{
  "policy": {
    "name": "MTE Relay v5",
    "incident_preference": "PER_CONDITION_AND_TARGET"
  },
  "conditions": [
    {
      "name": "High/critical security event detected",
      "description": "Any high or critical MTE Relay security_event (signature failures, state corruption, state-store persistence failures).",
      "nrql": "SELECT count(*) FROM Log WHERE service = 'mte-relay' AND `security_event.severity` IN ('high', 'critical')",
      "threshold": { "operator": "ABOVE", "value": 0, "duration_minutes": 5, "occurrences": "AT_LEAST_ONCE" },
      "severity": "CRITICAL"
    },
    {
      "name": "Handler panic recovered",
      "description": "An MTE Relay handler panicked and was recovered; the error_event carries the full stack trace.",
      "nrql": "SELECT count(*) FROM Log WHERE service = 'mte-relay' AND `error_event.event_type` = 'panic'",
      "threshold": { "operator": "ABOVE", "value": 0, "duration_minutes": 5, "occurrences": "AT_LEAST_ONCE" },
      "severity": "CRITICAL"
    },
    {
      "name": "State store persistence failures",
      "description": "Relay failing to persist/restore encoder-decoder state. Check Redis health; sustained failures surface as 559/562 client errors.",
      "nrql": "SELECT count(*) FROM Log WHERE service = 'mte-relay' AND `security_event.event_type` IN ('state_save_failed', 'state_not_found')",
      "threshold": { "operator": "ABOVE", "value": 5, "duration_minutes": 10, "occurrences": "AT_LEAST_ONCE" },
      "severity": "CRITICAL"
    },
    {
      "name": "Elevated request latency",
      "description": "Average end-to-end relay latency above 500 ms. Use the phase-breakdown panel to attribute (upstream vs MTE encode/decode). Tune to your traffic profile.",
      "nrql": "SELECT average(numeric(`performance_event.total_time_ms`)) FROM Log WHERE service = 'mte-relay' AND `performance_event.event_type` = 'request_timing'",
      "threshold": { "operator": "ABOVE", "value": 500, "duration_minutes": 10, "occurrences": "ALL" },
      "severity": "WARNING"
    },
    {
      "name": "Client pair exhaustion spike",
      "description": "Many clients exhausting MTE pair pools (forced full re-pair). Capacity early-warning: raise pool sizes or scale out. Tune to your traffic profile.",
      "nrql": "SELECT count(*) FROM Log WHERE service = 'mte-relay' AND `security_event.event_type` = 'client_pairs_exhausted'",
      "threshold": { "operator": "ABOVE", "value": 50, "duration_minutes": 15, "occurrences": "AT_LEAST_ONCE" },
      "severity": "WARNING"
    }
  ]
}