From e1dfc354007dbfb8da8221c6230e99e9f1004db3 Mon Sep 17 00:00:00 2001
From: Jordan Ramos <jordan.ramos@spectrum.com>
Date: Mon, 15 Jun 2026 09:53:09 -0600
Subject: [PATCH] Widen BU change query window to 60 minutes before anomaly
 timestamp

The drift checker runs well before computeAnomalySummary writes to the
anomaly log (20+ minute gap in some syncs). The 10-minute window was
too narrow to capture the BU history records written during drift
checking. Widened to 60 minutes to reliably catch all records from
the same sync cycle.
---
 frontend/src/components/pages/AnomalyBanner.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/frontend/src/components/pages/AnomalyBanner.js b/frontend/src/components/pages/AnomalyBanner.js
index d2a118d..837a998 100644
--- a/frontend/src/components/pages/AnomalyBanner.js
+++ b/frontend/src/components/pages/AnomalyBanner.js
@@ -247,14 +247,14 @@ export default function AnomalyBanner() {
         setBuLoading(true);
         setBuExpanded(true);
         try {
-            // Scope to changes detected around this anomaly's sync.
-            // The drift checker writes BU history records slightly before the anomaly
-            // summary is recorded, so use a 10-minute window before sync_timestamp.
+            // Fetch BU change records relevant to this anomaly.
+            // Use a generous 60-minute window before sync_timestamp since the drift
+            // checker runs well before the anomaly summary is recorded.
             const since = anomaly?.sync_timestamp || '';
             let url;
             if (since) {
                 const sinceDate = new Date(since);
-                sinceDate.setMinutes(sinceDate.getMinutes() - 10);
+                sinceDate.setMinutes(sinceDate.getMinutes() - 60);
                 url = `${API_BASE}/ivanti/findings/bu-changes?since=${encodeURIComponent(sinceDate.toISOString())}`;
             } else {
                 url = `${API_BASE}/ivanti/findings/bu-changes?limit=50`;