[#1090][FIX] alerts: support updating IOCs via alert update routes

[Romil2112]

Summary

Fixes #1090.

POST /alerts/update/<id> and PUT /api/v2/alerts/<id> both silently ignored alert_iocs in the request body. The field never reached the ORM: AlertSchema has unknown = EXCLUDE, so alert_iocs — which doesn't match the schema's iocs key — was stripped before any relationship assignment could happen. IOCs were effectively immutable after alert creation.

Root cause: alert_iocs in the payload is never mapped to alert.iocs on update, unlike at creation where alerts_add_route explicitly pops alert_iocs, deserializes it with IocSchema, and passes the result directly to alerts_create.

Fix: Mirror the creation pattern in both update routes:

1. Pop alert_iocs from the request data before schema load (so the unknown=EXCLUDE policy doesn't swallow it and it doesn't pollute the activity log).
2. After schema load, if alert_iocs was present in the payload, deserialize the list with IocSchema and assign it to updated_alert.iocs.

Omitting alert_iocs from the payload leaves existing IOCs unchanged. Passing an empty list ("alert_iocs": []) clears all IOCs on the alert.

Changes

• source/app/blueprints/rest/alerts_routes.py — legacy POST /alerts/update/<id>
• source/app/blueprints/rest/v2/alerts.py — v2 PUT /api/v2/alerts/<id>

Test plan

• POST /alerts/update/<id> with alert_iocs: verify IOCs are updated on the alert
• PUT /api/v2/alerts/<id> with alert_iocs: same verification on the v2 endpoint
• Request without alert_iocs field: existing IOCs must remain unchanged
• Request with "alert_iocs": []: existing IOCs must be cleared
• Invalid IOC payload (bad ioc_type_id, missing ioc_value): verify 400 / validation error is returned

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• api_*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f22ec6c9-d8e1-4980-bd9d-4538b29ef8b2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}