[🐛 Bug]: [Alert enrichment] when changing status of incident, other enrichments of alerts are gone

[bbcorp]

Describe the bug Alert enrichment: I've noticed when you acknowledge an incident, it acknowledges the alert too by adding the enrichment "status": "acknowledged" but all other previous enrichments are gone. Same goes when you resolve and incident.

To Reproduce Steps to reproduce the behavior:

1. Send an alert
2. Click on the alert details
3. Add some enrichment
4. Create a ticket from alert
5. Acknowledge or Resolve the ticket
6. See that your previous enrichments on alert are gone.

Expected behavior Merge status and current enrichments of alerts.

Additional context The code uses batch_enrich in keep/api/bl/enrichments_bl https://github.com/keephq/keep/blob/main/keep/api/bl/enrichments_bl.py#L641-L650

[dosubot[bot]]

This is a confirmed bug: when you change the status of an incident (acknowledge/resolve), the batch_enrich method overwrites the entire enrichments field for the alert, causing all previous enrichments to be lost instead of merging them with the new status. This happens because batch_enrich passes the new enrichments dict directly to the database update, replacing whatever was there before, rather than merging with existing enrichments as enrich_entity does (source).

Alert enrichments are stored as key-value pairs in a dict (docs), so merging should mean combining the new status with the existing keys/values.

Workaround: If you need to preserve enrichments, you can manually fetch the current enrichments for the alert, merge in the new status, and then call batch_enrich with the combined dict. Alternatively, use enrich_entity for single alerts, since it merges enrichments by default.

No recent PRs or docs address this bug, so this behavior is still present in the latest codebase.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}