Add IO attribution anomaly detection and alert correlation

alert_events_test.go

@@ -10,7 +10,7 @@ func TestAlertLifecycle(t *testing.T) {
 	defer store.Close()
 	alert := Alert{ID: "disk", Severity: "warning", Source: "Диски", Title: "SMART", Message: "Проверьте диск"}
 	visible, err := store.SyncAlerts([]Alert{alert})
-	if err != nil || len(visible) != 1 || visible[0].EventID == 0 {
+	if err != nil || len(visible) != 1 || visible[0].EventID == 0 || visible[0].FirstSeen == 0 || visible[0].LastSeen == 0 {
 		t.Fatalf("unexpected new alert: %+v %v", visible, err)
 	}
 	firstID := visible[0].EventID