foxhunt/migrations/024_ml_security_events.sql

-- Migration: ML Security Events Table
-- Agent: Agent 122
-- Date: 2025-10-14
-- Purpose: Security event logging for ML inference system (SEC-001, SEC-002, SEC-003 fixes)

-- ML security events table for tracking security incidents
CREATE TABLE IF NOT EXISTS ml_security_events (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    timestamp TIMESTAMPTZ NOT NULL DEFAULT NOW(),

    -- Event classification
    event_type VARCHAR(50) NOT NULL,  -- signature_failure, outlier_detected, etc.
    severity VARCHAR(20) NOT NULL,    -- low, medium, high, critical

    -- Context
    model_id VARCHAR(50),
    checkpoint_id VARCHAR(255),
    prediction_id UUID,  -- References ensemble_predictions(id) if available

    -- Event details
    description TEXT NOT NULL,
    metadata JSONB,

    -- Response
    action_taken VARCHAR(100),  -- rejected, flagged, alerted, rollback

    CONSTRAINT chk_severity CHECK (severity IN ('low', 'medium', 'high', 'critical')),
    CONSTRAINT chk_event_type CHECK (event_type IN (
        'checkpoint_signature_failure',
        'checkpoint_signature_missing',
        'checkpoint_tampering_detected',
        'prediction_outlier_detected',
        'prediction_out_of_bounds',
        'extreme_rate_exceeded',
        'ensemble_sudden_shift',
        'coordinated_attack_suspected',
        'model_behavioral_drift',
        'automatic_rollback',
        'manual_intervention'
    ))
);

-- Indexes for fast querying
CREATE INDEX idx_ml_security_events_timestamp ON ml_security_events (timestamp DESC);
CREATE INDEX idx_ml_security_events_severity ON ml_security_events (severity)
    WHERE severity IN ('high', 'critical');
CREATE INDEX idx_ml_security_events_type ON ml_security_events (event_type);
CREATE INDEX idx_ml_security_events_model ON ml_security_events (model_id)
    WHERE model_id IS NOT NULL;

-- TimescaleDB hypertable for time-series data (if TimescaleDB is available)
DO $$
BEGIN
    -- Check if TimescaleDB extension exists
    IF EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'timescaledb') THEN
        PERFORM create_hypertable('ml_security_events', 'timestamp', if_not_exists => TRUE);

        -- Retention policy: Keep high/critical events for 1 year, others for 90 days
        -- Note: Actual retention requires setting up TimescaleDB retention policies
        -- This can be done later via:
        -- SELECT add_retention_policy('ml_security_events', INTERVAL '90 days');
    END IF;
END $$;

-- Add comment for documentation
COMMENT ON TABLE ml_security_events IS 'Security events for ML inference system - tracks checkpoint tampering, model poisoning, and ensemble anomalies';
COMMENT ON COLUMN ml_security_events.event_type IS 'Type of security event (see CHECK constraint for valid values)';
COMMENT ON COLUMN ml_security_events.severity IS 'Severity level: low, medium, high, critical';
COMMENT ON COLUMN ml_security_events.metadata IS 'Additional event-specific metadata (JSON)';
COMMENT ON COLUMN ml_security_events.action_taken IS 'Response action: rejected, flagged, alerted, rollback';