From 31abf2d3498b934c1d57d05a5d2cd1b73d8ea604 Mon Sep 17 00:00:00 2001
From: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>
Date: Mon, 28 Oct 2024 12:36:23 +0000
Subject: [PATCH] [Security Solution][Detection Engine] removes legacy alerting
 endpoints from Security Solution dev scripts (#197424)

## Summary

 - addresses https://github.com/elastic/kibana/issues/95842

---------

Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
(cherry picked from commit 00f34d9b1cf264a21586b77e829340ccf1b960ff)
---
 .../scripts/{get_alert_types.sh => find_alerting_rules.sh} | 7 ++++---
 .../server/lib/detection_engine/scripts/find_rules.sh      | 1 +
 .../{get_alert_instances.sh => get_alerting_rule_types.sh} | 6 +++---
 3 files changed, 8 insertions(+), 6 deletions(-)
 rename x-pack/plugins/security_solution/server/lib/detection_engine/scripts/{get_alert_types.sh => find_alerting_rules.sh} (59%)
 rename x-pack/plugins/security_solution/server/lib/detection_engine/scripts/{get_alert_instances.sh => get_alerting_rule_types.sh} (65%)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/get_alert_types.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/find_alerting_rules.sh
similarity index 59%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/scripts/get_alert_types.sh
rename to x-pack/plugins/security_solution/server/lib/detection_engine/scripts/find_alerting_rules.sh
index 9b51c289ac2c3..c735dd333710c 100755
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/get_alert_types.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/find_alerting_rules.sh
@@ -10,9 +10,10 @@
 set -e
 ./check_env_variables.sh
 
-# Example: ./get_alert_types.sh
-# https://github.com/elastic/kibana/blob/main/x-pack/plugins/alerting/README.md#get-apialerttypes-list-alert-types
+# Example: ./find_alerting_rules.sh
+# https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-findrules
+# Related: use ./find_rules.sh to retrieve Detection Engine (Security) rules
 curl -s -k \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
-  -X GET ${KIBANA_URL}${SPACE_URL}/api/alerts/list_alert_types \
+  -X GET ${KIBANA_URL}${SPACE_URL}/api/alerting/rules/_find \
   | jq .
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/find_rules.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/find_rules.sh
index ef8244ad6e200..422f3e2bb0545 100755
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/find_rules.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/find_rules.sh
@@ -12,5 +12,6 @@ set -e
 
 # Example: ./find_rules.sh
 curl -s -k \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X GET ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_find | jq .
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/get_alert_instances.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/get_alerting_rule_types.sh
similarity index 65%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/scripts/get_alert_instances.sh
rename to x-pack/plugins/security_solution/server/lib/detection_engine/scripts/get_alerting_rule_types.sh
index f2ba9bb70a7c6..59c960d67ba4d 100755
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/get_alert_instances.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/get_alerting_rule_types.sh
@@ -10,9 +10,9 @@
 set -e
 ./check_env_variables.sh
 
-# Example: ./get_alert_instances.sh
-# https://github.com/elastic/kibana/blob/main/x-pack/plugins/alerting/README.md#get-apialert_find-find-alerts
+# Example: ./get_rule_types.sh
+# https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-getruletypes
 curl -s -k \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
-  -X GET ${KIBANA_URL}${SPACE_URL}/api/alerts/_find \
+  -X GET ${KIBANA_URL}${SPACE_URL}/api/alerting/rule_types \
   | jq .