src.dackar.RCA.log_pattern_recognition.rca_pattern_search.models

Classes

UnifiedEvent	Canonical representation of a single event from any source.
IncidentFingerprint	Pre-computed similarity representations for a single incident or detected
HistoricalSignalEpisode	Public output type for PatternSearcher.search().
SearchResult	A single entry in the ranked retrieval output.

Module Contents

class src.dackar.RCA.log_pattern_recognition.rca_pattern_search.models.UnifiedEvent

Canonical representation of a single event from any source.

All three input sources (alarm, SOE, anomaly) are normalised into this structure before any further processing.

Lifecycle:

• Created by IncidentExtractor.to_unified_events()

• episode_id is None until EpisodeDetector assigns membership

• timestamp_end is nullable and not used in current similarity metrics but carried for traceability and future use

raw_id: str

asset_id: str

source: str

event_type: str

timestamp_start: datetime.datetime

timestamp_end: datetime.datetime | None

episode_id: str | None = None

class src.dackar.RCA.log_pattern_recognition.rca_pattern_search.models.IncidentFingerprint

Pre-computed similarity representations for a single incident or detected historical episode. This is the unit of comparison in the retrieval pipeline.

Derived from a list of UnifiedEvents by IncidentExtractor.extract() or EpisodeDetector after episode boundary assignment.

The three representations serve distinct metrics:

event_set → Jaccard (what types occurred, ignoring order/repetition) event_seq → NLCS (what types occurred and in what order) freq_vec → EMD (how many times each type occurred)

High-frequency event types (count > freq_threshold) are excluded from event_set and event_seq but retained in freq_vec.

episode_id: str

asset_id: str

window_start: datetime.datetime

window_end: datetime.datetime

density: float

event_set: frozenset[str]

event_seq: list[str]

freq_vec: dict[str, int]

known_rca: str | None = None

source_types: list[str] = []

class src.dackar.RCA.log_pattern_recognition.rca_pattern_search.models.HistoricalSignalEpisode

Public output type for PatternSearcher.search().

Represents a single historical signal episode retrieved for a query incident. Carries all three metric scores individually (§5 of the integration plan) and an index_status field that governs cross-pattern linkage eligibility (§4.11).

Sentinel (no_episodes_indexed) instances have episode_id == “” and similarity_to_current == 0.0. Callers must check index_status before attempting linkage.

episode_id: str

asset_id: str

window_start: datetime.datetime | None

window_end: datetime.datetime | None

source_types: list[str]

event_set: frozenset[str]

event_seq: list[str]

freq_vec: dict[str, int]

similarity_to_current: float

jaccard_score: float

nlcs_score: float

emd_score: float

weight_profile: str

matched_events: set[str]

query_only_events: set[str]

episode_only_events: set[str]

episode_density: float

known_rca: str | None

linked_doc_ids: list[str]

index_status: str

class src.dackar.RCA.log_pattern_recognition.rca_pattern_search.models.SearchResult

A single entry in the ranked retrieval output.

Returned by PatternSearcher.search() for each matching historical episode. Includes all three metric scores for transparency and downstream analysis.

episode_id: str

jaccard_score: float

nlcs_score: float

emd_score: float

combined_score: float

weight_profile: str

episode_window: tuple[datetime.datetime, datetime.datetime]

episode_density: float

matched_events: set[str]

query_only_events: set[str]

episode_only_events: set[str]

known_rca: str | None = None