillover",89      "title_fr": "Debordement vers remboursement et reconciliation",90      "confidence_score": 52,91      "risk_color": "#f59e0b",92      "explanation_en": "Secondary payment workflows are delayed and could worsen customer impact if not isolated, but they do not appear to be the primary trigger.",93      "explanation_fr": "Les workflows secondaires de paiement sont retardes et pourraient aggraver l'impact client s'ils ne sont pas isoles, mais ils ne semblent pas etre le declencheur principal.",94      "recommended_action_en": "Protect refund and reconciliation capacity by rate-limiting non-critical background payment jobs.",95      "recommended_action_fr": "Protegez la capacite de remboursement et de reconciliation en limitant les travaux paiement de fond non critiques."96    }97  ],98  "suspicious-login-anomaly": [99    {100      "title_en": "Suspicious credential abuse",101      "title_fr": "Abus suspect d'identifiants",102      "confidence_score": 93,103      "risk_color": "#ef4444",104      "explanation_en": "The anomaly is concentrated on privileged accounts, new IP clusters, and failed MFA prompts while infrastructure metrics remain calm. That pattern is strongly consistent with targeted credential abuse.",105      "explanation_fr": "L'anomalie se concentre sur des comptes privilegies, de nouveaux groupes d'IP et des invites MFA en echec tandis que les metriques d'infrastructure restent calmes. Ce profil est tres coherent avec un abus cible d'identifiants.",106      "recommended_action_en": "Review top source ASNs, tighten temporary rate limits, and require step-up verification on the targeted account segment.",107      "recommended_action_fr": "Examinez les principaux ASN sources, renforcez temporairement les limites de debit et imposez une verification renforcee sur le segment de comptes cible."108    },109    {110      "title_en": "Bot traffic bypassing normal baselines",111      "title_fr": "Trafic bot contournant les references normales",112      "confidence_score": 74,113      "risk_color": "#f97316",114      "explanation_en": "Traffic volume is elevated without the usual user-behavior shape, which suggests automation even though edge filtering is still absorbing part of it.",115      "explanation_fr": "Le volume de trafic est eleve sans la forme comportementale habituelle des utilisateurs, ce qui suggere une automatisation meme si le filtrage edge en absorbe encore une partie.",116      "recommended_action_en": "Inspect user-agent diversity, IP reputation, and challenge pass rates for bot signatures.",117      "recommended_action_fr": "Inspectez la diversite des user-agents, la reputation IP et les taux de reussite des challenges pour detecter des signatures de bot."118    },119    {120      "title_en": "False positive risk model shift",121      "title_fr": "Derive du modele de risque produisant des faux positifs",122      "confidence_score": 28,123      "risk_color": "#f59e0b",124      "explanation_en": "A detection drift is possible, but the account concentration and MFA behavior make a pure false-positive explanation less convincing.",125      "explanation_fr": "Une derive de detection est possible, mais la concentration des comptes et le comportement MFA rendent une explication purement faux positif moins convaincante.",126      "recommended_action_en": "Review the latest risk rule tuning only after attack-shape evidence has been assessed.",127      "recommended_action_fr": "Examinez le dernier ajustement des regles de risque seulement apres avoir evalue les preuves de forme d'attaque."128    }129  ],130  "database-saturation": [131    {132      "title_en": "Workload overlap on primary database",133      "title_fr": "Chevauchement de charges sur la base primaire",134      "confidence_score": 90,135      "risk_color": "#ef4444",136      "explanation_en": "The BI export schedule moved into the order-processing ramp, and CPU, lock wait, and active sessions all rose together. The database is saturated rather than unavailable.",137      "explanation_fr": "L'horaire d'export BI a glisse dans la montee du traitement des commandes, et CPU, attente de verrous et sessions actives ont tous augmente ensemble. La base est saturee plutot qu'indisponible.",138      "recommended_action_en": "Pause or throttle the BI export and confirm whether primary database CPU and lock waits return toward baseline.",139      "recommended_action_fr": "Mettez en pause ou limitez l'export BI et confirmez si le CPU de la base primaire et l'attente de verrous reviennent vers la normale."140    },141    {142      "title_en": "Lock contention on hot order tables",143      "title_fr": "Contention de verrous sur les tables de commandes chaudes",144      "confidence_score": 77,145      "risk_color": "#f97316",146      "explanation_en": "As concurrency increased, lock wait time rose sharply on a narrow set of order tables, increasing latency even before overall failure rates peaked.",147      "explanation_fr": "A mesure que la concurrence a augmente, le temps d'attente de verrous a fortement monte sur un ensemble restreint de tables de commandes, augmentant la latence avant meme que les taux d'echec globaux n'atteignent leur pic.",148      "recommended_action_en": "Inspect the longest-running transactions and lock graphs for the busiest order-processing tables.",149      "recommended_action_fr": "Inspectez les transactions les plus longues et les graphes de verrous pour les tables de traitement de commandes les plus sollicitees."150    },151    {152      "title_en": "Replica lag causing read spillback",153      "title_fr": "Retard de replica provoquant un retour des lectures",154      "confidence_score": 41,155      "risk_color": "#f59e0b",156      "explanation_en": "Replica lag is present and could force extra reads onto the primary, but the timing still suggests the BI overlap triggered the main event.",157      "explanation_fr": "Un retard de replica est present et pourrait renvoyer des lectures vers la primaire, mais le timing suggere toujours que le chevauchement BI a declenche l'evenement principal.",158      "recommended_action_en": "Validate whether any read traffic automatically failed back to primary during the peak window.",159      "recommended_action_fr": "Validez si du trafic de lecture est automatiquement revenu vers la primaire pendant la fenetre de pic."160    }161  ]162}163