From a3496c9ca6d99fa301fd8ca73ad44178cdeb2955 Mon Sep 17 00:00:00 2001 From: Christos Nasikas Date: Tue, 3 Dec 2024 12:21:53 +0200 Subject: [PATCH] [ResponseOps][Alerting] Decouple feature IDs from consumers (#183756) ## Summary This PR aims to decouple the feature IDs from the `consumer` attribute of rules and alerts. Towards: https://github.com/elastic/kibana/issues/187202 Fixes: https://github.com/elastic/kibana/issues/181559 Fixes: https://github.com/elastic/kibana/issues/182435 > [!NOTE] > Unfortunately, I could not break the PR into smaller pieces. The APIs could not work anymore with feature IDs and had to convert them to use rule type IDs. Also, I took the chance and refactored crucial parts of the authorization class that in turn affected a lot of files. Most of the changes in the files are minimal and easy to review. The crucial changes are in the authorization class and some alerting APIs. ## Architecture ### Alerting RBAC model The Kibana security uses Elasticsearch's [application privileges](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-privileges.html#security-api-put-privileges). This way Kibana can represent and store its privilege models within Elasticsearch roles. To do that, Kibana security creates actions that are granted by a specific privilege. Alerting uses its own RBAC model and is built on top of the existing Kibana security model. The Alerting RBAC uses the `rule_type_id` and `consumer` attributes to define who owns the rule and the alerts procured by the rule. To connect the `rule_type_id` and `consumer` with the Kibana security actions the Alerting RBAC registers its custom actions. They are constructed as `alerting:///`. Because to authorizate a resource an action has to be generated and because the action needs a valid feature ID the value of the `consumer` should be a valid feature ID. For example, the `alerting:siem.esqlRule/siem/rule/get` action, means that a user with a role that grants this action can get a rule of type `siem.esqlRule` with consumer `siem`. ### Problem statement At the moment the `consumer` attribute should be a valid feature ID. Though this approach worked well so far it has its limitation. Specifically: - Rule types cannot support more than one consumer. - To associate old rules with a new feature ID required a migration on the rule's SOs and the alerts documents. - The API calls are feature ID-oriented and not rule-type-oriented. - The framework has to be aware of the values of the `consumer` attribute. - Feature IDs are tightly coupled with the alerting indices leading to [bugs](https://github.com/elastic/kibana/issues/179082). - Legacy consumers that are not a valid feature anymore can cause [bugs](https://github.com/elastic/kibana/issues/184595). - The framework has to be aware of legacy consumers to handle edge cases. - The framework has to be aware of specific consumers to handle edge cases. ### Proposed solution This PR aims to decouple the feature IDs from consumers. It achieves that a) by changing the way solutions configure the alerting privileges when registering a feature and b) by changing the alerting actions. The schema changes as: ``` // Old formatting id: 'siem', <--- feature ID alerting:['siem.queryRule'] // New formatting id: 'siem', <--- feature ID alerting: [{ ruleTypeId: 'siem.queryRule', consumers: ['siem'] }] <-- consumer same as the feature ID in the old formatting ``` The new actions are constructed as `alerting:///`. For example `alerting:rule-type-id/my-consumer/rule/get`. The new action means that a user with a role that grants this action can get a rule of type `rule-type` with consumer `my-consumer`. Changing the action strings is not considered a breaking change as long as the user's permission works as before. In our case, this is true because the consumer will be the same as before (feature ID), and the alerting security actions will be the same. For example: **Old formatting** Schema: ``` id: 'logs', <--- feature ID alerting:['.es-query'] <-- rule type ID ``` Generated action: ``` alerting:.es-query/logs/rule/get ``` **New formatting** Schema: ``` id: 'siem', <--- feature ID alerting: [{ ruleTypeId: '.es-query', consumers: ['logs'] }] <-- consumer same as the feature ID in the old formatting ``` Generated action: ``` alerting:.es-query/logs/rule/get <--- consumer is set as logs and the action is the same as before ``` In both formating the actions are the same thus breaking changes are avoided. ### Alerting authorization class The alerting plugin uses and exports the alerting authorization class (`AlertingAuthorization`). The class is responsible for handling all authorization actions related to rules and alerts. The class changed to handle the new actions as described in the above sections. A lot of methods were renamed, removed, and cleaned up, all method arguments converted to be an object, and the response signature of some methods changed. These changes affected various pieces of the code. The changes in this class are the most important in this PR especially the `_getAuthorizedRuleTypesWithAuthorizedConsumers` method which is the cornerstone of the alerting RBAC. Please review carefully. ### Instantiation of the alerting authorization class The `AlertingAuthorizationClientFactory` is used to create instances of the `AlertingAuthorization` class. The `AlertingAuthorization` class needs to perform async operations upon instantiation. Because JS, at the moment, does not support async instantiation of classes the `AlertingAuthorization` class was assigning `Promise` objects to variables that could be resolved later in other phases of the lifecycle of the class. To improve readability and make the lifecycle of the class clearer, I separated the construction of the class (initialization) from the bootstrap process. As a result, getting the `AlertingAuthorization` class or any client that depends on it (`getRulesClient` for example) is an async operation. ### Filtering A lot of routes use the authorization class to get the authorization filter (`getFindAuthorizationFilter`), a filter that, if applied, returns only the rule types and consumers the user is authorized to. The method that returns the filter was built in a way to also support filtering on top of the authorization filter thus coupling the authorized filter with router filtering. I believe these two operations should be decoupled and the filter method should return a filter that gives you all the authorized rule types. It is the responsibility of the consumer, router in our case, to apply extra filters on top of the authorization filter. For that reason, I made all the necessary changes to decouple them. ### Legacy consumers & producer A lot of rules and alerts have been created and are still being created from observability with the `alerts` consumer. When the Alerting RBAC encounters a rule or alert with `alerts` as a consumer it falls back to the `producer` of the rule type ID to construct the actions. For example if a rule with `ruleTypeId: .es-query` and `consumer: alerts` the alerting action will be constructed as `alerting:.es-query/stackAlerts/rule/get` where `stackRules` is the producer of the `.es-query` rule type. The `producer` is used to be used in alerting authorization but due to its complexity, it was deprecated and only used as a fallback for the `alerts` consumer. To avoid breaking changes all feature privileges that specify access to rule types add the `alerts` consumer when configuring their alerting privileges. By moving the `alerts` consumer to the registration of the feature we can stop relying on the `producer`. The `producer` is not used anymore in the authorization class. In the next PRs the `producer` will removed entirely. ### Routes The following changes were introduced to the alerting routes: - All related routes changed to be rule-type oriented and not feature ID oriented. - All related routes support the `ruleTypeIds` and the `consumers` parameters for filtering. In all routes, the filters are constructed as `ruleTypeIds: ['foo'] AND consumers: ['bar'] AND authorizationFilter`. Filtering by consumers is important. In o11y for example, we do not want to show ES rule types with the `stackAlerts` consumer even if the user has access to them. - The `/internal/rac/alerts/_feature_ids` route got deleted as it was not used anywhere in the codebase and it was internal. All the changes in the routes are related to internal routes and no breaking changes are introduced. ### Constants I moved the o11y and stack rule type IDs to `kbn-rule-data-utils` and exported all security solution rule type IDs from `kbn-securitysolution-rules`. I am not a fan of having a centralized place for the rule type IDs. Ideally, consumers of the framework should specify keywords like `observablility` (category or subcategory) or even `apm.*` and the framework should know which rule type IDs to pick up. I think it is out of the scope of the PR, and at the moment it seems the most straightforward way to move forward. I will try to clean up as much as possible in further iterations. If you are interested in the upcoming work follow this issue https://github.com/elastic/kibana/issues/187202. ### Other notable code changes - Change all instances of feature IDs to rule type IDs. - `isSiemRuleType`: This is a temporary helper function that is needed in places where we handle edge cases related to security solution rule types. Ideally, the framework should be agnostic to the rule types or consumers. The plan is to be removed entirely in further iterations. - Rename alerting `PluginSetupContract` and `PluginStartContract` to `AlertingServerSetup` and `AlertingServerStart`. This made me touch a lot of files but I could not resist. - `filter_consumers` was mistakenly exposed to a public API. It was undocumented. - Files or functions that were not used anywhere in the codebase got deleted. - Change the returned type of the `list` method of the `RuleTypeRegistry` from `Set` to `Map`. - Assertion of `KueryNode` in tests changed to an assertion of KQL using `toKqlExpression`. - Removal of `useRuleAADFields` as it is not used anywhere. ## Testing > [!CAUTION] > It is very important to test all the areas of the application where rules or alerts are being used directly or indirectly. Scenarios to consider: > - The correct rules, alerts, and aggregations on top of them are being shown as expected as a superuser. > - The correct rules, alerts, and aggregations on top of them are being shown as expected by a user with limited access to certain features. > - The changes in this PR are backward compatible with the previous users' permissions. ### Solutions Please test and verify that: - All the rule types you own with all possible combinations of permissions both in ESS and in Serverless. - The consumers and rule types make sense when registering the features. - The consumers and rule types that are passed to the components are the intended ones. ### ResponseOps The most important changes are in the alerting authorization class, the search strategy, and the routes. Please test: - The rules we own with all possible combinations of permissions. - The stack alerts page and its solution filtering. - The categories filtering in the maintenance window UI. ## Risks > [!WARNING] > The risks involved in this PR are related to privileges. Specifically: > - Users with no privileges can access rules and alerts they do not have access to. > - Users with privileges cannot access rules and alerts they have access to. > > An excessive list of integration tests is in place to ensure that the above scenarios will not occur. In the case of a bug, we could a) release an energy release for serverless and b) backport the fix in ESS. Given that this PR is intended to be merged in 8.17 we have plenty of time to test and to minimize the chances of risks. ## FQA - I noticed that a lot of routes support the `filter` parameter where we can pass an arbitrary KQL filter. Why we do not use this to filter by the rule type IDs and the consumers and instead we introduce new dedicated parameters? The `filter` parameter should not be exposed in the first place. It assumes that the consumer of the API knows the underlying structure and implementation details of the persisted storage API (SavedObject client API). For example, a valid filter would be `alerting.attributes.rule_type_id`. In this filter the consumer should know a) the name of the SO b) the keyword `attributes` (storage implementation detail) and c) the name of the attribute as it is persisted in ES (snake case instead of camel case as it is returned by the APIs). As there is no abstraction layer between the SO and the API, it makes it very difficult to make changes in the persistent schema or the APIs. For all the above I decided to introduce new query parameters where the alerting framework has total control over it. - I noticed in the code a lot of instances where the consumer is used. Should not remove any logic around consumers? This PR is a step forward making the framework as agnostic as possible. I had to keep the scope of the PR as contained as possible. We will get there. It needs time :). - I noticed a lot of hacks like checking if the rule type is `siem`. Should not remove the hacks? This PR is a step forward making the framework as agnostic as possible. I had to keep the scope of the PR as contained as possible. We will get there. It needs time :). - I hate the "Role visibility" dropdown. Can we remove it? I also do not like it. The goal is to remove it. Follow https://github.com/elastic/kibana/issues/189997. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Aleh Zasypkin Co-authored-by: Paula Borgonovi <159723434+pborgonovi@users.noreply.github.com> --- .../search_strategy_types.ts | 4 +- .../observability_threshold_schema.ts | 90 + .../src/components/alerts_grouping.test.tsx | 6 +- .../src/components/alerts_grouping.tsx | 6 +- .../components/alerts_grouping_level.test.tsx | 58 + .../src/components/alerts_grouping_level.tsx | 9 +- .../src/mocks/grouping_props.mock.tsx | 7 +- .../src/mocks/grouping_query.mock.ts | 6 +- packages/kbn-alerts-grouping/src/types.ts | 9 +- .../src/action_variables/transforms.test.ts | 1 + .../alert_filter_controls.test.tsx | 3 +- .../alert_filter_controls.tsx | 15 +- .../filter_group.test.tsx | 7 +- .../alert_filter_controls/filter_group.tsx | 6 +- .../src/alert_filter_controls/types.ts | 3 +- .../src/alerts_search_bar/index.test.tsx | 171 +- .../src/alerts_search_bar/index.tsx | 37 +- .../src/alerts_search_bar/types.ts | 4 +- .../fetch_alerts_fields.test.ts | 8 +- .../fetch_alerts_fields.ts | 4 +- .../common/apis/fetch_alerts_fields/types.ts | 5 +- .../fetch_alerts_index_names.test.ts | 7 +- .../fetch_alerts_index_names.ts | 4 +- .../apis/fetch_alerts_index_names/types.ts | 5 +- .../apis/search_alerts/search_alerts.test.tsx | 6 +- .../apis/search_alerts/search_alerts.ts | 15 +- .../src/common/hooks/index.ts | 1 - .../hooks/use_alerts_data_view.test.tsx | 50 +- .../src/common/hooks/use_alerts_data_view.ts | 35 +- .../use_fetch_alerts_fields_query.test.tsx | 45 +- .../hooks/use_fetch_alerts_fields_query.ts | 16 +- ...se_fetch_alerts_index_names_query.test.tsx | 17 +- .../use_fetch_alerts_index_names_query.ts | 8 +- .../hooks/use_find_alerts_query.test.tsx | 53 + .../src/common/hooks/use_find_alerts_query.ts | 5 +- ...t_alerts_group_aggregations_query.test.tsx | 4 +- ...use_get_alerts_group_aggregations_query.ts | 8 +- .../src/common/hooks/use_rule_aad_fields.ts | 63 - .../hooks/use_search_alerts_query.test.tsx | 34 +- .../common/hooks/use_search_alerts_query.ts | 8 +- .../src/maintenance_window_callout/index.tsx | 1 + .../rule_actions_alerts_filter.test.tsx | 9 +- .../rule_actions_alerts_filter.tsx | 8 +- .../rule_actions/rule_actions_item.tsx | 1 - .../rule_actions_settings.test.tsx | 46 +- .../rule_actions/rule_actions_settings.tsx | 11 +- .../filter_and_count_rule_types.test.ts | 1 + .../components/rule_type_list.test.tsx | 3 + packages/kbn-rule-data-utils/jest.config.js | 14 + .../src/alerts_as_data_rbac.test.ts | 22 + .../src/alerts_as_data_rbac.ts | 8 + .../src/rule_types/o11y_rules.ts | 70 +- .../src/rule_types/stack_rules.ts | 10 + .../src/rule_type_constants.ts | 11 + .../rule_types.ts | 1 + src/plugins/data_views/public/mocks.ts | 1 + .../alerting_example/server/plugin.ts | 80 +- .../components/alerts_table_sandbox.tsx | 8 +- .../server/plugin.ts | 4 +- .../triggers_actions_ui_example/tsconfig.json | 1 - .../src/hooks/use_alerts_history.test.tsx | 175 +- .../src/hooks/use_alerts_history.ts | 23 +- .../observability/alert_details/tsconfig.json | 4 +- .../features/src/security/kibana_features.ts | 19 +- .../src/actions/alerting.test.ts | 18 - .../src/actions/alerting.ts | 8 - .../alerting.test.ts | 633 +- .../feature_privilege_builder/alerting.ts | 18 +- .../src/privileges/privileges.test.ts | 13 +- .../src/privileges/privileges.ts | 8 +- .../routes/rule/apis/aggregate/schemas/v1.ts | 3 +- .../apis/bulk_untrack_by_query/schemas/v1.ts | 2 +- .../common/routes/rule/apis/find/index.ts | 7 +- .../routes/rule/apis/find/schemas/v1.ts | 32 + .../common/routes/rule/apis/find/types/v1.ts | 3 +- .../create_maintenance_windows_form.tsx | 17 +- .../maintenance_window_scoped_query.test.tsx | 7 +- .../maintenance_window_scoped_query.tsx | 7 +- ...rting_authorization_client_factory.test.ts | 104 +- .../alerting_authorization_client_factory.ts | 45 +- .../lib/set_alerts_to_untracked.test.ts | 42 +- .../lib/set_alerts_to_untracked.ts | 31 +- .../methods/find/find_backfill.test.ts | 91 +- .../backfill/methods/find/find_backfill.ts | 10 +- .../schedule/schedule_backfill.test.ts | 13 +- .../methods/schedule/schedule_backfill.ts | 8 +- .../methods/aggregate/aggregate_rules.test.ts | 96 +- .../rule/methods/aggregate/aggregate_rules.ts | 35 +- .../schemas/aggregate_options_schema.ts | 3 +- .../rule/methods/aggregate/types/index.ts | 8 - .../rule/methods/bulk_edit/bulk_edit_rules.ts | 8 +- .../bulk_untrack/bulk_untrack_alerts.ts | 7 +- .../schemas/bulk_untrack_body_schema.ts | 2 +- .../rule/methods/create/create_rule.ts | 6 + .../rule/methods/find/find_rules.test.ts | 188 +- .../rule/methods/find/find_rules.ts | 41 +- .../find/schemas/find_rules_schemas.ts | 4 +- .../methods/find/types/find_rules_types.ts | 1 - .../methods/rule_types/rule_types.test.ts | 52 + .../rule/methods/rule_types/rule_types.ts | 28 +- .../rule/methods/tags/get_rule_tags.test.ts | 65 +- .../rule/methods/tags/get_rule_tags.ts | 8 +- .../alerting_authorization.mock.ts | 18 +- .../alerting_authorization.test.ts | 3815 ++- .../authorization/alerting_authorization.ts | 621 +- .../alerting_authorization_kuery.test.ts | 910 +- .../alerting_authorization_kuery.ts | 57 +- .../alerting/server/authorization/index.ts | 1 + .../alerting/server/authorization/types.ts | 46 + x-pack/plugins/alerting/server/index.ts | 5 +- x-pack/plugins/alerting/server/mocks.ts | 6 +- x-pack/plugins/alerting/server/plugin.test.ts | 25 +- x-pack/plugins/alerting/server/plugin.ts | 29 +- .../server/routes/_mock_handler_arguments.ts | 2 +- .../apis/delete/delete_backfill_route.ts | 3 +- .../backfill/apis/find/find_backfill_route.ts | 3 +- .../backfill/apis/get/get_backfill_route.ts | 3 +- .../apis/schedule/schedule_backfill_route.ts | 3 +- .../framework/apis/health/health.test.ts | 21 +- .../routes/framework/apis/health/health.ts | 3 +- .../server/routes/get_action_error_log.ts | 3 +- .../server/routes/get_global_execution_kpi.ts | 3 +- .../routes/get_global_execution_logs.ts | 3 +- .../server/routes/get_rule_alert_summary.ts | 3 +- .../server/routes/get_rule_execution_kpi.ts | 3 +- .../server/routes/get_rule_execution_log.ts | 3 +- .../alerting/server/routes/get_rule_state.ts | 3 +- .../alerting/server/routes/legacy/create.ts | 4 +- .../alerting/server/routes/legacy/delete.ts | 3 +- .../alerting/server/routes/legacy/disable.ts | 3 +- .../alerting/server/routes/legacy/enable.ts | 3 +- .../alerting/server/routes/legacy/find.ts | 3 +- .../alerting/server/routes/legacy/get.ts | 3 +- .../legacy/get_alert_instance_summary.ts | 3 +- .../server/routes/legacy/get_alert_state.ts | 3 +- .../server/routes/legacy/health.test.ts | 20 +- .../alerting/server/routes/legacy/health.ts | 3 +- .../routes/legacy/list_alert_types.test.ts | 13 +- .../server/routes/legacy/list_alert_types.ts | 4 +- .../alerting/server/routes/legacy/mute_all.ts | 3 +- .../server/routes/legacy/mute_instance.ts | 3 +- .../server/routes/legacy/unmute_all.ts | 3 +- .../server/routes/legacy/unmute_instance.ts | 3 +- .../alerting/server/routes/legacy/update.ts | 3 +- .../server/routes/legacy/update_api_key.ts | 3 +- .../aggregate/aggregate_rules_route.test.ts | 4 + .../apis/aggregate/aggregate_rules_route.ts | 3 +- .../transform_aggregate_query_request/v1.ts | 6 +- .../bulk_delete/bulk_delete_rules_route.ts | 3 +- .../bulk_disable/bulk_disable_rules_route.ts | 3 +- .../apis/bulk_edit/bulk_edit_rules_route.ts | 3 +- .../bulk_enable/bulk_enable_rules_route.ts | 3 +- .../bulk_untrack/bulk_untrack_alerts_route.ts | 3 +- ...bulk_untrack_alerts_by_query_route.test.ts | 4 +- .../bulk_untrack_alerts_by_query_route.ts | 3 +- .../v1.ts | 4 +- .../rule/apis/clone/clone_rule_route.ts | 3 +- .../rule/apis/create/create_rule_route.ts | 3 +- .../rule/apis/delete/delete_rule_route.ts | 3 +- .../rule/apis/disable/disable_rule_route.ts | 2 +- .../rule/apis/enable/enable_rule_route.ts | 2 +- .../find/find_internal_rules_route.test.ts | 78 + .../apis/find/find_internal_rules_route.ts | 14 +- .../rule/apis/find/find_rules_route.test.ts | 135 + .../routes/rule/apis/find/find_rules_route.ts | 2 +- .../routes/rule/apis/find/transforms/index.ts | 5 +- .../transform_find_rules_body/v1.ts | 42 +- .../routes/rule/apis/get/get_rule_route.ts | 3 +- .../get_schedule_frequency_route.ts | 3 +- .../rule/apis/list_types/rule_types.test.ts | 6 +- .../routes/rule/apis/list_types/rule_types.ts | 2 +- .../transform_rule_types_response/v1.ts | 4 +- .../routes/rule/apis/mute_alert/mute_alert.ts | 3 +- .../rule/apis/mute_all/mute_all_rule.ts | 3 +- .../rule/apis/resolve/resolve_rule_route.ts | 3 +- .../rule/apis/snooze/snooze_rule_route.ts | 3 +- .../routes/rule/apis/tags/get_rule_tags.ts | 3 +- .../apis/unmute_alert/unmute_alert_route.ts | 2 +- .../rule/apis/unmute_all/unmute_all_rule.ts | 3 +- .../rule/apis/unsnooze/unsnooze_rule_route.ts | 3 +- .../rule/apis/update/update_rule_route.ts | 3 +- .../update_rule_api_key_route.ts | 2 +- .../alerting/server/routes/run_soon.ts | 3 +- .../suggestions/values_suggestion_alerts.ts | 47 +- .../suggestions/values_suggestion_rules.ts | 13 +- .../server/rule_type_registry.test.ts | 6 +- .../alerting/server/rule_type_registry.ts | 87 +- .../alerting/server/rules_client.mock.ts | 8 +- .../rules_client/common/filters.test.ts | 463 + .../server/rules_client/common/filters.ts | 92 + .../lib/get_authorization_filter.ts | 10 +- .../methods/get_action_error_log.ts | 10 +- .../rules_client/methods/get_execution_kpi.ts | 10 +- .../rules_client/methods/get_execution_log.ts | 10 +- .../server/rules_client/rules_client.mock.ts | 70 + .../tests/list_rule_types.test.ts | 262 +- .../alerting/server/rules_client/types.ts | 4 - .../server/rules_client_factory.test.ts | 22 +- .../alerting/server/rules_client_factory.ts | 10 +- .../server/task_runner/rule_loader.test.ts | 6 +- x-pack/plugins/alerting/server/types.ts | 8 +- x-pack/plugins/alerting/tsconfig.json | 2 + .../cases/common/constants/owner.test.ts | 6 +- .../plugins/cases/common/constants/owners.ts | 7 +- .../plugins/cases/common/utils/owner.test.ts | 13 +- x-pack/plugins/cases/common/utils/owner.ts | 6 +- .../components/case_view_alerts.test.tsx | 6 +- .../case_view/components/case_view_alerts.tsx | 15 +- .../system_actions/cases/cases_params.tsx | 7 +- .../server/connectors/cases/index.test.ts | 4 +- .../cases/server/connectors/cases/index.ts | 2 +- .../plugins/cases/server/connectors/index.ts | 4 +- x-pack/plugins/cases/server/types.ts | 4 +- x-pack/plugins/cases/tsconfig.json | 1 + .../bulk_action/bulk_action.ts | 4 +- .../common/alerting_kibana_privilege.ts | 18 + .../common/feature_kibana_privileges.ts | 25 +- .../plugins/features/common/kibana_feature.ts | 10 +- .../feature_privilege_iterator.test.ts | 172 +- .../feature_privilege_iterator.ts | 53 +- .../features/server/feature_registry.test.ts | 940 +- .../plugins/features/server/feature_schema.ts | 78 +- x-pack/plugins/ml/common/constants/alerts.ts | 4 + x-pack/plugins/ml/common/index.ts | 2 +- .../plugins/ml/common/types/capabilities.ts | 14 +- x-pack/plugins/ml/kibana.jsonc | 3 +- .../explorer/alerts/alerts_panel.tsx | 11 +- .../anomaly_detection_alerts_state_service.ts | 6 +- x-pack/plugins/ml/server/plugin.ts | 6 +- .../plugins/ml/server/routes/job_service.ts | 20 +- .../public/alerts/alert_form.test.tsx | 1 + .../lib/cluster/get_clusters_from_request.ts | 38 +- .../collection/get_collection_status.test.ts | 2 +- x-pack/plugins/monitoring/server/plugin.ts | 15 +- .../server/routes/api/v1/alerts/enable.ts | 4 +- .../server/routes/api/v1/alerts/status.ts | 2 +- x-pack/plugins/monitoring/server/types.ts | 21 +- .../config/apm_alerting_feature_ids.ts | 11 +- .../components/app/alerts_overview/index.tsx | 8 +- .../apm/server/feature.ts | 16 +- .../lib/helpers/get_apm_alerts_client.ts | 4 +- .../routes/alerts/register_apm_rule_types.ts | 7 +- .../server/routes/alerts/test_utils/index.ts | 4 +- .../apm/server/routes/typings.ts | 6 +- .../apm/server/types.ts | 6 +- .../alerting/logs/log_threshold/types.ts | 2 +- .../infra/common/alerting/metrics/types.ts | 6 +- .../infra/common/constants.ts | 3 +- .../shared/alerts/alerts_overview.tsx | 11 +- .../components/shared/alerts/constants.ts | 4 +- .../public/hooks/use_alerts_count.test.ts | 15 +- .../infra/public/hooks/use_alerts_count.ts | 21 +- .../settings/indices_configuration_panel.tsx | 5 +- .../tabs/alerts/alerts_tab_content.tsx | 14 +- .../components/tabs/alerts_tab_badge.tsx | 6 +- .../source_configuration_settings.tsx | 8 +- .../infra/server/features.ts | 31 +- .../lib/adapters/framework/adapter_types.ts | 4 +- ...er_inventory_metric_threshold_rule_type.ts | 4 +- .../register_log_threshold_rule_type.ts | 7 +- .../register_metric_threshold_rule_type.ts | 7 +- .../lib/alerting/register_rule_types.ts | 4 +- .../lib/helpers/get_infra_alerts_client.ts | 6 +- .../infra/lib/host/get_hosts_alerts_count.ts | 4 +- .../infra/server/services/rules/types.ts | 4 +- .../create_alerts_client.ts | 9 +- .../server/services/get_alerts_client.ts | 10 +- .../lib/adapters/framework/adapter_types.ts | 4 +- .../observability/common/constants.ts | 12 +- .../alert_search_bar.test.tsx | 4 +- .../alert_search_bar/alert_search_bar.tsx | 4 +- .../get_alerts_page_table_configuration.tsx | 9 +- .../alerts/get_persistent_controls.ts | 7 +- .../components/alert_history.tsx | 25 +- .../components/related_alerts.tsx | 11 +- .../public/pages/alerts/alerts.tsx | 20 +- .../public/pages/overview/overview.tsx | 11 +- .../components/rule_details_tabs.tsx | 11 +- .../pages/rule_details/rule_details.tsx | 22 +- .../public/pages/rules/rules_tab.tsx | 6 +- .../server/lib/rules/register_rule_types.ts | 4 +- .../observability/server/plugin.ts | 44 +- .../server/routes/register_routes.ts | 2 +- .../server/routes/types.ts | 2 +- .../server/types.ts | 9 +- .../server/functions/alerts.ts | 42 +- .../server/types.ts | 9 +- .../alerts/components/slo_alerts_summary.tsx | 5 +- .../alerts/components/slo_alerts_table.tsx | 5 +- .../public/hooks/use_fetch_active_alerts.ts | 13 +- .../use_fetch_slos_with_burn_rate_rules.ts | 13 +- .../components/slo_detail_alerts.tsx | 5 +- .../lib/rules/register_burn_rate_rule.ts | 4 +- .../slo/server/plugin.ts | 20 +- .../slo/server/services/get_slos_overview.ts | 15 +- .../slo/server/types.ts | 6 +- .../common/constants/synthetics_alerts.ts | 14 +- .../hooks/use_fetch_active_alerts.ts | 8 +- .../monitor_alerts/monitor_detail_alerts.tsx | 5 +- .../lib/alert_types/monitor_status.tsx | 3 +- .../apps/synthetics/lib/alert_types/tls.tsx | 3 +- .../status_rule/monitor_status_rule.ts | 6 +- .../server/alert_rules/tls_rule/tls_rule.ts | 6 +- .../synthetics/server/feature.ts | 27 +- .../default_alerts/default_alert_service.ts | 10 +- .../synthetics/server/types.ts | 11 +- .../common/constants/synthetics_alerts.ts | 2 - .../uptime/common/constants/uptime_alerts.ts | 7 +- .../routes/monitors/monitors_details.ts | 2 +- .../alert_data_client/alerts_client.mock.ts | 1 - .../alert_data_client/alerts_client.test.ts | 244 + .../server/alert_data_client/alerts_client.ts | 155 +- .../alerts_client_factory.test.ts | 2 +- .../alerts_client_factory.ts | 18 +- .../tests/bulk_update.test.ts | 60 +- .../tests/find_alerts.test.ts | 316 +- .../alert_data_client/tests/get.test.ts | 55 +- .../tests/get_aad_fields.test.ts | 4 +- .../get_alerts_group_aggregations.test.ts | 70 +- .../tests/get_alerts_summary.test.ts | 311 + .../alert_data_client/tests/update.test.ts | 54 +- .../server/lib/get_authz_filter.ts | 12 +- .../server/lib/get_consumers_filter.test.tsx | 26 + .../server/lib/get_consumers_filter.tsx | 13 + .../lib/get_rule_type_ids_filter.test.tsx | 26 + .../server/lib/get_rule_type_ids_filter.tsx | 13 + x-pack/plugins/rule_registry/server/plugin.ts | 17 +- .../routes/__mocks__/request_responses.ts | 21 +- .../routes/__mocks__/response_adapters.ts | 2 + .../rule_registry/server/routes/find.test.ts | 56 + .../rule_registry/server/routes/find.ts | 9 +- .../server/routes/get_alert_index.test.ts | 26 +- .../server/routes/get_alert_index.ts | 18 +- .../server/routes/get_alert_summary.test.ts | 71 +- .../server/routes/get_alert_summary.ts | 15 +- .../get_alerts_group_aggregations.test.ts | 106 +- .../routes/get_alerts_group_aggregations.ts | 35 +- .../get_browser_fields_by_feature_id.test.ts | 65 - ...et_browser_fields_by_rule_type_ids.test.ts | 123 + ...=> get_browser_fields_by_rule_type_ids.ts} | 23 +- ...ature_ids_by_registration_contexts.test.ts | 78 - ...et_feature_ids_by_registration_contexts.ts | 71 - .../rule_registry/server/routes/index.ts | 4 +- .../rule_data_plugin_service.mock.ts | 1 - .../rule_data_plugin_service.ts | 17 - .../search_strategy/search_strategy.test.ts | 458 +- .../server/search_strategy/search_strategy.ts | 111 +- .../tabs/alerts_tab/index.tsx | 9 +- .../components/alerts_table/index.tsx | 8 +- .../detection_engine_filters.tsx | 4 +- .../endpoint/endpoint_app_context_services.ts | 4 +- .../fleet_integration/fleet_integration.ts | 4 +- .../handlers/install_prepackaged_rules.ts | 11 +- ...ebuilt_rules_and_timelines_status_route.ts | 2 +- .../get_prebuilt_rules_status_route.ts | 2 +- ...tall_prebuilt_rules_and_timelines_route.ts | 2 +- .../perform_rule_installation_route.ts | 2 +- .../perform_rule_upgrade_route.ts | 2 +- .../review_rule_installation_route.ts | 2 +- .../review_rule_upgrade_route.ts | 2 +- .../routes/__mocks__/request_context.ts | 2 +- .../api/create_legacy_notification/route.ts | 2 +- .../api/create_rule_exceptions/route.ts | 2 +- .../api/find_exception_references/route.ts | 2 +- .../api/rules/bulk_actions/route.ts | 2 +- .../api/rules/bulk_create_rules/route.ts | 2 +- .../api/rules/bulk_delete_rules/route.ts | 2 +- .../api/rules/bulk_patch_rules/route.ts | 2 +- .../api/rules/bulk_update_rules/route.ts | 2 +- .../api/rules/coverage_overview/route.ts | 2 +- .../api/rules/create_rule/route.ts | 2 +- .../api/rules/delete_rule/route.ts | 2 +- .../api/rules/export_rules/route.ts | 2 +- .../api/rules/filters/route.ts | 2 +- .../api/rules/find_rules/route.ts | 2 +- .../api/rules/patch_rule/route.ts | 2 +- .../api/rules/read_rule/route.ts | 2 +- .../api/rules/update_rule/route.ts | 2 +- .../api/tags/read_tags/route.ts | 2 +- .../rule_types/__mocks__/rule_type.ts | 4 +- .../utils/search_after_bulk_create.test.ts | 4 +- .../rule_types/utils/utils.test.ts | 4 +- .../rule_types/utils/utils.ts | 4 +- .../lib/siem_migrations/rules/api/retry.ts | 2 +- .../rules/api/rules/install.ts | 2 +- .../rules/api/rules/install_translated.ts | 2 +- .../lib/siem_migrations/rules/api/start.ts | 2 +- .../server/plugin_contract.ts | 9 +- .../server/request_context_factory.ts | 6 +- .../server/routes/alert_status_route.test.ts | 3 +- .../server/routes/alert_status_route.ts | 7 +- .../server/routes/alerts_client_mock.test.ts | 105 +- .../server/routes/alerts_route.test.ts | 6 +- .../server/routes/alerts_route.ts | 7 +- .../routes/process_events_route.test.ts | 4 +- x-pack/plugins/session_view/tsconfig.json | 1 + .../stack_alerts/server/feature.test.ts | 151 +- x-pack/plugins/stack_alerts/server/feature.ts | 93 +- .../stack_alerts/server/rule_types/types.ts | 4 +- x-pack/plugins/stack_alerts/server/types.ts | 7 +- x-pack/plugins/timelines/server/types.ts | 4 +- .../register_transform_health_rule_type.ts | 8 +- .../api/transforms_all/route_handler.ts | 5 +- .../translations/translations/fr-FR.json | 7 - .../translations/translations/ja-JP.json | 9 +- .../translations/translations/zh-CN.json | 7 - .../hooks/use_load_alert_summary.test.ts | 11 +- .../hooks/use_load_alert_summary.ts | 29 +- .../hooks/use_load_rule_aggregations.test.tsx | 21 +- .../hooks/use_load_rule_aggregations_query.ts | 11 +- .../application/hooks/use_load_rules_query.ts | 11 +- .../application/hooks/use_rule_aad_fields.ts | 58 - .../lib/check_rule_type_enabled.test.tsx | 2 + .../lib/execution_duration_utils.test.ts | 1 + .../lib/rule_api/aggregate.test.ts | 12 +- .../application/lib/rule_api/aggregate.ts | 8 +- .../lib/rule_api/aggregate_helpers.ts | 4 +- .../rule_api/aggregate_kuery_filter.test.ts | 115 + .../lib/rule_api/aggregate_kuery_filter.ts | 8 +- .../application/lib/rule_api/alert_fields.ts | 27 - .../application/lib/rule_api/alert_index.ts | 25 - .../lib/rule_api/rule_types.test.ts | 1 + .../application/lib/rule_api/rules.test.ts | 135 + .../public/application/lib/rule_api/rules.ts | 4 + .../application/lib/rule_api/rules_helpers.ts | 3 +- .../lib/rule_api/rules_kuery_filter.test.ts | 384 + .../lib/rule_api/rules_kuery_filter.ts | 6 +- .../public/application/lib/search_filters.ts | 113 +- .../action_form.test.tsx | 1 + .../action_type_form.test.tsx | 10 +- .../action_type_form.tsx | 3 +- .../connector_rules_list.tsx | 4 +- .../alert_summary_widget.test.tsx | 2 +- .../alert_summary_widget.tsx | 6 +- .../sections/alert_summary_widget/types.ts | 5 +- .../components/stack_alerts_page.tsx | 183 +- .../alerts_page/hooks/use_rule_stats.tsx | 12 +- .../hooks/use_rule_type_ids_by_feature_id.ts | 20 +- .../alerts_search_bar.test.tsx | 184 +- .../alerts_search_bar/alerts_search_bar.tsx | 32 +- .../sections/alerts_search_bar/constants.ts | 5 +- .../sections/alerts_search_bar/types.ts | 4 +- .../url_synced_alerts_search_bar.tsx | 24 +- .../sections/alerts_table/alerts_table.tsx | 6 +- .../alerts_table/alerts_table_state.test.tsx | 51 +- .../alerts_table/alerts_table_state.tsx | 30 +- .../alerts_table/cells/render_cell_value.tsx | 4 +- .../sections/alerts_table/constants.ts | 15 +- .../alert_mute/use_get_muted_alerts.test.tsx | 2 +- .../hooks/alert_mute/use_get_muted_alerts.tsx | 2 +- .../hooks/apis/get_rules_muted_alerts.test.ts | 46 + .../hooks/apis/get_rules_muted_alerts.ts | 10 +- .../hooks/use_bulk_actions.test.tsx | 12 +- .../alerts_table/hooks/use_bulk_actions.ts | 21 +- .../use_bulk_untrack_alerts_by_query.test.ts | 53 + .../use_bulk_untrack_alerts_by_query.tsx | 7 +- .../hooks/use_columns/use_columns.test.tsx | 27 +- .../hooks/use_columns/use_columns.ts | 7 +- .../sections/alerts_table/types.ts | 2 + .../rule_details/components/rule.test.tsx | 1 + .../sections/rule_details/components/rule.tsx | 13 +- .../components/rule_details.test.tsx | 1 + .../components/rule_route.test.tsx | 1 + .../rule_details/components/test_helpers.ts | 1 + .../sections/rule_form/rule_add.test.tsx | 1 + .../sections/rule_form/rule_form.test.tsx | 9 + .../rule_form_consumer_selection.test.tsx | 40 +- .../rule_form_consumer_selection.tsx | 11 +- .../rules_list/components/rules_list.test.tsx | 122 +- .../rules_list/components/rules_list.tsx | 25 +- .../triggers_actions_ui/public/types.ts | 4 +- .../triggers_actions_ui/server/plugin.ts | 9 +- .../server/routes/config.test.ts | 4 +- .../common/plugins/alerts/server/plugin.ts | 111 +- .../alerts_restricted/server/plugin.ts | 47 +- .../observability/metric_threshold_rule.ts | 7 +- .../tests/alerting/backfill/schedule.ts | 1 + .../tests/alerting/bulk_untrack_by_query.ts | 2 +- .../group1/tests/alerting/create.ts | 9 +- .../group1/tests/alerting/delete.ts | 2 +- .../group1/tests/alerting/disable.ts | 9 +- .../group1/tests/alerting/enable.ts | 9 +- .../group1/tests/alerting/find.ts | 122 +- .../group1/tests/alerting/find_internal.ts | 351 +- .../group1/tests/alerting/find_with_post.ts | 593 - .../group1/tests/alerting/get.ts | 13 +- .../group1/tests/alerting/index.ts | 1 - .../group2/tests/alerting/aggregate.ts | 377 + .../group2/tests/alerting/index.ts | 1 + .../group2/tests/alerting/mute_all.ts | 6 +- .../group2/tests/alerting/mute_instance.ts | 13 +- .../group2/tests/alerting/unmute_all.ts | 6 +- .../group2/tests/alerting/unmute_instance.ts | 13 +- .../group2/tests/alerting/update.ts | 13 +- .../group2/tests/alerting/update_api_key.ts | 13 +- .../group3/tests/alerting/bulk_delete.ts | 67 +- .../group3/tests/alerting/bulk_disable.ts | 2 +- .../group3/tests/alerting/bulk_edit.ts | 6 +- .../group3/tests/alerting/bulk_enable.ts | 50 +- .../group4/tests/alerting/snooze.ts | 13 +- .../group4/tests/alerting/unsnooze.ts | 6 +- .../security_and_spaces/scenarios.ts | 7 +- .../{aggregate_post.ts => aggregate.ts} | 171 +- .../spaces_only/tests/alerting/group1/find.ts | 47 +- .../tests/alerting/group1/find_internal.ts | 65 +- .../tests/alerting/group1/index.ts | 3 +- x-pack/test/common/services/search_secure.ts | 6 +- .../infra/metrics_source_configuration.ts | 7 +- .../observability/alerts/data.json.gz | Bin 4610 -> 4473 bytes .../alerts/8.1.0/data.json.gz | Bin 9456 -> 9487 bytes .../plugins/alerts/server/plugin.ts | 10 +- .../apps/triggers_actions_ui/home_page.ts | 48 +- .../plugins/alerts/server/plugin.ts | 39 +- .../apps/observability/pages/rules_page.ts | 1 + .../tests/basic/bulk_update_alerts.ts | 3 - .../tests/basic/find_alerts.ts | 14 +- .../basic/get_aad_fields_by_rule_type.ts | 6 +- .../tests/basic/get_alert_summary.ts | 6 +- .../tests/basic/get_alerts_index.ts | 25 +- ...=> get_browser_fields_by_rule_type_ids.ts} | 47 +- ...et_feature_ids_by_registration_contexts.ts | 79 - .../security_and_spaces/tests/basic/index.ts | 3 +- .../tests/basic/search_strategy.ts | 454 +- .../tests/basic/update_alert.ts | 1 - .../tests/trial/get_alerts.ts | 5 + .../tests/trial/update_alert.ts | 2 + .../spaces_only/tests/trial/update_alert.ts | 1 - .../plugins/features_provider/server/index.ts | 97 +- .../tests/features/deprecated_features.ts | 92 +- .../platform_security/authorization.ts | 23573 +++++++++++----- 530 files changed, 30016 insertions(+), 14403 deletions(-) create mode 100644 packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_threshold_schema.ts create mode 100644 packages/kbn-alerts-ui-shared/src/common/hooks/use_find_alerts_query.test.tsx delete mode 100644 packages/kbn-alerts-ui-shared/src/common/hooks/use_rule_aad_fields.ts create mode 100644 packages/kbn-rule-data-utils/jest.config.js create mode 100644 packages/kbn-rule-data-utils/src/alerts_as_data_rbac.test.ts create mode 100644 x-pack/plugins/alerting/server/application/rule/methods/rule_types/rule_types.test.ts create mode 100644 x-pack/plugins/alerting/server/authorization/types.ts create mode 100644 x-pack/plugins/alerting/server/rules_client/common/filters.test.ts create mode 100644 x-pack/plugins/alerting/server/rules_client/common/filters.ts create mode 100644 x-pack/plugins/alerting/server/rules_client/rules_client.mock.ts create mode 100644 x-pack/plugins/features/common/alerting_kibana_privilege.ts create mode 100644 x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.test.ts create mode 100644 x-pack/plugins/rule_registry/server/alert_data_client/tests/get_alerts_summary.test.ts create mode 100644 x-pack/plugins/rule_registry/server/lib/get_consumers_filter.test.tsx create mode 100644 x-pack/plugins/rule_registry/server/lib/get_consumers_filter.tsx create mode 100644 x-pack/plugins/rule_registry/server/lib/get_rule_type_ids_filter.test.tsx create mode 100644 x-pack/plugins/rule_registry/server/lib/get_rule_type_ids_filter.tsx create mode 100644 x-pack/plugins/rule_registry/server/routes/find.test.ts delete mode 100644 x-pack/plugins/rule_registry/server/routes/get_browser_fields_by_feature_id.test.ts create mode 100644 x-pack/plugins/rule_registry/server/routes/get_browser_fields_by_rule_type_ids.test.ts rename x-pack/plugins/rule_registry/server/routes/{get_browser_fields_by_feature_id.ts => get_browser_fields_by_rule_type_ids.ts} (83%) delete mode 100644 x-pack/plugins/rule_registry/server/routes/get_feature_ids_by_registration_contexts.test.ts delete mode 100644 x-pack/plugins/rule_registry/server/routes/get_feature_ids_by_registration_contexts.ts delete mode 100644 x-pack/plugins/triggers_actions_ui/public/application/hooks/use_rule_aad_fields.ts create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/aggregate_kuery_filter.test.ts delete mode 100644 x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/alert_fields.ts delete mode 100644 x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/alert_index.ts create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/rules_kuery_filter.test.ts create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/apis/get_rules_muted_alerts.test.ts create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_untrack_alerts_by_query.test.ts delete mode 100644 x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find_with_post.ts create mode 100644 x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/aggregate.ts rename x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/{aggregate_post.ts => aggregate.ts} (51%) rename x-pack/test/rule_registry/security_and_spaces/tests/basic/{get_browser_fields_by_feature_id.ts => get_browser_fields_by_rule_type_ids.ts} (74%) delete mode 100644 x-pack/test/rule_registry/security_and_spaces/tests/basic/get_feature_ids_by_registration_contexts.ts diff --git a/packages/kbn-alerting-types/search_strategy_types.ts b/packages/kbn-alerting-types/search_strategy_types.ts index 797ca82294b8a..9df72e4fa7886 100644 --- a/packages/kbn-alerting-types/search_strategy_types.ts +++ b/packages/kbn-alerting-types/search_strategy_types.ts @@ -8,7 +8,6 @@ */ import type { IEsSearchRequest, IEsSearchResponse } from '@kbn/search-types'; -import type { ValidFeatureId } from '@kbn/rule-data-utils'; import type { MappingRuntimeFields, QueryDslFieldAndFormat, @@ -18,7 +17,8 @@ import type { import type { Alert } from './alert_type'; export type RuleRegistrySearchRequest = IEsSearchRequest & { - featureIds: ValidFeatureId[]; + ruleTypeIds: string[]; + consumers?: string[]; fields?: QueryDslFieldAndFormat[]; query?: Pick; sort?: SortCombinations[]; diff --git a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_threshold_schema.ts b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_threshold_schema.ts new file mode 100644 index 0000000000000..2f08e082aebea --- /dev/null +++ b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_threshold_schema.ts @@ -0,0 +1,90 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the "Elastic License + * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side + * Public License v 1"; you may not use this file except in compliance with, at + * your election, the "Elastic License 2.0", the "GNU Affero General Public + * License v3.0 only", or the "Server Side Public License, v 1". + */ +// ---------------------------------- WARNING ---------------------------------- +// this file was generated, and should not be edited by hand +// ---------------------------------- WARNING ---------------------------------- +import * as rt from 'io-ts'; +import { Either } from 'fp-ts/lib/Either'; +import { AlertSchema } from './alert_schema'; +import { EcsSchema } from './ecs_schema'; +const ISO_DATE_PATTERN = /^d{4}-d{2}-d{2}Td{2}:d{2}:d{2}.d{3}Z$/; +export const IsoDateString = new rt.Type( + 'IsoDateString', + rt.string.is, + (input, context): Either => { + if (typeof input === 'string' && ISO_DATE_PATTERN.test(input)) { + return rt.success(input); + } else { + return rt.failure(input, context); + } + }, + rt.identity +); +export type IsoDateStringC = typeof IsoDateString; +export const schemaUnknown = rt.unknown; +export const schemaUnknownArray = rt.array(rt.unknown); +export const schemaString = rt.string; +export const schemaStringArray = rt.array(schemaString); +export const schemaNumber = rt.number; +export const schemaNumberArray = rt.array(schemaNumber); +export const schemaDate = rt.union([IsoDateString, schemaNumber]); +export const schemaDateArray = rt.array(schemaDate); +export const schemaDateRange = rt.partial({ + gte: schemaDate, + lte: schemaDate, +}); +export const schemaDateRangeArray = rt.array(schemaDateRange); +export const schemaStringOrNumber = rt.union([schemaString, schemaNumber]); +export const schemaStringOrNumberArray = rt.array(schemaStringOrNumber); +export const schemaBoolean = rt.boolean; +export const schemaBooleanArray = rt.array(schemaBoolean); +const schemaGeoPointCoords = rt.type({ + type: schemaString, + coordinates: schemaNumberArray, +}); +const schemaGeoPointString = schemaString; +const schemaGeoPointLatLon = rt.type({ + lat: schemaNumber, + lon: schemaNumber, +}); +const schemaGeoPointLocation = rt.type({ + location: schemaNumberArray, +}); +const schemaGeoPointLocationString = rt.type({ + location: schemaString, +}); +export const schemaGeoPoint = rt.union([ + schemaGeoPointCoords, + schemaGeoPointString, + schemaGeoPointLatLon, + schemaGeoPointLocation, + schemaGeoPointLocationString, +]); +export const schemaGeoPointArray = rt.array(schemaGeoPoint); +// prettier-ignore +const ObservabilityThresholdAlertRequired = rt.type({ +}); +// prettier-ignore +const ObservabilityThresholdAlertOptional = rt.partial({ + 'kibana.alert.context': schemaUnknown, + 'kibana.alert.evaluation.threshold': schemaStringOrNumber, + 'kibana.alert.evaluation.value': schemaStringOrNumber, + 'kibana.alert.evaluation.values': schemaStringOrNumberArray, + 'kibana.alert.group': rt.array( + rt.partial({ + field: schemaStringArray, + value: schemaStringArray, + }) + ), +}); + +// prettier-ignore +export const ObservabilityThresholdAlertSchema = rt.intersection([ObservabilityThresholdAlertRequired, ObservabilityThresholdAlertOptional, AlertSchema, EcsSchema]); +// prettier-ignore +export type ObservabilityThresholdAlert = rt.TypeOf; diff --git a/packages/kbn-alerts-grouping/src/components/alerts_grouping.test.tsx b/packages/kbn-alerts-grouping/src/components/alerts_grouping.test.tsx index 86ae0a54f9224..0137953b2313c 100644 --- a/packages/kbn-alerts-grouping/src/components/alerts_grouping.test.tsx +++ b/packages/kbn-alerts-grouping/src/components/alerts_grouping.test.tsx @@ -23,7 +23,8 @@ import { groupingSearchResponse } from '../mocks/grouping_query.mock'; import { useAlertsGroupingState } from '../contexts/alerts_grouping_context'; import { I18nProvider } from '@kbn/i18n-react'; import { - mockFeatureIds, + mockRuleTypeIds, + mockConsumers, mockDate, mockGroupingProps, mockGroupingId, @@ -146,7 +147,8 @@ describe('AlertsGrouping', () => { expect.objectContaining({ params: { aggregations: {}, - featureIds: mockFeatureIds, + ruleTypeIds: mockRuleTypeIds, + consumers: mockConsumers, groupByField: 'kibana.alert.rule.name', filters: [ { diff --git a/packages/kbn-alerts-grouping/src/components/alerts_grouping.tsx b/packages/kbn-alerts-grouping/src/components/alerts_grouping.tsx index d814d70903a5c..5ea010d442145 100644 --- a/packages/kbn-alerts-grouping/src/components/alerts_grouping.tsx +++ b/packages/kbn-alerts-grouping/src/components/alerts_grouping.tsx @@ -66,7 +66,7 @@ const AlertsGroupingInternal = ( const { groupingId, services, - featureIds, + ruleTypeIds, defaultGroupingOptions, defaultFilters, globalFilters, @@ -79,7 +79,7 @@ const AlertsGroupingInternal = ( const { grouping, updateGrouping } = useAlertsGroupingState(groupingId); const { dataView } = useAlertsDataView({ - featureIds, + ruleTypeIds, dataViewsService: dataViews, http, toasts: notifications.toasts, @@ -252,7 +252,7 @@ const typedMemo: (c: T) => T = memo; * * return ( * - * featureIds={[...]} + * ruleTypeIds={[...]} * globalQuery={{ query: ..., language: 'kql' }} * globalFilters={...} * from={...} diff --git a/packages/kbn-alerts-grouping/src/components/alerts_grouping_level.test.tsx b/packages/kbn-alerts-grouping/src/components/alerts_grouping_level.test.tsx index 5548c14fcf26f..b908b07caf7a1 100644 --- a/packages/kbn-alerts-grouping/src/components/alerts_grouping_level.test.tsx +++ b/packages/kbn-alerts-grouping/src/components/alerts_grouping_level.test.tsx @@ -55,6 +55,10 @@ const mockGroupingLevelProps: Omit = { describe('AlertsGroupingLevel', () => { let buildEsQuerySpy: jest.SpyInstance; + beforeEach(() => { + jest.clearAllMocks(); + }); + beforeAll(() => { buildEsQuerySpy = jest.spyOn(buildEsQueryModule, 'buildEsQuery'); }); @@ -119,4 +123,58 @@ describe('AlertsGroupingLevel', () => { Object.keys(groupingSearchResponse.aggregations) ); }); + + it('should calls useGetAlertsGroupAggregationsQuery with correct props', () => { + render( + + {() => } + + ); + + expect(mockUseGetAlertsGroupAggregationsQuery.mock.calls).toMatchInlineSnapshot(` + Array [ + Array [ + Object { + "enabled": true, + "http": Object { + "get": [MockFunction], + }, + "params": Object { + "aggregations": Object {}, + "consumers": Array [ + "stackAlerts", + ], + "filters": Array [ + Object { + "bool": Object { + "filter": Array [], + "must": Array [], + "must_not": Array [], + "should": Array [], + }, + }, + Object { + "range": Object { + "kibana.alert.time_range": Object { + "gte": "2020-07-07T08:20:18.966Z", + "lte": "2020-07-08T08:20:18.966Z", + }, + }, + }, + ], + "groupByField": "selectedGroup", + "pageIndex": 0, + "pageSize": 10, + "ruleTypeIds": Array [ + ".es-query", + ], + }, + "toasts": Object { + "addDanger": [MockFunction], + }, + }, + ], + ] + `); + }); }); diff --git a/packages/kbn-alerts-grouping/src/components/alerts_grouping_level.tsx b/packages/kbn-alerts-grouping/src/components/alerts_grouping_level.tsx index 7e620276d2e4d..02fd5d33e2379 100644 --- a/packages/kbn-alerts-grouping/src/components/alerts_grouping_level.tsx +++ b/packages/kbn-alerts-grouping/src/components/alerts_grouping_level.tsx @@ -46,7 +46,8 @@ const DEFAULT_FILTERS: Filter[] = []; const typedMemo: (c: T) => T = memo; export const AlertsGroupingLevel = typedMemo( ({ - featureIds, + ruleTypeIds, + consumers, defaultFilters = DEFAULT_FILTERS, from, getGrouping, @@ -86,7 +87,8 @@ export const AlertsGroupingLevel = typedMemo( const aggregationsQuery = useMemo(() => { return { - featureIds, + ruleTypeIds, + consumers, groupByField: selectedGroup, aggregations: getAggregationsByGroupingField(selectedGroup)?.reduce( (acc, val) => Object.assign(acc, val), @@ -107,12 +109,13 @@ export const AlertsGroupingLevel = typedMemo( pageSize, }; }, [ - featureIds, + consumers, filters, from, getAggregationsByGroupingField, pageIndex, pageSize, + ruleTypeIds, selectedGroup, to, ]); diff --git a/packages/kbn-alerts-grouping/src/mocks/grouping_props.mock.tsx b/packages/kbn-alerts-grouping/src/mocks/grouping_props.mock.tsx index 925a32fbd9de6..510c7c8fdb896 100644 --- a/packages/kbn-alerts-grouping/src/mocks/grouping_props.mock.tsx +++ b/packages/kbn-alerts-grouping/src/mocks/grouping_props.mock.tsx @@ -8,12 +8,12 @@ */ import React from 'react'; -import { AlertConsumers } from '@kbn/rule-data-utils'; import { AlertsGroupingProps } from '../types'; export const mockGroupingId = 'test'; -export const mockFeatureIds = [AlertConsumers.STACK_ALERTS]; +export const mockRuleTypeIds = ['.es-query']; +export const mockConsumers = ['stackAlerts']; export const mockDate = { from: '2020-07-07T08:20:18.966Z', @@ -30,7 +30,8 @@ export const mockOptions = [ export const mockGroupingProps: Omit = { ...mockDate, groupingId: mockGroupingId, - featureIds: mockFeatureIds, + ruleTypeIds: mockRuleTypeIds, + consumers: mockConsumers, defaultGroupingOptions: mockOptions, getAggregationsByGroupingField: () => [], getGroupStats: () => [{ title: 'Stat', component: }], diff --git a/packages/kbn-alerts-grouping/src/mocks/grouping_query.mock.ts b/packages/kbn-alerts-grouping/src/mocks/grouping_query.mock.ts index 8820f884928b7..486771e70a140 100644 --- a/packages/kbn-alerts-grouping/src/mocks/grouping_query.mock.ts +++ b/packages/kbn-alerts-grouping/src/mocks/grouping_query.mock.ts @@ -11,12 +11,12 @@ export const getQuery = ({ selectedGroup, uniqueValue, timeRange, - featureIds, + ruleTypeIds, }: { selectedGroup: string; uniqueValue: string; timeRange: { from: string; to: string }; - featureIds: string[]; + ruleTypeIds: string[]; }) => ({ _source: false, aggs: { @@ -52,7 +52,7 @@ export const getQuery = ({ }, }, }, - feature_ids: featureIds, + rule_type_ids: ruleTypeIds, query: { bool: { filter: [ diff --git a/packages/kbn-alerts-grouping/src/types.ts b/packages/kbn-alerts-grouping/src/types.ts index c6132e94e8729..f1eb9ef00fee8 100644 --- a/packages/kbn-alerts-grouping/src/types.ts +++ b/packages/kbn-alerts-grouping/src/types.ts @@ -8,7 +8,6 @@ */ import type { Filter, Query } from '@kbn/es-query'; -import { ValidFeatureId } from '@kbn/rule-data-utils'; import type { NotificationsStart } from '@kbn/core-notifications-browser'; import type { DataViewsServicePublic } from '@kbn/data-views-plugin/public/types'; import type { HttpSetup } from '@kbn/core-http-browser'; @@ -63,9 +62,13 @@ export interface AlertsGroupingProps< */ defaultGroupingOptions: GroupOption[]; /** - * The alerting feature ids this grouping covers + * The alerting rule type ids this grouping covers */ - featureIds: ValidFeatureId[]; + ruleTypeIds: string[]; + /** + * The alerting consumers this grouping covers + */ + consumers?: string[]; /** * Time filter start */ diff --git a/packages/kbn-alerts-ui-shared/src/action_variables/transforms.test.ts b/packages/kbn-alerts-ui-shared/src/action_variables/transforms.test.ts index d574aaf9592a9..6f362fd34710b 100644 --- a/packages/kbn-alerts-ui-shared/src/action_variables/transforms.test.ts +++ b/packages/kbn-alerts-ui-shared/src/action_variables/transforms.test.ts @@ -289,5 +289,6 @@ function getAlertType(actionVariables: ActionVariables): RuleType { producer: ALERTING_FEATURE_ID, minimumLicenseRequired: 'basic', enabledInLicense: true, + category: 'my-category', }; } diff --git a/packages/kbn-alerts-ui-shared/src/alert_filter_controls/alert_filter_controls.test.tsx b/packages/kbn-alerts-ui-shared/src/alert_filter_controls/alert_filter_controls.test.tsx index 3c314c62fc28c..6c35234b54006 100644 --- a/packages/kbn-alerts-ui-shared/src/alert_filter_controls/alert_filter_controls.test.tsx +++ b/packages/kbn-alerts-ui-shared/src/alert_filter_controls/alert_filter_controls.test.tsx @@ -10,7 +10,6 @@ import React from 'react'; import { render, screen } from '@testing-library/react'; import { AlertFilterControls, AlertFilterControlsProps } from './alert_filter_controls'; -import { AlertConsumers } from '@kbn/rule-data-utils'; import { DEFAULT_CONTROLS } from './constants'; import { useAlertsDataView } from '../common/hooks/use_alerts_data_view'; import { FilterGroup } from './filter_group'; @@ -56,7 +55,7 @@ const ControlGroupRenderer = (() => ( describe('AlertFilterControls', () => { const props: AlertFilterControlsProps = { - featureIds: [AlertConsumers.STACK_ALERTS], + ruleTypeIds: ['.es-query'], defaultControls: DEFAULT_CONTROLS, dataViewSpec: { id: 'alerts-filters-dv', diff --git a/packages/kbn-alerts-ui-shared/src/alert_filter_controls/alert_filter_controls.tsx b/packages/kbn-alerts-ui-shared/src/alert_filter_controls/alert_filter_controls.tsx index e8e7e63859250..f64b02e2ee350 100644 --- a/packages/kbn-alerts-ui-shared/src/alert_filter_controls/alert_filter_controls.tsx +++ b/packages/kbn-alerts-ui-shared/src/alert_filter_controls/alert_filter_controls.tsx @@ -12,7 +12,6 @@ import React, { useCallback, useEffect, useState } from 'react'; import type { Filter } from '@kbn/es-query'; import { EuiFlexItem } from '@elastic/eui'; import type { DataViewSpec, DataViewsPublicPluginStart } from '@kbn/data-views-plugin/public'; -import { AlertConsumers } from '@kbn/rule-data-utils'; import { HttpStart } from '@kbn/core-http-browser'; import { NotificationsStart } from '@kbn/core-notifications-browser'; import type { Storage } from '@kbn/kibana-utils-plugin/public'; @@ -24,12 +23,12 @@ import { FilterControlConfig } from './types'; export type AlertFilterControlsProps = Omit< ComponentProps, - 'dataViewId' | 'defaultControls' | 'featureIds' | 'Storage' + 'dataViewId' | 'defaultControls' | 'ruleTypeIds' | 'Storage' > & { /** - * The feature ids used to get the correct alert data view(s) + * The rule type ids used to get the correct alert data view(s) */ - featureIds?: AlertConsumers[]; + ruleTypeIds?: string[]; /** * An array of default control configurations */ @@ -57,7 +56,7 @@ export type AlertFilterControlsProps = Omit< * * { const { - featureIds = [AlertConsumers.STACK_ALERTS], + ruleTypeIds = [], defaultControls = DEFAULT_CONTROLS, dataViewSpec, onFiltersChange, @@ -96,7 +95,7 @@ export const AlertFilterControls = (props: AlertFilterControlsProps) => { } = props; const [loadingPageFilters, setLoadingPageFilters] = useState(true); const { dataView, isLoading: isLoadingDataView } = useAlertsDataView({ - featureIds, + ruleTypeIds, dataViewsService: dataViews, http, toasts, @@ -156,7 +155,7 @@ export const AlertFilterControls = (props: AlertFilterControlsProps) => { > = (props) => { ) => { const { - featureIds, dataViewId, onFiltersChange, timeRange, @@ -59,6 +58,7 @@ export const FilterGroup = (props: PropsWithChildren) => { maxControls = Infinity, ControlGroupRenderer, Storage, + ruleTypeIds, storageKey, } = props; @@ -80,8 +80,8 @@ export const FilterGroup = (props: PropsWithChildren) => { const [controlGroup, setControlGroup] = useState(); const localStoragePageFilterKey = useMemo( - () => storageKey ?? `${featureIds.join(',')}.${spaceId}.${URL_PARAM_KEY}`, - [featureIds, spaceId, storageKey] + () => storageKey ?? `${ruleTypeIds.join(',')}.${spaceId}.${URL_PARAM_KEY}`, + [ruleTypeIds, spaceId, storageKey] ); const currentFiltersRef = useRef(); diff --git a/packages/kbn-alerts-ui-shared/src/alert_filter_controls/types.ts b/packages/kbn-alerts-ui-shared/src/alert_filter_controls/types.ts index 19a76c76ff6f8..ed625897a418e 100644 --- a/packages/kbn-alerts-ui-shared/src/alert_filter_controls/types.ts +++ b/packages/kbn-alerts-ui-shared/src/alert_filter_controls/types.ts @@ -15,7 +15,6 @@ import type { ControlGroupRendererApi, } from '@kbn/controls-plugin/public'; import type { Storage } from '@kbn/kibana-utils-plugin/public'; -import { AlertConsumers } from '@kbn/rule-data-utils'; export type FilterUrlFormat = Record< string, @@ -46,7 +45,7 @@ export interface FilterGroupProps extends Pick ( +)); + describe('AlertsSearchBar', () => { beforeEach(() => { + jest.clearAllMocks(); + mockUseKibana.mockReturnValue({ services: { data: mockDataPlugin, unifiedSearch: { ui: { - SearchBar: jest.fn().mockImplementation((props) => ( - - )), + SearchBar: unifiedSearchBarMock, }, }, notifications: { toasts: { addWarning: jest.fn() } } as unknown as NotificationsStart, @@ -85,10 +66,6 @@ describe('AlertsSearchBar', () => { }); }); - beforeEach(() => { - jest.clearAllMocks(); - }); - it('renders correctly', async () => { render( { onSavedQueryUpdated={jest.fn()} onClearSavedQuery={jest.fn()} appName={'test'} - featureIds={['observability', 'stackAlerts']} /> ); expect(await screen.findByTestId('querySubmitButton')).toBeInTheDocument(); @@ -119,7 +95,6 @@ describe('AlertsSearchBar', () => { onSavedQueryUpdated={jest.fn()} onClearSavedQuery={jest.fn()} appName={'test'} - featureIds={['observability', 'stackAlerts']} /> ); @@ -176,7 +151,6 @@ describe('AlertsSearchBar', () => { onSavedQueryUpdated={jest.fn()} onClearSavedQuery={jest.fn()} appName={'test'} - featureIds={['observability', 'stackAlerts']} /> ); @@ -187,4 +161,136 @@ describe('AlertsSearchBar', () => { expect(mockDataPlugin.query.filterManager.setFilters).toHaveBeenCalledWith(filters); }); }); + + it('calls the unifiedSearchBar correctly for security rule types', async () => { + render( + + ); + + await waitFor(() => { + expect(unifiedSearchBarMock).toHaveBeenCalledWith( + expect.objectContaining({ + suggestionsAbstraction: undefined, + }), + {} + ); + }); + }); + + it('calls the unifiedSearchBar correctly for NON security rule types', async () => { + render( + + ); + + await waitFor(() => { + expect(unifiedSearchBarMock).toHaveBeenCalledWith( + expect.objectContaining({ + suggestionsAbstraction: { type: 'alerts', fields: {} }, + }), + {} + ); + }); + }); + + it('calls the unifiedSearchBar with correct index patters', async () => { + render( + + ); + + await waitFor(() => { + expect(unifiedSearchBarMock).toHaveBeenCalledWith( + expect.objectContaining({ + indexPatterns: [ + { + fields: [ + { aggregatable: true, name: 'event.action', searchable: true, type: 'string' }, + ], + title: '.esQuery,apm.anomaly', + }, + ], + }), + {} + ); + }); + }); + + it('calls the unifiedSearchBar with correct index patters without rule types', async () => { + render( + + ); + + await waitFor(() => { + expect(unifiedSearchBarMock).toHaveBeenCalledWith( + expect.objectContaining({ + indexPatterns: [ + { + fields: [ + { aggregatable: true, name: 'event.action', searchable: true, type: 'string' }, + ], + title: '.alerts-*', + }, + ], + }), + {} + ); + }); + }); + + it('calls the unifiedSearchBar with correct index patters without data views', async () => { + jest.mocked(useAlertsDataView).mockReturnValue({ + isLoading: false, + dataView: undefined, + }); + + render( + + ); + + await waitFor(() => { + expect(unifiedSearchBarMock).toHaveBeenCalledWith( + expect.objectContaining({ + indexPatterns: [], + }), + {} + ); + }); + }); }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/alerts_search_bar.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/alerts_search_bar.tsx index 5e2880e65231c..0a5c18fab9d8c 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/alerts_search_bar.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/alerts_search_bar.tsx @@ -9,7 +9,7 @@ import React, { useCallback, useMemo, useState } from 'react'; import { useKibana } from '@kbn/kibana-react-plugin/public'; import { compareFilters, Query, TimeRange } from '@kbn/es-query'; import { SuggestionsAbstraction } from '@kbn/unified-search-plugin/public/typeahead/suggestions_component'; -import { AlertConsumers, ValidFeatureId } from '@kbn/rule-data-utils'; +import { isSiemRuleType } from '@kbn/rule-data-utils'; import { EuiContextMenuPanelDescriptor, EuiContextMenuPanelItemDescriptor } from '@elastic/eui'; import { useAlertsDataView } from '@kbn/alerts-ui-shared/src/common/hooks/use_alerts_data_view'; import { isQuickFiltersGroup, QuickFiltersMenuItem } from './quick_filters'; @@ -17,19 +17,15 @@ import { NO_INDEX_PATTERNS } from './constants'; import { SEARCH_BAR_PLACEHOLDER } from './translations'; import { AlertsSearchBarProps, QueryLanguageType } from './types'; import { TriggersAndActionsUiServices } from '../../..'; -import { useRuleAADFields } from '../../hooks/use_rule_aad_fields'; -import { useLoadRuleTypesQuery } from '../../hooks/use_load_rule_types_query'; const SA_ALERTS = { type: 'alerts', fields: {} } as SuggestionsAbstraction; -const EMPTY_FEATURE_IDS: ValidFeatureId[] = []; // TODO Share buildEsQuery to be used between AlertsSearchBar and AlertsStateTable component https://github.com/elastic/kibana/issues/144615 // Also TODO: Replace all references to this component with the one from alerts-ui-shared export function AlertsSearchBar({ appName, disableQueryLanguageSwitcher = false, - featureIds = EMPTY_FEATURE_IDS, - ruleTypeId, + ruleTypeIds, query, filters, quickFilters = [], @@ -58,33 +54,25 @@ export function AlertsSearchBar({ const [queryLanguage, setQueryLanguage] = useState('kuery'); const { dataView } = useAlertsDataView({ - featureIds, + ruleTypeIds: ruleTypeIds ?? [], http, dataViewsService, toasts, }); - const { aadFields, loading: fieldsLoading } = useRuleAADFields(ruleTypeId); const indexPatterns = useMemo(() => { - if (ruleTypeId && aadFields?.length) { - return [{ title: ruleTypeId, fields: aadFields }]; + if (ruleTypeIds && dataView?.fields?.length) { + return [{ title: ruleTypeIds.join(','), fields: dataView.fields }]; } + if (dataView) { return [dataView]; } - return null; - }, [aadFields, dataView, ruleTypeId]); - const ruleType = useLoadRuleTypesQuery({ - filteredRuleTypes: ruleTypeId !== undefined ? [ruleTypeId] : [], - enabled: ruleTypeId !== undefined, - }); + return null; + }, [dataView, ruleTypeIds]); - const isSecurity = - (featureIds && featureIds.length === 1 && featureIds.includes(AlertConsumers.SIEM)) || - (ruleType && - ruleTypeId && - ruleType.ruleTypesState.data.get(ruleTypeId)?.producer === AlertConsumers.SIEM); + const isSecurity = ruleTypeIds?.some(isSiemRuleType) ?? false; const onSearchQuerySubmit = useCallback( ( @@ -174,7 +162,7 @@ export function AlertsSearchBar({ appName={appName} disableQueryLanguageSwitcher={disableQueryLanguageSwitcher} // @ts-expect-error - DataView fields prop and SearchBar indexPatterns props are overly broad - indexPatterns={!indexPatterns || fieldsLoading ? NO_INDEX_PATTERNS : indexPatterns} + indexPatterns={!indexPatterns ? NO_INDEX_PATTERNS : indexPatterns} placeholder={placeholder} query={{ query: query ?? '', language: queryLanguage }} filters={filters} diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/constants.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/constants.ts index 408d4d1714743..3539966400054 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/constants.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/constants.ts @@ -10,5 +10,6 @@ import { AlertConsumers } from '@kbn/rule-data-utils'; export const NO_INDEX_PATTERNS: DataView[] = []; export const ALERTS_SEARCH_BAR_PARAMS_URL_STORAGE_KEY = 'searchBarParams'; -export const ALL_FEATURE_IDS = Object.values(AlertConsumers); -export const NON_SIEM_FEATURE_IDS = ALL_FEATURE_IDS.filter((fid) => fid !== AlertConsumers.SIEM); +export const NON_SIEM_CONSUMERS = Object.values(AlertConsumers).filter( + (fid) => fid !== AlertConsumers.SIEM +); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/types.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/types.ts index b1af2746d6cac..a9538bd4888b1 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/types.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/types.ts @@ -6,7 +6,6 @@ */ import { Filter } from '@kbn/es-query'; -import { ValidFeatureId } from '@kbn/rule-data-utils'; import { SearchBarProps } from '@kbn/unified-search-plugin/public/search_bar/search_bar'; import { QuickFiltersMenuItem } from './quick_filters'; @@ -16,7 +15,6 @@ export interface AlertsSearchBarProps extends Omit, 'query' | 'onQueryChange' | 'onQuerySubmit'> { appName: string; disableQueryLanguageSwitcher?: boolean; - featureIds: ValidFeatureId[]; rangeFrom?: string; rangeTo?: string; query?: string; @@ -27,7 +25,7 @@ export interface AlertsSearchBarProps showSubmitButton?: boolean; placeholder?: string; submitOnBlur?: boolean; - ruleTypeId?: string; + ruleTypeIds?: string[]; onQueryChange?: (query: { dateRange: { from: string; to: string; mode?: 'absolute' | 'relative' }; query?: string; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/url_synced_alerts_search_bar.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/url_synced_alerts_search_bar.tsx index de89eb9715733..175d9538918e7 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/url_synced_alerts_search_bar.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_search_bar/url_synced_alerts_search_bar.tsx @@ -5,20 +5,17 @@ * 2.0. */ -import React, { useCallback, useEffect, useMemo, useState } from 'react'; -import { BoolQuery } from '@kbn/es-query'; -import { AlertConsumers } from '@kbn/rule-data-utils'; +import React, { useCallback, useEffect, useState, useMemo } from 'react'; +import { BoolQuery, Filter } from '@kbn/es-query'; import { i18n } from '@kbn/i18n'; import { AlertFilterControls } from '@kbn/alerts-ui-shared/src/alert_filter_controls'; import { ControlGroupRenderer } from '@kbn/controls-plugin/public'; import { Storage } from '@kbn/kibana-utils-plugin/public'; -import { AlertsFeatureIdsFilter } from '../../lib/search_filters'; import { useKibana } from '../../..'; import { useAlertSearchBarStateContainer } from './use_alert_search_bar_state_container'; import { ALERTS_SEARCH_BAR_PARAMS_URL_STORAGE_KEY } from './constants'; import { AlertsSearchBarProps } from './types'; import AlertsSearchBar from './alerts_search_bar'; -import { nonNullable } from '../../../../common/utils'; import { buildEsQuery } from './build_es_query'; const INVALID_QUERY_STRING_TOAST_TITLE = i18n.translate( @@ -35,16 +32,17 @@ export interface UrlSyncedAlertsSearchBarProps > { showFilterControls?: boolean; onEsQueryChange: (esQuery: { bool: BoolQuery }) => void; - onActiveFeatureFiltersChange?: (value: AlertConsumers[]) => void; + onFilterSelected?: (filters: Filter[]) => void; } /** * An abstraction over AlertsSearchBar that syncs the query state with the url */ export const UrlSyncedAlertsSearchBar = ({ + ruleTypeIds, showFilterControls = false, onEsQueryChange, - onActiveFeatureFiltersChange, + onFilterSelected, ...rest }: UrlSyncedAlertsSearchBarProps) => { const { @@ -91,13 +89,6 @@ export const UrlSyncedAlertsSearchBar = ({ useEffect(() => { try { - onActiveFeatureFiltersChange?.([ - ...new Set( - filters - .flatMap((f) => (f as AlertsFeatureIdsFilter).meta.alertsFeatureIds) - .filter(nonNullable) - ), - ]); onEsQueryChange( buildEsQuery({ timeRange: { @@ -108,6 +99,8 @@ export const UrlSyncedAlertsSearchBar = ({ filters: [...filters, ...controlFilters], }) ); + + onFilterSelected?.(filters); } catch (error) { toasts.addError(error, { title: INVALID_QUERY_STRING_TOAST_TITLE, @@ -118,8 +111,8 @@ export const UrlSyncedAlertsSearchBar = ({ controlFilters, filters, kuery, - onActiveFeatureFiltersChange, onEsQueryChange, + onFilterSelected, onKueryChange, rangeFrom, rangeTo, @@ -154,6 +147,7 @@ export const UrlSyncedAlertsSearchBar = ({ savedQuery={savedQuery} onSavedQueryUpdated={setSavedQuery} onClearSavedQuery={clearSavedQuery} + ruleTypeIds={ruleTypeIds} {...rest} /> {showFilterControls && ( diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx index 61c65eded27b5..cf7e184c50f31 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx @@ -309,7 +309,7 @@ const AlertsTable: React.FunctionComponent = memo((props: Aler dynamicRowHeight, query, querySnapshot, - featureIds, + ruleTypeIds, cases: { data: cases, isLoading: isLoadingCases }, maintenanceWindows: { data: maintenanceWindows, isLoading: isLoadingMaintenanceWindows }, controls, @@ -345,7 +345,7 @@ const AlertsTable: React.FunctionComponent = memo((props: Aler query, useBulkActionsConfig: alertsTableConfiguration.useBulkActions, refresh: refetchAlerts, - featureIds, + ruleTypeIds, hideBulkActions: Boolean(alertsTableConfiguration.hideBulkActions), }; }, [ @@ -355,7 +355,7 @@ const AlertsTable: React.FunctionComponent = memo((props: Aler alertsTableConfiguration.hideBulkActions, query, refetchAlerts, - featureIds, + ruleTypeIds, ]); const { diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.test.tsx index 13b9433ce4b9e..9db58d26d9251 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.test.tsx @@ -9,12 +9,7 @@ import { BehaviorSubject } from 'rxjs'; import userEvent from '@testing-library/user-event'; import { get } from 'lodash'; import { fireEvent, render, waitFor, screen, act } from '@testing-library/react'; -import { - AlertConsumers, - ALERT_CASE_IDS, - ALERT_MAINTENANCE_WINDOW_IDS, - ALERT_UUID, -} from '@kbn/rule-data-utils'; +import { ALERT_CASE_IDS, ALERT_MAINTENANCE_WINDOW_IDS, ALERT_UUID } from '@kbn/rule-data-utils'; import { Storage } from '@kbn/kibana-utils-plugin/public'; import { @@ -344,7 +339,7 @@ const browserFields: BrowserFields = { }, }; -jest.mocked(fetchAlertsFields).mockResolvedValue({ browserFields, fields: [] }); +const fetchAlertsFieldsMock = fetchAlertsFields as jest.Mock; const queryClient = new QueryClient({ defaultOptions: { @@ -367,7 +362,7 @@ describe('AlertsTableState', () => { alertsTableConfigurationRegistry: alertsTableConfigurationRegistryMock, configurationId: PLUGIN_ID, id: PLUGIN_ID, - featureIds: [AlertConsumers.LOGS], + ruleTypeIds: ['logs'], query: {}, columns, pagination: { @@ -419,6 +414,8 @@ describe('AlertsTableState', () => { data: maintenanceWindowsMap, isFetching: false, }); + + fetchAlertsFieldsMock.mockResolvedValue({ browserFields, fields: [] }); }); describe('Cases', () => { @@ -837,6 +834,8 @@ describe('AlertsTableState', () => { data: new Map(), isFetching: false, }); + + fetchAlertsFieldsMock.mockResolvedValue({ browserFields, fields: [] }); }); it('should show field browser', async () => { @@ -845,13 +844,13 @@ describe('AlertsTableState', () => { }); it('should remove an already existing element when selected', async () => { - const { getByTestId, queryByTestId } = render(); + const { findByTestId, queryByTestId } = render(); expect(queryByTestId(`dataGridHeaderCell-${AlertsField.name}`)).not.toBe(null); - fireEvent.click(getByTestId('show-field-browser')); - const fieldCheckbox = getByTestId(`field-${AlertsField.name}-checkbox`); + fireEvent.click(await findByTestId('show-field-browser')); + const fieldCheckbox = await findByTestId(`field-${AlertsField.name}-checkbox`); fireEvent.click(fieldCheckbox); - fireEvent.click(getByTestId('close')); + fireEvent.click(await findByTestId('close')); await waitFor(() => { expect(queryByTestId(`dataGridHeaderCell-${AlertsField.name}`)).toBe(null); @@ -877,13 +876,15 @@ describe('AlertsTableState', () => { set: jest.fn(), })); - const { getByTestId, queryByTestId } = render(); + const { getByTestId, findByTestId, queryByTestId } = render( + + ); expect(queryByTestId(`dataGridHeaderCell-${AlertsField.name}`)).toBe(null); - fireEvent.click(getByTestId('show-field-browser')); - const fieldCheckbox = getByTestId(`field-${AlertsField.name}-checkbox`); + fireEvent.click(await findByTestId('show-field-browser')); + const fieldCheckbox = await findByTestId(`field-${AlertsField.name}-checkbox`); fireEvent.click(fieldCheckbox); - fireEvent.click(getByTestId('close')); + fireEvent.click(await findByTestId('close')); await waitFor(() => { expect(queryByTestId(`dataGridHeaderCell-${AlertsField.name}`)).not.toBe(null); @@ -896,13 +897,13 @@ describe('AlertsTableState', () => { }); it('should insert a new field as column when its not a default one', async () => { - const { getByTestId, queryByTestId } = render(); + const { findByTestId, queryByTestId } = render(); expect(queryByTestId(`dataGridHeaderCell-${AlertsField.uuid}`)).toBe(null); - fireEvent.click(getByTestId('show-field-browser')); - const fieldCheckbox = getByTestId(`field-${AlertsField.uuid}-checkbox`); + fireEvent.click(await findByTestId('show-field-browser')); + const fieldCheckbox = await findByTestId(`field-${AlertsField.uuid}-checkbox`); fireEvent.click(fieldCheckbox); - fireEvent.click(getByTestId('close')); + fireEvent.click(await findByTestId('close')); await waitFor(() => { expect(queryByTestId(`dataGridHeaderCell-${AlertsField.uuid}`)).not.toBe(null); @@ -958,6 +959,16 @@ describe('AlertsTableState', () => { expect(result.getByTestId('alertsStateTableEmptyState')).toBeTruthy(); }); + it('should render an empty screen when the data are undefined', async () => { + mockUseSearchAlertsQuery.mockReturnValue({ + data: undefined, + refetch: refetchMock, + }); + + const result = render(); + expect(result.getByTestId('alertsStateTableEmptyState')).toBeTruthy(); + }); + describe('inspect button', () => { it('should hide the inspect button by default', () => { render(); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.tsx index 62c78a3ad589c..93bb4f18dfe9a 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.tsx @@ -21,7 +21,6 @@ import { } from '@elastic/eui'; import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; import { ALERT_CASE_IDS, ALERT_MAINTENANCE_WINDOW_IDS } from '@kbn/rule-data-utils'; -import type { ValidFeatureId } from '@kbn/rule-data-utils'; import type { RuleRegistrySearchRequestPagination } from '@kbn/rule-registry-plugin/common'; import type { BrowserFields } from '@kbn/alerting-types'; import { Storage } from '@kbn/kibana-utils-plugin/public'; @@ -68,7 +67,8 @@ export type AlertsTableStateProps = { alertsTableConfigurationRegistry: AlertsTableConfigurationRegistryContract; configurationId: string; id: string; - featureIds: ValidFeatureId[]; + ruleTypeIds: string[]; + consumers?: string[]; query: Pick; initialPageSize?: number; browserFields?: BrowserFields; @@ -192,7 +192,8 @@ const AlertsTableStateWithQueryProvider = memo( alertsTableConfigurationRegistry, configurationId, id, - featureIds, + ruleTypeIds, + consumers, query, initialPageSize = DEFAULT_ALERTS_PAGE_SIZE, leadingControlColumns = DEFAULT_LEADING_CONTROL_COLUMNS, @@ -292,7 +293,7 @@ const AlertsTableStateWithQueryProvider = memo( onColumnResize, fields, } = useColumns({ - featureIds, + ruleTypeIds, storageAlertsTable, storage, id, @@ -301,7 +302,8 @@ const AlertsTableStateWithQueryProvider = memo( }); const [queryParams, setQueryParams] = useState({ - featureIds, + ruleTypeIds, + consumers, fields, query, sort, @@ -312,14 +314,16 @@ const AlertsTableStateWithQueryProvider = memo( useEffect(() => { setQueryParams(({ pageIndex: oldPageIndex, pageSize: oldPageSize, ...prevQueryParams }) => ({ - featureIds, + ruleTypeIds, + consumers, fields, query, sort, runtimeMappings, // Go back to the first page if the query changes pageIndex: !deepEqual(prevQueryParams, { - featureIds, + ruleTypeIds, + consumers, fields, query, sort, @@ -329,7 +333,7 @@ const AlertsTableStateWithQueryProvider = memo( : oldPageIndex, pageSize: oldPageSize, })); - }, [featureIds, fields, query, runtimeMappings, sort]); + }, [ruleTypeIds, fields, query, runtimeMappings, sort, consumers]); const { data: alertsData, @@ -363,11 +367,11 @@ const AlertsTableStateWithQueryProvider = memo( } }, [alerts, isLoading, isSuccess, onLoaded]); - const mutedAlertIds = useMemo(() => { + const mutedRuleIds = useMemo(() => { return [...new Set(alerts.map((a) => a['kibana.alert.rule.uuid']![0]))]; }, [alerts]); - const { data: mutedAlerts } = useGetMutedAlerts(mutedAlertIds); + const { data: mutedAlerts } = useGetMutedAlerts(mutedRuleIds); const overriddenActions = useMemo(() => { return { toggleColumn: onToggleColumn }; }, [onToggleColumn]); @@ -501,7 +505,7 @@ const AlertsTableStateWithQueryProvider = memo( toolbarVisibility, shouldHighlightRow, dynamicRowHeight, - featureIds, + ruleTypeIds, querySnapshot, pageIndex: queryParams.pageIndex, pageSize: queryParams.pageSize, @@ -541,7 +545,7 @@ const AlertsTableStateWithQueryProvider = memo( toolbarVisibility, shouldHighlightRow, dynamicRowHeight, - featureIds, + ruleTypeIds, querySnapshot, queryParams.pageIndex, queryParams.pageSize, @@ -579,7 +583,7 @@ const AlertsTableStateWithQueryProvider = memo( return ( - {!isLoading && alertsCount === 0 && ( + {!isLoading && alertsCount <= 0 && ( field === ALERT_RULE_PRODUCER)?.value?.[0]; - const consumer: AlertConsumers = observabilityFeatureIds.includes(producer) + const consumer: AlertsTableSupportedConsumers = observabilityFeatureIds.includes(producer) ? 'observability' : producer && (value === 'alerts' || value === 'stackAlerts' || value === 'discover') ? producer diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/constants.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/constants.ts index 9605abb085232..54846574c1a10 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/constants.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/constants.ts @@ -19,6 +19,7 @@ import { STACK_MONITORING_DISPLAY_NAME, UPTIME_DISPLAY_NAME, } from '../translations'; +import { AlertsTableSupportedConsumers } from './types'; interface AlertProducerData { displayName: string; @@ -33,13 +34,18 @@ export const observabilityFeatureIds: AlertConsumers[] = [ AlertConsumers.LOGS, AlertConsumers.SLO, AlertConsumers.UPTIME, + AlertConsumers.ALERTS, ]; -export const stackFeatureIds: AlertConsumers[] = [AlertConsumers.STACK_ALERTS, AlertConsumers.ML]; +export const stackFeatureIds: AlertConsumers[] = [ + AlertConsumers.STACK_ALERTS, + AlertConsumers.ML, + AlertConsumers.DISCOVER, +]; export const [_, ...observabilityApps] = observabilityFeatureIds; -export const alertProducersData: Record = { +export const alertProducersData: Record = { [AlertConsumers.OBSERVABILITY]: { displayName: OBSERVABILITY_DISPLAY_NAME, icon: 'logoObservability', @@ -86,4 +92,9 @@ export const alertProducersData: Record = { displayName: 'Example', icon: 'beaker', }, + [AlertConsumers.DISCOVER]: { + displayName: STACK_DISPLAY_NAME, + icon: 'managementApp', + subFeatureIds: stackFeatureIds, + }, }; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/alert_mute/use_get_muted_alerts.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/alert_mute/use_get_muted_alerts.test.tsx index 2718ccd8ca88e..ae75e5472f229 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/alert_mute/use_get_muted_alerts.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/alert_mute/use_get_muted_alerts.test.tsx @@ -37,7 +37,7 @@ describe('useGetMutedAlerts', () => { await waitFor(() => { expect(muteAlertInstanceSpy).toHaveBeenCalledWith( expect.anything(), - { ids: ruleIds }, + { ruleIds }, expect.any(AbortSignal) ); }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/alert_mute/use_get_muted_alerts.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/alert_mute/use_get_muted_alerts.tsx index 08f172451ca23..1ca6cbb22ea97 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/alert_mute/use_get_muted_alerts.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/alert_mute/use_get_muted_alerts.tsx @@ -25,7 +25,7 @@ export const useGetMutedAlerts = (ruleIds: string[], enabled = true) => { return useQuery( triggersActionsUiQueriesKeys.mutedAlerts(), ({ signal }) => - getMutedAlerts(http, { ids: ruleIds }, signal).then(({ data: rules }) => + getMutedAlerts(http, { ruleIds }, signal).then(({ data: rules }) => rules?.reduce((mutedAlerts, rule) => { mutedAlerts[rule.id] = rule.muted_alert_ids; return mutedAlerts; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/apis/get_rules_muted_alerts.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/apis/get_rules_muted_alerts.test.ts new file mode 100644 index 0000000000000..d0f1a39f7cede --- /dev/null +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/apis/get_rules_muted_alerts.test.ts @@ -0,0 +1,46 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ +import { httpServiceMock } from '@kbn/core/public/mocks'; +import { getMutedAlerts } from './get_rules_muted_alerts'; + +const http = httpServiceMock.createStartContract(); + +describe('getMutedAlerts', () => { + const apiRes = { + page: 1, + per_page: 10, + total: 0, + data: [], + }; + + beforeEach(() => { + jest.clearAllMocks(); + + http.post.mockResolvedValueOnce(apiRes); + }); + + test('should call find API with correct params', async () => { + const result = await getMutedAlerts(http, { ruleIds: ['foo'] }); + + expect(result).toEqual({ + page: 1, + per_page: 10, + total: 0, + data: [], + }); + + expect(http.post.mock.calls[0]).toMatchInlineSnapshot(` + Array [ + "/internal/alerting/rules/_find", + Object { + "body": "{\\"rule_type_ids\\":[\\"foo\\"],\\"fields\\":[\\"id\\",\\"mutedInstanceIds\\"],\\"page\\":1,\\"per_page\\":1}", + "signal": undefined, + }, + ] + `); + }); +}); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/apis/get_rules_muted_alerts.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/apis/get_rules_muted_alerts.ts index 5a2f2fcc21c6b..d9baef548dafc 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/apis/get_rules_muted_alerts.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/apis/get_rules_muted_alerts.ts @@ -6,7 +6,6 @@ */ import { HttpStart } from '@kbn/core-http-browser'; -import { nodeBuilder } from '@kbn/es-query'; const INTERNAL_FIND_RULES_URL = '/internal/alerting/rules/_find'; @@ -21,18 +20,15 @@ export interface FindRulesResponse { export const getMutedAlerts = async ( http: HttpStart, - params: { ids: string[] }, + params: { ruleIds: string[] }, signal?: AbortSignal ) => { - const filterNode = nodeBuilder.or( - params.ids.map((id) => nodeBuilder.is('alert.id', `alert:${id}`)) - ); return http.post(INTERNAL_FIND_RULES_URL, { body: JSON.stringify({ - filter: JSON.stringify(filterNode), + rule_type_ids: params.ruleIds, fields: ['id', 'mutedInstanceIds'], page: 1, - per_page: params.ids.length, + per_page: params.ruleIds.length, }), signal, }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.test.tsx index 0f136e15156d7..554febab20210 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.test.tsx @@ -392,7 +392,13 @@ describe('bulk action hooks', () => { it('appends only the case bulk actions for SIEM', async () => { const { result } = renderHook( () => - useBulkActions({ alertsCount: 0, query: {}, casesConfig, refresh, featureIds: ['siem'] }), + useBulkActions({ + alertsCount: 0, + query: {}, + casesConfig, + refresh, + ruleTypeIds: ['siem.esqlRule'], + }), { wrapper: appMockRender.AppWrapper, } @@ -476,7 +482,7 @@ describe('bulk action hooks', () => { query: {}, casesConfig, refresh, - featureIds: ['observability'], + ruleTypeIds: ['observability'], }), { wrapper: appMockRender.AppWrapper, @@ -492,7 +498,7 @@ describe('bulk action hooks', () => { query: {}, casesConfig, refresh, - featureIds: ['observability'], + ruleTypeIds: ['observability'], hideBulkActions: true, }), { diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.ts index 727ff4f93ebd8..1f35d02f8d72f 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.ts @@ -7,7 +7,7 @@ import { useCallback, useContext, useEffect, useMemo } from 'react'; import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; import { useKibana } from '@kbn/kibana-react-plugin/public'; -import { ALERT_CASE_IDS, ValidFeatureId } from '@kbn/rule-data-utils'; +import { ALERT_CASE_IDS, isSiemRuleType } from '@kbn/rule-data-utils'; import { AlertsTableContext } from '../contexts/alerts_table_context'; import { AlertsTableConfigurationRegistry, @@ -40,7 +40,7 @@ interface BulkActionsProps { casesConfig?: AlertsTableConfigurationRegistry['cases']; useBulkActionsConfig?: UseBulkActionsRegistry; refresh: () => void; - featureIds?: ValidFeatureId[]; + ruleTypeIds?: string[]; hideBulkActions?: boolean; } @@ -57,7 +57,7 @@ export interface UseBulkActions { type UseBulkAddToCaseActionsProps = Pick & Pick; -type UseBulkUntrackActionsProps = Pick & +type UseBulkUntrackActionsProps = Pick & Pick & { isAllSelected: boolean; }; @@ -191,7 +191,7 @@ export const useBulkUntrackActions = ({ refresh, clearSelection, query, - featureIds = [], + ruleTypeIds = [], isAllSelected, }: UseBulkUntrackActionsProps) => { const onSuccess = useCallback(() => { @@ -217,7 +217,7 @@ export const useBulkUntrackActions = ({ try { setIsBulkActionsLoading(true); if (isAllSelected) { - await untrackAlertsByQuery({ query, featureIds }); + await untrackAlertsByQuery({ query, ruleTypeIds }); } else { await untrackAlerts({ indices, alertUuids }); } @@ -228,7 +228,7 @@ export const useBulkUntrackActions = ({ }, [ query, - featureIds, + ruleTypeIds, isAllSelected, onSuccess, setIsBulkActionsLoading, @@ -277,7 +277,7 @@ export function useBulkActions({ query, refresh, useBulkActionsConfig = () => [], - featureIds, + ruleTypeIds, hideBulkActions, }: BulkActionsProps): UseBulkActions { const { @@ -300,13 +300,14 @@ export function useBulkActions({ refresh, clearSelection, query, - featureIds, + ruleTypeIds, isAllSelected: bulkActionsState.isAllSelected, }); const initialItems = useMemo(() => { - return [...caseBulkActions, ...(featureIds?.includes('siem') ? [] : untrackBulkActions)]; - }, [caseBulkActions, featureIds, untrackBulkActions]); + return [...caseBulkActions, ...(ruleTypeIds?.some(isSiemRuleType) ? [] : untrackBulkActions)]; + }, [caseBulkActions, ruleTypeIds, untrackBulkActions]); + const bulkActions = useMemo(() => { if (hideBulkActions) { return []; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_untrack_alerts_by_query.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_untrack_alerts_by_query.test.ts new file mode 100644 index 0000000000000..5de16dd70ce52 --- /dev/null +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_untrack_alerts_by_query.test.ts @@ -0,0 +1,53 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { act, renderHook } from '@testing-library/react-hooks'; +import { AppMockRenderer, createAppMockRenderer } from '../../test_utils'; +import { AlertsQueryContext } from '@kbn/alerts-ui-shared/src/common/contexts/alerts_query_context'; +import { useBulkUntrackAlertsByQuery } from './use_bulk_untrack_alerts_by_query'; +import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock'; +import { TriggersAndActionsUiServices } from '../../../..'; + +const mockUseKibanaReturnValue: TriggersAndActionsUiServices = createStartServicesMock(); + +jest.mock('../../../../common/lib/kibana', () => ({ + useKibana: jest.fn(() => ({ + services: mockUseKibanaReturnValue, + })), +})); + +const response = {}; + +describe('useBulkUntrackAlertsByQuery', () => { + const httpMock = mockUseKibanaReturnValue.http.post as jest.Mock; + + let appMockRender: AppMockRenderer; + + beforeEach(() => { + jest.clearAllMocks(); + appMockRender = createAppMockRenderer(AlertsQueryContext); + }); + + it('calls the api when invoked with the correct parameters', async () => { + httpMock.mockResolvedValue(response); + + const { result, waitFor } = renderHook(() => useBulkUntrackAlertsByQuery(), { + wrapper: appMockRender.AppWrapper, + }); + + await act(async () => { + // @ts-expect-error: no need to specify a query + await result.current.mutateAsync({ ruleTypeIds: ['foo'], query: [] }); + }); + + await waitFor(() => { + expect(httpMock).toHaveBeenCalledWith('/internal/alerting/alerts/_bulk_untrack_by_query', { + body: '{"query":[],"rule_type_ids":["foo"]}', + }); + }); + }); +}); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_untrack_alerts_by_query.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_untrack_alerts_by_query.tsx index 321d861e03615..88c878aa47a66 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_untrack_alerts_by_query.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_untrack_alerts_by_query.tsx @@ -9,7 +9,6 @@ import { i18n } from '@kbn/i18n'; import { useMutation } from '@tanstack/react-query'; import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; import { INTERNAL_BASE_ALERTING_API_PATH } from '@kbn/alerting-plugin/common'; -import { ValidFeatureId } from '@kbn/rule-data-utils'; import { AlertsQueryContext } from '@kbn/alerts-ui-shared/src/common/contexts/alerts_query_context'; import { useKibana } from '../../../../common'; @@ -22,14 +21,14 @@ export const useBulkUntrackAlertsByQuery = () => { const untrackAlertsByQuery = useMutation< string, string, - { query: Pick; featureIds: ValidFeatureId[] } + { query: Pick; ruleTypeIds: string[] } >( ['untrackAlerts'], - ({ query, featureIds }) => { + ({ query, ruleTypeIds }) => { try { const body = JSON.stringify({ query: Array.isArray(query) ? query : [query], - feature_ids: featureIds, + rule_type_ids: ruleTypeIds, }); return http.post(`${INTERNAL_BASE_ALERTING_API_PATH}/alerts/_bulk_untrack_by_query`, { body, diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_columns/use_columns.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_columns/use_columns.test.tsx index d6ecf3d9ab20d..3b742bbd6d620 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_columns/use_columns.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_columns/use_columns.test.tsx @@ -7,7 +7,6 @@ import React, { FunctionComponent } from 'react'; import { EuiDataGridColumn } from '@elastic/eui'; -import { AlertConsumers } from '@kbn/rule-data-utils'; import { Storage } from '@kbn/kibana-utils-plugin/public'; import { act, waitFor, renderHook } from '@testing-library/react'; import { QueryClient, QueryClientProvider } from '@tanstack/react-query'; @@ -76,7 +75,7 @@ mockFetchAlertsFields.mockResolvedValue({ browserFields, fields: [] }); describe('useColumns', () => { const id = 'useColumnTest'; - const featureIds: AlertConsumers[] = [AlertConsumers.LOGS, AlertConsumers.APM]; + const ruleTypeIds: string[] = ['apm', 'logs']; let storage = { current: new Storage(mockStorage) }; const getStorageAlertsTableByDefaultColumns = (defaultColumns: EuiDataGridColumn[]) => { @@ -155,7 +154,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -187,7 +186,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -213,7 +212,7 @@ describe('useColumns', () => { useColumns({ alertsFields, defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -232,7 +231,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -254,7 +253,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -283,7 +282,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -301,7 +300,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns: localDefaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -338,7 +337,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -357,7 +356,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -378,7 +377,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -407,7 +406,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, @@ -440,7 +439,7 @@ describe('useColumns', () => { () => useColumns({ defaultColumns, - featureIds, + ruleTypeIds, id, storageAlertsTable: localStorageAlertsTable, storage, diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_columns/use_columns.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_columns/use_columns.ts index 30c9ff0ea69ed..3af1d37f10de8 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_columns/use_columns.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_columns/use_columns.ts @@ -9,7 +9,6 @@ import { EuiDataGridColumn, EuiDataGridOnColumnResizeData } from '@elastic/eui'; import { IStorageWrapper } from '@kbn/kibana-utils-plugin/public'; import { BrowserField, BrowserFields } from '@kbn/alerting-types'; import { MutableRefObject, useCallback, useEffect, useMemo, useRef, useState } from 'react'; -import { AlertConsumers } from '@kbn/rule-data-utils'; import { isEmpty } from 'lodash'; import { useFetchAlertsFieldsQuery } from '@kbn/alerts-ui-shared/src/common/hooks/use_fetch_alerts_fields_query'; import { AlertsQueryContext } from '@kbn/alerts-ui-shared/src/common/contexts/alerts_query_context'; @@ -18,7 +17,7 @@ import { toggleColumn } from './toggle_column'; import { useKibana } from '../../../../../common'; export interface UseColumnsArgs { - featureIds: AlertConsumers[]; + ruleTypeIds: string[]; storageAlertsTable: React.MutableRefObject; storage: React.MutableRefObject; id: string; @@ -155,7 +154,7 @@ const persist = ({ }; export const useColumns = ({ - featureIds, + ruleTypeIds, storageAlertsTable, storage, id, @@ -167,7 +166,7 @@ export const useColumns = ({ const fieldsQuery = useFetchAlertsFieldsQuery( { http, - featureIds, + ruleTypeIds, }, { enabled: !alertsFields, diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/types.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/types.ts index 819cc42bd90e6..46b349ae9bcce 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/types.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/types.ts @@ -20,6 +20,8 @@ export interface Consumer { name: string; } +export type AlertsTableSupportedConsumers = Exclude; + export type ServerError = IHttpFetchError; export interface CellComponentProps { diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule.test.tsx index 23e6f978f4c05..d64c018a07f3e 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule.test.tsx @@ -602,6 +602,7 @@ function mockRuleType(overloads: Partial = {}): RuleType { producer: 'rules', minimumLicenseRequired: 'basic', enabledInLicense: true, + category: 'my-category', ...overloads, }; } diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule.tsx index 34f5a8e65436a..593e0a989b5f3 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule.tsx @@ -8,8 +8,8 @@ import React, { lazy, useCallback, useMemo } from 'react'; import { i18n } from '@kbn/i18n'; import { EuiSpacer, EuiFlexGroup, EuiFlexItem, EuiTabbedContent } from '@elastic/eui'; -import { AlertStatusValues, ALERTING_FEATURE_ID } from '@kbn/alerting-plugin/common'; -import { ALERT_RULE_UUID, AlertConsumers } from '@kbn/rule-data-utils'; +import { AlertStatusValues } from '@kbn/alerting-plugin/common'; +import { ALERT_RULE_UUID } from '@kbn/rule-data-utils'; import { ALERT_TABLE_GENERIC_CONFIG_ID } from '../../../constants'; import { AlertTableConfigRegistry } from '../../../alert_table_config_registry'; import { useKibana } from '../../../../common/lib/kibana'; @@ -106,11 +106,7 @@ export function RuleComponent({ alertsTableConfigurationRegistry={ alertsTableConfigurationRegistry as AlertTableConfigRegistry } - featureIds={ - (rule.consumer === ALERTING_FEATURE_ID - ? [ruleType.producer] - : [rule.consumer]) as AlertConsumers[] - } + ruleTypeIds={[ruleType.id]} query={{ bool: { filter: { term: { [ALERT_RULE_UUID]: rule.id } } } }} showAlertStatusWithFlapping lastReloadRequestTime={lastReloadRequestTime} @@ -131,11 +127,10 @@ export function RuleComponent({ lastReloadRequestTime, onMuteAction, readOnly, - rule.consumer, rule.id, ruleType.hasAlertsMappings, ruleType.hasFieldsForAAD, - ruleType.producer, + ruleType.id, ]); const tabs = [ diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_details.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_details.test.tsx index ffde171117385..23c19642a8701 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_details.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_details.test.tsx @@ -88,6 +88,7 @@ const ruleType: RuleType = { producer: ALERTING_FEATURE_ID, authorizedConsumers, enabledInLicense: true, + category: 'my-category', }; describe('rule_details', () => { diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_route.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_route.test.tsx index 7e660a30f7ec9..b8357c68da20e 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_route.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_route.test.tsx @@ -146,6 +146,7 @@ function mockRuleType(overloads: Partial = {}): RuleType { producer: 'rules', minimumLicenseRequired: 'basic', enabledInLicense: true, + category: 'my-category', ...overloads, }; } diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/test_helpers.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/test_helpers.ts index 01ea94fdea8df..3da317d4e2be1 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/test_helpers.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/test_helpers.ts @@ -79,6 +79,7 @@ export function mockRuleType(overloads: Partial = {}): RuleType { producer: 'rules', minimumLicenseRequired: 'basic', enabledInLicense: true, + category: 'my-category', ...overloads, }; } diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_add.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_add.test.tsx index c7b2876d83d84..0b9109c18831c 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_add.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_add.test.tsx @@ -450,6 +450,7 @@ describe('rule_add', () => { }, ], enabledInLicense: true, + category: 'my-category', defaultActionGroupId: 'threshold.fired', minimumLicenseRequired: 'basic', recoveryActionGroup: { id: 'recovered', name: 'Recovered' }, diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form.test.tsx index 17bdcc92997ca..a89f7fe76339b 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form.test.tsx @@ -329,6 +329,7 @@ describe('rule_form', () => { state: [], }, enabledInLicense: true, + category: 'my-category', }, { id: 'disabled-by-license', @@ -352,6 +353,7 @@ describe('rule_form', () => { state: [], }, enabledInLicense: false, + category: 'my-category', }, ]; useLoadRuleTypesQuery.mockReturnValue({ @@ -579,6 +581,7 @@ describe('rule_form', () => { }, ], enabledInLicense: true, + category: 'my-category', defaultActionGroupId: 'threshold.fired', minimumLicenseRequired: 'basic', recoveryActionGroup: { id: 'recovered', name: 'Recovered' }, @@ -652,6 +655,7 @@ describe('rule_form', () => { }, ], enabledInLicense: true, + category: 'my-category', defaultActionGroupId: 'threshold.fired', minimumLicenseRequired: 'basic', recoveryActionGroup: { id: 'recovered', name: 'Recovered' }, @@ -730,6 +734,7 @@ describe('rule_form', () => { }, ], enabledInLicense: true, + category: 'my-category', defaultActionGroupId: 'threshold.fired', minimumLicenseRequired: 'basic', recoveryActionGroup: { id: 'recovered', name: 'Recovered' }, @@ -789,6 +794,7 @@ describe('rule_form', () => { }, ], enabledInLicense: true, + category: 'my-category', defaultActionGroupId: 'threshold.fired', minimumLicenseRequired: 'basic', recoveryActionGroup: { id: 'recovered', name: 'Recovered' }, @@ -848,6 +854,7 @@ describe('rule_form', () => { }, ], enabledInLicense: true, + category: 'my-category', defaultActionGroupId: 'threshold.fired', minimumLicenseRequired: 'basic', recoveryActionGroup: { id: 'recovered', name: 'Recovered' }, @@ -907,6 +914,7 @@ describe('rule_form', () => { }, ], enabledInLicense: true, + category: 'my-category', defaultActionGroupId: 'threshold.fired', minimumLicenseRequired: 'basic', recoveryActionGroup: { id: 'recovered', name: 'Recovered' }, @@ -966,6 +974,7 @@ describe('rule_form', () => { }, ], enabledInLicense: true, + category: 'my-category', defaultActionGroupId: 'threshold.fired', minimumLicenseRequired: 'basic', recoveryActionGroup: { id: 'recovered', name: 'Recovered' }, diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form_consumer_selection.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form_consumer_selection.test.tsx index bec46c682919b..c98733d377f0e 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form_consumer_selection.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form_consumer_selection.test.tsx @@ -9,14 +9,19 @@ import React from 'react'; import { fireEvent, render, screen } from '@testing-library/react'; import { RuleFormConsumerSelection } from './rule_form_consumer_selection'; import { RuleCreationValidConsumer } from '../../../types'; +import { useKibana } from '../../../common/lib/kibana'; const mockConsumers: RuleCreationValidConsumer[] = ['logs', 'infrastructure', 'stackAlerts']; const mockOnChange = jest.fn(); +jest.mock('../../../common/lib/kibana'); +const useKibanaMock = useKibana as jest.Mocked; + describe('RuleFormConsumerSelectionModal', () => { beforeEach(() => { jest.clearAllMocks(); + useKibanaMock().services.isServerless = false; }); it('renders correctly', async () => { @@ -162,41 +167,56 @@ describe('RuleFormConsumerSelectionModal', () => { expect(screen.queryByTestId('ruleFormConsumerSelect')).not.toBeInTheDocument(); }); - it('should display nothing if observability is one of the consumers', () => { + it('should display the initial selected consumer', () => { render( ); - expect(screen.queryByTestId('ruleFormConsumerSelect')).not.toBeInTheDocument(); + expect(screen.getByTestId('comboBoxSearchInput')).toHaveValue('Logs'); }); - it('should display the initial selected consumer', () => { + it('should not display the initial selected consumer if it is not a selectable option', () => { render( ); + expect(screen.getByTestId('comboBoxSearchInput')).toHaveValue(''); + }); - expect(screen.getByTestId('comboBoxSearchInput')).toHaveValue('Logs'); + it('should not show the role visibility dropdown on serverless on an o11y project', () => { + useKibanaMock().services.isServerless = true; + + render( + + ); + expect(screen.queryByTestId('ruleFormConsumerSelect')).not.toBeInTheDocument(); }); - it('should not display the initial selected consumer if it is not a selectable option', () => { + it('should set the consumer correctly on an o11y project', () => { + useKibanaMock().services.isServerless = true; + render( ); - expect(screen.getByTestId('comboBoxSearchInput')).toHaveValue(''); + expect(mockOnChange).toHaveBeenLastCalledWith('observability'); }); }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form_consumer_selection.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form_consumer_selection.tsx index 46ec61cca8a5e..9fff99c1c9998 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form_consumer_selection.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form_consumer_selection.tsx @@ -10,6 +10,7 @@ import { EuiComboBox, EuiFormRow, EuiComboBoxOptionOption } from '@elastic/eui'; import { i18n } from '@kbn/i18n'; import { AlertConsumers, STACK_ALERTS_FEATURE_ID } from '@kbn/rule-data-utils'; import { IErrorObject, RuleCreationValidConsumer } from '../../../types'; +import { useKibana } from '../../../common/lib/kibana'; const SELECT_LABEL: string = i18n.translate( 'xpack.triggersActionsUI.sections.ruleFormConsumerSelectionModal.selectLabel', @@ -80,8 +81,11 @@ export interface RuleFormConsumerSelectionProps { const SINGLE_SELECTION = { asPlainText: true }; export const RuleFormConsumerSelection = (props: RuleFormConsumerSelectionProps) => { + const { isServerless } = useKibana().services; + const { consumers, errors, onChange, selectedConsumer, initialSelectedConsumer } = props; const isInvalid = (errors?.consumer as string[])?.length > 0; + const handleOnChange = useCallback( (selected: Array>) => { if (selected.length > 0) { @@ -93,6 +97,7 @@ export const RuleFormConsumerSelection = (props: RuleFormConsumerSelectionProps) }, [onChange] ); + const validatedSelectedConsumer = useMemo(() => { if ( selectedConsumer && @@ -103,6 +108,7 @@ export const RuleFormConsumerSelection = (props: RuleFormConsumerSelectionProps) } return null; }, [selectedConsumer, consumers]); + const selectedOptions = useMemo( () => validatedSelectedConsumer @@ -149,15 +155,16 @@ export const RuleFormConsumerSelection = (props: RuleFormConsumerSelectionProps) useEffect(() => { if (consumers.length === 1) { onChange(consumers[0] as RuleCreationValidConsumer); - } else if (consumers.includes(AlertConsumers.OBSERVABILITY)) { + } else if (isServerless && consumers.includes(AlertConsumers.OBSERVABILITY)) { onChange(AlertConsumers.OBSERVABILITY as RuleCreationValidConsumer); } // eslint-disable-next-line react-hooks/exhaustive-deps }, [consumers]); - if (consumers.length <= 1 || consumers.includes(AlertConsumers.OBSERVABILITY)) { + if (consumers.length <= 1 || (isServerless && consumers.includes(AlertConsumers.OBSERVABILITY))) { return null; } + return ( { }); }); -// Failing: See https://github.com/elastic/kibana/issues/182435 -describe.skip('rules_list component empty', () => { +describe('rules_list component empty', () => { beforeEach(() => { fetchActiveMaintenanceWindowsMock.mockResolvedValue([]); loadRulesWithKueryFilter.mockResolvedValue({ @@ -282,28 +281,6 @@ describe.skip('rules_list component empty', () => { expect(await screen.findByTestId('createFirstRuleEmptyPrompt')).toBeInTheDocument(); }); - it('renders MaintenanceWindowCallout if one exists', async () => { - fetchActiveMaintenanceWindowsMock.mockResolvedValue([RUNNING_MAINTENANCE_WINDOW_1]); - renderWithProviders(); - expect( - await screen.findByText( - 'Rule notifications are stopped while maintenance windows are running.' - ) - ).toBeInTheDocument(); - expect(fetchActiveMaintenanceWindowsMock).toHaveBeenCalledTimes(1); - }); - - it("hides MaintenanceWindowCallout if filterConsumers does not match the running maintenance window's category", async () => { - fetchActiveMaintenanceWindowsMock.mockResolvedValue([ - { ...RUNNING_MAINTENANCE_WINDOW_1, categoryIds: ['securitySolution'] }, - ]); - renderWithProviders(); - await expect( - screen.findByText('Rule notifications are stopped while maintenance windows are running.') - ).rejects.toThrow(); - expect(fetchActiveMaintenanceWindowsMock).toHaveBeenCalledTimes(1); - }); - it('renders Create rule button', async () => { renderWithProviders(); @@ -319,6 +296,7 @@ describe.skip('rules_list component empty', () => { describe('rules_list ', () => { let ruleTypeRegistry: jest.Mocked; let actionTypeRegistry: jest.Mocked>; + beforeEach(() => { (getIsExperimentalFeatureEnabled as jest.Mock).mockImplementation(() => false); loadRulesWithKueryFilter.mockResolvedValue({ @@ -1403,3 +1381,99 @@ describe('rules_list with show only capability', () => { }); }); }); + +describe('MaintenanceWindowsMock', () => { + beforeEach(() => { + fetchActiveMaintenanceWindowsMock.mockResolvedValue([]); + + loadRulesWithKueryFilter.mockResolvedValue({ + page: 1, + perPage: 10000, + total: 0, + data: [], + }); + + loadActionTypes.mockResolvedValue([ + { + id: 'test', + name: 'Test', + }, + { + id: 'test2', + name: 'Test2', + }, + ]); + + loadRuleTypes.mockResolvedValue([ruleTypeFromApi]); + loadAllActions.mockResolvedValue([]); + loadRuleAggregationsWithKueryFilter.mockResolvedValue({}); + loadRuleTags.mockResolvedValue({ + data: ruleTags, + page: 1, + perPage: 50, + total: 4, + }); + + const actionTypeRegistry = actionTypeRegistryMock.create(); + const ruleTypeRegistry = ruleTypeRegistryMock.create(); + + ruleTypeRegistry.list.mockReturnValue([ruleType]); + actionTypeRegistry.list.mockReturnValue([]); + useKibanaMock().services.application.capabilities = { + ...useKibanaMock().services.application.capabilities, + [MAINTENANCE_WINDOW_FEATURE_ID]: { + save: true, + show: true, + }, + }; + useKibanaMock().services.ruleTypeRegistry = ruleTypeRegistry; + useKibanaMock().services.actionTypeRegistry = actionTypeRegistry; + }); + + afterEach(() => { + jest.clearAllMocks(); + queryClient.clear(); + cleanup(); + }); + + it('renders MaintenanceWindowCallout if one exists', async () => { + fetchActiveMaintenanceWindowsMock.mockResolvedValue([RUNNING_MAINTENANCE_WINDOW_1]); + renderWithProviders(); + + expect( + await screen.findByText('One or more maintenance windows are running') + ).toBeInTheDocument(); + + expect(fetchActiveMaintenanceWindowsMock).toHaveBeenCalledTimes(1); + }); + + it('hides MaintenanceWindowCallout if the category ID is not supported', async () => { + loadRuleTypes.mockResolvedValue([{ ...ruleTypeFromApi, category: 'observability' }]); + fetchActiveMaintenanceWindowsMock.mockResolvedValue([ + { ...RUNNING_MAINTENANCE_WINDOW_1, categoryIds: ['securitySolution'] }, + ]); + + renderWithProviders(); + + await expect( + screen.findByText('Rule notifications are stopped while maintenance windows are running.') + ).rejects.toThrow(); + + expect(fetchActiveMaintenanceWindowsMock).toHaveBeenCalledTimes(1); + }); + + it('shows MaintenanceWindowCallout for a specific category', async () => { + loadRuleTypes.mockResolvedValue([{ ...ruleTypeFromApi, category: 'observability' }]); + fetchActiveMaintenanceWindowsMock.mockResolvedValue([ + { ...RUNNING_MAINTENANCE_WINDOW_1, categoryIds: ['securitySolution', 'observability'] }, + ]); + + renderWithProviders(); + + expect( + await screen.findByText('A maintenance window is running for Observability rules') + ).toBeInTheDocument(); + + expect(fetchActiveMaintenanceWindowsMock).toHaveBeenCalledTimes(1); + }); +}); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list.tsx index d98aa2c5dec67..c0b56fa224519 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list.tsx @@ -117,7 +117,8 @@ const RuleAdd = lazy(() => import('../../rule_form/rule_add')); const RuleEdit = lazy(() => import('../../rule_form/rule_edit')); export interface RulesListProps { - filterConsumers?: string[]; + ruleTypeIds?: string[]; + consumers?: string[]; filteredRuleTypes?: string[]; lastResponseFilter?: string[]; lastRunOutcomeFilter?: string[]; @@ -159,7 +160,8 @@ const initialPercentileOptions = Object.values(Percentiles).map((percentile) => const EMPTY_ARRAY: string[] = []; export const RulesList = ({ - filterConsumers, + ruleTypeIds, + consumers, filteredRuleTypes = EMPTY_ARRAY, lastResponseFilter, lastRunOutcomeFilter, @@ -272,6 +274,7 @@ export const RulesList = ({ const rulesTypesFilter = isEmpty(filters.types) ? authorizedRuleTypes.map((art) => art.id) : filters.types; + const hasDefaultRuleTypesFiltersOn = isEmpty(filters.types); const computedFilter = useMemo(() => { @@ -285,7 +288,8 @@ export const RulesList = ({ // Fetch rules const { rulesState, loadRules, hasData, lastUpdate } = useLoadRulesQuery({ - filterConsumers, + ruleTypeIds, + consumers, filters: computedFilter, hasDefaultRuleTypesFiltersOn, page, @@ -298,7 +302,8 @@ export const RulesList = ({ // Fetch status aggregation const { loadRuleAggregations, rulesStatusesTotal, rulesLastRunOutcomesTotal } = useLoadRuleAggregationsQuery({ - filterConsumers, + ruleTypeIds, + consumers, filters: computedFilter, enabled: canLoadRules, refresh, @@ -766,12 +771,16 @@ export const RulesList = ({ const numberRulesToDelete = rulesToBulkEdit.length || numberOfSelectedItems; + const allRuleCategories = getAllUniqueRuleTypeCategories( + Array.from(ruleTypesState.data.values()) + ); + return ( <> {showSearchBar && !isEmpty(filters.ruleParams) ? ( ) : null} - + ids.includes(rule.id)); } + +const getAllUniqueRuleTypeCategories = (ruleTypes: RuleType[]) => { + const categories = new Set(ruleTypes.map((ruleType) => ruleType.category)); + + return Array.from(categories).filter(Boolean); +}; diff --git a/x-pack/plugins/triggers_actions_ui/public/types.ts b/x-pack/plugins/triggers_actions_ui/public/types.ts index a592b19ae8a79..d6ea582058c1e 100644 --- a/x-pack/plugins/triggers_actions_ui/public/types.ts +++ b/x-pack/plugins/triggers_actions_ui/public/types.ts @@ -26,7 +26,7 @@ import type { RenderCellValue, EuiDataGridCellPopoverElementProps, } from '@elastic/eui'; -import type { RuleCreationValidConsumer, ValidFeatureId } from '@kbn/rule-data-utils'; +import type { RuleCreationValidConsumer } from '@kbn/rule-data-utils'; import { EuiDataGridColumn, EuiDataGridControlColumn, EuiDataGridSorting } from '@elastic/eui'; import { HttpSetup } from '@kbn/core/public'; import { KueryNode } from '@kbn/es-query'; @@ -490,7 +490,7 @@ export type AlertsTableProps = { * Enable when rows may have variable heights (disables virtualization) */ dynamicRowHeight?: boolean; - featureIds?: ValidFeatureId[]; + ruleTypeIds?: string[]; pageIndex: number; pageSize: number; sort: SortCombinations[]; diff --git a/x-pack/plugins/triggers_actions_ui/server/plugin.ts b/x-pack/plugins/triggers_actions_ui/server/plugin.ts index b5cafb0571482..2263af73dbdc7 100644 --- a/x-pack/plugins/triggers_actions_ui/server/plugin.ts +++ b/x-pack/plugins/triggers_actions_ui/server/plugin.ts @@ -6,10 +6,7 @@ */ import { Logger, Plugin, CoreSetup, PluginInitializerContext } from '@kbn/core/server'; -import { - PluginSetupContract as AlertingPluginSetup, - PluginStartContract as AlertingPluginStart, -} from '@kbn/alerting-plugin/server'; +import { AlertingServerSetup, AlertingServerStart } from '@kbn/alerting-plugin/server'; import { EncryptedSavedObjectsPluginSetup } from '@kbn/encrypted-saved-objects-plugin/server'; import { getService, register as registerDataService } from './data'; import { createHealthRoute, createConfigRoute } from './routes'; @@ -21,11 +18,11 @@ export interface PluginStartContract { interface PluginsSetup { encryptedSavedObjects?: EncryptedSavedObjectsPluginSetup; - alerting: AlertingPluginSetup; + alerting: AlertingServerSetup; } interface TriggersActionsPluginStart { - alerting: AlertingPluginStart; + alerting: AlertingServerStart; } export class TriggersActionsPlugin implements Plugin { diff --git a/x-pack/plugins/triggers_actions_ui/server/routes/config.test.ts b/x-pack/plugins/triggers_actions_ui/server/routes/config.test.ts index 010a01b46fbdb..e96d5837b1138 100644 --- a/x-pack/plugins/triggers_actions_ui/server/routes/config.test.ts +++ b/x-pack/plugins/triggers_actions_ui/server/routes/config.test.ts @@ -45,7 +45,7 @@ describe('createConfigRoute', () => { const logger = loggingSystemMock.create().get(); const mockRulesClient = rulesClientMock.create(); - mockRulesClient.listRuleTypes.mockResolvedValueOnce(new Set(ruleTypes)); + mockRulesClient.listRuleTypes.mockResolvedValueOnce(ruleTypes); createConfigRoute({ logger, router, @@ -80,7 +80,7 @@ describe('createConfigRoute', () => { const logger = loggingSystemMock.create().get(); const mockRulesClient = rulesClientMock.create(); - mockRulesClient.listRuleTypes.mockResolvedValueOnce(new Set()); + mockRulesClient.listRuleTypes.mockResolvedValueOnce([]); createConfigRoute({ logger, router, diff --git a/x-pack/test/alerting_api_integration/common/plugins/alerts/server/plugin.ts b/x-pack/test/alerting_api_integration/common/plugins/alerts/server/plugin.ts index 9210e9f71ed9c..62b6d6594b06c 100644 --- a/x-pack/test/alerting_api_integration/common/plugins/alerts/server/plugin.ts +++ b/x-pack/test/alerting_api_integration/common/plugins/alerts/server/plugin.ts @@ -8,10 +8,7 @@ import { Plugin, CoreSetup, CoreStart, Logger, PluginInitializerContext } from '@kbn/core/server'; import { firstValueFrom, Subject } from 'rxjs'; import { PluginSetupContract as ActionsPluginSetup } from '@kbn/actions-plugin/server/plugin'; -import { - PluginStartContract as AlertingPluginsStart, - PluginSetupContract as AlertingPluginSetup, -} from '@kbn/alerting-plugin/server/plugin'; +import { AlertingServerSetup, AlertingServerStart } from '@kbn/alerting-plugin/server/plugin'; import { TaskManagerSetupContract, TaskManagerStartContract, @@ -25,6 +22,7 @@ import { RuleRegistryPluginSetupContract } from '@kbn/rule-registry-plugin/serve import { IEventLogClientService } from '@kbn/event-log-plugin/server'; import { NotificationsPluginStart } from '@kbn/notifications-plugin/server'; import { RULE_SAVED_OBJECT_TYPE } from '@kbn/alerting-plugin/server'; +import { ALERTING_FEATURE_ID } from '@kbn/alerting-plugin/common'; import { KibanaFeatureScope } from '@kbn/features-plugin/common'; import { defineRoutes } from './routes'; import { defineActionTypes } from './action_types'; @@ -34,13 +32,13 @@ import { defineConnectorAdapters } from './connector_adapters'; export interface FixtureSetupDeps { features: FeaturesPluginSetup; actions: ActionsPluginSetup; - alerting: AlertingPluginSetup; + alerting: AlertingServerSetup; taskManager: TaskManagerSetupContract; ruleRegistry: RuleRegistryPluginSetupContract; } export interface FixtureStartDeps { - alerting: AlertingPluginsStart; + alerting: AlertingServerStart; encryptedSavedObjects: EncryptedSavedObjectsPluginStart; security?: SecurityPluginStart; spaces?: SpacesPluginStart; @@ -50,6 +48,35 @@ export interface FixtureStartDeps { notifications: NotificationsPluginStart; } +const testRuleTypes = [ + 'test.always-firing', + 'test.cumulative-firing', + 'test.never-firing', + 'test.failing', + 'test.authorization', + 'test.delayed', + 'test.validation', + 'test.onlyContextVariables', + 'test.onlyStateVariables', + 'test.noop', + 'test.unrestricted-noop', + 'test.patternFiring', + 'test.patternSuccessOrFailure', + 'test.throw', + 'test.longRunning', + 'test.exceedsAlertLimit', + 'test.always-firing-alert-as-data', + 'test.patternFiringAad', + 'test.waitingRule', + 'test.patternFiringAutoRecoverFalse', + 'test.severity', +]; + +const testAlertingFeatures = testRuleTypes.map((ruleTypeId) => ({ + ruleTypeId, + consumers: ['alertsFixture', ALERTING_FEATURE_ID], +})); + export class FixturePlugin implements Plugin { private readonly logger: Logger; @@ -72,30 +99,8 @@ export class FixturePlugin implements Plugin { const defaultStart = moment().utc().startOf('day').subtract(7, 'days').toISOString(); const defaultEnd = moment().utc().startOf('day').subtract(1, 'day').toISOString(); diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/bulk_untrack_by_query.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/bulk_untrack_by_query.ts index 794cb73677730..66d04b723ca03 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/bulk_untrack_by_query.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/bulk_untrack_by_query.ts @@ -130,7 +130,7 @@ export default function bulkUntrackByQueryTests({ getService }: FtrProviderConte }, }, ], - feature_ids: ['alertsFixture'], + rule_type_ids: ['test.always-firing-alert-as-data'], }); switch (scenario.id) { diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/create.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/create.ts index 95e6f7043c90b..d0716df4e2db9 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/create.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/create.ts @@ -261,18 +261,11 @@ export default function createAlertTests({ getService }: FtrProviderContext) { switch (scenario.id) { case 'no_kibana_privileges at space1': case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: getUnauthorizedErrorMessage('create', 'test.noop', 'alerts'), - statusCode: 403, - }); - break; case 'global_read at space1': expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage('create', 'test.noop', 'alertsFixture'), + message: getUnauthorizedErrorMessage('create', 'test.noop', 'alerts'), statusCode: 403, }); break; diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/delete.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/delete.ts index d6cb57261a558..6814ed46c42b3 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/delete.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/delete.ts @@ -219,7 +219,7 @@ export default function createDeleteTests({ getService }: FtrProviderContext) { expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage('delete', 'test.noop', 'alertsFixture'), + message: getUnauthorizedErrorMessage('delete', 'test.noop', 'alerts'), statusCode: 403, }); objectRemover.add(space.id, createdAlert.id, 'rule', 'alerting'); diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/disable.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/disable.ts index 264df417440f3..aa43d52d60ad4 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/disable.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/disable.ts @@ -255,18 +255,11 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte switch (scenario.id) { case 'no_kibana_privileges at space1': case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: getUnauthorizedErrorMessage('disable', 'test.noop', 'alerts'), - statusCode: 403, - }); - break; case 'global_read at space1': expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage('disable', 'test.noop', 'alertsFixture'), + message: getUnauthorizedErrorMessage('disable', 'test.noop', 'alerts'), statusCode: 403, }); break; diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/enable.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/enable.ts index 581f6f13a63b7..eef6ff320a828 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/enable.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/enable.ts @@ -246,18 +246,11 @@ export default function createEnableAlertTests({ getService }: FtrProviderContex switch (scenario.id) { case 'no_kibana_privileges at space1': case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: getUnauthorizedErrorMessage('enable', 'test.noop', 'alerts'), - statusCode: 403, - }); - break; case 'global_read at space1': expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage('enable', 'test.noop', 'alertsFixture'), + message: getUnauthorizedErrorMessage('enable', 'test.noop', 'alerts'), statusCode: 403, }); break; diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find.ts index bf5595e5756c1..da74893f81713 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find.ts @@ -8,12 +8,7 @@ import expect from '@kbn/expect'; import { chunk, omit } from 'lodash'; import { v4 as uuidv4 } from 'uuid'; -import { - ES_QUERY_ID, - ML_ANOMALY_DETECTION_RULE_TYPE_ID, - OBSERVABILITY_THRESHOLD_RULE_TYPE_ID, -} from '@kbn/rule-data-utils'; -import { SuperuserAtSpace1, UserAtSpaceScenarios, StackAlertsOnly } from '../../../scenarios'; +import { SuperuserAtSpace1, UserAtSpaceScenarios } from '../../../scenarios'; import { getUrlPrefix, getTestRuleData, ObjectRemover } from '../../../../common/lib'; import { FtrProviderContext } from '../../../../common/ftr_provider_context'; @@ -614,120 +609,5 @@ export default function createFindTests({ getService }: FtrProviderContext) { ]); }); }); - - describe('stack alerts', () => { - const ruleTypes = [ - [ - ES_QUERY_ID, - { - searchType: 'esQuery', - timeWindowSize: 5, - timeWindowUnit: 'm', - threshold: [1000], - thresholdComparator: '>', - size: 100, - esQuery: '{\n "query":{\n "match_all" : {}\n }\n }', - aggType: 'count', - groupBy: 'all', - termSize: 5, - excludeHitsFromPreviousRun: false, - sourceFields: [], - index: ['.kibana'], - timeField: 'created_at', - }, - ], - [ - OBSERVABILITY_THRESHOLD_RULE_TYPE_ID, - { - criteria: [ - { - comparator: '>', - metrics: [ - { - name: 'A', - aggType: 'count', - }, - ], - threshold: [100], - timeSize: 1, - timeUnit: 'm', - }, - ], - alertOnNoData: false, - alertOnGroupDisappear: false, - searchConfiguration: { - query: { - query: '', - language: 'kuery', - }, - index: 'kibana-event-log-data-view', - }, - }, - ], - [ - ML_ANOMALY_DETECTION_RULE_TYPE_ID, - { - severity: 75, - resultType: 'bucket', - includeInterim: false, - jobSelection: { - jobIds: ['low_request_rate'], - }, - }, - ], - ]; - - const createRule = async (rule = {}) => { - const { body: createdAlert } = await supertest - .post(`${getUrlPrefix('space1')}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send(getTestRuleData({ ...rule })) - .expect(200); - - objectRemover.add('space1', createdAlert.id, 'rule', 'alerting'); - }; - - for (const [ruleTypeId, params] of ruleTypes) { - it(`should get rules of ${ruleTypeId} rule type ID and stackAlerts consumer`, async () => { - /** - * We create two rules. The first one is a test.noop - * rule with stackAlerts as consumer. The second rule - * is has different rule type ID but with the same consumer as the first rule (stackAlerts). - * This way we can verify that the find API call returns only the rules the user is authorized to. - * Specifically only the second rule because the StackAlertsOnly user does not have - * access to the test.noop rule type. - */ - await createRule({ consumer: 'stackAlerts' }); - await createRule({ rule_type_id: ruleTypeId, params, consumer: 'stackAlerts' }); - - const response = await supertestWithoutAuth - .get(`${getUrlPrefix('space1')}/api/alerting/rules/_find`) - .auth(StackAlertsOnly.username, StackAlertsOnly.password); - - expect(response.statusCode).to.eql(200); - expect(response.body.total).to.equal(1); - expect(response.body.data[0].rule_type_id).to.equal(ruleTypeId); - expect(response.body.data[0].consumer).to.equal('stackAlerts'); - }); - } - - for (const [ruleTypeId, params] of ruleTypes) { - it(`should NOT get rules of ${ruleTypeId} rule type ID and NOT stackAlerts consumer`, async () => { - /** - * We create two rules with logs as consumer. The user is authorized to - * access rules only with the stackAlerts consumers. - */ - await createRule({ consumer: 'logs' }); - await createRule({ rule_type_id: ruleTypeId, params, consumer: 'logs' }); - - const response = await supertestWithoutAuth - .get(`${getUrlPrefix('space1')}/api/alerting/rules/_find`) - .auth(StackAlertsOnly.username, StackAlertsOnly.password); - - expect(response.statusCode).to.eql(200); - expect(response.body.total).to.equal(0); - }); - } - }); }); } diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find_internal.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find_internal.ts index ee8d49c662ada..751d5cf169836 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find_internal.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find_internal.ts @@ -13,7 +13,13 @@ import { ML_ANOMALY_DETECTION_RULE_TYPE_ID, OBSERVABILITY_THRESHOLD_RULE_TYPE_ID, } from '@kbn/rule-data-utils'; -import { SuperuserAtSpace1, UserAtSpaceScenarios, StackAlertsOnly } from '../../../scenarios'; +import { Space } from '../../../../common/types'; +import { + Space1AllAtSpace1, + StackAlertsOnly, + SuperuserAtSpace1, + UserAtSpaceScenarios, +} from '../../../scenarios'; import { getUrlPrefix, getTestRuleData, ObjectRemover } from '../../../../common/lib'; import { FtrProviderContext } from '../../../../common/ftr_provider_context'; @@ -31,40 +37,13 @@ export default function createFindTests({ getService }: FtrProviderContext) { for (const scenario of UserAtSpaceScenarios) { const { user, space } = scenario; + describe(scenario.id, () => { it('should handle find alert request appropriately', async () => { - const { body: createdAction } = await supertest - .post(`${getUrlPrefix(space.id)}/api/actions/connector`) - .set('kbn-xsrf', 'foo') - .send({ - name: 'MY action', - connector_type_id: 'test.noop', - config: {}, - secrets: {}, - }) - .expect(200); - const { body: createdAlert } = await supertest .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) .set('kbn-xsrf', 'foo') - .send( - getTestRuleData({ - actions: [ - { - group: 'default', - id: createdAction.id, - params: {}, - frequency: { - summary: false, - notify_when: 'onThrottleInterval', - throttle: '1m', - }, - }, - ], - notify_when: undefined, - throttle: undefined, - }) - ) + .send(getTestRuleData()) .expect(200); objectRemover.add(space.id, createdAlert.id, 'rule', 'alerting'); @@ -108,37 +87,23 @@ export default function createFindTests({ getService }: FtrProviderContext) { consumer: 'alertsFixture', schedule: { interval: '1m' }, enabled: true, - actions: [ - { - group: 'default', - id: createdAction.id, - connector_type_id: 'test.noop', - params: {}, - uuid: match.actions[0].uuid, - frequency: { - summary: false, - notify_when: 'onThrottleInterval', - throttle: '1m', - }, - }, - ], + actions: [], params: {}, created_by: 'elastic', + api_key_created_by_user: false, + revision: 0, scheduled_task_id: match.scheduled_task_id, created_at: match.created_at, updated_at: match.updated_at, - throttle: null, - notify_when: null, + throttle: '1m', + notify_when: 'onThrottleInterval', updated_by: 'elastic', api_key_owner: 'elastic', - api_key_created_by_user: false, mute_all: false, muted_alert_ids: [], - revision: 0, execution_status: match.execution_status, ...(match.next_run ? { next_run: match.next_run } : {}), ...(match.last_run ? { last_run: match.last_run } : {}), - monitoring: match.monitoring, snooze_schedule: match.snooze_schedule, ...(hasActiveSnoozes && { active_snoozes: activeSnoozes }), @@ -153,40 +118,15 @@ export default function createFindTests({ getService }: FtrProviderContext) { }); it('should filter out types that the user is not authorized to `get` retaining pagination', async () => { - async function createNoOpAlert(overrides = {}) { - const alert = getTestRuleData(overrides); - const { body: createdAlert } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send(alert) - .expect(200); - objectRemover.add(space.id, createdAlert.id, 'rule', 'alerting'); - return { - id: createdAlert.id, - rule_type_id: alert.rule_type_id, - }; - } - function createRestrictedNoOpAlert() { - return createNoOpAlert({ - rule_type_id: 'test.restricted-noop', - consumer: 'alertsRestrictedFixture', - }); - } - function createUnrestrictedNoOpAlert() { - return createNoOpAlert({ - rule_type_id: 'test.unrestricted-noop', - consumer: 'alertsFixture', - }); - } const allAlerts = []; - allAlerts.push(await createNoOpAlert()); - allAlerts.push(await createNoOpAlert()); - allAlerts.push(await createRestrictedNoOpAlert()); - allAlerts.push(await createUnrestrictedNoOpAlert()); - allAlerts.push(await createUnrestrictedNoOpAlert()); - allAlerts.push(await createRestrictedNoOpAlert()); - allAlerts.push(await createNoOpAlert()); - allAlerts.push(await createNoOpAlert()); + allAlerts.push(await createNoOpAlert(space)); + allAlerts.push(await createNoOpAlert(space)); + allAlerts.push(await createRestrictedNoOpAlert(space)); + allAlerts.push(await createUnrestrictedNoOpAlert(space)); + allAlerts.push(await createUnrestrictedNoOpAlert(space)); + allAlerts.push(await createRestrictedNoOpAlert(space)); + allAlerts.push(await createNoOpAlert(space)); + allAlerts.push(await createNoOpAlert(space)); const perPage = 4; @@ -233,25 +173,24 @@ export default function createFindTests({ getService }: FtrProviderContext) { expect(response.body.per_page).to.be.equal(perPage); expect(response.body.total).to.be.equal(8); - { - const [firstPage, secondPage] = chunk( - allAlerts.map((alert) => alert.id), - perPage - ); - expect(response.body.data.map((alert: any) => alert.id)).to.eql(firstPage); - - const secondResponse = await supertestWithoutAuth - .post(`${getUrlPrefix(space.id)}/internal/alerting/rules/_find`) - .set('kbn-xsrf', 'foo') - .auth(user.username, user.password) - .send({ - per_page: perPage, - sort_field: 'createdAt', - page: 2, - }); - - expect(secondResponse.body.data.map((alert: any) => alert.id)).to.eql(secondPage); - } + const [firstPage, secondPage] = chunk( + allAlerts.map((alert) => alert.id), + perPage + ); + expect(response.body.data.map((alert: any) => alert.id)).to.eql(firstPage); + + const secondResponse = await supertestWithoutAuth + .post(`${getUrlPrefix(space.id)}/internal/alerting/rules/_find`) + .set('kbn-xsrf', 'foo') + .auth(user.username, user.password) + .send({ + per_page: perPage, + sort_field: 'createdAt', + page: '2', + }); + + expect(secondResponse.statusCode).to.eql(200); + expect(secondResponse.body.data.map((alert: any) => alert.id)).to.eql(secondPage); break; default: @@ -294,7 +233,7 @@ export default function createFindTests({ getService }: FtrProviderContext) { .set('kbn-xsrf', 'foo') .auth(user.username, user.password) .send({ - filter: 'alert.attributes.actions:{ actionTypeId: test.noop }', + filter: 'alert.attributes.actions:{ actionTypeId: "test.noop" }', }); switch (scenario.id) { @@ -334,13 +273,14 @@ export default function createFindTests({ getService }: FtrProviderContext) { group: 'default', connector_type_id: 'test.noop', params: {}, - uuid: createdAlert.actions[0].uuid, + uuid: match.actions[0].uuid, }, ], params: {}, created_by: 'elastic', - throttle: '1m', api_key_created_by_user: null, + revision: 0, + throttle: '1m', updated_by: 'elastic', api_key_owner: null, mute_all: false, @@ -349,7 +289,6 @@ export default function createFindTests({ getService }: FtrProviderContext) { created_at: match.created_at, updated_at: match.updated_at, execution_status: match.execution_status, - revision: 0, ...(match.next_run ? { next_run: match.next_run } : {}), ...(match.last_run ? { last_run: match.last_run } : {}), monitoring: match.monitoring, @@ -577,73 +516,153 @@ export default function createFindTests({ getService }: FtrProviderContext) { throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); } }); + + it('should filter by rule type IDs correctly', async () => { + await createNoOpAlert(space); + await createRestrictedNoOpAlert(space); + await createUnrestrictedNoOpAlert(space); + + const perPage = 10; + const ruleTypeIds = ['test.restricted-noop', 'test.noop']; + + const response = await supertestWithoutAuth + .post(`${getUrlPrefix(space.id)}/internal/alerting/rules/_find`) + .set('kbn-xsrf', 'foo') + .auth(user.username, user.password) + .send({ + per_page: perPage, + sort_field: 'createdAt', + rule_type_ids: ruleTypeIds, + }); + + switch (scenario.id) { + case 'no_kibana_privileges at space1': + case 'space_1_all at space2': + expect(response.statusCode).to.eql(403); + expect(response.body).to.eql({ + error: 'Forbidden', + message: `Unauthorized to find rules for any rule types`, + statusCode: 403, + }); + break; + case 'space_1_all at space1': + case 'space_1_all_alerts_none_actions at space1': + expect(response.statusCode).to.eql(200); + expect(response.body.total).to.be.equal(1); + + expect( + response.body.data.every( + (rule: { rule_type_id: string }) => rule.rule_type_id === 'test.noop' + ) + ).to.be.eql(true); + break; + case 'global_read at space1': + case 'superuser at space1': + case 'space_1_all_with_restricted_fixture at space1': + expect(response.statusCode).to.eql(200); + expect(response.body.total).to.be.equal(2); + + expect( + response.body.data.every((rule: { rule_type_id: string }) => + ruleTypeIds.includes(rule.rule_type_id) + ) + ).to.be.eql(true); + break; + default: + throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); + } + }); }); } - describe('Actions', () => { - const { user, space } = SuperuserAtSpace1; + describe('filtering', () => { + it('should return the correct rules when trying to exploit RBAC through the ruleTypeIds parameter', async () => { + const { user, space } = Space1AllAtSpace1; - it('should return the actions correctly', async () => { - const { body: createdAction } = await supertest - .post(`${getUrlPrefix(space.id)}/api/actions/connector`) + const { body: createdAlert1 } = await supertest + .post(`${getUrlPrefix(SuperuserAtSpace1.space.id)}/api/alerting/rule`) .set('kbn-xsrf', 'foo') - .send({ - name: 'MY action', - connector_type_id: 'test.noop', - config: {}, - secrets: {}, - }) + .send( + getTestRuleData({ + rule_type_id: 'test.restricted-noop', + consumer: 'alertsRestrictedFixture', + }) + ) + .auth(SuperuserAtSpace1.user.username, SuperuserAtSpace1.user.password) .expect(200); - const { body: createdRule1 } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) + const { body: createdAlert2 } = await supertest + .post(`${getUrlPrefix(SuperuserAtSpace1.space.id)}/api/alerting/rule`) .set('kbn-xsrf', 'foo') .send( getTestRuleData({ - enabled: true, - actions: [ - { - id: createdAction.id, - group: 'default', - params: {}, - }, - { - id: 'system-connector-test.system-action', - params: {}, - }, - ], + rule_type_id: 'test.noop', + consumer: 'alertsFixture', }) ) + .auth(SuperuserAtSpace1.user.username, SuperuserAtSpace1.user.password) .expect(200); - objectRemover.add(space.id, createdRule1.id, 'rule', 'alerting'); + objectRemover.add(SuperuserAtSpace1.space.id, createdAlert1.id, 'rule', 'alerting'); + objectRemover.add(SuperuserAtSpace1.space.id, createdAlert2.id, 'rule', 'alerting'); const response = await supertestWithoutAuth - .get(`${getUrlPrefix(space.id)}/api/alerting/rules/_find`) + .post(`${getUrlPrefix(space.id)}/internal/alerting/rules/_find`) .set('kbn-xsrf', 'foo') - .auth(user.username, user.password); + .auth(user.username, user.password) + .send({ + rule_type_ids: ['test.noop', 'test.restricted-noop'], + }); - const action = response.body.data[0].actions[0]; - const systemAction = response.body.data[0].actions[1]; - const { uuid, ...restAction } = action; - const { uuid: systemActionUuid, ...restSystemAction } = systemAction; + expect(response.status).to.eql(200); + expect(response.body.total).to.equal(1); + expect(response.body.data[0].rule_type_id).to.eql('test.noop'); + }); - expect([restAction, restSystemAction]).to.eql([ - { - id: createdAction.id, - connector_type_id: 'test.noop', - group: 'default', - params: {}, - }, - { - id: 'system-connector-test.system-action', - connector_type_id: 'test.system-action', - params: {}, - }, - , - ]); + it('should return the correct rules when trying to exploit RBAC through the consumers parameter', async () => { + const { user, space } = Space1AllAtSpace1; + + const { body: createdAlert1 } = await supertest + .post(`${getUrlPrefix(SuperuserAtSpace1.space.id)}/api/alerting/rule`) + .set('kbn-xsrf', 'foo') + .send( + getTestRuleData({ + rule_type_id: 'test.restricted-noop', + consumer: 'alertsRestrictedFixture', + }) + ) + .auth(SuperuserAtSpace1.user.username, SuperuserAtSpace1.user.password) + .expect(200); + + const { body: createdAlert2 } = await supertest + .post(`${getUrlPrefix(SuperuserAtSpace1.space.id)}/api/alerting/rule`) + .set('kbn-xsrf', 'foo') + .send( + getTestRuleData({ + rule_type_id: 'test.noop', + consumer: 'alertsFixture', + }) + ) + .auth(SuperuserAtSpace1.user.username, SuperuserAtSpace1.user.password) + .expect(200); + + objectRemover.add(SuperuserAtSpace1.space.id, createdAlert1.id, 'rule', 'alerting'); + objectRemover.add(SuperuserAtSpace1.space.id, createdAlert2.id, 'rule', 'alerting'); + + const response = await supertestWithoutAuth + .post(`${getUrlPrefix(space.id)}/internal/alerting/rules/_find`) + .set('kbn-xsrf', 'foo') + .auth(user.username, user.password) + .send({ + consumers: ['alertsFixture', 'alertsRestrictedFixture'], + }); + + expect(response.status).to.eql(200); + expect(response.body.total).to.equal(1); + expect(response.body.data[0].consumer).to.eql('alertsFixture'); }); }); + describe('stack alerts', () => { const ruleTypes = [ [ @@ -758,5 +777,35 @@ export default function createFindTests({ getService }: FtrProviderContext) { }); } }); + + async function createNoOpAlert(space: Space, overrides = {}) { + const alert = getTestRuleData(overrides); + const { body: createdAlert } = await supertest + .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) + .set('kbn-xsrf', 'foo') + .send(alert) + .expect(200); + + objectRemover.add(space.id, createdAlert.id, 'rule', 'alerting'); + + return { + id: createdAlert.id, + rule_type_id: alert.rule_type_id, + }; + } + + function createRestrictedNoOpAlert(space: Space) { + return createNoOpAlert(space, { + rule_type_id: 'test.restricted-noop', + consumer: 'alertsRestrictedFixture', + }); + } + + function createUnrestrictedNoOpAlert(space: Space) { + return createNoOpAlert(space, { + rule_type_id: 'test.unrestricted-noop', + consumer: 'alertsFixture', + }); + } }); } diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find_with_post.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find_with_post.ts deleted file mode 100644 index c8afff8fcc476..0000000000000 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find_with_post.ts +++ /dev/null @@ -1,593 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import expect from '@kbn/expect'; -import { Agent as SuperTestAgent } from 'supertest'; -import { chunk, omit } from 'lodash'; -import { v4 as uuidv4 } from 'uuid'; -import { SupertestWithoutAuthProviderType } from '@kbn/ftr-common-functional-services'; -import { UserAtSpaceScenarios } from '../../../scenarios'; -import { getUrlPrefix, getTestRuleData, ObjectRemover } from '../../../../common/lib'; -import { FtrProviderContext } from '../../../../common/ftr_provider_context'; - -const findTestUtils = ( - describeType: 'internal' | 'public', - objectRemover: ObjectRemover, - supertest: SuperTestAgent, - supertestWithoutAuth: SupertestWithoutAuthProviderType -) => { - describe(describeType, () => { - afterEach(async () => { - await objectRemover.removeAll(); - }); - - for (const scenario of UserAtSpaceScenarios) { - const { user, space } = scenario; - describe(scenario.id, () => { - it('should handle find alert request appropriately', async () => { - const { body: createdAlert } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send(getTestRuleData()) - .expect(200); - objectRemover.add(space.id, createdAlert.id, 'rule', 'alerting'); - - const response = await supertestWithoutAuth - .post( - `${getUrlPrefix(space.id)}/${ - describeType === 'public' ? 'api' : 'internal' - }/alerting/rules/_find` - ) - .set('kbn-xsrf', 'foo') - .auth(user.username, user.password) - .send({ - search: 'test.noop', - search_fields: 'alertTypeId', - }); - - switch (scenario.id) { - case 'no_kibana_privileges at space1': - case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: `Unauthorized to find rules for any rule types`, - statusCode: 403, - }); - break; - case 'global_read at space1': - case 'superuser at space1': - case 'space_1_all at space1': - case 'space_1_all_alerts_none_actions at space1': - case 'space_1_all_with_restricted_fixture at space1': - expect(response.statusCode).to.eql(200); - expect(response.body.page).to.equal(1); - expect(response.body.per_page).to.be.greaterThan(0); - expect(response.body.total).to.be.greaterThan(0); - const match = response.body.data.find((obj: any) => obj.id === createdAlert.id); - const activeSnoozes = match.active_snoozes; - const hasActiveSnoozes = !!(activeSnoozes || []).filter((obj: any) => obj).length; - expect(match).to.eql({ - id: createdAlert.id, - name: 'abc', - tags: ['foo'], - rule_type_id: 'test.noop', - running: match.running ?? false, - consumer: 'alertsFixture', - schedule: { interval: '1m' }, - enabled: true, - actions: [], - params: {}, - created_by: 'elastic', - api_key_created_by_user: false, - revision: 0, - scheduled_task_id: match.scheduled_task_id, - created_at: match.created_at, - updated_at: match.updated_at, - throttle: '1m', - notify_when: 'onThrottleInterval', - updated_by: 'elastic', - api_key_owner: 'elastic', - mute_all: false, - muted_alert_ids: [], - execution_status: match.execution_status, - ...(match.next_run ? { next_run: match.next_run } : {}), - ...(match.last_run ? { last_run: match.last_run } : {}), - ...(describeType === 'internal' - ? { - monitoring: match.monitoring, - snooze_schedule: match.snooze_schedule, - ...(hasActiveSnoozes && { active_snoozes: activeSnoozes }), - is_snoozed_until: null, - } - : {}), - }); - expect(Date.parse(match.created_at)).to.be.greaterThan(0); - expect(Date.parse(match.updated_at)).to.be.greaterThan(0); - break; - default: - throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); - } - }); - - it('should filter out types that the user is not authorized to `get` retaining pagination', async () => { - async function createNoOpAlert(overrides = {}) { - const alert = getTestRuleData(overrides); - const { body: createdAlert } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send(alert) - .expect(200); - objectRemover.add(space.id, createdAlert.id, 'rule', 'alerting'); - return { - id: createdAlert.id, - rule_type_id: alert.rule_type_id, - }; - } - function createRestrictedNoOpAlert() { - return createNoOpAlert({ - rule_type_id: 'test.restricted-noop', - consumer: 'alertsRestrictedFixture', - }); - } - function createUnrestrictedNoOpAlert() { - return createNoOpAlert({ - rule_type_id: 'test.unrestricted-noop', - consumer: 'alertsFixture', - }); - } - const allAlerts = []; - allAlerts.push(await createNoOpAlert()); - allAlerts.push(await createNoOpAlert()); - allAlerts.push(await createRestrictedNoOpAlert()); - allAlerts.push(await createUnrestrictedNoOpAlert()); - allAlerts.push(await createUnrestrictedNoOpAlert()); - allAlerts.push(await createRestrictedNoOpAlert()); - allAlerts.push(await createNoOpAlert()); - allAlerts.push(await createNoOpAlert()); - - const perPage = 4; - - const response = await supertestWithoutAuth - .post( - `${getUrlPrefix(space.id)}/${ - describeType === 'public' ? 'api' : 'internal' - }/alerting/rules/_find` - ) - .set('kbn-xsrf', 'foo') - .auth(user.username, user.password) - .send({ - per_page: perPage, - sort_field: 'createdAt', - }); - - switch (scenario.id) { - case 'no_kibana_privileges at space1': - case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: `Unauthorized to find rules for any rule types`, - statusCode: 403, - }); - break; - case 'space_1_all at space1': - case 'space_1_all_alerts_none_actions at space1': - expect(response.statusCode).to.eql(200); - expect(response.body.page).to.equal(1); - expect(response.body.per_page).to.be.equal(perPage); - expect(response.body.total).to.be.equal(6); - { - const [firstPage] = chunk( - allAlerts - .filter((alert) => alert.rule_type_id !== 'test.restricted-noop') - .map((alert) => alert.id), - perPage - ); - expect(response.body.data.map((alert: any) => alert.id)).to.eql(firstPage); - } - break; - case 'global_read at space1': - case 'superuser at space1': - case 'space_1_all_with_restricted_fixture at space1': - expect(response.statusCode).to.eql(200); - expect(response.body.page).to.equal(1); - expect(response.body.per_page).to.be.equal(perPage); - expect(response.body.total).to.be.equal(8); - - { - const [firstPage, secondPage] = chunk( - allAlerts.map((alert) => alert.id), - perPage - ); - expect(response.body.data.map((alert: any) => alert.id)).to.eql(firstPage); - - const secondResponse = await supertestWithoutAuth - .post(`${getUrlPrefix(space.id)}/internal/alerting/rules/_find`) - .set('kbn-xsrf', 'kibana') - .auth(user.username, user.password) - .send({ - per_page: perPage, - sort_field: 'createdAt', - page: 2, - }); - - expect(secondResponse.body.data.map((alert: any) => alert.id)).to.eql(secondPage); - } - - break; - default: - throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); - } - }); - - it('should handle find alert request with filter appropriately', async () => { - const { body: createdAction } = await supertest - .post(`${getUrlPrefix(space.id)}/api/actions/connector`) - .set('kbn-xsrf', 'foo') - .send({ - name: 'My action', - connector_type_id: 'test.noop', - config: {}, - secrets: {}, - }) - .expect(200); - - const { body: createdAlert } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send( - getTestRuleData({ - enabled: false, - actions: [ - { - id: createdAction.id, - group: 'default', - params: {}, - }, - ], - }) - ) - .expect(200); - objectRemover.add(space.id, createdAlert.id, 'rule', 'alerting'); - - const response = await supertestWithoutAuth - .post( - `${getUrlPrefix(space.id)}/${ - describeType === 'public' ? 'api' : 'internal' - }/alerting/rules/_find` - ) - .set('kbn-xsrf', 'foo') - .auth(user.username, user.password) - .send({ - filter: 'alert.attributes.actions:{ actionTypeId: "test.noop" }', - }); - - switch (scenario.id) { - case 'no_kibana_privileges at space1': - case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: `Unauthorized to find rules for any rule types`, - statusCode: 403, - }); - break; - case 'global_read at space1': - case 'superuser at space1': - case 'space_1_all at space1': - case 'space_1_all_alerts_none_actions at space1': - case 'space_1_all_with_restricted_fixture at space1': - expect(response.statusCode).to.eql(200); - expect(response.body.page).to.equal(1); - expect(response.body.per_page).to.be.greaterThan(0); - expect(response.body.total).to.be.greaterThan(0); - const match = response.body.data.find((obj: any) => obj.id === createdAlert.id); - const activeSnoozes = match.active_snoozes; - const hasActiveSnoozes = !!(activeSnoozes || []).filter((obj: any) => obj).length; - expect(match).to.eql({ - id: createdAlert.id, - name: 'abc', - tags: ['foo'], - rule_type_id: 'test.noop', - running: match.running ?? false, - consumer: 'alertsFixture', - schedule: { interval: '1m' }, - enabled: false, - actions: [ - { - id: createdAction.id, - group: 'default', - connector_type_id: 'test.noop', - params: {}, - uuid: match.actions[0].uuid, - }, - ], - params: {}, - created_by: 'elastic', - api_key_created_by_user: null, - revision: 0, - throttle: '1m', - updated_by: 'elastic', - api_key_owner: null, - mute_all: false, - muted_alert_ids: [], - notify_when: 'onThrottleInterval', - created_at: match.created_at, - updated_at: match.updated_at, - execution_status: match.execution_status, - ...(match.next_run ? { next_run: match.next_run } : {}), - ...(match.last_run ? { last_run: match.last_run } : {}), - ...(describeType === 'internal' - ? { - monitoring: match.monitoring, - snooze_schedule: match.snooze_schedule, - ...(hasActiveSnoozes && { active_snoozes: activeSnoozes }), - is_snoozed_until: null, - } - : {}), - }); - expect(Date.parse(match.created_at)).to.be.greaterThan(0); - expect(Date.parse(match.updated_at)).to.be.greaterThan(0); - break; - default: - throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); - } - }); - - it('should handle find alert request with fields appropriately', async () => { - const myTag = uuidv4(); - const { body: createdAlert } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send( - getTestRuleData({ - enabled: false, - tags: [myTag], - rule_type_id: 'test.restricted-noop', - consumer: 'alertsRestrictedFixture', - }) - ) - .expect(200); - objectRemover.add(space.id, createdAlert.id, 'rule', 'alerting'); - - // create another type with same tag - const { body: createdSecondAlert } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send( - getTestRuleData({ - tags: [myTag], - rule_type_id: 'test.restricted-noop', - consumer: 'alertsRestrictedFixture', - }) - ) - .expect(200); - objectRemover.add(space.id, createdSecondAlert.id, 'rule', 'alerting'); - - const response = await supertestWithoutAuth - .post( - `${getUrlPrefix(space.id)}/${ - describeType === 'public' ? 'api' : 'internal' - }/alerting/rules/_find` - ) - .set('kbn-xsrf', 'foo') - .auth(user.username, user.password) - .send({ - filter: 'alert.attributes.alertTypeId:test.restricted-noop', - fields: ['tags'], - sort_field: 'createdAt', - }); - - switch (scenario.id) { - case 'no_kibana_privileges at space1': - case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: `Unauthorized to find rules for any rule types`, - statusCode: 403, - }); - break; - case 'space_1_all at space1': - case 'space_1_all_alerts_none_actions at space1': - expect(response.statusCode).to.eql(200); - expect(response.body.data).to.eql([]); - break; - case 'global_read at space1': - case 'superuser at space1': - case 'space_1_all_with_restricted_fixture at space1': - expect(response.statusCode).to.eql(200); - expect(response.body.page).to.equal(1); - expect(response.body.per_page).to.be.greaterThan(0); - expect(response.body.total).to.be.greaterThan(0); - const [matchFirst, matchSecond] = response.body.data; - expect(omit(matchFirst, 'updatedAt')).to.eql({ - id: createdAlert.id, - actions: [], - tags: [myTag], - ...(describeType === 'internal' && { - snooze_schedule: [], - is_snoozed_until: null, - }), - }); - expect(omit(matchSecond, 'updatedAt')).to.eql({ - id: createdSecondAlert.id, - actions: [], - tags: [myTag], - ...(describeType === 'internal' && { - snooze_schedule: [], - is_snoozed_until: null, - }), - }); - break; - default: - throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); - } - }); - - it('should handle find alert request with executionStatus field appropriately', async () => { - const myTag = uuidv4(); - const { body: createdAlert } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send( - getTestRuleData({ - enabled: false, - tags: [myTag], - rule_type_id: 'test.restricted-noop', - consumer: 'alertsRestrictedFixture', - }) - ) - .expect(200); - objectRemover.add(space.id, createdAlert.id, 'rule', 'alerting'); - - // create another type with same tag - const { body: createdSecondAlert } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send( - getTestRuleData({ - tags: [myTag], - rule_type_id: 'test.restricted-noop', - consumer: 'alertsRestrictedFixture', - }) - ) - .expect(200); - objectRemover.add(space.id, createdSecondAlert.id, 'rule', 'alerting'); - - const response = await supertestWithoutAuth - .post( - `${getUrlPrefix(space.id)}/${ - describeType === 'public' ? 'api' : 'internal' - }/alerting/rules/_find` - ) - .set('kbn-xsrf', 'foo') - .auth(user.username, user.password) - .send({ - filter: 'alert.attributes.alertTypeId:test.restricted-noop', - fields: ['tags', 'executionStatus'], - sort_field: 'createdAt', - }); - - switch (scenario.id) { - case 'no_kibana_privileges at space1': - case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: `Unauthorized to find rules for any rule types`, - statusCode: 403, - }); - break; - case 'space_1_all at space1': - case 'space_1_all_alerts_none_actions at space1': - expect(response.statusCode).to.eql(200); - expect(response.body.data).to.eql([]); - break; - case 'global_read at space1': - case 'superuser at space1': - case 'space_1_all_with_restricted_fixture at space1': - expect(response.statusCode).to.eql(200); - expect(response.body.page).to.equal(1); - expect(response.body.per_page).to.be.greaterThan(0); - expect(response.body.total).to.be.greaterThan(0); - const [matchFirst, matchSecond] = response.body.data; - expect(omit(matchFirst, 'updatedAt')).to.eql({ - id: createdAlert.id, - actions: [], - tags: [myTag], - execution_status: matchFirst.execution_status, - ...(describeType === 'internal' && { - snooze_schedule: [], - is_snoozed_until: null, - }), - }); - expect(omit(matchSecond, 'updatedAt')).to.eql({ - id: createdSecondAlert.id, - actions: [], - tags: [myTag], - execution_status: matchSecond.execution_status, - ...(describeType === 'internal' && { - snooze_schedule: [], - is_snoozed_until: null, - }), - }); - break; - default: - throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); - } - }); - - it(`shouldn't find alert from another space`, async () => { - const { body: createdAlert } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send(getTestRuleData()) - .expect(200); - objectRemover.add(space.id, createdAlert.id, 'rule', 'alerting'); - - const response = await supertestWithoutAuth - .post( - `${getUrlPrefix('other')}/${ - describeType === 'public' ? 'api' : 'internal' - }/alerting/rules/_find` - ) - .set('kbn-xsrf', 'foo') - .auth(user.username, user.password) - .send({ - search: 'test.noop', - search_fields: 'alertTypeId', - }); - - switch (scenario.id) { - case 'no_kibana_privileges at space1': - case 'space_1_all at space2': - case 'space_1_all at space1': - case 'space_1_all_alerts_none_actions at space1': - case 'space_1_all_with_restricted_fixture at space1': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: `Unauthorized to find rules for any rule types`, - statusCode: 403, - }); - break; - case 'global_read at space1': - case 'superuser at space1': - expect(response.statusCode).to.eql(200); - expect(response.body).to.eql({ - page: 1, - per_page: 10, - total: 0, - data: [], - }); - break; - default: - throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); - } - }); - }); - } - }); -}; - -// eslint-disable-next-line import/no-default-export -export default function createFindTests({ getService }: FtrProviderContext) { - const supertest = getService('supertest'); - const supertestWithoutAuth = getService('supertestWithoutAuth'); - - describe('find with post', () => { - const objectRemover = new ObjectRemover(supertest); - - afterEach(async () => { - await objectRemover.removeAll(); - }); - - findTestUtils('internal', objectRemover, supertest, supertestWithoutAuth); - }); -} diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/get.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/get.ts index 78c662d98a541..c1872d1e40213 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/get.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/get.ts @@ -223,23 +223,12 @@ const getTestUtils = ( switch (scenario.id) { case 'no_kibana_privileges at space1': case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: getUnauthorizedErrorMessage('get', 'test.restricted-noop', 'alerts'), - statusCode: 403, - }); - break; case 'space_1_all at space1': case 'space_1_all_alerts_none_actions at space1': expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage( - 'get', - 'test.restricted-noop', - 'alertsRestrictedFixture' - ), + message: getUnauthorizedErrorMessage('get', 'test.restricted-noop', 'alerts'), statusCode: 403, }); break; diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/index.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/index.ts index 262fe8af301c8..dc85feb741eb8 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/index.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/index.ts @@ -23,7 +23,6 @@ export default function alertingTests({ loadTestFile, getService }: FtrProviderC loadTestFile(require.resolve('./backfill')); loadTestFile(require.resolve('./find')); loadTestFile(require.resolve('./find_internal')); - loadTestFile(require.resolve('./find_with_post')); loadTestFile(require.resolve('./create')); loadTestFile(require.resolve('./delete')); loadTestFile(require.resolve('./disable')); diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/aggregate.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/aggregate.ts new file mode 100644 index 0000000000000..dde153aca402e --- /dev/null +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/aggregate.ts @@ -0,0 +1,377 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import expect from '@kbn/expect'; +import { Space, User } from '../../../../common/types'; +import { Space1AllAtSpace1, SuperuserAtSpace1, UserAtSpaceScenarios } from '../../../scenarios'; +import { getUrlPrefix, getTestRuleData, ObjectRemover, getEventLog } from '../../../../common/lib'; +import { FtrProviderContext } from '../../../../common/ftr_provider_context'; + +// eslint-disable-next-line import/no-default-export +export default function createAggregateTests({ getService }: FtrProviderContext) { + const supertest = getService('supertest'); + const supertestWithoutAuth = getService('supertestWithoutAuth'); + const retry = getService('retry'); + + const getEventLogWithRetry = async (id: string, space: Space) => { + await retry.try(async () => { + return await getEventLog({ + getService, + spaceId: space.id, + type: 'alert', + id, + provider: 'alerting', + actions: new Map([['execute', { equal: 1 }]]), + }); + }); + }; + + describe('aggregate', () => { + const objectRemover = new ObjectRemover(supertest); + + afterEach(async () => { + await objectRemover.removeAll(); + }); + + for (const scenario of UserAtSpaceScenarios) { + const { user, space } = scenario; + + describe(scenario.id, () => { + it('should aggregate alert status totals', async () => { + const NumOkAlerts = 4; + const NumActiveAlerts = 1; + const NumErrorAlerts = 2; + + const okAlertIds: string[] = []; + const activeAlertIds: string[] = []; + const errorAlertIds: string[] = []; + + await Promise.all( + [...Array(NumOkAlerts)].map(async () => { + const okAlertId = await createTestAlert( + { + /** + * The _aggregate calls is made + * to get all stats across all rule types + * that the user has access to. Only a subset + * of users have access to the test.restricted-noop/alertsRestrictedFixture + * pair. The differences in the stats ensure that even though we request + * the stats for all rule types only for the ones that the user has access to + * are returned. + * */ + rule_type_id: 'test.restricted-noop', + schedule: { interval: '24h' }, + consumer: 'alertsRestrictedFixture', + }, + space, + user + ); + + okAlertIds.push(okAlertId); + + objectRemover.add(space.id, okAlertId, 'rule', 'alerting'); + }) + ); + + await Promise.all(okAlertIds.map((id) => getEventLogWithRetry(id, space))); + + await Promise.all( + [...Array(NumActiveAlerts)].map(async () => { + const activeAlertId = await createTestAlert( + { + rule_type_id: 'test.patternFiring', + schedule: { interval: '24h' }, + params: { + pattern: { instance: new Array(100).fill(true) }, + }, + }, + space, + user + ); + + activeAlertIds.push(activeAlertId); + objectRemover.add(space.id, activeAlertId, 'rule', 'alerting'); + }) + ); + + await Promise.all(activeAlertIds.map((id) => getEventLogWithRetry(id, space))); + + await Promise.all( + [...Array(NumErrorAlerts)].map(async () => { + const errorAlertId = await createTestAlert( + { + rule_type_id: 'test.throw', + schedule: { interval: '24h' }, + }, + space, + user + ); + + errorAlertIds.push(errorAlertId); + objectRemover.add(space.id, errorAlertId, 'rule', 'alerting'); + }) + ); + + await Promise.all(errorAlertIds.map((id) => getEventLogWithRetry(id, space))); + + switch (scenario.id) { + case 'no_kibana_privileges at space1': + case 'space_1_all at space2': + await aggregate({ + space, + user, + expectedStatusCode: 403, + expectedResponse: { + error: 'Forbidden', + message: 'Unauthorized to find rules for any rule types', + statusCode: 403, + }, + }); + break; + case 'space_1_all at space1': + case 'space_1_all_alerts_none_actions at space1': + await aggregate({ + space, + user, + expectedStatusCode: 200, + expectedResponse: { + rule_enabled_status: { + disabled: 0, + enabled: 3, + }, + rule_execution_status: { + ok: 0, + active: NumActiveAlerts, + error: NumErrorAlerts, + pending: 0, + unknown: 0, + warning: 0, + }, + rule_last_run_outcome: { + succeeded: 1, + warning: 0, + failed: 2, + }, + rule_muted_status: { + muted: 0, + unmuted: 3, + }, + rule_snoozed_status: { + snoozed: 0, + }, + rule_tags: ['foo'], + }, + }); + break; + case 'global_read at space1': + case 'superuser at space1': + case 'space_1_all_with_restricted_fixture at space1': + await aggregate({ + space, + user, + expectedStatusCode: 200, + expectedResponse: { + rule_enabled_status: { + disabled: 0, + enabled: 7, + }, + rule_execution_status: { + ok: NumOkAlerts, + active: NumActiveAlerts, + error: NumErrorAlerts, + pending: 0, + unknown: 0, + warning: 0, + }, + rule_last_run_outcome: { + succeeded: 5, + warning: 0, + failed: 2, + }, + rule_muted_status: { + muted: 0, + unmuted: 7, + }, + rule_snoozed_status: { + snoozed: 0, + }, + rule_tags: ['foo'], + }, + }); + break; + default: + throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); + } + }); + }); + } + + describe('filtering', () => { + it('should return the correct rule stats when trying to exploit RBAC through the ruleTypeIds parameter', async () => { + const { user, space } = Space1AllAtSpace1; + + const okAlertId = await createTestAlert( + { + rule_type_id: 'test.restricted-noop', + schedule: { interval: '24h' }, + consumer: 'alertsRestrictedFixture', + }, + SuperuserAtSpace1.space, + SuperuserAtSpace1.user + ); + + const activeAlertId = await createTestAlert( + { + rule_type_id: 'test.patternFiring', + schedule: { interval: '24h' }, + params: { + pattern: { instance: new Array(100).fill(true) }, + }, + }, + SuperuserAtSpace1.space, + SuperuserAtSpace1.user + ); + + objectRemover.add(SuperuserAtSpace1.space.id, okAlertId, 'rule', 'alerting'); + objectRemover.add(SuperuserAtSpace1.space.id, activeAlertId, 'rule', 'alerting'); + + await aggregate({ + space, + user, + params: { rule_type_ids: ['test.restricted-noop', 'test.patternFiring'] }, + expectedStatusCode: 200, + expectedResponse: { + rule_enabled_status: { + disabled: 0, + enabled: 1, + }, + rule_execution_status: { + ok: 0, + active: 1, + error: 0, + pending: 0, + unknown: 0, + warning: 0, + }, + rule_last_run_outcome: { + succeeded: 1, + warning: 0, + failed: 0, + }, + rule_muted_status: { + muted: 0, + unmuted: 1, + }, + rule_snoozed_status: { + snoozed: 0, + }, + rule_tags: ['foo'], + }, + }); + }); + + it('should return the correct rule stats when trying to exploit RBAC through the consumer parameter', async () => { + const { user, space } = Space1AllAtSpace1; + + const okAlertId = await createTestAlert( + { + rule_type_id: 'test.restricted-noop', + schedule: { interval: '24h' }, + consumer: 'alertsRestrictedFixture', + }, + SuperuserAtSpace1.space, + SuperuserAtSpace1.user + ); + + const activeAlertId = await createTestAlert( + { + rule_type_id: 'test.patternFiring', + schedule: { interval: '24h' }, + params: { + pattern: { instance: new Array(100).fill(true) }, + }, + }, + SuperuserAtSpace1.space, + SuperuserAtSpace1.user + ); + + objectRemover.add(SuperuserAtSpace1.space.id, okAlertId, 'rule', 'alerting'); + objectRemover.add(SuperuserAtSpace1.space.id, activeAlertId, 'rule', 'alerting'); + + await aggregate({ + space, + user, + params: { consumers: ['alertsRestrictedFixture', 'alertsFixture'] }, + expectedStatusCode: 200, + expectedResponse: { + rule_enabled_status: { + disabled: 0, + enabled: 1, + }, + rule_execution_status: { + ok: 0, + active: 1, + error: 0, + pending: 0, + unknown: 0, + warning: 0, + }, + rule_last_run_outcome: { + succeeded: 1, + warning: 0, + failed: 0, + }, + rule_muted_status: { + muted: 0, + unmuted: 1, + }, + rule_snoozed_status: { + snoozed: 0, + }, + rule_tags: ['foo'], + }, + }); + }); + }); + }); + + async function createTestAlert(testAlertOverrides = {}, space: Space, user: User) { + const { body: createdAlert } = await supertest + .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) + .set('kbn-xsrf', 'foo') + .send(getTestRuleData(testAlertOverrides)) + .auth(user.username, user.password) + .expect(200); + + return createdAlert.id; + } + + const aggregate = async ({ + space, + user, + expectedStatusCode, + expectedResponse, + params = {}, + }: { + space: Space; + user: User; + expectedStatusCode: number; + expectedResponse: Record; + params?: Record; + }) => { + await retry.try(async () => { + const response = await supertestWithoutAuth + .post(`${getUrlPrefix(space.id)}/internal/alerting/rules/_aggregate`) + .set('kbn-xsrf', 'foo') + .auth(user.username, user.password) + .send(params); + + expect(response.status).to.eql(expectedStatusCode); + expect(response.body).to.eql(expectedResponse); + }); + }; +} diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/index.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/index.ts index a6f090030a6d4..ea834cbdb5027 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/index.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/index.ts @@ -19,6 +19,7 @@ export default function alertingTests({ loadTestFile, getService }: FtrProviderC await tearDown(getService); }); + loadTestFile(require.resolve('./aggregate')); loadTestFile(require.resolve('./mute_all')); loadTestFile(require.resolve('./mute_instance')); loadTestFile(require.resolve('./unmute_all')); diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/mute_all.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/mute_all.ts index c5be0877c89ff..a9b6bf42e55a3 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/mute_all.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/mute_all.ts @@ -252,11 +252,7 @@ export default function createMuteAlertTests({ getService }: FtrProviderContext) expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage( - 'muteAll', - 'test.restricted-noop', - 'alertsRestrictedFixture' - ), + message: getUnauthorizedErrorMessage('muteAll', 'test.restricted-noop', 'alerts'), statusCode: 403, }); break; diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/mute_instance.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/mute_instance.ts index b7cdf762836fe..1e3d99f5dd6a8 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/mute_instance.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/mute_instance.ts @@ -239,24 +239,13 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider switch (scenario.id) { case 'no_kibana_privileges at space1': case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: getUnauthorizedErrorMessage('muteAlert', 'test.restricted-noop', 'alerts'), - statusCode: 403, - }); - break; case 'global_read at space1': case 'space_1_all at space1': case 'space_1_all_alerts_none_actions at space1': expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage( - 'muteAlert', - 'test.restricted-noop', - 'alertsRestrictedFixture' - ), + message: getUnauthorizedErrorMessage('muteAlert', 'test.restricted-noop', 'alerts'), statusCode: 403, }); break; diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/unmute_all.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/unmute_all.ts index d038108d29f67..6c7f56b75eec6 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/unmute_all.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/unmute_all.ts @@ -259,6 +259,9 @@ export default function createUnmuteAlertTests({ getService }: FtrProviderContex switch (scenario.id) { case 'no_kibana_privileges at space1': case 'space_1_all at space2': + case 'global_read at space1': + case 'space_1_all at space1': + case 'space_1_all_alerts_none_actions at space1': expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', @@ -266,9 +269,6 @@ export default function createUnmuteAlertTests({ getService }: FtrProviderContex statusCode: 403, }); break; - case 'global_read at space1': - case 'space_1_all at space1': - case 'space_1_all_alerts_none_actions at space1': expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/unmute_instance.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/unmute_instance.ts index 97add81c6d5b8..a569b834fb82a 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/unmute_instance.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/unmute_instance.ts @@ -259,17 +259,6 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider switch (scenario.id) { case 'no_kibana_privileges at space1': case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: getUnauthorizedErrorMessage( - 'unmuteAlert', - 'test.restricted-noop', - 'alerts' - ), - statusCode: 403, - }); - break; case 'global_read at space1': case 'space_1_all at space1': case 'space_1_all_alerts_none_actions at space1': @@ -279,7 +268,7 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider message: getUnauthorizedErrorMessage( 'unmuteAlert', 'test.restricted-noop', - 'alertsRestrictedFixture' + 'alerts' ), statusCode: 403, }); diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/update.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/update.ts index 198baf12e751f..14f089b40759f 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/update.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/update.ts @@ -409,24 +409,13 @@ export default function createUpdateTests({ getService }: FtrProviderContext) { switch (scenario.id) { case 'no_kibana_privileges at space1': case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: getUnauthorizedErrorMessage('update', 'test.restricted-noop', 'alerts'), - statusCode: 403, - }); - break; case 'global_read at space1': case 'space_1_all at space1': case 'space_1_all_alerts_none_actions at space1': expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage( - 'update', - 'test.restricted-noop', - 'alertsRestrictedFixture' - ), + message: getUnauthorizedErrorMessage('update', 'test.restricted-noop', 'alerts'), statusCode: 403, }); break; diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/update_api_key.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/update_api_key.ts index 3df0570650146..b92e423cd6829 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/update_api_key.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/update_api_key.ts @@ -238,17 +238,6 @@ export default function createUpdateApiKeyTests({ getService }: FtrProviderConte switch (scenario.id) { case 'no_kibana_privileges at space1': case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: getUnauthorizedErrorMessage( - 'updateApiKey', - 'test.restricted-noop', - 'alerts' - ), - statusCode: 403, - }); - break; case 'global_read at space1': case 'space_1_all at space1': case 'space_1_all_alerts_none_actions at space1': @@ -258,7 +247,7 @@ export default function createUpdateApiKeyTests({ getService }: FtrProviderConte message: getUnauthorizedErrorMessage( 'updateApiKey', 'test.restricted-noop', - 'alertsRestrictedFixture' + 'alerts' ), statusCode: 403, }); diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_delete.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_delete.ts index fc3526eebc6a4..acc0321adfa5b 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_delete.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_delete.ts @@ -249,71 +249,6 @@ export default ({ getService }: FtrProviderContext) => { } }); - it('should handle delete alert request appropriately when consumer is not the producer', async () => { - const { body: createdRule1 } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send( - getTestRuleData({ - rule_type_id: 'test.restricted-noop', - consumer: 'alertsFixture', - }) - ) - .expect(200); - - const response = await supertestWithoutAuth - .patch(`${getUrlPrefix(space.id)}/internal/alerting/rules/_bulk_delete`) - .set('kbn-xsrf', 'foo') - .send({ ids: [createdRule1.id] }) - .auth(user.username, user.password); - - switch (scenario.id) { - case 'no_kibana_privileges at space1': - case 'space_1_all at space2': - expect(response.body).to.eql({ - error: 'Forbidden', - message: 'Unauthorized to find rules for any rule types', - statusCode: 403, - }); - expect(response.statusCode).to.eql(403); - objectRemover.add(space.id, createdRule1.id, 'rule', 'alerting'); - // Ensure task still exists - await getScheduledTask(createdRule1.scheduled_task_id); - break; - case 'space_1_all at space1': - case 'space_1_all_alerts_none_actions at space1': - case 'space_1_all_with_restricted_fixture at space1': - case 'global_read at space1': - expect(response.body).to.eql({ - statusCode: 400, - error: 'Bad Request', - message: 'No rules found for bulk delete', - }); - expect(response.statusCode).to.eql(400); - objectRemover.add(space.id, createdRule1.id, 'rule', 'alerting'); - // Ensure task still exists - await getScheduledTask(createdRule1.scheduled_task_id); - break; - case 'superuser at space1': - expect(response.body).to.eql({ - rules: [{ ...getDefaultRules(response), rule_type_id: 'test.restricted-noop' }], - errors: [], - total: 1, - taskIdsFailedToBeDeleted: [], - }); - expect(response.statusCode).to.eql(200); - try { - await getScheduledTask(createdRule1.scheduled_task_id); - throw new Error('Should have removed scheduled task'); - } catch (e) { - expect(e.meta.statusCode).to.eql(404); - } - break; - default: - throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); - } - }); - it('should handle delete alert request appropriately when consumer is "alerts"', async () => { const { body: createdRule1 } = await supertest .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) @@ -348,7 +283,7 @@ export default ({ getService }: FtrProviderContext) => { case 'global_read at space1': expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage('bulkDelete', 'test.noop', 'alertsFixture'), + message: getUnauthorizedErrorMessage('bulkDelete', 'test.noop', 'alerts'), statusCode: 403, }); expect(response.statusCode).to.eql(403); diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_disable.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_disable.ts index b8c2041cb27af..7bd3e42edeb70 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_disable.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_disable.ts @@ -278,7 +278,7 @@ export default ({ getService }: FtrProviderContext) => { case 'global_read at space1': expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage('bulkDisable', 'test.noop', 'alertsFixture'), + message: getUnauthorizedErrorMessage('bulkDisable', 'test.noop', 'alerts'), statusCode: 403, }); expect(response.statusCode).to.eql(403); diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_edit.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_edit.ts index 1082a6741ec0d..c0835b91e209e 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_edit.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_edit.ts @@ -388,11 +388,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) { case 'global_read at space1': expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage( - 'bulkEdit', - 'test.restricted-noop', - 'alertsRestrictedFixture' - ), + message: getUnauthorizedErrorMessage('bulkEdit', 'test.restricted-noop', 'alerts'), statusCode: 403, }); expect(response.statusCode).to.eql(403); diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_enable.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_enable.ts index e7cd7044717c4..c829e130f246d 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_enable.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_enable.ts @@ -228,54 +228,6 @@ export default ({ getService }: FtrProviderContext) => { } }); - it('should handle enable alert request appropriately when consumer is not the producer', async () => { - const { body: createdRule } = await supertest - .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send( - getTestRuleData({ - rule_type_id: 'test.restricted-noop', - consumer: 'alertsFixture', - }) - ) - .expect(200); - objectRemover.add(space.id, createdRule.id, 'rule', 'alerting'); - - const response = await supertestWithoutAuth - .patch(`${getUrlPrefix(space.id)}/internal/alerting/rules/_bulk_enable`) - .set('kbn-xsrf', 'foo') - .send({ ids: [createdRule.id] }) - .auth(user.username, user.password); - - switch (scenario.id) { - case 'no_kibana_privileges at space1': - case 'space_1_all at space2': - expect(response.body).to.eql({ - error: 'Forbidden', - message: 'Unauthorized to find rules for any rule types', - statusCode: 403, - }); - expect(response.statusCode).to.eql(403); - break; - case 'space_1_all at space1': - case 'space_1_all_alerts_none_actions at space1': - case 'space_1_all_with_restricted_fixture at space1': - case 'global_read at space1': - expect(response.body).to.eql({ - statusCode: 400, - error: 'Bad Request', - message: 'No rules found for bulk enable', - }); - expect(response.statusCode).to.eql(400); - break; - case 'superuser at space1': - expect(response.statusCode).to.eql(200); - break; - default: - throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`); - } - }); - it('should handle enable alert request appropriately when consumer is "alerts"', async () => { const { body: createdRule } = await supertest .post(`${getUrlPrefix(space.id)}/api/alerting/rule`) @@ -308,7 +260,7 @@ export default ({ getService }: FtrProviderContext) => { case 'global_read at space1': expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage('bulkEnable', 'test.noop', 'alertsFixture'), + message: getUnauthorizedErrorMessage('bulkEnable', 'test.noop', 'alerts'), statusCode: 403, }); expect(response.statusCode).to.eql(403); diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group4/tests/alerting/snooze.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group4/tests/alerting/snooze.ts index 8c1fed7978b55..c880b18dd4b46 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group4/tests/alerting/snooze.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group4/tests/alerting/snooze.ts @@ -269,24 +269,13 @@ export default function createSnoozeRuleTests({ getService }: FtrProviderContext switch (scenario.id) { case 'no_kibana_privileges at space1': case 'space_1_all at space2': - expect(response.statusCode).to.eql(403); - expect(response.body).to.eql({ - error: 'Forbidden', - message: getUnauthorizedErrorMessage('snooze', 'test.restricted-noop', 'alerts'), - statusCode: 403, - }); - break; case 'global_read at space1': case 'space_1_all at space1': case 'space_1_all_alerts_none_actions at space1': expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage( - 'snooze', - 'test.restricted-noop', - 'alertsRestrictedFixture' - ), + message: getUnauthorizedErrorMessage('snooze', 'test.restricted-noop', 'alerts'), statusCode: 403, }); break; diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group4/tests/alerting/unsnooze.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group4/tests/alerting/unsnooze.ts index eae8814a514fb..8f509e6104c3d 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group4/tests/alerting/unsnooze.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group4/tests/alerting/unsnooze.ts @@ -254,11 +254,7 @@ export default function createUnsnoozeRuleTests({ getService }: FtrProviderConte expect(response.statusCode).to.eql(403); expect(response.body).to.eql({ error: 'Forbidden', - message: getUnauthorizedErrorMessage( - 'unsnooze', - 'test.restricted-noop', - 'alertsRestrictedFixture' - ), + message: getUnauthorizedErrorMessage('unsnooze', 'test.restricted-noop', 'alerts'), statusCode: 403, }); break; diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/scenarios.ts b/x-pack/test/alerting_api_integration/security_and_spaces/scenarios.ts index fdb56a4fb501e..bf6b38b6befbe 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/scenarios.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/scenarios.ts @@ -282,6 +282,10 @@ const GlobalReadAtSpace1: GlobalReadAtSpace1 = { space: Space1, }; +interface Space1AllAtSpace1 extends Scenario { + id: 'space_1_all at space1'; +} + interface Space1AllWithRestrictedFixtureAtSpace1 extends Scenario { id: 'space_1_all_with_restricted_fixture at space1'; } @@ -322,7 +326,8 @@ export const systemActionScenario: SystemActionSpace1 = { interface Space1AllAtSpace1 extends Scenario { id: 'space_1_all at space1'; } -const Space1AllAtSpace1: Space1AllAtSpace1 = { + +export const Space1AllAtSpace1: Space1AllAtSpace1 = { id: 'space_1_all at space1', user: Space1All, space: Space1, diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/aggregate_post.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/aggregate.ts similarity index 51% rename from x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/aggregate_post.ts rename to x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/aggregate.ts index 6269e9bff6e2b..c1553d1ef8d9e 100644 --- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/aggregate_post.ts +++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/aggregate.ts @@ -28,10 +28,12 @@ export default function createAggregateTests({ getService }: FtrProviderContext) }); }; - describe('aggregate post', () => { + describe('aggregate', () => { const objectRemover = new ObjectRemover(supertest); - afterEach(() => objectRemover.removeAll()); + afterEach(async () => { + await objectRemover.removeAll(); + }); it('should aggregate when there are no alerts', async () => { const response = await supertest @@ -157,6 +159,171 @@ export default function createAggregateTests({ getService }: FtrProviderContext) }); }); + it('should aggregate only filtered rules by rule type IDs', async () => { + const NumOkAlerts = 4; + const NumActiveAlerts = 1; + const NumErrorAlerts = 2; + + const okAlertIds: string[] = []; + const activeAlertIds: string[] = []; + const errorAlertIds: string[] = []; + + await Promise.all( + [...Array(NumOkAlerts)].map(async () => { + const okAlertId = await createTestAlert({ + rule_type_id: 'test.noop', + schedule: { interval: '24h' }, + }); + okAlertIds.push(okAlertId); + objectRemover.add(Spaces.space1.id, okAlertId, 'rule', 'alerting'); + }) + ); + + await Promise.all(okAlertIds.map((id) => getEventLogWithRetry(id))); + + await Promise.all( + [...Array(NumActiveAlerts)].map(async () => { + const activeAlertId = await createTestAlert({ + rule_type_id: 'test.patternFiring', + schedule: { interval: '24h' }, + params: { + pattern: { instance: new Array(100).fill(true) }, + }, + }); + activeAlertIds.push(activeAlertId); + objectRemover.add(Spaces.space1.id, activeAlertId, 'rule', 'alerting'); + }) + ); + + await Promise.all(activeAlertIds.map((id) => getEventLogWithRetry(id))); + + await Promise.all( + [...Array(NumErrorAlerts)].map(async () => { + const errorAlertId = await createTestAlert({ + rule_type_id: 'test.throw', + schedule: { interval: '24h' }, + }); + errorAlertIds.push(errorAlertId); + objectRemover.add(Spaces.space1.id, errorAlertId, 'rule', 'alerting'); + }) + ); + + await Promise.all(errorAlertIds.map((id) => getEventLogWithRetry(id))); + + await retry.try(async () => { + const response = await supertest + .post(`${getUrlPrefix(Spaces.space1.id)}/internal/alerting/rules/_aggregate`) + .set('kbn-xsrf', 'foo') + .send({ rule_type_ids: ['test.noop'] }); + + expect(response.status).to.eql(200); + expect(response.body).to.eql({ + rule_enabled_status: { + disabled: 0, + enabled: 4, + }, + rule_execution_status: { + ok: NumOkAlerts, + active: 0, + error: 0, + pending: 0, + unknown: 0, + warning: 0, + }, + rule_last_run_outcome: { + succeeded: 4, + warning: 0, + failed: 0, + }, + rule_muted_status: { + muted: 0, + unmuted: 4, + }, + rule_snoozed_status: { + snoozed: 0, + }, + rule_tags: ['foo'], + }); + }); + }); + + it('should aggregate only filtered rules by consumer', async () => { + const NumOkAlerts = 4; + const NumActiveAlerts = 1; + const NumErrorAlerts = 2; + + const okAlertIds: string[] = []; + const activeAlertIds: string[] = []; + const errorAlertIds: string[] = []; + + await Promise.all( + [...Array(NumOkAlerts)].map(async () => { + const okAlertId = await createTestAlert({ + rule_type_id: 'test.restricted-noop', + schedule: { interval: '24h' }, + consumer: 'alertsRestrictedFixture', + }); + okAlertIds.push(okAlertId); + objectRemover.add(Spaces.space1.id, okAlertId, 'rule', 'alerting'); + }) + ); + + await Promise.all(okAlertIds.map((id) => getEventLogWithRetry(id))); + + await Promise.all( + [...Array(NumActiveAlerts)].map(async () => { + const activeAlertId = await createTestAlert({ + rule_type_id: 'test.patternFiring', + schedule: { interval: '24h' }, + params: { + pattern: { instance: new Array(100).fill(true) }, + }, + }); + activeAlertIds.push(activeAlertId); + objectRemover.add(Spaces.space1.id, activeAlertId, 'rule', 'alerting'); + }) + ); + + await Promise.all(activeAlertIds.map((id) => getEventLogWithRetry(id))); + + await Promise.all( + [...Array(NumErrorAlerts)].map(async () => { + const errorAlertId = await createTestAlert({ + rule_type_id: 'test.throw', + schedule: { interval: '24h' }, + }); + errorAlertIds.push(errorAlertId); + objectRemover.add(Spaces.space1.id, errorAlertId, 'rule', 'alerting'); + }) + ); + + await Promise.all(errorAlertIds.map((id) => getEventLogWithRetry(id))); + + await retry.try(async () => { + const response = await supertest + .post(`${getUrlPrefix(Spaces.space1.id)}/internal/alerting/rules/_aggregate`) + .set('kbn-xsrf', 'foo') + .send({ consumers: ['alertsFixture'] }); + + expect(response.status).to.eql(200); + expect(response.body).to.eql({ + rule_execution_status: { + error: NumErrorAlerts, + active: NumActiveAlerts, + ok: 0, + pending: 0, + unknown: 0, + warning: 0, + }, + rule_last_run_outcome: { failed: 2, succeeded: 1, warning: 0 }, + rule_enabled_status: { enabled: 3, disabled: 0 }, + rule_muted_status: { muted: 0, unmuted: 3 }, + rule_snoozed_status: { snoozed: 0 }, + rule_tags: ['foo'], + }); + }); + }); + describe('tags limit', () => { it('should be 50 be default', async () => { const numOfAlerts = 3; diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/find.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/find.ts index e730dd657d2f1..f6b48df9b9f17 100644 --- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/find.ts +++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/find.ts @@ -33,10 +33,13 @@ export default function createFindTests({ getService }: FtrProviderContext) { describe('find public API', () => { const objectRemover = new ObjectRemover(supertest); - afterEach(() => objectRemover.removeAll()); + afterEach(async () => { + await objectRemover.removeAll(); + }); describe('handle find alert request', function () { this.tags('skipFIPS'); + it('should handle find alert request appropriately', async () => { const { body: createdAction } = await supertest .post(`${getUrlPrefix(Spaces.space1.id)}/api/actions/connector`) @@ -290,6 +293,48 @@ export default function createFindTests({ getService }: FtrProviderContext) { 'Error find rules: Filter is not supported on this field alert.attributes.mapped_params.risk_score' ); }); + + it('should throw when using rule_type_ids', async () => { + const { body: createdAlert } = await supertest + .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerting/rule`) + .set('kbn-xsrf', 'foo') + .send(getTestRuleData()) + .expect(200); + + objectRemover.add(Spaces.space1.id, createdAlert.id, 'rule', 'alerting'); + + const response = await supertest.get( + `${getUrlPrefix(Spaces.space1.id)}/api/alerting/rules/_find?rule_type_ids=foo` + ); + + expect(response.statusCode).to.eql(400); + expect(response.body).to.eql({ + statusCode: 400, + error: 'Bad Request', + message: '[request query.rule_type_ids]: definition for this key is missing', + }); + }); + + it('should throw when using consumers', async () => { + const { body: createdAlert } = await supertest + .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerting/rule`) + .set('kbn-xsrf', 'foo') + .send(getTestRuleData()) + .expect(200); + + objectRemover.add(Spaces.space1.id, createdAlert.id, 'rule', 'alerting'); + + const response = await supertest.get( + `${getUrlPrefix(Spaces.space1.id)}/api/alerting/rules/_find?consumers=foo` + ); + + expect(response.statusCode).to.eql(400); + expect(response.body).to.eql({ + statusCode: 400, + error: 'Bad Request', + message: '[request query.consumers]: definition for this key is missing', + }); + }); }); describe('legacy', function () { diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/find_internal.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/find_internal.ts index 25fc54a5229d3..7c10b9be598bb 100644 --- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/find_internal.ts +++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/find_internal.ts @@ -22,6 +22,7 @@ async function createAlert( .set('kbn-xsrf', 'foo') .send(getTestRuleData(overwrites)) .expect(200); + objectRemover.add(Spaces.space1.id, createdAlert.id, 'rule', 'alerting'); return createdAlert; } @@ -33,10 +34,13 @@ export default function createFindTests({ getService }: FtrProviderContext) { describe('find internal API', () => { const objectRemover = new ObjectRemover(supertest); - afterEach(() => objectRemover.removeAll()); + afterEach(async () => { + await objectRemover.removeAll(); + }); describe('handle find alert request', function () { this.tags('skipFIPS'); + it('should handle find alert request appropriately', async () => { const { body: createdAction } = await supertest .post(`${getUrlPrefix(Spaces.space1.id)}/api/actions/connector`) @@ -276,7 +280,7 @@ export default function createFindTests({ getService }: FtrProviderContext) { it('should filter on parameters', async () => { const response = await supertest - .get(`${getUrlPrefix(Spaces.space1.id)}/internal/alerting/rules/_find`) + .post(`${getUrlPrefix(Spaces.space1.id)}/internal/alerting/rules/_find`) .set('kbn-xsrf', 'foo') .send({ filter: 'alert.attributes.params.risk_score:40', @@ -286,17 +290,52 @@ export default function createFindTests({ getService }: FtrProviderContext) { expect(response.body.total).to.equal(1); expect(response.body.data[0].params.risk_score).to.eql(40); }); + }); - it('should error if filtering on mapped parameters directly using the public API', async () => { - const response = await supertest - .post(`${getUrlPrefix(Spaces.space1.id)}/internal/alerting/rules/_find`) - .set('kbn-xsrf', 'foo') - .send({ - filter: 'alert.attributes.mapped_params.risk_score:40', - }); + it('should filter rules by rule type IDs', async () => { + await createAlert(objectRemover, supertest, { + rule_type_id: 'test.noop', + consumer: 'alertsFixture', + }); - expect(response.status).to.eql(200); + await createAlert(objectRemover, supertest, { + rule_type_id: 'test.restricted-noop', + consumer: 'alertsRestrictedFixture', }); + + const response = await supertest + .post(`${getUrlPrefix(Spaces.space1.id)}/internal/alerting/rules/_find`) + .set('kbn-xsrf', 'foo') + .send({ + rule_type_ids: ['test.restricted-noop'], + }); + + expect(response.status).to.eql(200); + expect(response.body.total).to.equal(1); + expect(response.body.data[0].rule_type_id).to.eql('test.restricted-noop'); + }); + + it('should filter rules by consumers', async () => { + await createAlert(objectRemover, supertest, { + rule_type_id: 'test.noop', + consumer: 'alertsFixture', + }); + + await createAlert(objectRemover, supertest, { + rule_type_id: 'test.restricted-noop', + consumer: 'alertsRestrictedFixture', + }); + + const response = await supertest + .post(`${getUrlPrefix(Spaces.space1.id)}/internal/alerting/rules/_find`) + .set('kbn-xsrf', 'foo') + .send({ + consumers: ['alertsRestrictedFixture'], + }); + + expect(response.status).to.eql(200); + expect(response.body.total).to.equal(1); + expect(response.body.data[0].consumer).to.eql('alertsRestrictedFixture'); }); describe('legacy', function () { @@ -309,11 +348,7 @@ export default function createFindTests({ getService }: FtrProviderContext) { .expect(200); objectRemover.add(Spaces.space1.id, createdAlert.id, 'rule', 'alerting'); - const response = await supertest.get( - `${getUrlPrefix( - Spaces.space1.id - )}/api/alerts/_find?search=test.noop&search_fields=alertTypeId` - ); + const response = await supertest.get(`${getUrlPrefix(Spaces.space1.id)}/api/alerts/_find`); expect(response.status).to.eql(200); expect(response.body.page).to.equal(1); diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/index.ts index 7a0c24878d07f..d750fd7bcfb4e 100644 --- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/index.ts +++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/index.ts @@ -14,12 +14,13 @@ export default function alertingTests({ loadTestFile, getService }: FtrProviderC before(async () => await buildUp(getService)); after(async () => await tearDown(getService)); - loadTestFile(require.resolve('./aggregate_post')); + loadTestFile(require.resolve('./aggregate')); loadTestFile(require.resolve('./create')); loadTestFile(require.resolve('./delete')); loadTestFile(require.resolve('./disable')); loadTestFile(require.resolve('./enable')); loadTestFile(require.resolve('./find')); + loadTestFile(require.resolve('./find_internal')); loadTestFile(require.resolve('./get')); loadTestFile(require.resolve('./get_alert_state')); loadTestFile(require.resolve('./get_alert_summary')); diff --git a/x-pack/test/common/services/search_secure.ts b/x-pack/test/common/services/search_secure.ts index f46e9e57ef275..9f25140df5d23 100644 --- a/x-pack/test/common/services/search_secure.ts +++ b/x-pack/test/common/services/search_secure.ts @@ -44,10 +44,12 @@ export class SearchSecureService extends FtrService { space, }: SendOptions) { const spaceUrl = getSpaceUrlPrefix(space); + const statusesWithoutRetry = [200, 400, 403, 500]; const { body } = await this.retry.try(async () => { let result; const url = `${spaceUrl}/internal/search/${strategy}`; + if (referer && kibanaVersion) { result = await supertestWithoutAuth .post(url) @@ -89,9 +91,11 @@ export class SearchSecureService extends FtrService { .set('kbn-xsrf', 'true') .send(options); } - if ((result.status === 500 || result.status === 200) && result.body) { + + if (statusesWithoutRetry.includes(result.status) && result.body) { return result; } + throw new Error('try again'); }); diff --git a/x-pack/test/functional/apps/infra/metrics_source_configuration.ts b/x-pack/test/functional/apps/infra/metrics_source_configuration.ts index 46d20489e4d36..39c6b33d2f3e2 100644 --- a/x-pack/test/functional/apps/infra/metrics_source_configuration.ts +++ b/x-pack/test/functional/apps/infra/metrics_source_configuration.ts @@ -7,13 +7,10 @@ import { cleanup, Dataset, generate, PartialConfig } from '@kbn/data-forge'; import expect from '@kbn/expect'; -import { - Aggregators, - InfraRuleType, - MetricThresholdParams, -} from '@kbn/infra-plugin/common/alerting/metrics'; +import { Aggregators, MetricThresholdParams } from '@kbn/infra-plugin/common/alerting/metrics'; import { COMPARATORS } from '@kbn/alerting-comparators'; +import { InfraRuleType } from '@kbn/rule-data-utils'; import { createRule } from '../../../alerting_api_integration/observability/helpers/alerting_api_helper'; import { waitForDocumentInIndex, diff --git a/x-pack/test/functional/es_archives/observability/alerts/data.json.gz b/x-pack/test/functional/es_archives/observability/alerts/data.json.gz index 4017aaab1bddf1ca9ba2582b819b813dfdc42e2d..bcab15f41c4492582199703e1d3feedd8f693af0 100644 GIT binary patch literal 4473 zcmV-<5r*y`iwFoXMi*xQ17u-zVJ>QOZ*BnXom+1sxs}J?=Tis<0?aJJ3hx&^1Q}#! zfdD%|u$jCh9T>dYO3RX?i=ED(zx$plSuNSBl8fC^S(0mdX3&yYJS-OZ|M8HAtY5zy z46YWR?&H;Pa22Nh>bK<=4|cpPzxfqDz{gQ2f7MP2m!d(QCV{wuzd7qAa#+(4j5pD+ z>hki6Nr?Y0FDgcpMVw9SxUl0mTg=ha&ExFBy3u&F_*B^YyY&wtCc7Lj5H9~A>x|~p z<;-u20^j^$F}jQMg}u8k^QV{+L@*-e7b1of51B3$H-CG&9@58$I9U|dFGkZzc}4lR zhxqdMk5JR8s|D*fVi7U#Fq zacM%lntEOP3>S(jZKN?mVNC?DzjQQ#>X`Ugte#U@r;C}L%vbk(9cQ!Y>>5fQujAOx z7bB1S6s6e|p3Ed%-!2ySXcqsqgi5VG%!j}G-Q(k9@szmm(}wDpMLS>B>HpZ#IEKNN z)%l<_I2g?bH;@dPz+iD}Cj(L7-weL@%h?PneNf$KnTCqf)DwGG^_L(2{PW<+>@Qnp|F1Or{d5w4*q6!u zY#NsS$>jarzNF>``;0j@kUS{z) zoqbH>>Ere0MyB_1vXgp#57h?`sZ8R8UMpy%1f|3X;uZ^}E#^ow7HP1CYoUAA9FjG>Fqkq1_alr^oXKxx z&Ggr zpu3I2cR;G(er~I$%aQ4lp=6grm#^*TCp+imX;e|*h$5$@KdA(=ltL>uERx`(R>}4> zIv|ZWg)YX3AzT|KiRubX<0-Vt+v$8UWI%_b6Ns}OKs|tt44@40x-bAW_2!f1OwgWd zMlE8}IK-I=$hwG;CzP|8N-gZyRu1a*eDhjLTe1*C3nFzv3QANrbRn{*OHY?0(h9(y|js^)rEaKP^WW6vbNzVfd#7Fwpkzzy-u>iu5J%sV&>HH9YVMJg< zn)$NI@b&Vwp%Tq-e@JUAwLsBVM2-Da<~s1xCGg}WZK$a8WXLz8X4~eG@v<`Y$I8^P zk&=gzKygTcRT%LH!3d#4feR_{>lm3uKLypSS>^r;lGNCRq~qG8n;z8;IvFZ$-;S-I&o+C)l=J(_wcm|3av*=8lVug(xIqfl0(E_Q)n95RY0rOq2K0 zyfJsMEJfn9w}#)RphR+@b9!+D?Q!RQ23BP3~Yiq__~$bj+O^yG`8L>QU{u zlc8cgceXQnGwvv50>M$DpoIqalw0JYvIt9MrFA5V_}2aoxZH$;%Z)qW4xtj0On;}Y ze23;v`)RmS;g0ONbBf&ILjleNh&t<*JGFKjxwGj}?YNVnVlBAy*73~mi9a-24r2p} zDEARY3<@J714Ge-V1rgNvFsI{@$_bXFaT8(zC%t6Ojs9=57UHlm4l#$61G8*YL6h@ zZU^Uoy^0de2k?LfP(QO#oDaUgo6h12Bue}+xU&m?3m+p0|0Im6MV+E8G5#0wJt8R< z<;-$RFqCaDhYXuGTR?|dmOZ+t(ANeMMhB+6C?P@R3KANpfJopVecEs>Q)@`*^^B7# z1gG6WqRDP8B%ZhVc96)Bnv-!(zFlCw=Gq7xko3Su4h;nvXb@13G$|EAP$YX|>7W9; zS~D-_H;w3I&74Y774}$4$+>AIm1#7N4#v^wW~OhNLL4``3EAcfXEg$UZsxdJ`kLyk zmGoKW;7v@I_XGDSZ|L2r!a8r@kF18_=`hO% zV8?lgh&}N8R~7J&fBx%WIkz{vn`G?PU~8JdA+L*K#)W>`GxMz_dMTfOnv~UFemJ;v z{=8~mgVEYVi@~Iw*}JM^{`%o+G7a$;=p7%fh99oV?Q$Qke*59d&qh#pBMaaD9TKe? zah1g1FIOq1cV#|cvHJS=)t6r?xx9|!f0SQAJO0b)KV|;p>EmA~qeXSm-72T$d@;TI zd2IsBE!O2({ZyqIh3cE?Hqh#Ov@RC>oJMiHN>P2ZH}Lpxs%E^p?BV9a)#uM;fmVI( zPpiaFj~0Gwi=WXX&Fp+JTl&Rvwl~V*C5WCWLGk5z6|K0s5oQq+;|Cj$iy<*X$_l9) zmsgJ!BED;P&=4}QB`EFil_BI8gfH;ZeDWp$Tqr<0VS&l_kMSK&kIBmB5Kdl;q;4d)oAx6epcFg%vF;$g}!nf`B0*oC8buVXq`Xo5eG~c zl6NhoHFle%bgON*lhO=Pxg;s2fL9V#`ML&+I04o=88i~gFs3Z?A!J8$A4f`eJkH~7 z*%XHF2~BKJ()}LsX?g-uW-Y(;oAii+2ve1GJER z@IX(mcSSGgtz?KP^w!2>sg8Bt!mizVdOZ`AcJ#{7@e86?GTf`EC<;tt#G^DwI|fSS z9N|J~<9POq*^WUkRvxs$O&901mCl#Rn#QUx-x&lCaFK>E5yS$f@qbv1XG7yDLUzH{)tc)@z_ ztH;-S!xtYC((OS;O?DgcwGot-bBFDP{DSc1sWD6@50s7yabg&9mWA?fI(imdP}wKN z9RpvgI$oFRj!rA3A`@RV>^xZeBf@pTdS64gnlxZBX}TDy(-+6YQJd}Rpv z1>q~Pq>Z#?vmhREr#Z4F7!5FKC$(}=0Y7g74Dc>1H zZUDYiAGy)v>s{dsdMhc<*Ak*z@2l2sJ-(g^O3TT^_CkI^`0`YGi=iz|HhhAMQeX)Y{&R0*b_eL*Pz5Ymc9X4NM_h9tO(D4hR zmm}V!loS#sGH^6iKw4pilne@+B)Kr;6zHX@S3;6~XZjv;?vP~#9@dxd9Gowjwe;0H zUp>Aq0$*atc_CESVe>V18}YRfly>;a5b{gHm)AU6K@sBuBhIZwCOLq1!q`%*gTyDX z>#Js;#!>N=Id}N#K9UoS+`xtCBR6_{y)%53|B?c_c-OnWcI`IdYfDgC;;X%oUl6{c zc2QAH5VlGp&U{2B8jFIE5*i9K(w)Nj4|S8($HW)TeZTo@lj$cqdC2?7jUHd`3}1XG zOnElYp0`3DD{^DkZlm|L5tMfL$`JAv`0DmGy9bD$w*O zjyU_RV8`&nXt{Ah;!eCUt&KLBURX`}&S4S}XPq6}Pa^ghJAaG;BlJ+PLXyUC;bToA z?%Hki!Zw1^4r3WY-U4HlmYxN`JR_LeB#@Wo3y_n+$Qgx^4ARJmlOjZ%0>IwkG-5Xq z^!@(j9$@bcV3#}ilae12#2iY3W)&DND3lCOF0FM)ik`L?qkl3 zMSQhmoTeWpbstIJW9gRjkDh$JU=Ia`P@C-Uq~^h{*DC7q=$PMD9sAftbYlW!R%0$B~P#*OrM-6JL_{t6@F9 z-XFeRJ3QxD_}aDGh_8*HwDiK-3;6}%OKWPNRTvbwgnM<~B8zoG)?w{}r%t((IF17k zsVM~S;w)cDGtWY-FWxys)aShixR0ps>2(qGI)jkJji9unSB8#X5WS>ugr|U!NFH2H zrYX`6TO@5@-ccTCeEYKy;c3$HU}hm?2lQe}W0Cn9u)6Z?!&j#-RAl5!yhi^*#glrW zVl_u3U_9P&P(iKTMkU>}?RH96s<~9nHZ!yg*U2W zGZeCrxQkO|84;Le26fk!?;IQf+#ibGI|A>_5omD?*|CDUckMRfYa=Kvr?J`#`32$2 z3qo9o7Ex#gh;z7W9h5>2N2^&R(#eyEh3jxnlB7oFMsy!xOHwy4RP3j*dV0M#dJ$Z{ zDqix=Bf59(Hqk44OHzi8Ul6?%i<)R~%xQTh2G>|1t(`}dGU*~uIGw;NJ>Dg~x;PgC z_lL^%^y=w#0rbky@e86CHNsIF0`i(U#Hoa~!J|Q%3F(A@&*tqT;L4c%ArtW6yLzLC z%H4-lQ@)c~grTfof;q({nCgIla#2}zemM88-9{bVwCr{|nxQBcq@&m}X(&mEi*g$f zP7>T6DN*7~Xy=>}{v<-N%8k14G`m>LmJI8xx2o3{?{s98eA(^N3+br|DX;cB$i{|q zyv2Z*b{iK1Hf_6|kY-3q3n4w96JAK&eXH&JZWGlCckVy-()kV2`QK9yas(3Sr^`vD zntCvrfY8Lj7$jpLZp)9w>gqxDB#Ob0WhR5i+cQOZ*BnXom+1sxs}J?=Tis`1ejTb72Yp;2r|gd z0s(e_?C#_x>A>LCR@#;vUEJvm`n&I8$!^(Jm0awW%932uJq=r8@vvCr|HnffvVQ$; zG5R+Y9FA>iFk%x>H zv(?;hiUObfVL7>pi>1A}&G}PI2_hH~^9vDUipNY>ikrXQUk~ZyU7Ri}>z9++G+&W_ zx{J@h{{SV<-!3MXP}t44A12OD?YfLrSj}zDrdll^Eg?n`!=bdzsbj9ib^7JiJT9(g z*V%-4G4(_3Gh8XEw2{ULg*6ep`O?W0s$=S7wSG>yPM32#U99i>I~SluVC{H&!q=Fu+Jb^2d+avj6y zk=4a08yrm*qf1BzO<=UVveS{M@NY)n`_+67l|HI(G^b(YH$RNhY(8ozV4LyPb*wz( zd^wwcYA(aN2%Ea!l@XM9bra`x{nhPpSL&&~sr$>1fBt!NZ}yi*X8$*v{eCu$KkUln zc0LO$e{b^kW>?bu&qeN}7cV{GUAe4Q>#GGNE)a_m!!aO2qDMv(=+?pqoUD(|w$&B1 zv-xtn+hIKBq!L2>wf(wf-DkFX-;-pyXTxnwFCTY!NOZZ3JB{9_{M?-D!+jU%*Yhks z&gLJ|_3Y!t=0;|>ak`ayaSPQ44=Jbk+ot^Y()Li!zdyh1F3uPC>ZB`N;Z45KNPJu@ zX7j3+shr}`gWsgfnmPdmh|{|X^qZUev@dn%hsz!s^v>?Lw3qdLZHoV>DAfZ)9?Qx4 zhChFo|Ns2mcfWRL4fk3>BPA#$Mi94HAZ;;6nz2ZOHCzilux6jE;g!LZF}NRLjN(jw zD{E%AF2Wb+_S5nTzVQ*R|8%idy{C=$P*4%~Ppx6qAK}qo z#_ifVHm)@F;^!=B>vi2QvX+al2Z*$cYpDqeOmM^nPsoZ8PzWg{j-@x64glFBKuAl* z<-qudy|Wh&4oQ!^Aov+CazO@K47At_EeZtbT)dAGN<8gr-5BxBUIwFHC+WZsgr|VG zp%iH)B0Q4-17RSzRC0jCULo<#l;|{t1un0h`zxpwH~SYf@L;Pjx0fKZAx^7*+}dkz zuPx|qtMKiSDtMUN8t8Ihx)dncxzOcn`}xt%d3hRD6gZ;DY4#_TK$cQy#fC)^eAFu0 zfku0z5vS0_7%_xv!z59Cq3L=Ct@3KNSdJOc;ot<~Yyi*zpaTP_K)lWjKyAJGXgL$K z=bBNAm^2P?W&*MW3~w4s;pla$vd? zNYIR(x6+2?+ zJj%9iB-@!b1L)CpE#12{qx(+q*m6UM-Mah>p}v|sE;1IPkcb5)5vSNAn~Xp_YV9yh z-b?e!+`&3~HbVEp9i=g$W!z~h-=4WcyHB(o33sR(xO1G`!E{VmKfiVfU(oYAXsM=28sjuHheG`OeSA{UiKSSl;6BT>ZH_IJSLCLCOD+yi$Am6#Oz zJ5A-=H+Q;E!yOBEz@68QXMRikq0w>} z8%RXCk1%3T7#SHDiY5dbw33MxujpLQE*EASGoQr8==+=5Jgz~a#1EqzyYyG^YXsq+hDp7sQ*|ZAe?z_p zB*ik%EO!J$Zi6Lc*tFRSI?O8f=&D9v7f2W#nDQb+g32`{G)@7Lz(M-7;aaB7kkAh^ zPNou^_6LbJyN!@|+UC1KqCjen#yRhv;!)obE zs`sFzPcjE@Vz#;+xld(7?_L$wc>{lBJq%C#S$0rkVJc~QUA=x}w3}uYsK*&;rr;R< zP=lnbx7%xQCmi@-iWx1Pw*>0oZE2W=yA`*+h>h`&JZc>iwv{$1WK_x{~)-@o(o3Dn)h!l!?O zMC(ReC-Jwdb&Ap1><{s`Lf|4sg#^C$Pe{$)B@))(EZb6PEy zvzwnEOn|xNLwVL;)u|?-{-nMQwEi4D6brsilX$&OQU7W$;qhPA&3Jv;-R1jtpFigU zt^3-a)`{;QEqvD%Ka**i+r@Ie^2^nHXOzQp5Is?X>dW)0I&pO)%pxYn_ck6EV`9dX zRZ_PuuO2EyeB17*C1m1}pmf7mfsmgOzQ9lO$(sOhp#bfK2{KkwBz!VfQEI6f@bxI-V!1xlZ;syBHRiXi31HJ})y&k>_g#3)~WjRYYD2IfO8gc6)vRY$AH8|j&QN?ue zMEon^>uHsLHN0M%TAqd0UcE1;OH{OgTDwX#P-~#psZi_1-g+QvHQ3!7wF>n6jHpF1 zk3I&Aq!$rf&6JS!o*>Ty2Y1tHgWVBO3x+GgR2uiM2`t9vK&k#k3Xgo`Y(=WbNtKH}LS!?SdS4|!$^p)$#`x4b6DYZgH>->I? zIAFSxyl*LOu-hi3kJ@%ODJ>9{bCOaDcqLKg*ELwg39#15ppj69F=d$#p*WiRFjBhZ zaUO2VrZ9X*Xkv?!?)Hd}(-V-gX!&LE1O`vw96SM{;BTdv>Kk9%c6Z?GK~Os4tGke& z5xxWl$A?mnV0=Rn_Y|N_l|)ig8-%6Y==kdR;$uN`Y`ws{VoCRfFUc_0CG=`8-YEnR z&`J)$0|UL@6uqFgk};;xTU(E%I@Ea!+jg7j^+Zs*(W^km&xl^haId1GC@_r?kJ2FR z7$}u&&X*~g#%eC#2?P&tQG~A{cwoTSfUkb=wGotV z_$mp5 z*x-E)_WacS}7HU_-ZKM33y)u7X`r$-q(Pyv%r_APeR50hHf|7ZN=9{P`cr( zK*-MsUx_7cq|MEOc*LFN$eLhK@Rp|(qUGlGClAFK^ZNZ(vX7-Nq75cH4pC`5Y`dX+ zClI*-_)B%iM(M8DowqupkFJrR_SlZV}f{EYDBsq_{@V+fYihvz!v zf-uN34b@3x)T#JA5hsqX9Jx{Cd>w{feJp*kiVV)zK(Dt(FIK<)NcJ5z-(Yud^eWKt zGoqIx-lUWi5+*WmG*v)aVTF_o3Y#RkFyt8MrRrBgl3i!|?sM*t6$KtPm+usuFIu$p zH8@`bzRm()V$69ZRNrCq4R%}cwGotV_$m`vJyaT@aea-G3;^(bNEF^=B7YT7i7}CTuU^#Y4 zC7~lOek<4^yfB(KPDtE~7pAq*rqBy(DBmeeBI2U6V~0t^0b{3+F<^uq3syn(})E^eujRSa2!kTJ)$@o#Dj3iTCR`?;EbdoBD9oaz*s}WJLo>< z!dS!?JH~PPVNwr~^aIA;9>!Sxx_8_fdUYs_ZQE_d*hWygVXQ#N&k$q8dK0Y`NKqva zmo6fWtwxkdDlAWqiPv8hYuN z@(vg~m7oqGMa-Lb5%E4C9z{f!=Uv>II1{-i;Rs?9o0nk^dK^b7zFt};K2Cf|I;@5b z_n`MHgfFeBfmUHq;1cfDd5bL830a4=3!XaVj^a2D zJf@}+ypOYdB`rJ)vAKAs5K&+D9^fIOexTP`(CY+35;uaKC2=38$}%D_D-7yxD&HwM0(dwSeQ*Tcm?O~P7_vhJb#L2k#n(nqI!SDT5JBOh8r@Ot3L7BpA*Dk_bbL;e*o;MyL@?!FbD%UMJKU3I$uHyXD=*BMn zRcnvgsO^8wJSZ5brk|~*wa{ujnoL2Q;^-P=W<)R!`Gabm!9|_HWO{kw?IPw033!~< z=*Rr&=;KwKJ{4+2s;4%`u?=|pSps&T=Q6V>(=?> ziz5GAbE~*OFW$?Sftc`w8;Vh~Rv~VUg)tcR$VW!KrUd)~Rj9JKUiuUr_HRG$3Ev>G s8>1ZupbT!zD1)+$Anv3_mO^$u3JgO~!(bqK8UxV(2U;<`jvWF40CwK;1poj5 diff --git a/x-pack/test/functional/es_archives/security_solution/alerts/8.1.0/data.json.gz b/x-pack/test/functional/es_archives/security_solution/alerts/8.1.0/data.json.gz index 50d664aa24ced0c18a63810e7ce53f9e2cf7f407..bebcb0d90f838f469e5d9f06021dfba1262e2206 100644 GIT binary patch literal 9487 zcmch6by$?$-Yy_0jfnJ%C@IZIBOwwm-H3FzfRso%(hW+;z|h@@Ff0y6Xv zBQfNe(RW`v&fedt?>hgind`Zp=U4YH?zI+UG(J8yHkBRLEo%!;3tmSLR~M|kMF)=s zg*5hq)ARepZF774#VzsgAWlY^i!+ej;}gz8$ra5X9BwdK+mBx)D6SD;tTIKcP|g=6 zr0=Je<6IJPKP2CYgPE~qo{vzovlrC^{S}LV(qggGD?iK5$ru-VOs-OHxS>gABUP5? zy8Ex+yz>IPR4(+SHYBO#b5K{ zXMH#-EJDi4Ap%+-yO|1-Sj(P_i@$cov6}VegXGNdX!|`SnilawY+jPp>@=dcNuTq0ZVUZ+-&Gc@IlR%)BX2d zx-Js421uRaTienWO$x#1GqXNT#`Uh}x~02yKel%fh&I#vb`xwnTuj!*a$jmWp}kQm z%t@i(2MXICR}$Oib@|LaN5akER|jWqI16rRDnd#nEIacri0P<))SQU~toA zanSRosI(+_K>~7TEW6lspgUA8m~R2xL1JQ+zBT)rI#KU5*J|4 zVO5b-AOr#g8F0neb`@}>jP@bl0%==`80S!+0&x6BSawr&w&Ia`vch;b@1eERpNU$oDxtg( z_$3VZmY-)4sy=w-{lbOgxcA0y$7SD^9SKdBMCdF7mxf&i1@_!g@OcSpgwu~}CH~j* z<*qt=&}o9DWnZeIqj`AUo0AXFf`kQW?PkWTN|)iTi$Qnu(;Uw+F_L{hwNs6+=V#K; zZ5LRHLw*5NL}UNHANz5@@v^B|W;na6#c6+5Q8YZaqAKqq?B(3Xb?No=Y1Oscl{9Sn zCi>;+;vV$+^4ME?`1Xm(PpplM82G6RUlrsu7w>`NcW0gQdbOhb8e|q<*t=^RROV5& zOL1YNvTJra)v=NeP_8j(SjA$^!F3v0=Dkk4tZRKkUUkEJOgp{3aShPOdf0UpbM7F( zRj`{$cFS9Hx@>2E$^T~lAS1tDbHBgVKFD_dl@~>l)2b{|mt93c?+;h0~yKwCWWIhYfyL0S+veWfCsA9lj-0Y3WIuob&#!?MWp+SS#&FiPo=;p*( zpGE9+yPx^}n@U9jrlf|4)k75?qVrzB$_4Ez+o9RfMvmphHdhxwyyODBTF2$uRoZxD zc;_UY$GNT1C6ir$8me!cEKux`_v-xO)UN!;F{(#Zp0=cqP5YC&-$T8h-CyMLRT_~r zjhdNgq12Q|3Fu$<_(??3}dD_2wB}`WB(4Bhh0VvIARelhn4r(>^+6dZNVPjnH|8eBHK&cu&`B@4VUyNou=L)$Ru!9w*{zBt zv&p>;#Z$tY`89@`jJ)NvB;^F46T3b_7wO@dy}Croi2Sf0E^c}$YG)AE66 zkSW5Odl|S*?;$4E%sh)7*#Na_bFNGXtmYB3nz(G)c9~J{xEb{&t;CBhJ8vqUN1ecV zD`u;!^Tv|YL_B#!7Xl)lezN@7*<0|^kDP25dKCb~e z>y+f5VQW!q}#LfzMcScBKA`KlRpC^DH~k+-0!P zFSTDnKqG-DS?78oco_*lRA;*VGBJ_EQcC)&6uJ)w-HcQ-(3%)QP%0!XKd^YOuJ>}ddxg!51STz($^@?& zuR6bQseW>!<7y*yb?s=r45fmX2@IX#gOf>{XGcUeNNsdwc|H z-g^Br2r3XMQW77CO7&wDm{i!zCeSeM`(ADiD1MfwFYL4SL`XgQS&g-+{A%6{86O0P z*~~4pMZniEef*kRXvwbbXWB$eFmqE2-(-GtiBP>*|k5@U%2G zlH9gv(E;mM_!dpx{|+J0OS}DY>)(Y@M=d5n$ssj&yj0hnty_7dL96Z^@R0lTz((^_VXG4`+&T#Gkosh4V`W{xr;vkuN_{BUO2uo*5|v7H}`{dvrL zRBL3S>sGw~nK};aPY{FoJK$6Po5N@3=$ZN}$QX31w%lT4P>Z~$#UQB93({!R)5N!l z=QJSKJjyt+!c>+>$0A~8L0{KeayD^R`8Q&BR(*04+#Fj@rtAmaW*6Agfuz%!_<=W| zk-N5c(2-vLaZo@d2g;Z#B(Rd|+`W|NM~A4c$KR)LmWB)I2S7qw&sNqBGH@|LYrnjH zV}89B*nW8;{VT;VSecEl(NQ8VOc3M%Ah`SwDx^2tA=@#4U%G^ahc&KDm4G?@j=COO znBQP*?eKUu&xoNG*dVHda9yo7HK{fCFxn6B8?Kc960SB)TU^+FE8gKAc**E)yMM?m zCOrdD8UHJ+2;uZr65hJj%myF&ztIH6JmK1FfKNQ8vcGDQ8Rk{$#2sbb7{z5%No~0W zCo95-Elb1ce+w58^Dn_erv=2J6XQLQ9F0oG9w6%t(-s2(@@CeLXmx(y)XD}OH!P%I z0jBikn}3zEzxnlc{(IDT-=#~6pDt`!g6mH2rHN9DQUEcGyu_>93}F)fgfGc;4{k zPtT)ALYTJl4KzajU*t}o|09Kn)SD4g*rn^z<$Jz%c}yx-{X{3sJ3s2b64@-{K0ojr zw7lmYAB6(j{X>ywDi_{T5tHkE`<dPkGw}OkWD}A|gDOw8y zLX;ym+{&=j{MFZ1qln0c^=F>nD?_z5o3u8Cy_I5~XRSQe&2p=FVNyYs0-HZtZgQI2 zdXPllyG|kSP9ta|&zkpG#^{11aoy6^lvv_MKh7-$0nY*`F8UOU%smvM?TjQ7JSyL@ zsO#5KMsP6e`a1cevXYIJY-CrT14@;CD1UfZOp(MVzDJX9`C+d4!Ktuf0X?abR+_F|eJ_*qqrv0ps@;VOe#M@Ll)<{h+JL|Rk(_#{m*LRME~;n) zCeucR1y8^$N&|?sy&r7HiYStV-R2vF2HqKQXHuWsXQU}iegsQ+^1)VB&O#zF^0rd? zAt13`6r#!<2Ku`x>u6I@Q3dIY?S zdt}_V#ul>kc6denE-Q`}lOu`A&w>|X#n7kFh=RT4^XQ#}o%wKH&;1|iRGFWiOIit2 z0<@DMmDVu@0tG=O+X$Ov2Wv6El8{}0or4ruVL^d@po8l;!dP5oy-&L-5$K^0OuxKt zOM;L?%|2a!9?(lcbl$O2*UAj#TAmLOhH;F9B!pWGpUhU{z2;pscm{T|_b7WxYmcNI zV|z|XJhPsO`#I~f8NAa>W{0%L*DbMD>Q7-wEL90Q`4dt{72hF(Ajk-dM43xwm}ch!lJ5%z%4nX0nQJI zDZ>b5Lvt{%ae0TMe?@jqV;zfiP>4E70&{6p9{u)}3Td8y_` zcq)*XVdw8UeO&*|?x3?@f9DINo-#ax>8E3(QP>Lc_^=t6eyxzd+Cr-jTxklfX!TiV zF*Ls(FE#2-1boU&BVT@<<}!`<_0Mlh;Z^MOLMZC!DCs(il*9V3sUUmpd&)#<4N0m7 z~fvn)MphrLF|3bC9Fdg+3G&bt(pbk-B@MMqeDVP4z+#=^AeYOE;BcQ{y=VpU|W*9 z`#NzBCtafDPo|Q`k`Rffi~~^q2|bQZ%~SK@ENWzOmB@s4=U7ABi!^qVNs-ur?c!47 z%ui8xMhIGl>GwIq^jK)j7|xlpDQLE>)LuCkGg!{#S6UQ5rQ4R6yBQ@p)|u9XULlVA zRw!t~4Ap&TIEf)yJm~c|)>05@;^VD%%MoEsYA;Cts4|zvnbEl33==nP36i8FL(7&7 z$#L)IdO0BMNzvqk1Mx2>=;qo?!9652H|6I8QS&+xpoBDQrThK; zgT+sX;^<{{HN`{ROS?A*9Gv8cbCb0AmUhA@x+2L|x;45XJ%&d1KLf60@=^@%IyoDG z3-hL4Iz>b3ek~wx(Vmtrfh_NKLnBoUb6=csio~?ccEkCKsX2ra)3zVgxO}aWlEMgOiV|JbW07IjUIW2|4@cE=&OdOS-u}bOYGZkCkuJT9Wdz z$}0!jsLR}O;?B|4s&MA8)>R1Aemq#qW^4_n-k?B7)fZn@D9fhUvo%NI_c_v!qt8DI zd?b0GoYb#Q@{PaNN^*zh@Y4Ol%>_W?SoYY6&as(OxKZ4^xS8J3C!KLw6L{TZSL|xK zOq|uuKjA*mg|5h}R~_h;Ul$GCamkfMvBv3zg3!cJjr&X4U&$!lloLl?WvulF|6%4)dN5#ul@f3CMRKl~j5VBAz2%9#=pjNKmKlM8=iBDRd9VT>YD z4+&#Fi`%DY_rLleW4jTdXiqD)updk5}={IJ{Xv|)< z=Fl+=p#HFuSJh2cRMq9>Gy*UOivVap&LN}tC**InqYh?({W-TxR?$4)k)EaZR=cgX=WiXy%bHy+5u*#%EGT9GVyNPsq}2Q!In=7Sr`fJdx4kYQ^hTT6e3mjqY`Gy+`*?bJO3_9W6b>8@4#?5&>qpn&) zIiaK!<1uy)%J@F|mNtngv&1@snZu_bgKE8{T0*hPeylWoX=zJ-NqyHp5;H2E~T z5$24Z9^Z*Ib(ATGI6J4s8Cq5FOwC#TT9#JsBS}a6m$03j0g{1R1gaXUj=nff&h>^) z&Ft8_?8}iEuuRtHK>X5 zmE~dOj@`j*`}Gf~!H7T*DZF1)CG;)cMVvnW zQ2qL8-RftZ5Qkna8s{co=eiSka-w}8N@L`qX~&!%6vIExnwr^eEVT~%-dNh!P;sJm zpCl@MLUza@mF}Sf< z+Y&@BiElBj8M5wup;Y%sU|^4=r;YrY{_!CsD)VV+Y?5&3?i8>a-5PVp#5wXRR69Qx z6I08Dwkt!Pq&2XzvB>&UiQ6(q-d|s8SMDhG5J!_D;^WU@oai!}^_3M8$1k-ikBBV2 z7a2JqZ^LD4eZa=XoZ!reCz~OHh3=tqO#|k|=mR!L&YM*gSM6#3i3}1wfp`A0US_An z$E$aw{c*Z92RX?8Kf$GhhRgMz;9@fENc#m>XzO13Wwd+`<9wt}Tuh^NBN6w&AD(r! z67kLn<-|iJ^)L8)5|4C4xl;=Tamy?@xFBNd;S=AxU$5R0t?orr4?#iSMD)GL{}uH} z#%IB+{;)yyI`RZmFKhqQqk6lZ^9ls{Wy=Oku=3VRc2>s z$rD#v(PpT9Nx_>G|Gb$cV_M>?oCAw`*rw=dfo354Jvq29`4Jt4tG&-rJ~9X!n5K8+ zuy8Q`lWQok5?8I|i+Cw#icz@bx^i638Xf0twGitW7xST)KyM)k&P={XyR`hgSTkMXNOclR4#7tE?9sBhZbUCv7fbRB zm4cU=(d?MALDR+c|4bKI0P6Ey+BDm_*cg(qLKU1-7xkqerw()Xbt|l?Imf+1fq&xE zMD_|XbPDaz)Tiad?BD*~82iON{=*n!U8Ur

HBsln6AGn!;VB{Q1A%5CiH?*8jC3 z{zHWcxD7uxQNL^3s;{Ng9}zc&+;r{-moOek-Ih&G;WpBX+Hz(|b#%s&UiA(R@X$w$ zrm)`>Azm_qB0L(o6#mpMctV{VVXR-bAjQ=eTWE^+C~`3*0xZ+M^05I0icJ+&R@X_B zqCg7t<9?dM$qO9)wZDDoI6o)IP}{3LKbkTZCGcqGFlFw#M#T3LK19ZalWbA4cc4Ar zcRf*>(=+3NuSS}6$Q`sIX2ap$Q=6ZhJ*B4*p__RqkqoHh4u6w*WOl^eDS23LR4x>M z-~?Pl2oM10ErQH7qAeYKOet0IC z9Cq9JmYXns8R(u8hb>m@``#{@JQTOR^-j*{=ELH+Y9_W)WtP8R7Q`sl1>DbeTf%y; z@XTt5^OhhfWO3@-Ok_uklF2PP@37u6FfBHnUo=Zw&hj#8R{Q&2_kmk<*snX}2i z;oD!{%c-7Mp{Jz7jLjT3yGkc*##?k^WFZt9Azn#DX{xqEgvQjegn@}aghtZwOEOfA zOU*N=Q>*hMrbD=wo?!{%(4CUSt|EiNSBXGav1DMZ*yyf9JXIc+bW%a|qd1b-qnH6e z_Mr|n-QRYk-$XC*RDYRp*d~u1%XNy2mVzBS!a#S?T1%eehB@=5^M*H}&%CoopAMD) z`ak~=%b7FkP2#!f-Bf)ehMO3yxj>QOb%DF7H_=|~nJ`iT7-iiDL(2Q;{D=vn1;yGmW!C5>Njb#lu}Hcy=Sc??!8M*A4! zp$-4P(;o4y0ev9QlIy1bI}tcWWWIdQg`~4lQ}ml^YBcD{a8&JlO;l1SRMHH5tdf_l z8}(HYrK0*%4#VdQCRZ_VVo8rZ0fb%;fTWxQ6*NX48z@=uf}_=<32$!Qo(Vugkw^Poj){ zUXZS*I%ZcDB-9U2-@duW5lfPrUJnanVWoING4fb{iM*)XCY>GQ#RFnG%AS9pbYThs z3Ly{B6^Pb9$|#VHPJ@3cKjT>ydUCq@{((S!LBxO;`s(1B)kL5sSEBHoUkZgCFS$#( z9j6wxVEoveYQ#aDM@~Rts(gh%u?+3nfek-8-Jdh}{d>*f3YC-i-)5pm&lbV^z+31P pz{Cer^1s8*<>!$1d<~Aivk*kU(2B{vo!wwp-;N*Y8Q`mM$fvOS;t|q`QVjVx&_#g`q(jB}clYyGvl`ZfR*@2Plrmm)()-DeA2nQK@36z5I0juY1 zWOp_Dj%p2fl7|cNmV%ZXqAf=Kx7AUn5E_Gi=ov(rksdzHyMm z$Uj45I7LpqovrTtVSRGKY2eG-aH`>c?sos9m7EL4^dL_=(Ldf3isuPl1683{hm+$C z3qeU>wlqu50ze;j$s7D(=a%oP_h_U^TU)+HsdV(7*oq!|WwCwE<;1TwrC6d*kxqt_G;+74`0S6mkvNo zYM(-Y9J462dP@j9LoYaO_uyUTRXdYkqJ)ao$K&CyR_fctm$n?D8PJq^)8v$l*sjC6 zmNmd$m2|vygF*SVv}%ysm;fNEISMtp`fS`Pk?jRaE$)1oLsshI8}G>aY7>%qJ5FZ- z?^m16^HW^Q_H;WBjU)Zv&*guJ`BPx*OL!H!3|i7fh`Xa($i%0bQW;n#LO$2bu`pP; z))AXWz59i9^e0RQwiCuR|JHFda^B`^{V_x3OHjQzE7DpOb$jpOK_L z#nD(bdHFQ4bw13@zRO&V+;CTIerxO3XkX62DFB@CL8ErJOroW|;)frS2XV-!V2df~ zcpg?mOQ&n*sLApCH5H!nWYz);s_2hO#bx=m;0ux6$=11zT_wYxEngNA&JIS{SGL{6 zvQ{`U+o{s7%r-M0tX6*Ptgu62-@FoueLs;aX5^1*48wM8h{d=XHgzU{_AP5|rH0PmsI`;%UmaPv zC)M}0QY!(s20I-;R$rBo$9ivF$vQ?_u4$FXTadt7s~eo`o6-+-TJk!7Y`fiwi)pVa z??jU)OU}Q3r!(oPG3P$;D#Xbs2B(tdD|SgKndaxl^PuVJ!+eRvipn9+m-gppFAt@^ z(eskuZk<1fKV%t%d6laRZhTPZtIu&V)$~!57O$P)CBwP5W9)37g)K!7(TwAH#}j*65^8_h|g1A1y#UpqJ$-;3RGogW&<2~?2yd&3S( zXm_YRhp2yeC8+t7AD^-|D&Q<#cDRj~?we_-58dwS&93^}RInVoNE7eLHwW^upT16L zryI^zvo3A7Hm6pykB{aOsd~S@C1`+K^wi;t1r5!!<(sIb1*itw{s!b7Dt~mF-}%sG zyL$yg$Sa&7&Eo90X_qC>hQph?igRY@maEkkTnn5c$8XvWmuM&Fn}ss()pqZ94O7oH zIrBQi)2dCjOOh%;qb4Hce4*zZTkkl2zxLY6X66SSI)#cmWQF>evrCkd1W8^C6y{tt zd%Fjn$pH^ihS` zkJebqA~kzSa81l^fqJk-`U^^rQW!t4vyFtosI1@s0J<7ZuxINA#63Eiz_yFfs%zuA z^Aj$Y%qUM&w*iEilAMOmL)$7Fr(^JF4VY_$+G%39%iN>v9a6B~MdG+leoJ=wz_@H( zRKhZ%XrF9jb7@Z=AE~!kR&MDw9W!P1TPKaUnsxkGTB&HTqIfzl$y!`SROG0s8QQvZ z>AT`Ec}jiB%!gwvx&cf@i&o9M8N75iXK|9s`zn*KQajo%zAwM~^HW)|-p=ln>M-^N z2&Ca>hoWF*ll1K*d+{db;yQr~`rdIyd>)su639~#sW-8<`1N_`p3a>0D>o zt9S9Ekp`oY^Dk`&bid`~4w_Lm5eu;&-v*X3+sri*>oYmY-rvpMaek|+zM3CT-_mP7 zkeUs!UW|@0SUh;EbK%!K(VryIJ>sf4ZR1{d;Z=|^KXKE%ef&+suo3v7L}AWebSAF4 zyWDNP-%oUw-|FVTNc`AUpou(hq!&=Ma^NY*T@qg znMic_1YGHxN}#5$<~6sPw#^}K&t6lQ+?zOtb7vX(E<>9|p%3SaA}04o)BAd|D_l6+ z^e;vcVE)CI=L)y)P*PXXU@VVoAixl}k)dd*c-*w`MQ@pKVEg(<)m^vC(!v~2NwRR# z+AQR4eQD-!d6&`}rFH4OL`6E0k@T2g&k6$|VsMUt2nAzKybOhHe5TE=LOt5!A{yO3 zGLl%^35VRqa{b@VBmjevxuC9>8zCcM>m#hRniJyx>|EdFgT&pg;O^ahyU@AD>5Ied z&)p!Es#4x&zrDO+c^}$0>~njUOMje#3hPxR^m>xIDkS77eBX%#J^pxw@=p@}{Q&nw z;HzPdOLEhDiLdD-+q6+Vkqe`UF#6gVS$5(CWjcz&vk{O?3lXk2o9nkhsnRHOTv_GP zU*El0(!Wia0jtpdW*;?p9ub}q|CDtOoHwZ%@)M}tKIql3kPi4*EeS1%7n6YcPr_rl z8rsi7*aoC#?Byf=6V5sNzXDn{ChoW$3cWh#xYRSfKl=B8Dy8IqJ!8OIc^fApOqbip zsELu`@BfN$joyWVa&8IcNRT*H8PygJ!h{zMKHH$QZ5$w z3g2=ED-b?f`KQK`i6TQCsM1?HBqxrN;F)BWdg4HL$6S}4iMnVX;(N&e)1fu%(xq53g7qY&ExL#q}wnE!%oBJ)v(VG zX1Cop|8rEt+k)_@g0F7E{w*pzI>+cZ2%VV}eqM|jLEKkujo#YIIXR`Ar@FF)Et876 zTW(S;DLQoqk&iN#6o&5LTmI3YVMIM2y6Fd2IZ|xcbLa>u(&Ko~orU2BSJ7{ho=9Vg z)gXjaJkt*dfAnuWg!IP&@HE|NAwt`IQjJ%gvxv8kIS1dH-gmxjDZFFnHfFIX>SSkC zrozMY-f7rTdkbLfmB$Z-RZ#YTkYt0Oe`dHGB*Ik3*gvfL$8nksnm};cV}6dcosZg#9+t`4doU!Mt>Y{x_ksQ zH>tSWPdLJke_clYe_|^b*N|&?^M#0p*yW8E1WCP%B`-%xky(kll9g;dLs>(Jt~XUq zxMl6K77?x>f9q70=TO{7i8eoVc#q$8pc&6e_Gl|El*jSTRN|c#Tt_zamiO-Mw+NB} zSdZ8QfsaMYk00w_+P>65<$gFd_46I_)lO}1W-bW1LZd(Vdg0RH6Db@Q6Z})``IH(V z8PQV~I+XYxGY&=bWXR9FErzP^i9dvL`SPe_EHndT1Fj?s288@Ysc(qh`N#<6^i8sh z4D#lyK}%&=0TevJHF#a|cKq5re$S70$?xw7XC2m_C-T+TaI!S)atD;-sPotN3d|X@lm)JFCkLEMMbnqW1U_r**aK zdAF37MZNp7x|l?L8MT#I{_)Pu8hkaP7aPJ7bmD&=NQQ3OpvFrn#-VP@kF9V_T*g+*_03q75&H! zO2AZR{kMnMt=tF*!x>VBW>s^7yt}Jsu-ks8 z&)_L}X^%0)PAu>)f=D6bqRn%b{4wfIIaDU%|9Y5`6_t}#G|Enpk3GyS-|(RAl@p(u z7EMdoL+|YI90&`KbBoQgo3Mo7g&HRrhdWjTk_+Qm$>`N+L^SX{VCYy_P8Jk54 zdE`GP@O}|3T#KjH>vDV5fQvp`sc=$9{n3#+jRAf3B(dA=RU&#AVcg`HGuL$g z>qBS03%SeL4`Ob|<;V47(Vd=pzxep~Fy3iwi<77gMtNrmXmk~^uNqkrcoXJq1)VH# zp+0=Bd_Unz%WcO%9iy=G{EolY{+B!NmC)}EJ8PTQw|+L_KR1fYw0@hXCNS#H-Lx(< zeH6a>gyBa4)uX2NMi`kHL;|^BEiBnEBG+7@jK2tG{b`aSOBXP_=U_Rxwd_cZgNQ|t zc)F`4fS()e8pjM4pGlXtQI9sVf#f`g5~WqKI8;W&;g6!cTr{o}NGdrz5+*Com72U= zTmw>Ws_rGF|28uZ7GxHQW>+vQVy}m)9%?=_(kEtKPxNM^IqAm^gxq70vxcs6p@1>5 z-5&4nu47W|c+OM^{8K^#5Rx_A>;YalulDRv4TK;8P~p>v$*dhdm=t!Xx-VX4BteV@ z9qOsW5d=#7UBOM)@!fiUfFq${WcbAMr`TGyR)wzwXAO~EVJfnMfk68&RT)4e7oShU zew>nGEPnJIEv$7IsifQ$fX}2I>;ZZR)d-g2xKI(oC=rS`zzoG1TOa!U3&t}HpS8_> zJ2UFTKGQOcXruCah`xz|H;_H5IVhYu&8ux=ugr`(TE{5($&CNL{!5yu%CoWX-!c8J zp+>L#P!_x&VCJFP52Xjc`?q@r9xQq2wzSX{--401($R-~I2x7jL}sr zBm_@_$-)RvcF7D@1j1HO4-X%G`p@c*^>#{*X z+?oYO@tVB0!CFf%yN+IzUaj3gkXzU9S%RFaqQSbB~ z3i`EVrj%33d54T$TOngoC~H!fMG8x@w<;_Ok!$?Z`))*XMF#kKth&p9n_`)nVssp-kmgG7;V)jT6H^uakw<0_L_JJrjF9r@i?Lxu z)gdL7S1m!73eSuXxw%Y?I$97c?J5vWNFFicSNxbe!Q_N3p2{{m>DqKz^sxyoI-P4* z#`Ljqy+Ph@7Z3M9)wjQsKsw}@U+kQgWD~uw6t1M}Qz$j3XjnkqMoD3IW>CdW_9h7D z)ns8v|1^>ZS#Oo=*5*0Zwa#I0pT$Wh6FOlLIze`_TPx=n`>FMS7;XO^|7ZcO?oeR& zA9n7KKc$NrbT)PqNxBC#*ExzI_7gdZIjO z26`)?ZUwTjaclLVyb0H#f}8>0omk=QedR5dZ_Jk=z zo5Ga+TcQa61Qw%#b>a(ky1}n8TOLS%UE)gu=v^c))=@*3)0Ht)?2CVK4osK8+;FX7 zRx&qmQwW44|3gs!U56^0(tH9$yV)#d9ufQ85&Q*uwZS_jxGF%l$5mmqj7&ymO>z3@ zR)OBf<%!8yxiw7+@wU*w*T341OR?SD)s%-+W2F$%rX@uH;>ImO^!#}6NmCl!nm8wz zKr`fJlqO*W>&9ISI80lN9yWw+R47&|X-DZHKLQjf6_pzcj$G8J)51^x9wdlsqtx)- z19eBVe1&yp++#}`WO7%}gkNE@U$!cn-FoTnhgWv5H-8dKGfTqDh=QT(Rg6>rUe8hZ z%1K6^HE0c6Pw}0ryeUzz)m!VhFP3EMaWX%8TL1A~0^0hc&9cW!?vW{$C!Q_UmN6LO z)`H=r{yI>|y&=dYl*#W10S?mxDTe93z14fyj$U>h!EdyHY_lN%J6?-De)jXg(u;wS z=N%)_D%juVyV*aG!cI~?lnR^ z&h42B^UTKP-P6BbkYG@5*eSPZj=Bk!qXU*X5wMBDO)&P45E@`}365Ju+Zm$^4xn{j zHG>C>Y|jB1aCeQtZyZZe90=)B4P6d`kEVs(nq+&8{oSggtCt+sg(>b9>t8B1(0_cp zn#XZ#^g^Y_!TTqGQ6C2qSD2G^cAA5-AS77@@VYhVE-u>$5sI~q3PZBYut!Wqg(6u( zj5@!cV`?|)`_)8sw>~eeHtIB6+e=uc7-rL{M2eMcjqpNcs`9fMTPbT@Ub<~Q>=`}m z0iw-}1GnDQJWnF|9HAl*S!kXMCetdDGjLt1NP9K^VtiVzy+y-yQIuAQC*1>+NkU_m zq_J-7rvnTv+OIC?d+oAt4Na{~Ift`doK2*Geh>8u{n4+%4czaw(jG`_7{N^1#F?+k z549TW=rQ1DYqhTIjEI&eHjIDzoYTw>C!EzK5C2R1CAI}t|C~BTJf^7JOwm{CYMTn3 zS9;fCJ@*p?H#Q-7B7*x>HWD^O49uj_IEg{>O?kz@fpAx+TJw>ng(m><89MCq4**6O z9UyNKydXPAD!3P&vnOyD5-89~JYRE0T2Q?5*sop44pZ$1}xKq z6}BnBUOAA#3^St+)dw=N;(NtVE)z2A_DwjXDbsqBM^vnE#9l`y+*7biUo46}e#6f* zsw844Qs1d$L(=G6-O&+Uz=SAwhQ_HQ_{z(HQ9H}tPtky1$?c|k>% zk+`woyxz11Rqhj)y42r-$V0sWx>l`0y54``4T z`^Q1{Cc!`-A}6q5qP~B1Zd;4orN2BB!l;F_yBwRxJ#~oG0iPPGgAH!tO=QDyb7$rB z{LrE5AgJlAFy(V+v#KiTbM>1N`#cq54d>)G$MJ_2CY*Dow;1;Mt?%kru$QM!KL6C8 zdT{`5GH4Bo1EawwaGDg34fhuX+P4WW2LmN=P|q;t?iAdk}sHB?PmccRDC3(wINXUX(oaVwNYX} z+Uqzpdwg*+&gRAs)jHZhACBqKc449|vP)}8{nVdqB7dPg(kf*Y3p7|Pakl#-#pY`Y zEzQQy*_v|C7j&_Oi#Y2##^bExG#MQt*JWfZ_H!8`7CdbL!yK9S#F4XX%>2Xi>qXxk1ntP@N_Y}a!y%usboziArZdxcvSy@Z94zqr%5OrEtn6HWZTCeyl&G%5^+g0~U!#z)j0qR!u3<;hy*f zH{cX1HgVIH5dYY)U_qMdPyr;{sPq1+(hj>}21ctUf6u!J8L@YkEIA7>)HVce0(%i zm+GiE4cP0x&EYkmHJ@#gV(%@IkgeYbfMK~&=iBa&@CgOnn$cdUqfI!=!S?qEwLV`k zrr5}0P|h(;j2>OZz3+m}vE=$GI;&&IT*`Uci6srxjb6!D0qrU(M#Pq2Roh*2LFwE5wch z4D^GU@H1a|m}#wHY%Ulj*@!-BaCLe%TWObeGqO>#ckU*+26J6M3P@Uz3nrw?v%My& zv)o8zl7@sZgu4mD*hngL@IMyzG&(aX2}DSds&8nf;{mlkM7-@Cdl)ftK9OswTzFz7 zt(bf$`q(kRZ;OdYcqtc{T2Bk(ZGkLZr!k&yDK$N4nBj61S-(B@V-JDYlfwTQ0K{9& z;JhFP?+cqXoCd0q!CuXf_ykn!^H^WN-PTZrf0t@3c`+EC{r|SR00REh^HKZ4p=ma< z_a2Y!$5XJiTE!2&dPv&XFl~0S3U8nnYWM%UwU|4{oN4?&TZ_qMilM))1-xQ1RsTn8 zq15}c_Z+JyI59V@R;H1VFzKn+>g^q+59_>*+)T|g-&B^T(={#92!0?2H&4HhHqvl$Ill#Vh~9Bpr_J=)A|kfDjKlw0%u2i zT&-~Er%A|gqS`jk;D9wB0l&7%UEs{L9&(3T-fJ%UV@rtNpKVRXy|H*(E1qtB<0|QP zkkdQC6C6s@w$2<>pq;i=$1}2rvyU&B*?4j3QGCZ+epqnSI@G?!+$FfaYFL>e)Fl~; z<`Bzpdk9A8d@EPk)NV{&hWFcg9eq1ycwDT0aUK0;wud+_7@3PIj4?fo(ct_|h;Enl zJB)ri2al9G6SD(&%OJpWVOj1C^2Gqv3?!yv@1`roNJv@L;J!x7Q<}MJZ>@O+Y*90^ zBCU#e?t)KmARUFqheT2EQRaaT#8&_rZ-y=;RjIXo2bZiVu@egPEvEYvW!lV%V~zc8 zKnRd|wJ}nSJ>~&AEC=_sQb1Fn{Mjd#paXYatXCV)GN$(*ie*@lOONixEf^u@Z#vKv4MFK7goJ@;K0=XI(9Tpq9`3G(ck{ z3JvVs){2!WDf#B7QE_7riG;q999F9@u^6|$428d&F{48r9lYSNk5oj0AB*T!j>$eB z{9qmfyQ6MT^b4|Z%g87y-Msuj<|i<~#<3)B_Q_DcKW$q8V)UE{4t!S$u_u3aN1|Az z;X7K*%L zK>QB}6h4|(1^uTKj~C#W2k)$SP1{=;dcAHLrz|<=7hxVuWgd`Et_L~Aov=F{d4BmB zi&X}7n?Zf!&kWaP-x1(v-vH$B|8pcG=WCaY&Y9f;02^4wHY1agVoRBa3nBU=MYQDp z=GH#e>8C+ZxqL8~T?wO%c%P!v{pIK7bsaBJj_F+Jd zz3fY(VwAGl~I58C;HC z6OQQ`Xp7A4wJ5OE$-mH+mSCXQ>OUx)!~de5PDju@<;vSD$0{6oNnrd08I+Dsf$`r+ zj9yp|fdY-6!vE@YKPv!^{vXVL6Yg=wX{QEiXS CHeI6t diff --git a/x-pack/test/functional_execution_context/plugins/alerts/server/plugin.ts b/x-pack/test/functional_execution_context/plugins/alerts/server/plugin.ts index 9f6d33d9ca164..78c79375f3e9f 100644 --- a/x-pack/test/functional_execution_context/plugins/alerts/server/plugin.ts +++ b/x-pack/test/functional_execution_context/plugins/alerts/server/plugin.ts @@ -7,7 +7,7 @@ import apmAgent from 'elastic-apm-node'; import type { Plugin, CoreSetup } from '@kbn/core/server'; -import { PluginSetupContract as AlertingPluginSetup } from '@kbn/alerting-plugin/server/plugin'; +import { AlertingServerSetup } from '@kbn/alerting-plugin/server/plugin'; import { EncryptedSavedObjectsPluginStart } from '@kbn/encrypted-saved-objects-plugin/server'; import { FeaturesPluginSetup } from '@kbn/features-plugin/server'; import { SpacesPluginStart } from '@kbn/spaces-plugin/server'; @@ -16,7 +16,7 @@ import { KibanaFeatureScope } from '@kbn/features-plugin/common'; export interface FixtureSetupDeps { features: FeaturesPluginSetup; - alerting: AlertingPluginSetup; + alerting: AlertingServerSetup; } export interface FixtureStartDeps { @@ -34,8 +34,8 @@ export class FixturePlugin implements Plugin { const testSubjects = getService('testSubjects'); @@ -24,6 +24,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { before(async () => { await security.testUser.setRoles(['alerts_and_actions_role']); }); + after(async () => { await security.testUser.restoreDefaults(); }); @@ -41,6 +42,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { before(async () => { await security.testUser.setRoles(['only_actions_role']); }); + after(async () => { await security.testUser.restoreDefaults(); }); @@ -57,19 +59,35 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await pageObjects.common.navigateToApp('triggersActions'); }); - after(async () => { - await objectRemover.removeAll(); - }); - it('Loads the Alerts page', async () => { - await log.debug('Checking for section heading to say Rules.'); + log.debug('Checking for section heading to say Rules.'); const headingText = await pageObjects.triggersActionsUI.getSectionHeadingText(); expect(headingText).to.be('Rules'); }); describe('Alerts tab', () => { + let createdRule: { name: string; id: string }; + + before(async () => { + const resRule = await supertest + .post(`/api/alerting/rule`) + .set('kbn-xsrf', 'foo') + .send(getTestAlertData()) + .expect(200); + + createdRule = resRule.body; + objectRemover.add(createdRule.id, 'rule', 'alerting'); + }); + + after(async () => { + await objectRemover.removeAll(); + }); + it('renders the alerts tab', async () => { + // refresh to see alert + await browser.refresh(); + // Navigate to the alerts tab await pageObjects.triggersActionsUI.changeTabs('rulesTab'); @@ -84,20 +102,6 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { }); it('navigates to an alert details page', async () => { - const { body: createdConnector } = await supertest - .post(`/api/actions/connector`) - .set('kbn-xsrf', 'foo') - .send(getTestConnectorData()) - .expect(200); - objectRemover.add(createdConnector.id, 'connector', 'actions'); - - const { body: createdAlert } = await supertest - .post(`/api/alerting/rule`) - .set('kbn-xsrf', 'foo') - .send(getTestAlertData()) - .expect(200); - objectRemover.add(createdAlert.id, 'alert', 'alerts'); - // refresh to see alert await browser.refresh(); @@ -107,10 +111,10 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await testSubjects.existOrFail('rulesList'); // click on first alert - await pageObjects.triggersActionsUI.clickOnAlertInAlertsList(createdAlert.name); + await pageObjects.triggersActionsUI.clickOnAlertInAlertsList(createdRule.name); // Verify url - expect(await browser.getCurrentUrl()).to.contain(`/rule/${createdAlert.id}`); + expect(await browser.getCurrentUrl()).to.contain(`/rule/${createdRule.id}`); }); }); }); diff --git a/x-pack/test/functional_with_es_ssl/plugins/alerts/server/plugin.ts b/x-pack/test/functional_with_es_ssl/plugins/alerts/server/plugin.ts index 972b9cf2b3af6..b4a2ee84566cc 100644 --- a/x-pack/test/functional_with_es_ssl/plugins/alerts/server/plugin.ts +++ b/x-pack/test/functional_with_es_ssl/plugins/alerts/server/plugin.ts @@ -6,17 +6,14 @@ */ import { Plugin, CoreSetup } from '@kbn/core/server'; -import { - PluginSetupContract as AlertingSetup, - RuleType, - RuleTypeParams, -} from '@kbn/alerting-plugin/server'; +import { AlertingServerSetup, RuleType, RuleTypeParams } from '@kbn/alerting-plugin/server'; import { FeaturesPluginSetup } from '@kbn/features-plugin/server'; +import { ALERTING_FEATURE_ID } from '@kbn/alerting-plugin/common'; import { KibanaFeatureScope } from '@kbn/features-plugin/common'; // this plugin's dependendencies export interface AlertingExampleDeps { - alerting: AlertingSetup; + alerting: AlertingServerSetup; features: FeaturesPluginSetup; } @@ -117,13 +114,27 @@ export class AlertingFixturePlugin implements Plugin { search_fields: ['name'], }) .expect(200); + return rules.find((rule: any) => rule.name === name); } diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/basic/bulk_update_alerts.ts b/x-pack/test/rule_registry/security_and_spaces/tests/basic/bulk_update_alerts.ts index 68feb37137397..e54af674f6572 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/basic/bulk_update_alerts.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/basic/bulk_update_alerts.ts @@ -102,7 +102,6 @@ export default ({ getService }: FtrProviderContext) => { function addTests({ space, authorizedUsers, unauthorizedUsers, alertId, index }: TestCase) { authorizedUsers.forEach(({ username, password }) => { it(`${username} should bulk update alert with given id ${alertId} in ${space}/${index}`, async () => { - await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); // since this is a success case, reload the test data immediately beforehand const { body: updated } = await supertestWithoutAuth .post(`${getSpaceUrlPrefix(space)}${TEST_URL}/bulk_update`) .auth(username, password) @@ -119,7 +118,6 @@ export default ({ getService }: FtrProviderContext) => { }); it(`${username} should bulk update alerts which match KQL query string in ${space}/${index}`, async () => { - await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); // since this is a success case, reload the test data immediately beforehand const { body: updated } = await supertestWithoutAuth .post(`${getSpaceUrlPrefix(space)}${TEST_URL}/bulk_update`) .auth(username, password) @@ -134,7 +132,6 @@ export default ({ getService }: FtrProviderContext) => { }); it(`${username} should bulk update alerts which match query in DSL in ${space}/${index}`, async () => { - await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); // since this is a success case, reload the test data immediately beforehand const { body: updated } = await supertestWithoutAuth .post(`${getSpaceUrlPrefix(space)}${TEST_URL}/bulk_update`) .auth(username, password) diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/basic/find_alerts.ts b/x-pack/test/rule_registry/security_and_spaces/tests/basic/find_alerts.ts index 694c27060f191..404250a169e0a 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/basic/find_alerts.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/basic/find_alerts.ts @@ -7,7 +7,7 @@ import expect from '@kbn/expect'; import { - ALERT_RULE_CONSUMER, + ALERT_RULE_TYPE_ID, ALERT_WORKFLOW_STATUS, } from '@kbn/rule-registry-plugin/common/technical_rule_data_field_names'; import { @@ -268,30 +268,30 @@ export default ({ getService }: FtrProviderContext) => { expect(found.body.aggregations.nbr_consumer.value).to.be.equal(2); }); - it(`${superUser.username} should handle 'siem' featureIds`, async () => { + it(`${superUser.username} should handle 'siem' rule type IDs`, async () => { const found = await supertestWithoutAuth .post(`${getSpaceUrlPrefix(SPACE1)}${TEST_URL}/find`) .auth(superUser.username, superUser.password) .set('kbn-xsrf', 'true') .send({ - feature_ids: ['siem'], + rule_type_ids: ['siem.queryRule'], }); - expect(found.body.hits.hits.every((hit: any) => hit[ALERT_RULE_CONSUMER] === 'siem')).equal( + expect(found.body.hits.hits.every((hit: any) => hit[ALERT_RULE_TYPE_ID] === 'siem')).equal( true ); }); - it(`${superUser.username} should handle 'apm' featureIds`, async () => { + it(`${superUser.username} should handle 'apm' rule type IDs`, async () => { const found = await supertestWithoutAuth .post(`${getSpaceUrlPrefix(SPACE1)}${TEST_URL}/find`) .auth(superUser.username, superUser.password) .set('kbn-xsrf', 'true') .send({ - feature_ids: ['apm'], + rule_type_ids: ['apm.error_rate'], }); - expect(found.body.hits.hits.every((hit: any) => hit[ALERT_RULE_CONSUMER] === 'apm')).equal( + expect(found.body.hits.hits.every((hit: any) => hit[ALERT_RULE_TYPE_ID] === 'apm')).equal( true ); }); diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_aad_fields_by_rule_type.ts b/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_aad_fields_by_rule_type.ts index 4d8fed02a7c71..1e7759b06c30d 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_aad_fields_by_rule_type.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_aad_fields_by_rule_type.ts @@ -38,8 +38,12 @@ export default ({ getService }: FtrProviderContext) => { await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); }); + after(async () => { + await esArchiver.unload('x-pack/test/functional/es_archives/rule_registry/alerts'); + }); + describe('Users:', () => { - it(`${obsOnlySpacesAll.username} should be able to get browser fields for o11y featureIds`, async () => { + it(`${obsOnlySpacesAll.username} should be able to get browser fields for o11y rule type ids`, async () => { await retry.try(async () => { const aadFields = await getAADFieldsByRuleType( obsOnlySpacesAll, diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_alert_summary.ts b/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_alert_summary.ts index 5da72c7f6a76a..abfc4c9d5aa79 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_alert_summary.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_alert_summary.ts @@ -39,7 +39,7 @@ export default ({ getService }: FtrProviderContext) => { .send({ gte: '2020-12-16T15:00:00.000Z', lte: '2020-12-16T16:00:00.000Z', - featureIds: ['logs'], + ruleTypeIds: ['logs.alert.document.count'], fixed_interval: '10m', }) .expect(200); @@ -83,7 +83,7 @@ export default ({ getService }: FtrProviderContext) => { }, }, ], - featureIds: ['logs'], + ruleTypeIds: ['logs.alert.document.count'], fixed_interval: '10m', }) .expect(200); @@ -127,7 +127,7 @@ export default ({ getService }: FtrProviderContext) => { }, }, ], - featureIds: ['logs'], + ruleTypeIds: ['logs.alert.document.count'], fixed_interval: '10m', }) .expect(200); diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_alerts_index.ts b/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_alerts_index.ts index 530c0a57b02ef..604cff34865d9 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_alerts_index.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_alerts_index.ts @@ -30,16 +30,18 @@ export default ({ getService }: FtrProviderContext) => { const STACK_ALERT_INDEX = '.alerts-stack.alerts-default'; const getIndexName = async ( - featureIds: string[], + ruleTypeIds: string[], user: User, space: string, expectedStatusCode: number = 200 ) => { const resp = await supertestWithoutAuth - .get(`${getSpaceUrlPrefix(space)}${ALERTS_INDEX_URL}?features=${featureIds.join(',')}`) + .get(`${getSpaceUrlPrefix(space)}${ALERTS_INDEX_URL}`) + .query({ ruleTypeIds }) .auth(user.username, user.password) .set('kbn-xsrf', 'true') .expect(expectedStatusCode); + return resp.body.index_name as string[]; }; @@ -47,33 +49,34 @@ export default ({ getService }: FtrProviderContext) => { before(async () => { await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); }); + + before(async () => { + await esArchiver.unload('x-pack/test/functional/es_archives/rule_registry/alerts'); + }); + describe('Users:', () => { it(`${obsOnlySpacesAll.username} should be able to access the APM alert in ${SPACE1}`, async () => { - const indexNames = await getIndexName(['apm'], obsOnlySpacesAll, SPACE1); + const indexNames = await getIndexName(['apm.error_rate'], obsOnlySpacesAll, SPACE1); expect(indexNames.includes(APM_ALERT_INDEX)).to.eql(true); // assert this here so we can use constants in the dynamically-defined test cases below }); it(`${superUser.username} should be able to access the APM alert in ${SPACE1}`, async () => { - const indexNames = await getIndexName(['apm'], superUser, SPACE1); + const indexNames = await getIndexName(['apm.error_rate'], superUser, SPACE1); expect(indexNames.includes(APM_ALERT_INDEX)).to.eql(true); // assert this here so we can use constants in the dynamically-defined test cases below }); it(`${secOnlyRead.username} should NOT be able to access the APM alert in ${SPACE1}`, async () => { - const indexNames = await getIndexName(['apm'], secOnlyRead, SPACE1); + const indexNames = await getIndexName(['apm.error_rate'], secOnlyRead, SPACE1); expect(indexNames?.length).to.eql(0); }); it(`${secOnlyRead.username} should be able to access the security solution alert in ${SPACE1}`, async () => { - const indexNames = await getIndexName(['siem'], secOnlyRead, SPACE1); + const indexNames = await getIndexName(['siem.esqlRule'], secOnlyRead, SPACE1); expect(indexNames.includes(`${SECURITY_SOLUTION_ALERT_INDEX}-${SPACE1}`)).to.eql(true); // assert this here so we can use constants in the dynamically-defined test cases below }); it(`${stackAlertsOnlyReadSpacesAll.username} should be able to access the stack alert in ${SPACE1}`, async () => { - const indexNames = await getIndexName( - ['stackAlerts'], - stackAlertsOnlyReadSpacesAll, - SPACE1 - ); + const indexNames = await getIndexName(['.es-query'], stackAlertsOnlyReadSpacesAll, SPACE1); expect(indexNames.includes(STACK_ALERT_INDEX)).to.eql(true); }); }); diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_browser_fields_by_feature_id.ts b/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_browser_fields_by_rule_type_ids.ts similarity index 74% rename from x-pack/test/rule_registry/security_and_spaces/tests/basic/get_browser_fields_by_feature_id.ts rename to x-pack/test/rule_registry/security_and_spaces/tests/basic/get_browser_fields_by_rule_type_ids.ts index 352ff0188b015..ac05dad573c65 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_browser_fields_by_feature_id.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_browser_fields_by_rule_type_ids.ts @@ -6,6 +6,7 @@ */ import expect from 'expect'; +import { OBSERVABILITY_RULE_TYPE_IDS } from '@kbn/rule-data-utils'; import { superUser, obsOnlySpacesAll, secOnlyRead } from '../../../common/lib/authentication/users'; import type { User } from '../../../common/lib/authentication/types'; import { FtrProviderContext } from '../../../common/ftr_provider_context'; @@ -20,31 +21,38 @@ export default ({ getService }: FtrProviderContext) => { const getBrowserFieldsByFeatureId = async ( user: User, - featureIds: string[], + ruleTypeIds: string[], expectedStatusCode: number = 200 ) => { const resp = await supertestWithoutAuth .get(`${getSpaceUrlPrefix(SPACE1)}${TEST_URL}`) - .query({ featureIds }) + .query({ ruleTypeIds }) .auth(user.username, user.password) .set('kbn-xsrf', 'true') .expect(expectedStatusCode); + return resp.body; }; - describe('Alert - Get browser fields by featureId', () => { + describe('Alert - Get browser fields by rule type IDs', () => { + const ruleTypeIds = [ + ...OBSERVABILITY_RULE_TYPE_IDS, + '.es-query', + 'xpack.ml.anomaly_detection_alert', + ]; + before(async () => { await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); }); + after(async () => { + await esArchiver.unload('x-pack/test/functional/es_archives/rule_registry/alerts'); + }); + describe('Users:', () => { - it(`${obsOnlySpacesAll.username} should be able to get browser fields for o11y featureIds`, async () => { - const resp = await getBrowserFieldsByFeatureId(obsOnlySpacesAll, [ - 'apm', - 'infrastructure', - 'logs', - 'uptime', - ]); + it(`${obsOnlySpacesAll.username} should be able to get browser fields for o11y ruleTypeIds that has access to`, async () => { + const resp = await getBrowserFieldsByFeatureId(obsOnlySpacesAll, ruleTypeIds); + expect(Object.keys(resp.browserFields)).toEqual([ 'base', 'agent', @@ -61,13 +69,9 @@ export default ({ getService }: FtrProviderContext) => { ]); }); - it(`${superUser.username} should be able to get browser fields for o11y featureIds`, async () => { - const resp = await getBrowserFieldsByFeatureId(superUser, [ - 'apm', - 'infrastructure', - 'logs', - 'uptime', - ]); + it(`${superUser.username} should be able to get browser fields for all o11y ruleTypeIds`, async () => { + const resp = await getBrowserFieldsByFeatureId(superUser, ruleTypeIds); + expect(Object.keys(resp.browserFields)).toEqual([ 'base', 'agent', @@ -82,17 +86,18 @@ export default ({ getService }: FtrProviderContext) => { 'observer', 'orchestrator', 'service', + 'slo', 'tls', 'url', ]); }); - it(`${superUser.username} should NOT be able to get browser fields for siem featureId`, async () => { - await getBrowserFieldsByFeatureId(superUser, ['siem'], 404); + it(`${superUser.username} should NOT be able to get browser fields for siem rule types`, async () => { + await getBrowserFieldsByFeatureId(superUser, ['siem.queryRule'], 404); }); - it(`${secOnlyRead.username} should NOT be able to get browser fields for siem featureId`, async () => { - await getBrowserFieldsByFeatureId(secOnlyRead, ['siem'], 404); + it(`${secOnlyRead.username} should NOT be able to get browser fields for siem rule types`, async () => { + await getBrowserFieldsByFeatureId(secOnlyRead, ['siem.queryRule'], 404); }); }); }); diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_feature_ids_by_registration_contexts.ts b/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_feature_ids_by_registration_contexts.ts deleted file mode 100644 index 5b4063cfe5285..0000000000000 --- a/x-pack/test/rule_registry/security_and_spaces/tests/basic/get_feature_ids_by_registration_contexts.ts +++ /dev/null @@ -1,79 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import expect from '@kbn/expect'; - -import { superUser, obsOnlySpacesAll, secOnlyRead } from '../../../common/lib/authentication/users'; -import type { User } from '../../../common/lib/authentication/types'; -import { FtrProviderContext } from '../../../common/ftr_provider_context'; -import { getSpaceUrlPrefix } from '../../../common/lib/authentication/spaces'; - -// eslint-disable-next-line import/no-default-export -export default ({ getService }: FtrProviderContext) => { - const supertestWithoutAuth = getService('supertestWithoutAuth'); - const esArchiver = getService('esArchiver'); - - const TEST_URL = '/internal/rac/alerts'; - const ALERTS_FEATURE_IDS_URL = `${TEST_URL}/_feature_ids`; - const SPACE1 = 'space1'; - - const getApmFeatureIdByRegistrationContexts = async ( - user: User, - space: string, - expectedStatusCode: number = 200 - ) => { - const resp = await supertestWithoutAuth - .get( - `${getSpaceUrlPrefix(space)}${ALERTS_FEATURE_IDS_URL}?registrationContext=observability.apm` - ) - .auth(user.username, user.password) - .set('kbn-xsrf', 'true') - .expect(expectedStatusCode); - return resp.body as string[]; - }; - - const getSecurityFeatureIdByRegistrationContexts = async ( - user: User, - space: string, - expectedStatusCode: number = 200 - ) => { - const resp = await supertestWithoutAuth - .get(`${getSpaceUrlPrefix(space)}${ALERTS_FEATURE_IDS_URL}?registrationContext=security`) - .auth(user.username, user.password) - .set('kbn-xsrf', 'true') - .expect(expectedStatusCode); - - return resp.body as string[]; - }; - - describe('Alert - Get feature ids by registration context', () => { - before(async () => { - await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); - }); - describe('Users:', () => { - it(`${obsOnlySpacesAll.username} should be able to get feature id for registration context 'observability.apm' in ${SPACE1}`, async () => { - const featureIds = await getApmFeatureIdByRegistrationContexts(obsOnlySpacesAll, SPACE1); - expect(featureIds).to.eql(['apm']); - }); - - it(`${superUser.username} should be able to get feature id for registration context 'observability.apm' in ${SPACE1}`, async () => { - const featureIds = await getApmFeatureIdByRegistrationContexts(superUser, SPACE1); - expect(featureIds).to.eql(['apm']); - }); - - it(`${secOnlyRead.username} should NOT be able to get feature id for registration context 'observability.apm' in ${SPACE1}`, async () => { - const featureIds = await getApmFeatureIdByRegistrationContexts(secOnlyRead, SPACE1); - expect(featureIds).to.eql([]); - }); - - it(`${secOnlyRead.username} should be able to get feature id for registration context 'security' in ${SPACE1}`, async () => { - const featureIds = await getSecurityFeatureIdByRegistrationContexts(secOnlyRead, SPACE1); - expect(featureIds).to.eql(['siem']); - }); - }); - }); -}; diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/basic/index.ts b/x-pack/test/rule_registry/security_and_spaces/tests/basic/index.ts index 5237cd02c0c89..e7593121bc2d0 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/basic/index.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/basic/index.ts @@ -25,11 +25,10 @@ export default ({ loadTestFile, getService }: FtrProviderContext): void => { // loadTestFile(require.resolve('./update_alert')); // loadTestFile(require.resolve('./bulk_update_alerts')); - loadTestFile(require.resolve('./get_feature_ids_by_registration_contexts')); loadTestFile(require.resolve('./get_alerts_index')); loadTestFile(require.resolve('./find_alerts')); loadTestFile(require.resolve('./search_strategy')); - loadTestFile(require.resolve('./get_browser_fields_by_feature_id')); + loadTestFile(require.resolve('./get_browser_fields_by_rule_type_ids')); loadTestFile(require.resolve('./get_alert_summary')); loadTestFile(require.resolve('./get_aad_fields_by_rule_type')); }); diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/basic/search_strategy.ts b/x-pack/test/rule_registry/security_and_spaces/tests/basic/search_strategy.ts index ffcd6fee5cf85..6462e2a1ec807 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/basic/search_strategy.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/basic/search_strategy.ts @@ -5,7 +5,6 @@ * 2.0. */ import expect from '@kbn/expect'; -import { AlertConsumers } from '@kbn/rule-data-utils'; import type { RuleRegistrySearchResponse } from '@kbn/rule-registry-plugin/common'; import type { FtrProviderContext } from '../../../common/ftr_provider_context'; @@ -39,6 +38,7 @@ export default ({ getService }: FtrProviderContext) => { before(async () => { await esArchiver.load('x-pack/test/functional/es_archives/observability/alerts'); }); + after(async () => { await esArchiver.unload('x-pack/test/functional/es_archives/observability/alerts'); }); @@ -54,15 +54,14 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: [AlertConsumers.LOGS], + ruleTypeIds: ['logs.alert.document.count'], }, strategy: 'privateRuleRegistryAlertsSearchStrategy', }); + expect(result.rawResponse.hits.total).to.eql(5); - const consumers = result.rawResponse.hits.hits.map((hit) => { - return hit.fields?.['kibana.alert.rule.consumer']; - }); - expect(consumers.every((consumer) => consumer === AlertConsumers.LOGS)); + + validateRuleTypeIds(result, ['logs.alert.document.count']); }); it('should support pagination and sorting', async () => { @@ -76,7 +75,7 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: [AlertConsumers.LOGS], + ruleTypeIds: ['logs.alert.document.count'], pagination: { pageSize: 2, pageIndex: 1, @@ -91,25 +90,35 @@ export default ({ getService }: FtrProviderContext) => { }, strategy: 'privateRuleRegistryAlertsSearchStrategy', }); + expect(result.rawResponse.hits.total).to.eql(5); expect(result.rawResponse.hits.hits.length).to.eql(2); + const first = result.rawResponse.hits.hits[0].fields?.['kibana.alert.evaluation.value']; const second = result.rawResponse.hits.hits[1].fields?.['kibana.alert.evaluation.value']; + expect(first > second).to.be(true); }); }); describe('siem', () => { + const siemRuleTypeIds = [ + 'siem.indicatorRule', + 'siem.thresholdRule', + 'siem.eqlRule', + 'siem.queryRule', + ]; + before(async () => { await esArchiver.load('x-pack/test/functional/es_archives/observability/alerts'); await esArchiver.load('x-pack/test/functional/es_archives/security_solution/alerts/8.1.0'); }); after(async () => { + await esArchiver.unload('x-pack/test/functional/es_archives/observability/alerts'); await esArchiver.unload( 'x-pack/test/functional/es_archives/security_solution/alerts/8.1.0' ); - await esArchiver.unload('x-pack/test/functional/es_archives/observability/alerts'); }); it('should return alerts from siem rules', async () => { @@ -123,15 +132,14 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: [AlertConsumers.SIEM], + ruleTypeIds: siemRuleTypeIds, }, strategy: 'privateRuleRegistryAlertsSearchStrategy', }); + expect(result.rawResponse.hits.total).to.eql(50); - const consumers = result.rawResponse.hits.hits.map( - (hit) => hit.fields?.['kibana.alert.rule.consumer'] - ); - expect(consumers.every((consumer) => consumer === AlertConsumers.SIEM)); + + validateRuleTypeIds(result, siemRuleTypeIds); }); it('should throw an error when trying to to search for more than just siem', async () => { @@ -145,13 +153,14 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: [AlertConsumers.SIEM, AlertConsumers.LOGS], + ruleTypeIds: ['siem.indicatorRule', 'logs.alert.document.count'], }, strategy: 'privateRuleRegistryAlertsSearchStrategy', }); - expect(result.statusCode).to.be(500); + + expect(result.statusCode).to.be(400); expect(result.message).to.be( - `The privateRuleRegistryAlertsSearchStrategy search strategy is unable to accommodate requests containing multiple feature IDs and one of those IDs is SIEM.` + 'The privateRuleRegistryAlertsSearchStrategy search strategy is unable to accommodate requests containing multiple rule types with mixed authorization.' ); }); @@ -168,7 +177,7 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: [AlertConsumers.SIEM], + ruleTypeIds: siemRuleTypeIds, runtimeMappings: { [runtimeFieldKey]: { type: 'keyword', @@ -180,18 +189,24 @@ export default ({ getService }: FtrProviderContext) => { }, strategy: 'privateRuleRegistryAlertsSearchStrategy', }); + expect(result.rawResponse.hits.total).to.eql(50); + const runtimeFields = result.rawResponse.hits.hits.map( (hit) => hit.fields?.[runtimeFieldKey] ); + expect(runtimeFields.every((field) => field === runtimeFieldValue)); }); }); describe('apm', () => { + const apmRuleTypeIds = ['apm.transaction_error_rate', 'apm.error_rate']; + before(async () => { await esArchiver.load('x-pack/test/functional/es_archives/observability/alerts'); }); + after(async () => { await esArchiver.unload('x-pack/test/functional/es_archives/observability/alerts'); }); @@ -207,19 +222,20 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: [AlertConsumers.APM], + ruleTypeIds: apmRuleTypeIds, }, strategy: 'privateRuleRegistryAlertsSearchStrategy', space: 'default', }); + expect(result.rawResponse.hits.total).to.eql(9); - const consumers = result.rawResponse.hits.hits.map( - (hit) => hit.fields?.['kibana.alert.rule.consumer'] - ); - expect(consumers.every((consumer) => consumer === AlertConsumers.APM)); + + validateRuleTypeIds(result, apmRuleTypeIds); }); - it('should not by pass our RBAC authz filter with a should filter', async () => { + it('should return alerts from different rules', async () => { + const ruleTypeIds = [...apmRuleTypeIds, 'logs.alert.document.count']; + const result = await secureSearch.send({ supertestWithoutAuth, auth: { @@ -230,7 +246,83 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: [AlertConsumers.APM], + ruleTypeIds, + }, + strategy: 'privateRuleRegistryAlertsSearchStrategy', + space: 'default', + }); + + expect(result.rawResponse.hits.total).to.eql(14); + + validateRuleTypeIds(result, ruleTypeIds); + }); + + it('should filter alerts by rule type IDs with consumers', async () => { + const result = await secureSearch.send({ + supertestWithoutAuth, + auth: { + username: obsOnlySpacesAll.username, + password: obsOnlySpacesAll.password, + }, + referer: 'test', + kibanaVersion, + internalOrigin: 'Kibana', + options: { + ruleTypeIds: apmRuleTypeIds, + consumers: ['alerts', 'logs'], + }, + strategy: 'privateRuleRegistryAlertsSearchStrategy', + space: 'default', + }); + + expect(result.rawResponse.hits.total).to.eql(9); + + validateRuleTypeIds(result, apmRuleTypeIds); + }); + + it('should filter alerts by consumers with rule type IDs', async () => { + const ruleTypeIds = [...apmRuleTypeIds, 'logs.alert.document.count']; + + const result = await secureSearch.send({ + supertestWithoutAuth, + auth: { + username: obsOnlySpacesAll.username, + password: obsOnlySpacesAll.password, + }, + referer: 'test', + kibanaVersion, + internalOrigin: 'Kibana', + options: { + ruleTypeIds, + consumers: ['alerts'], + }, + strategy: 'privateRuleRegistryAlertsSearchStrategy', + space: 'default', + }); + + /** + *There are five documents of rule type logs.alert.document.count + * The four have the consumer set to alerts + * and the one has the consumer set to logs. + * All apm rule types (nine in total) have consumer set to alerts. + */ + expect(result.rawResponse.hits.total).to.eql(13); + + validateRuleTypeIds(result, ruleTypeIds); + }); + + it('should not by pass our RBAC authz filter with a should filter for rule type ids', async () => { + const result = await secureSearch.send({ + supertestWithoutAuth, + auth: { + username: obsOnlySpacesAll.username, + password: obsOnlySpacesAll.password, + }, + referer: 'test', + kibanaVersion, + internalOrigin: 'Kibana', + options: { + ruleTypeIds: apmRuleTypeIds, query: { bool: { filter: [], @@ -240,7 +332,7 @@ export default ({ getService }: FtrProviderContext) => { should: [ { match: { - 'kibana.alert.rule.consumer': 'logs', + 'kibana.alert.rule.rule_type_id': 'metrics.alert.inventory.threshold', }, }, ], @@ -256,14 +348,56 @@ export default ({ getService }: FtrProviderContext) => { strategy: 'privateRuleRegistryAlertsSearchStrategy', space: 'default', }); + expect(result.rawResponse.hits.total).to.eql(9); - const consumers = result.rawResponse.hits.hits.map( - (hit) => hit.fields?.['kibana.alert.rule.consumer'] - ); - expect(consumers.every((consumer) => consumer === AlertConsumers.APM)); + + validateRuleTypeIds(result, apmRuleTypeIds); + }); + + it('should not by pass our RBAC authz filter with a should filter for consumers', async () => { + const result = await secureSearch.send({ + supertestWithoutAuth, + auth: { + username: obsOnlySpacesAll.username, + password: obsOnlySpacesAll.password, + }, + referer: 'test', + kibanaVersion, + internalOrigin: 'Kibana', + options: { + ruleTypeIds: apmRuleTypeIds, + query: { + bool: { + filter: [], + should: [ + { + bool: { + should: [ + { + match: { + 'kibana.alert.rule.consumer': 'infrastructure', + }, + }, + ], + minimum_should_match: 1, + }, + }, + ], + must: [], + must_not: [], + }, + }, + }, + strategy: 'privateRuleRegistryAlertsSearchStrategy', + space: 'default', + }); + + expect(result.rawResponse.hits.total).to.eql(9); + + validateRuleTypeIds(result, apmRuleTypeIds); }); - it('should return an empty response with must filter and our RBAC authz filter', async () => { + it('should return an empty response with must filter and our RBAC authz filter for rule type ids', async () => { const result = await secureSearch.send({ supertestWithoutAuth, auth: { @@ -274,7 +408,7 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: [AlertConsumers.APM], + ruleTypeIds: apmRuleTypeIds, query: { bool: { filter: [], @@ -284,7 +418,7 @@ export default ({ getService }: FtrProviderContext) => { should: [ { match: { - 'kibana.alert.rule.consumer': 'logs', + 'kibana.alert.rule.rule_type_id': 'metrics.alert.inventory.threshold', }, }, ], @@ -300,10 +434,11 @@ export default ({ getService }: FtrProviderContext) => { strategy: 'privateRuleRegistryAlertsSearchStrategy', space: 'default', }); + expect(result.rawResponse.hits.total).to.eql(0); }); - it('should not by pass our RBAC authz filter with must_not filter', async () => { + it('should return an empty response with must filter and our RBAC authz filter for consumers', async () => { const result = await secureSearch.send({ supertestWithoutAuth, auth: { @@ -314,7 +449,91 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: [AlertConsumers.APM], + ruleTypeIds: apmRuleTypeIds, + query: { + bool: { + filter: [], + must: [ + { + bool: { + should: [ + { + match: { + 'kibana.alert.rule.consumer': 'infrastructure', + }, + }, + ], + minimum_should_match: 1, + }, + }, + ], + should: [], + must_not: [], + }, + }, + }, + strategy: 'privateRuleRegistryAlertsSearchStrategy', + space: 'default', + }); + + expect(result.rawResponse.hits.total).to.eql(0); + }); + + it('should not by pass our RBAC authz filter with must_not filter for rule type ids', async () => { + const result = await secureSearch.send({ + supertestWithoutAuth, + auth: { + username: obsOnlySpacesAll.username, + password: obsOnlySpacesAll.password, + }, + referer: 'test', + kibanaVersion, + internalOrigin: 'Kibana', + options: { + ruleTypeIds: apmRuleTypeIds, + query: { + bool: { + filter: [], + must: [], + must_not: [ + { + bool: { + should: [ + ...apmRuleTypeIds.map((apmRuleTypeId) => ({ + match: { + 'kibana.alert.rule.rule_type_id': apmRuleTypeId, + }, + })), + ], + minimum_should_match: apmRuleTypeIds.length, + }, + }, + ], + should: [], + }, + }, + }, + strategy: 'privateRuleRegistryAlertsSearchStrategy', + space: 'default', + }); + + expect(result.rawResponse.hits.total).to.eql(9); + + validateRuleTypeIds(result, apmRuleTypeIds); + }); + + it('should not by pass our RBAC authz filter with must_not filter for consumers', async () => { + const result = await secureSearch.send({ + supertestWithoutAuth, + auth: { + username: obsOnlySpacesAll.username, + password: obsOnlySpacesAll.password, + }, + referer: 'test', + kibanaVersion, + internalOrigin: 'Kibana', + options: { + ruleTypeIds: apmRuleTypeIds, query: { bool: { filter: [], @@ -340,11 +559,136 @@ export default ({ getService }: FtrProviderContext) => { strategy: 'privateRuleRegistryAlertsSearchStrategy', space: 'default', }); + expect(result.rawResponse.hits.total).to.eql(9); - const consumers = result.rawResponse.hits.hits.map( - (hit) => hit.fields?.['kibana.alert.rule.consumer'] - ); - expect(consumers.every((consumer) => consumer === AlertConsumers.APM)); + + validateRuleTypeIds(result, apmRuleTypeIds); + }); + + it('should not by pass our RBAC authz filter with the ruleTypeIds and consumers parameter', async () => { + const ruleTypeIds = [ + ...apmRuleTypeIds, + 'metrics.alert.inventory.threshold', + 'metrics.alert.threshold', + '.es-query', + ]; + + const result = await secureSearch.send({ + supertestWithoutAuth, + auth: { + /** + * obsOnlySpacesAll does not have access to the following pairs: + * + * Rule type ID: metrics.alert.inventory.threshold + * Consumer: alerts + * + * Rule type ID: metrics.alert.threshold + * Consumer: alerts + * + * Rule type ID: .es-query + * Consumer: discover + */ + username: obsOnlySpacesAll.username, + password: obsOnlySpacesAll.password, + }, + referer: 'test', + kibanaVersion, + internalOrigin: 'Kibana', + options: { + ruleTypeIds, + consumers: ['alerts', 'discover'], + }, + strategy: 'privateRuleRegistryAlertsSearchStrategy', + space: 'default', + }); + + expect(result.rawResponse.hits.total).to.eql(9); + + validateRuleTypeIds(result, apmRuleTypeIds); + }); + + it('should not return any alerts if the user does not have access to any alerts', async () => { + const result = await secureSearch.send({ + supertestWithoutAuth, + auth: { + username: obsOnlySpacesAll.username, + password: obsOnlySpacesAll.password, + }, + referer: 'test', + kibanaVersion, + internalOrigin: 'Kibana', + options: { + ruleTypeIds: ['metrics.alert.threshold', 'metrics.alert.inventory.threshold'], + }, + strategy: 'privateRuleRegistryAlertsSearchStrategy', + space: 'default', + }); + + expect(result.rawResponse.hits.total).to.eql(0); + }); + + it('should not return alerts that the user does not have access to', async () => { + const result = await secureSearch.send({ + supertestWithoutAuth, + auth: { + username: obsOnlySpacesAll.username, + password: obsOnlySpacesAll.password, + }, + referer: 'test', + kibanaVersion, + internalOrigin: 'Kibana', + options: { + ruleTypeIds: ['metrics.alert.threshold', 'logs.alert.document.count'], + }, + strategy: 'privateRuleRegistryAlertsSearchStrategy', + space: 'default', + }); + + expect(result.rawResponse.hits.total).to.eql(5); + validateRuleTypeIds(result, ['logs.alert.document.count']); + }); + + it('should not return alerts if the user does not have access to using a filter', async () => { + const result = await secureSearch.send({ + supertestWithoutAuth, + auth: { + username: obsOnlySpacesAll.username, + password: obsOnlySpacesAll.password, + }, + referer: 'test', + kibanaVersion, + internalOrigin: 'Kibana', + options: { + ruleTypeIds: apmRuleTypeIds, + query: { + bool: { + filter: [], + should: [ + { + bool: { + should: [ + { + match: { + 'kibana.alert.rule.rule_type_id': 'metrics.alert.inventory.threshold', + }, + }, + ], + minimum_should_match: 1, + }, + }, + ], + must: [], + must_not: [], + }, + }, + }, + strategy: 'privateRuleRegistryAlertsSearchStrategy', + space: 'default', + }); + + expect(result.rawResponse.hits.total).to.eql(9); + + validateRuleTypeIds(result, apmRuleTypeIds); }); }); @@ -367,11 +711,13 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: ['discover'], + ruleTypeIds: ['.es-query'], }, strategy: 'privateRuleRegistryAlertsSearchStrategy', }); + validateRuleTypeIds(result, ['.es-query']); + expect(result.rawResponse.hits.total).to.eql(1); const consumers = result.rawResponse.hits.hits.map((hit) => { @@ -392,11 +738,13 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: ['discover'], + ruleTypeIds: ['.es-query'], }, strategy: 'privateRuleRegistryAlertsSearchStrategy', }); + validateRuleTypeIds(result, ['.es-query']); + expect(result.rawResponse.hits.total).to.eql(1); const consumers = result.rawResponse.hits.hits.map((hit) => { @@ -417,13 +765,12 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: ['discover'], + ruleTypeIds: ['.es-query'], }, strategy: 'privateRuleRegistryAlertsSearchStrategy', }); - expect(result.statusCode).to.be(500); - expect(result.message).to.be('Unauthorized to find alerts for any rule types'); + expect(result.rawResponse.hits.total).to.eql(0); }); }); @@ -439,12 +786,29 @@ export default ({ getService }: FtrProviderContext) => { kibanaVersion, internalOrigin: 'Kibana', options: { - featureIds: [], + ruleTypeIds: [], }, strategy: 'privateRuleRegistryAlertsSearchStrategy', }); - expect(result.rawResponse).to.eql({}); + + expect(result.rawResponse.hits.total).to.eql(0); }); }); }); }; + +const validateRuleTypeIds = (result: RuleRegistrySearchResponse, ruleTypeIdsToVerify: string[]) => { + expect(result.rawResponse.hits.total).to.greaterThan(0); + + const ruleTypeIds = result.rawResponse.hits.hits + .map((hit) => { + return hit.fields?.['kibana.alert.rule.rule_type_id']; + }) + .flat(); + + expect( + ruleTypeIds.every((ruleTypeId) => + ruleTypeIdsToVerify.some((ruleTypeIdToVerify) => ruleTypeIdToVerify === ruleTypeId) + ) + ).to.eql(true); +}; diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/basic/update_alert.ts b/x-pack/test/rule_registry/security_and_spaces/tests/basic/update_alert.ts index 4d7607442fbcb..237f492ebf363 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/basic/update_alert.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/basic/update_alert.ts @@ -101,7 +101,6 @@ export default ({ getService }: FtrProviderContext) => { function addTests({ space, authorizedUsers, unauthorizedUsers, alertId, index }: TestCase) { authorizedUsers.forEach(({ username, password }) => { it(`${username} should be able to update alert ${alertId} in ${space}/${index}`, async () => { - await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); // since this is a success case, reload the test data immediately beforehand await supertestWithoutAuth .post(`${getSpaceUrlPrefix(space)}${TEST_URL}`) .auth(username, password) diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/trial/get_alerts.ts b/x-pack/test/rule_registry/security_and_spaces/tests/trial/get_alerts.ts index f4aa5c503bc19..f3c4a4e6146a2 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/trial/get_alerts.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/trial/get_alerts.ts @@ -47,6 +47,11 @@ export default ({ getService }: FtrProviderContext) => { before(async () => { await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); }); + + after(async () => { + await esArchiver.unload('x-pack/test/functional/es_archives/rule_registry/alerts'); + }); + describe('Users:', () => { // user with minimal_read and alerts_read privileges should be able to access apm alert it(`${obsMinReadAlertsRead.username} should be able to access the APM alert in ${SPACE1}`, async () => { diff --git a/x-pack/test/rule_registry/security_and_spaces/tests/trial/update_alert.ts b/x-pack/test/rule_registry/security_and_spaces/tests/trial/update_alert.ts index 9b4e4b70d59c8..0de2adbf0f57f 100644 --- a/x-pack/test/rule_registry/security_and_spaces/tests/trial/update_alert.ts +++ b/x-pack/test/rule_registry/security_and_spaces/tests/trial/update_alert.ts @@ -46,9 +46,11 @@ export default ({ getService }: FtrProviderContext) => { beforeEach(async () => { await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); }); + afterEach(async () => { await esArchiver.unload('x-pack/test/functional/es_archives/rule_registry/alerts'); }); + it(`${superUser.username} should be able to update the APM alert in ${SPACE1}`, async () => { const apmIndex = await getAPMIndexName(superUser); await supertestWithoutAuth diff --git a/x-pack/test/rule_registry/spaces_only/tests/trial/update_alert.ts b/x-pack/test/rule_registry/spaces_only/tests/trial/update_alert.ts index 31c3cfdecb9ee..2fe7ff9dac0c4 100644 --- a/x-pack/test/rule_registry/spaces_only/tests/trial/update_alert.ts +++ b/x-pack/test/rule_registry/spaces_only/tests/trial/update_alert.ts @@ -90,7 +90,6 @@ export default ({ getService }: FtrProviderContext) => { }); it(`${superUser.username} should be able to update alert ${APM_ALERT_ID} in ${SPACE2}/${APM_ALERT_INDEX}`, async () => { - await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts'); // since this is a success case, reload the test data immediately beforehand await supertestWithoutAuth .post(`${getSpaceUrlPrefix(SPACE2)}${TEST_URL}`) .set('kbn-xsrf', 'true') diff --git a/x-pack/test/security_api_integration/plugins/features_provider/server/index.ts b/x-pack/test/security_api_integration/plugins/features_provider/server/index.ts index 61100babefea7..9b7158aca7b32 100644 --- a/x-pack/test/security_api_integration/plugins/features_provider/server/index.ts +++ b/x-pack/test/security_api_integration/plugins/features_provider/server/index.ts @@ -5,7 +5,7 @@ * 2.0. */ -import type { PluginSetupContract as AlertingPluginsSetup } from '@kbn/alerting-plugin/server/plugin'; +import type { AlertingServerSetup } from '@kbn/alerting-plugin/server/plugin'; import { schema } from '@kbn/config-schema'; import type { CoreSetup, Plugin, PluginInitializer } from '@kbn/core/server'; import { DEFAULT_APP_CATEGORIES } from '@kbn/core/server'; @@ -16,7 +16,7 @@ import { initRoutes } from './init_routes'; export interface PluginSetupDependencies { features: FeaturesPluginSetup; - alerting: AlertingPluginsSetup; + alerting: AlertingServerSetup; } export interface PluginStartDependencies { @@ -110,7 +110,10 @@ function case2FeatureSplit(deps: PluginSetupDependencies) { category: DEFAULT_APP_CATEGORIES.kibana, id: 'case_2_feature_a', name: 'Case #2 feature A (DEPRECATED)', - alerting: ['alerting_rule_type_one', 'alerting_rule_type_two'], + alerting: [ + { ruleTypeId: 'alerting_rule_type_one', consumers: ['case_2_feature_a'] }, + { ruleTypeId: 'alerting_rule_type_two', consumers: ['case_2_feature_a'] }, + ], cases: ['cases_owner_one', 'cases_owner_two'], privileges: { all: { @@ -122,12 +125,18 @@ function case2FeatureSplit(deps: PluginSetupDependencies) { management: { kibana: ['management_one', 'management_two'] }, alerting: { rule: { - all: ['alerting_rule_type_one', 'alerting_rule_type_two'], - read: ['alerting_rule_type_one', 'alerting_rule_type_two'], + all: [ + { ruleTypeId: 'alerting_rule_type_one', consumers: ['case_2_feature_a'] }, + { ruleTypeId: 'alerting_rule_type_two', consumers: ['case_2_feature_a'] }, + ], + read: [ + { ruleTypeId: 'alerting_rule_type_one', consumers: ['case_2_feature_a'] }, + { ruleTypeId: 'alerting_rule_type_two', consumers: ['case_2_feature_a'] }, + ], }, alert: { - all: ['alerting_rule_type_one', 'alerting_rule_type_two'], - read: ['alerting_rule_type_one', 'alerting_rule_type_two'], + all: [{ ruleTypeId: 'alerting_rule_type_one', consumers: ['case_2_feature_a'] }], + read: [{ ruleTypeId: 'alerting_rule_type_two', consumers: ['case_2_feature_a'] }], }, }, cases: { @@ -167,7 +176,12 @@ function case2FeatureSplit(deps: PluginSetupDependencies) { app: ['app_one'], catalogue: ['cat_one'], management: { kibana: ['management_one'] }, - alerting: ['alerting_rule_type_one'], + // In addition to registering the `case_2_feature_b` consumer, we also need to register + // `case_2_feature_a` as an additional consumer to ensure that users with either deprecated or + // replacement privileges can access the rules, regardless of which one created them. + alerting: [ + { ruleTypeId: 'alerting_rule_type_one', consumers: ['case_2_feature_a', 'case_2_feature_b'] }, + ], cases: ['cases_owner_one'], privileges: { all: { @@ -178,8 +192,34 @@ function case2FeatureSplit(deps: PluginSetupDependencies) { catalogue: ['cat_one'], management: { kibana: ['management_one'] }, alerting: { - rule: { all: ['alerting_rule_type_one'], read: ['alerting_rule_type_one'] }, - alert: { all: ['alerting_rule_type_one'], read: ['alerting_rule_type_one'] }, + rule: { + all: [ + { + ruleTypeId: 'alerting_rule_type_one', + consumers: ['case_2_feature_a', 'case_2_feature_b'], + }, + ], + read: [ + { + ruleTypeId: 'alerting_rule_type_one', + consumers: ['case_2_feature_a', 'case_2_feature_b'], + }, + ], + }, + alert: { + all: [ + { + ruleTypeId: 'alerting_rule_type_one', + consumers: ['case_2_feature_a', 'case_2_feature_b'], + }, + ], + read: [ + { + ruleTypeId: 'alerting_rule_type_one', + consumers: ['case_2_feature_a', 'case_2_feature_b'], + }, + ], + }, }, cases: { all: ['cases_owner_one'], @@ -208,7 +248,12 @@ function case2FeatureSplit(deps: PluginSetupDependencies) { app: ['app_two'], catalogue: ['cat_two'], management: { kibana: ['management_two'] }, - alerting: ['alerting_rule_type_two'], + // In addition to registering the `case_2_feature_c` consumer, we also need to register + // `case_2_feature_a` as an additional consumer to ensure that users with either deprecated or + // replacement privileges can access the rules, regardless of which one created them. + alerting: [ + { ruleTypeId: 'alerting_rule_type_two', consumers: ['case_2_feature_a', 'case_2_feature_c'] }, + ], cases: ['cases_owner_two'], privileges: { all: { @@ -219,8 +264,34 @@ function case2FeatureSplit(deps: PluginSetupDependencies) { catalogue: ['cat_two'], management: { kibana: ['management_two'] }, alerting: { - rule: { all: ['alerting_rule_type_two'], read: ['alerting_rule_type_two'] }, - alert: { all: ['alerting_rule_type_two'], read: ['alerting_rule_type_two'] }, + rule: { + all: [ + { + ruleTypeId: 'alerting_rule_type_two', + consumers: ['case_2_feature_a', 'case_2_feature_c'], + }, + ], + read: [ + { + ruleTypeId: 'alerting_rule_type_two', + consumers: ['case_2_feature_a', 'case_2_feature_c'], + }, + ], + }, + alert: { + all: [ + { + ruleTypeId: 'alerting_rule_type_two', + consumers: ['case_2_feature_a', 'case_2_feature_c'], + }, + ], + read: [ + { + ruleTypeId: 'alerting_rule_type_two', + consumers: ['case_2_feature_a', 'case_2_feature_c'], + }, + ], + }, }, cases: { all: ['cases_owner_two'], diff --git a/x-pack/test/security_api_integration/tests/features/deprecated_features.ts b/x-pack/test/security_api_integration/tests/features/deprecated_features.ts index 29135ff2440b2..7887cd6a23dc0 100644 --- a/x-pack/test/security_api_integration/tests/features/deprecated_features.ts +++ b/x-pack/test/security_api_integration/tests/features/deprecated_features.ts @@ -492,56 +492,88 @@ export default function ({ getService }: FtrProviderContext) { const ruleOneTransformed = await createRule( transformedUser, 'case_2_a_transform_one', - 'case_2_feature_b', + 'case_2_feature_a', 'alerting_rule_type_one' ); const ruleTwoTransformed = await createRule( transformedUser, 'case_2_a_transform_two', + 'case_2_feature_a', + 'alerting_rule_type_two' + ); + + // Create rules as user with new privileges (B). + const newUserB = getUserCredentials('case_2_b_new'); + const ruleOneNewBConsumerA = await createRule( + newUserB, + 'case_2_b_new_one', + 'case_2_feature_a', + 'alerting_rule_type_one' + ); + const ruleOneNewBConsumerB = await createRule( + newUserB, + 'case_2_b_new_one', + 'case_2_feature_b', + 'alerting_rule_type_one' + ); + + // Create cases as user with new privileges (C). + const newUserC = getUserCredentials('case_2_c_new'); + const ruleTwoNewCConsumerA = await createRule( + newUserC, + 'case_2_c_new_two', + 'case_2_feature_a', + 'alerting_rule_type_two' + ); + const ruleTwoNewCConsumerC = await createRule( + newUserC, + 'case_2_c_new_two', 'case_2_feature_c', 'alerting_rule_type_two' ); // Users with deprecated privileges should be able to access rules created by themselves and - // users with new privileges. + // users with new privileges assuming the consumer is the same. for (const ruleToCheck of [ ruleOneDeprecated, ruleTwoDeprecated, ruleOneTransformed, ruleTwoTransformed, + ruleOneNewBConsumerA, + ruleTwoNewCConsumerA, ]) { expect(await getRule(deprecatedUser, ruleToCheck.id)).toBeDefined(); + expect(await getRule(transformedUser, ruleToCheck.id)).toBeDefined(); } - // NOTE: Scenarios below require SO migrations for both alerting rules and alerts to switch to - // a new producer that is tied to feature ID. Presumably we won't have this requirement once - // https://github.com/elastic/kibana/pull/183756 is resolved. - - // Create rules as user with new privileges (B). - // const newUserB = getUserCredentials('case_2_b_new'); - // const caseOneNewB = await createRule(newUserB, { - // title: 'case_2_b_new_one', - // owner: 'cases_owner_one', - // }); - // - // // Create cases as user with new privileges (C). - // const newUserC = getUserCredentials('case_2_c_new'); - // const caseTwoNewC = await createRule(newUserC, { - // title: 'case_2_c_new_two', - // owner: 'cases_owner_two', - // }); - // + // Any new consumer that is not known to the deprecated feature shouldn't be available to the + // users with the deprecated privileges unless deprecated features are update to explicitly + // support new consumers. + for (const ruleToCheck of [ruleOneNewBConsumerB, ruleTwoNewCConsumerC]) { + expect(await getRule(deprecatedUser, ruleToCheck.id)).toBeUndefined(); + expect(await getRule(transformedUser, ruleToCheck.id)).toBeDefined(); + } - // User B and User C should be able to access cases created by themselves and users with - // deprecated and transformed privileges, but only for the specific owner. - // for (const caseToCheck of [ruleOneDeprecated, ruleOneTransformed, caseOneNewB]) { - // expect(await getRule(newUserB, caseToCheck.id)).toBeDefined(); - // expect(await getRule(newUserC, caseToCheck.id)).toBeUndefined(); - // } - // for (const caseToCheck of [ruleTwoDeprecated, ruleTwoTransformed, caseTwoNewC]) { - // expect(await getRule(newUserC, caseToCheck.id)).toBeDefined(); - // expect(await getRule(newUserB, caseToCheck.id)).toBeUndefined(); - // } + // User B and User C should be able to access rule types created by themselves and users with + // deprecated and transformed privileges, but only for the specific consumer. + for (const ruleToCheck of [ + ruleOneDeprecated, + ruleOneTransformed, + ruleOneNewBConsumerA, + ruleOneNewBConsumerB, + ]) { + expect(await getRule(newUserB, ruleToCheck.id)).toBeDefined(); + expect(await getRule(newUserC, ruleToCheck.id)).toBeUndefined(); + } + for (const ruleToCheck of [ + ruleTwoDeprecated, + ruleTwoTransformed, + ruleTwoNewCConsumerA, + ruleTwoNewCConsumerC, + ]) { + expect(await getRule(newUserC, ruleToCheck.id)).toBeDefined(); + expect(await getRule(newUserB, ruleToCheck.id)).toBeUndefined(); + } }); }); } diff --git a/x-pack/test_serverless/api_integration/test_suites/observability/platform_security/authorization.ts b/x-pack/test_serverless/api_integration/test_suites/observability/platform_security/authorization.ts index c77d5041aba06..b6dbceedfe65e 100644 --- a/x-pack/test_serverless/api_integration/test_suites/observability/platform_security/authorization.ts +++ b/x-pack/test_serverless/api_integration/test_suites/observability/platform_security/authorization.ts @@ -44,6 +44,7 @@ export default function ({ getService }: FtrProviderContext) { const features = Object.fromEntries( Object.entries(body.features).filter(([key]) => compositeFeatureIds.includes(key)) ); + expectSnapshot(features).toMatchInline(` Object { "apm": Object { @@ -126,6 +127,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/apm/rule/runSoon", "alerting:apm.error_rate/apm/rule/scheduleBackfill", "alerting:apm.error_rate/apm/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/create", + "alerting:apm.error_rate/alerts/rule/delete", + "alerting:apm.error_rate/alerts/rule/update", + "alerting:apm.error_rate/alerts/rule/updateApiKey", + "alerting:apm.error_rate/alerts/rule/enable", + "alerting:apm.error_rate/alerts/rule/disable", + "alerting:apm.error_rate/alerts/rule/muteAll", + "alerting:apm.error_rate/alerts/rule/unmuteAll", + "alerting:apm.error_rate/alerts/rule/muteAlert", + "alerting:apm.error_rate/alerts/rule/unmuteAlert", + "alerting:apm.error_rate/alerts/rule/snooze", + "alerting:apm.error_rate/alerts/rule/bulkEdit", + "alerting:apm.error_rate/alerts/rule/bulkDelete", + "alerting:apm.error_rate/alerts/rule/bulkEnable", + "alerting:apm.error_rate/alerts/rule/bulkDisable", + "alerting:apm.error_rate/alerts/rule/unsnooze", + "alerting:apm.error_rate/alerts/rule/runSoon", + "alerting:apm.error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_error_rate/apm/rule/get", "alerting:apm.transaction_error_rate/apm/rule/getRuleState", "alerting:apm.transaction_error_rate/apm/rule/getAlertSummary", @@ -154,6 +183,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/apm/rule/runSoon", "alerting:apm.transaction_error_rate/apm/rule/scheduleBackfill", "alerting:apm.transaction_error_rate/apm/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/create", + "alerting:apm.transaction_error_rate/alerts/rule/delete", + "alerting:apm.transaction_error_rate/alerts/rule/update", + "alerting:apm.transaction_error_rate/alerts/rule/updateApiKey", + "alerting:apm.transaction_error_rate/alerts/rule/enable", + "alerting:apm.transaction_error_rate/alerts/rule/disable", + "alerting:apm.transaction_error_rate/alerts/rule/muteAll", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAll", + "alerting:apm.transaction_error_rate/alerts/rule/muteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/snooze", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEdit", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDelete", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEnable", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDisable", + "alerting:apm.transaction_error_rate/alerts/rule/unsnooze", + "alerting:apm.transaction_error_rate/alerts/rule/runSoon", + "alerting:apm.transaction_error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_duration/apm/rule/get", "alerting:apm.transaction_duration/apm/rule/getRuleState", "alerting:apm.transaction_duration/apm/rule/getAlertSummary", @@ -182,6 +239,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/apm/rule/runSoon", "alerting:apm.transaction_duration/apm/rule/scheduleBackfill", "alerting:apm.transaction_duration/apm/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/create", + "alerting:apm.transaction_duration/alerts/rule/delete", + "alerting:apm.transaction_duration/alerts/rule/update", + "alerting:apm.transaction_duration/alerts/rule/updateApiKey", + "alerting:apm.transaction_duration/alerts/rule/enable", + "alerting:apm.transaction_duration/alerts/rule/disable", + "alerting:apm.transaction_duration/alerts/rule/muteAll", + "alerting:apm.transaction_duration/alerts/rule/unmuteAll", + "alerting:apm.transaction_duration/alerts/rule/muteAlert", + "alerting:apm.transaction_duration/alerts/rule/unmuteAlert", + "alerting:apm.transaction_duration/alerts/rule/snooze", + "alerting:apm.transaction_duration/alerts/rule/bulkEdit", + "alerting:apm.transaction_duration/alerts/rule/bulkDelete", + "alerting:apm.transaction_duration/alerts/rule/bulkEnable", + "alerting:apm.transaction_duration/alerts/rule/bulkDisable", + "alerting:apm.transaction_duration/alerts/rule/unsnooze", + "alerting:apm.transaction_duration/alerts/rule/runSoon", + "alerting:apm.transaction_duration/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_duration/alerts/rule/deleteBackfill", "alerting:apm.anomaly/apm/rule/get", "alerting:apm.anomaly/apm/rule/getRuleState", "alerting:apm.anomaly/apm/rule/getAlertSummary", @@ -210,26 +295,74 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/apm/rule/runSoon", "alerting:apm.anomaly/apm/rule/scheduleBackfill", "alerting:apm.anomaly/apm/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/create", + "alerting:apm.anomaly/alerts/rule/delete", + "alerting:apm.anomaly/alerts/rule/update", + "alerting:apm.anomaly/alerts/rule/updateApiKey", + "alerting:apm.anomaly/alerts/rule/enable", + "alerting:apm.anomaly/alerts/rule/disable", + "alerting:apm.anomaly/alerts/rule/muteAll", + "alerting:apm.anomaly/alerts/rule/unmuteAll", + "alerting:apm.anomaly/alerts/rule/muteAlert", + "alerting:apm.anomaly/alerts/rule/unmuteAlert", + "alerting:apm.anomaly/alerts/rule/snooze", + "alerting:apm.anomaly/alerts/rule/bulkEdit", + "alerting:apm.anomaly/alerts/rule/bulkDelete", + "alerting:apm.anomaly/alerts/rule/bulkEnable", + "alerting:apm.anomaly/alerts/rule/bulkDisable", + "alerting:apm.anomaly/alerts/rule/unsnooze", + "alerting:apm.anomaly/alerts/rule/runSoon", + "alerting:apm.anomaly/alerts/rule/scheduleBackfill", + "alerting:apm.anomaly/alerts/rule/deleteBackfill", "alerting:apm.error_rate/apm/alert/get", "alerting:apm.error_rate/apm/alert/find", "alerting:apm.error_rate/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/apm/alert/getAlertSummary", "alerting:apm.error_rate/apm/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/update", "alerting:apm.transaction_error_rate/apm/alert/get", "alerting:apm.transaction_error_rate/apm/alert/find", "alerting:apm.transaction_error_rate/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/apm/alert/getAlertSummary", "alerting:apm.transaction_error_rate/apm/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/update", "alerting:apm.transaction_duration/apm/alert/get", "alerting:apm.transaction_duration/apm/alert/find", "alerting:apm.transaction_duration/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/apm/alert/getAlertSummary", "alerting:apm.transaction_duration/apm/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/update", "alerting:apm.anomaly/apm/alert/get", "alerting:apm.anomaly/apm/alert/find", "alerting:apm.anomaly/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/apm/alert/getAlertSummary", "alerting:apm.anomaly/apm/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/update", "api:infra", "app:infra", "app:logs", @@ -294,6 +427,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:logs.alert.document.count/logs/rule/runSoon", "alerting:logs.alert.document.count/logs/rule/scheduleBackfill", "alerting:logs.alert.document.count/logs/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", "alerting:.es-query/logs/rule/get", "alerting:.es-query/logs/rule/getRuleState", "alerting:.es-query/logs/rule/getAlertSummary", @@ -322,6 +483,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/logs/rule/runSoon", "alerting:.es-query/logs/rule/scheduleBackfill", "alerting:.es-query/logs/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", "alerting:observability.rules.custom_threshold/logs/rule/get", "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", @@ -350,6 +539,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/logs/rule/runSoon", "alerting:observability.rules.custom_threshold/logs/rule/scheduleBackfill", "alerting:observability.rules.custom_threshold/logs/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", @@ -378,171 +595,79 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/logs/rule/runSoon", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/scheduleBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", "alerting:logs.alert.document.count/logs/alert/get", "alerting:logs.alert.document.count/logs/alert/find", "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", "alerting:logs.alert.document.count/logs/alert/getAlertSummary", "alerting:logs.alert.document.count/logs/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", "alerting:.es-query/logs/alert/get", "alerting:.es-query/logs/alert/find", "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", "alerting:.es-query/logs/alert/getAlertSummary", "alerting:.es-query/logs/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", "alerting:observability.rules.custom_threshold/logs/alert/get", "alerting:observability.rules.custom_threshold/logs/alert/find", "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", "alerting:observability.rules.custom_threshold/logs/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", "app:observability", "ui:catalogue/observability", "ui:navLinks/observability", "ui:observability/read", "ui:observability/write", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/rule/create", - "alerting:slo.rules.burnRate/observability/rule/delete", - "alerting:slo.rules.burnRate/observability/rule/update", - "alerting:slo.rules.burnRate/observability/rule/updateApiKey", - "alerting:slo.rules.burnRate/observability/rule/enable", - "alerting:slo.rules.burnRate/observability/rule/disable", - "alerting:slo.rules.burnRate/observability/rule/muteAll", - "alerting:slo.rules.burnRate/observability/rule/unmuteAll", - "alerting:slo.rules.burnRate/observability/rule/muteAlert", - "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", - "alerting:slo.rules.burnRate/observability/rule/snooze", - "alerting:slo.rules.burnRate/observability/rule/bulkEdit", - "alerting:slo.rules.burnRate/observability/rule/bulkDelete", - "alerting:slo.rules.burnRate/observability/rule/bulkEnable", - "alerting:slo.rules.burnRate/observability/rule/bulkDisable", - "alerting:slo.rules.burnRate/observability/rule/unsnooze", - "alerting:slo.rules.burnRate/observability/rule/runSoon", - "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", - "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/create", - "alerting:observability.rules.custom_threshold/observability/rule/delete", - "alerting:observability.rules.custom_threshold/observability/rule/update", - "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/observability/rule/enable", - "alerting:observability.rules.custom_threshold/observability/rule/disable", - "alerting:observability.rules.custom_threshold/observability/rule/muteAll", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/snooze", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", - "alerting:observability.rules.custom_threshold/observability/rule/runSoon", - "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/create", - "alerting:.es-query/observability/rule/delete", - "alerting:.es-query/observability/rule/update", - "alerting:.es-query/observability/rule/updateApiKey", - "alerting:.es-query/observability/rule/enable", - "alerting:.es-query/observability/rule/disable", - "alerting:.es-query/observability/rule/muteAll", - "alerting:.es-query/observability/rule/unmuteAll", - "alerting:.es-query/observability/rule/muteAlert", - "alerting:.es-query/observability/rule/unmuteAlert", - "alerting:.es-query/observability/rule/snooze", - "alerting:.es-query/observability/rule/bulkEdit", - "alerting:.es-query/observability/rule/bulkDelete", - "alerting:.es-query/observability/rule/bulkEnable", - "alerting:.es-query/observability/rule/bulkDisable", - "alerting:.es-query/observability/rule/unsnooze", - "alerting:.es-query/observability/rule/runSoon", - "alerting:.es-query/observability/rule/scheduleBackfill", - "alerting:.es-query/observability/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/create", - "alerting:metrics.alert.inventory.threshold/observability/rule/delete", - "alerting:metrics.alert.inventory.threshold/observability/rule/update", - "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/observability/rule/enable", - "alerting:metrics.alert.inventory.threshold/observability/rule/disable", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -683,6 +808,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/get", "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", @@ -711,121 +864,728 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:slo.rules.burnRate/observability/alert/update", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/update", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/update", - "alerting:apm.error_rate/observability/alert/get", - "alerting:apm.error_rate/observability/alert/find", - "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.error_rate/observability/alert/getAlertSummary", - "alerting:apm.error_rate/observability/alert/update", - "alerting:apm.transaction_error_rate/observability/alert/get", - "alerting:apm.transaction_error_rate/observability/alert/find", - "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/alert/update", - "alerting:apm.transaction_duration/observability/alert/get", - "alerting:apm.transaction_duration/observability/alert/find", - "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_duration/observability/alert/getAlertSummary", - "alerting:apm.transaction_duration/observability/alert/update", - "alerting:apm.anomaly/observability/alert/get", - "alerting:apm.anomaly/observability/alert/find", - "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.anomaly/observability/alert/getAlertSummary", - "alerting:apm.anomaly/observability/alert/update", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", - "alerting:xpack.synthetics.alerts.tls/observability/alert/get", - "alerting:xpack.synthetics.alerts.tls/observability/alert/find", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/alert/update", - ], - "minimal_all": Array [ - "login:", - "api:apm", - "api:apm_write", - "api:rac", - "app:apm", - "app:ux", - "app:kibana", - "ui:catalogue/apm", - "ui:management/insightsAndAlerting/triggersActions", - "ui:navLinks/apm", - "ui:navLinks/ux", - "ui:navLinks/kibana", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:apm-indices/bulk_get", - "saved_object:apm-indices/get", - "saved_object:apm-indices/find", - "saved_object:apm-indices/open_point_in_time", - "saved_object:apm-indices/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:apm/show", - "ui:apm/save", - "ui:apm/alerting:show", - "ui:apm/alerting:save", - "alerting:apm.error_rate/apm/rule/get", - "alerting:apm.error_rate/apm/rule/getRuleState", - "alerting:apm.error_rate/apm/rule/getAlertSummary", - "alerting:apm.error_rate/apm/rule/getExecutionLog", - "alerting:apm.error_rate/apm/rule/getActionErrorLog", - "alerting:apm.error_rate/apm/rule/find", - "alerting:apm.error_rate/apm/rule/getRuleExecutionKPI", - "alerting:apm.error_rate/apm/rule/getBackfill", - "alerting:apm.error_rate/apm/rule/findBackfill", - "alerting:apm.error_rate/apm/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/deleteBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/create", + "alerting:metrics.alert.threshold/observability/rule/delete", + "alerting:metrics.alert.threshold/observability/rule/update", + "alerting:metrics.alert.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.threshold/observability/rule/enable", + "alerting:metrics.alert.threshold/observability/rule/disable", + "alerting:metrics.alert.threshold/observability/rule/muteAll", + "alerting:metrics.alert.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.threshold/observability/rule/snooze", + "alerting:metrics.alert.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.threshold/observability/rule/runSoon", + "alerting:metrics.alert.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/create", + "alerting:metrics.alert.threshold/alerts/rule/delete", + "alerting:metrics.alert.threshold/alerts/rule/update", + "alerting:metrics.alert.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.threshold/alerts/rule/enable", + "alerting:metrics.alert.threshold/alerts/rule/disable", + "alerting:metrics.alert.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.threshold/alerts/rule/snooze", + "alerting:metrics.alert.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/alerts/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/create", + "alerting:metrics.alert.inventory.threshold/observability/rule/delete", + "alerting:metrics.alert.inventory.threshold/observability/rule/update", + "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/observability/rule/enable", + "alerting:metrics.alert.inventory.threshold/observability/rule/disable", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/create", + "alerting:metrics.alert.inventory.threshold/alerts/rule/delete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/update", + "alerting:metrics.alert.inventory.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/alerts/rule/enable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/disable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/snooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/create", + "alerting:xpack.uptime.alerts.tls/observability/rule/delete", + "alerting:xpack.uptime.alerts.tls/observability/rule/update", + "alerting:xpack.uptime.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/observability/rule/enable", + "alerting:xpack.uptime.alerts.tls/observability/rule/disable", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/create", + "alerting:xpack.uptime.alerts.tls/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/update", + "alerting:xpack.uptime.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/deleteBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/create", + "alerting:logs.alert.document.count/observability/rule/delete", + "alerting:logs.alert.document.count/observability/rule/update", + "alerting:logs.alert.document.count/observability/rule/updateApiKey", + "alerting:logs.alert.document.count/observability/rule/enable", + "alerting:logs.alert.document.count/observability/rule/disable", + "alerting:logs.alert.document.count/observability/rule/muteAll", + "alerting:logs.alert.document.count/observability/rule/unmuteAll", + "alerting:logs.alert.document.count/observability/rule/muteAlert", + "alerting:logs.alert.document.count/observability/rule/unmuteAlert", + "alerting:logs.alert.document.count/observability/rule/snooze", + "alerting:logs.alert.document.count/observability/rule/bulkEdit", + "alerting:logs.alert.document.count/observability/rule/bulkDelete", + "alerting:logs.alert.document.count/observability/rule/bulkEnable", + "alerting:logs.alert.document.count/observability/rule/bulkDisable", + "alerting:logs.alert.document.count/observability/rule/unsnooze", + "alerting:logs.alert.document.count/observability/rule/runSoon", + "alerting:logs.alert.document.count/observability/rule/scheduleBackfill", + "alerting:logs.alert.document.count/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/create", + "alerting:slo.rules.burnRate/observability/rule/delete", + "alerting:slo.rules.burnRate/observability/rule/update", + "alerting:slo.rules.burnRate/observability/rule/updateApiKey", + "alerting:slo.rules.burnRate/observability/rule/enable", + "alerting:slo.rules.burnRate/observability/rule/disable", + "alerting:slo.rules.burnRate/observability/rule/muteAll", + "alerting:slo.rules.burnRate/observability/rule/unmuteAll", + "alerting:slo.rules.burnRate/observability/rule/muteAlert", + "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", + "alerting:slo.rules.burnRate/observability/rule/snooze", + "alerting:slo.rules.burnRate/observability/rule/bulkEdit", + "alerting:slo.rules.burnRate/observability/rule/bulkDelete", + "alerting:slo.rules.burnRate/observability/rule/bulkEnable", + "alerting:slo.rules.burnRate/observability/rule/bulkDisable", + "alerting:slo.rules.burnRate/observability/rule/unsnooze", + "alerting:slo.rules.burnRate/observability/rule/runSoon", + "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/create", + "alerting:slo.rules.burnRate/alerts/rule/delete", + "alerting:slo.rules.burnRate/alerts/rule/update", + "alerting:slo.rules.burnRate/alerts/rule/updateApiKey", + "alerting:slo.rules.burnRate/alerts/rule/enable", + "alerting:slo.rules.burnRate/alerts/rule/disable", + "alerting:slo.rules.burnRate/alerts/rule/muteAll", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAll", + "alerting:slo.rules.burnRate/alerts/rule/muteAlert", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAlert", + "alerting:slo.rules.burnRate/alerts/rule/snooze", + "alerting:slo.rules.burnRate/alerts/rule/bulkEdit", + "alerting:slo.rules.burnRate/alerts/rule/bulkDelete", + "alerting:slo.rules.burnRate/alerts/rule/bulkEnable", + "alerting:slo.rules.burnRate/alerts/rule/bulkDisable", + "alerting:slo.rules.burnRate/alerts/rule/unsnooze", + "alerting:slo.rules.burnRate/alerts/rule/runSoon", + "alerting:slo.rules.burnRate/alerts/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/alerts/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/create", + "alerting:observability.rules.custom_threshold/observability/rule/delete", + "alerting:observability.rules.custom_threshold/observability/rule/update", + "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/observability/rule/enable", + "alerting:observability.rules.custom_threshold/observability/rule/disable", + "alerting:observability.rules.custom_threshold/observability/rule/muteAll", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/snooze", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", + "alerting:observability.rules.custom_threshold/observability/rule/runSoon", + "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/create", + "alerting:.es-query/observability/rule/delete", + "alerting:.es-query/observability/rule/update", + "alerting:.es-query/observability/rule/updateApiKey", + "alerting:.es-query/observability/rule/enable", + "alerting:.es-query/observability/rule/disable", + "alerting:.es-query/observability/rule/muteAll", + "alerting:.es-query/observability/rule/unmuteAll", + "alerting:.es-query/observability/rule/muteAlert", + "alerting:.es-query/observability/rule/unmuteAlert", + "alerting:.es-query/observability/rule/snooze", + "alerting:.es-query/observability/rule/bulkEdit", + "alerting:.es-query/observability/rule/bulkDelete", + "alerting:.es-query/observability/rule/bulkEnable", + "alerting:.es-query/observability/rule/bulkDisable", + "alerting:.es-query/observability/rule/unsnooze", + "alerting:.es-query/observability/rule/runSoon", + "alerting:.es-query/observability/rule/scheduleBackfill", + "alerting:.es-query/observability/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", + "alerting:apm.error_rate/observability/alert/get", + "alerting:apm.error_rate/observability/alert/find", + "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/observability/alert/get", + "alerting:apm.transaction_error_rate/observability/alert/find", + "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_duration/observability/alert/get", + "alerting:apm.transaction_duration/observability/alert/find", + "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.anomaly/observability/alert/get", + "alerting:apm.anomaly/observability/alert/find", + "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.synthetics.alerts.tls/observability/alert/get", + "alerting:xpack.synthetics.alerts.tls/observability/alert/find", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/update", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/update", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/update", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/update", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/update", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/update", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/update", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/update", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/update", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/update", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", + ], + "minimal_all": Array [ + "login:", + "api:apm", + "api:apm_write", + "api:rac", + "app:apm", + "app:ux", + "app:kibana", + "ui:catalogue/apm", + "ui:management/insightsAndAlerting/triggersActions", + "ui:navLinks/apm", + "ui:navLinks/ux", + "ui:navLinks/kibana", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:apm-indices/bulk_get", + "saved_object:apm-indices/get", + "saved_object:apm-indices/find", + "saved_object:apm-indices/open_point_in_time", + "saved_object:apm-indices/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:apm/show", + "ui:apm/save", + "ui:apm/alerting:show", + "ui:apm/alerting:save", + "alerting:apm.error_rate/apm/rule/get", + "alerting:apm.error_rate/apm/rule/getRuleState", + "alerting:apm.error_rate/apm/rule/getAlertSummary", + "alerting:apm.error_rate/apm/rule/getExecutionLog", + "alerting:apm.error_rate/apm/rule/getActionErrorLog", + "alerting:apm.error_rate/apm/rule/find", + "alerting:apm.error_rate/apm/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/apm/rule/getBackfill", + "alerting:apm.error_rate/apm/rule/findBackfill", + "alerting:apm.error_rate/apm/rule/create", "alerting:apm.error_rate/apm/rule/delete", "alerting:apm.error_rate/apm/rule/update", "alerting:apm.error_rate/apm/rule/updateApiKey", @@ -844,6 +1604,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/apm/rule/runSoon", "alerting:apm.error_rate/apm/rule/scheduleBackfill", "alerting:apm.error_rate/apm/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/create", + "alerting:apm.error_rate/alerts/rule/delete", + "alerting:apm.error_rate/alerts/rule/update", + "alerting:apm.error_rate/alerts/rule/updateApiKey", + "alerting:apm.error_rate/alerts/rule/enable", + "alerting:apm.error_rate/alerts/rule/disable", + "alerting:apm.error_rate/alerts/rule/muteAll", + "alerting:apm.error_rate/alerts/rule/unmuteAll", + "alerting:apm.error_rate/alerts/rule/muteAlert", + "alerting:apm.error_rate/alerts/rule/unmuteAlert", + "alerting:apm.error_rate/alerts/rule/snooze", + "alerting:apm.error_rate/alerts/rule/bulkEdit", + "alerting:apm.error_rate/alerts/rule/bulkDelete", + "alerting:apm.error_rate/alerts/rule/bulkEnable", + "alerting:apm.error_rate/alerts/rule/bulkDisable", + "alerting:apm.error_rate/alerts/rule/unsnooze", + "alerting:apm.error_rate/alerts/rule/runSoon", + "alerting:apm.error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_error_rate/apm/rule/get", "alerting:apm.transaction_error_rate/apm/rule/getRuleState", "alerting:apm.transaction_error_rate/apm/rule/getAlertSummary", @@ -872,6 +1660,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/apm/rule/runSoon", "alerting:apm.transaction_error_rate/apm/rule/scheduleBackfill", "alerting:apm.transaction_error_rate/apm/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/create", + "alerting:apm.transaction_error_rate/alerts/rule/delete", + "alerting:apm.transaction_error_rate/alerts/rule/update", + "alerting:apm.transaction_error_rate/alerts/rule/updateApiKey", + "alerting:apm.transaction_error_rate/alerts/rule/enable", + "alerting:apm.transaction_error_rate/alerts/rule/disable", + "alerting:apm.transaction_error_rate/alerts/rule/muteAll", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAll", + "alerting:apm.transaction_error_rate/alerts/rule/muteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/snooze", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEdit", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDelete", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEnable", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDisable", + "alerting:apm.transaction_error_rate/alerts/rule/unsnooze", + "alerting:apm.transaction_error_rate/alerts/rule/runSoon", + "alerting:apm.transaction_error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_duration/apm/rule/get", "alerting:apm.transaction_duration/apm/rule/getRuleState", "alerting:apm.transaction_duration/apm/rule/getAlertSummary", @@ -900,6 +1716,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/apm/rule/runSoon", "alerting:apm.transaction_duration/apm/rule/scheduleBackfill", "alerting:apm.transaction_duration/apm/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/create", + "alerting:apm.transaction_duration/alerts/rule/delete", + "alerting:apm.transaction_duration/alerts/rule/update", + "alerting:apm.transaction_duration/alerts/rule/updateApiKey", + "alerting:apm.transaction_duration/alerts/rule/enable", + "alerting:apm.transaction_duration/alerts/rule/disable", + "alerting:apm.transaction_duration/alerts/rule/muteAll", + "alerting:apm.transaction_duration/alerts/rule/unmuteAll", + "alerting:apm.transaction_duration/alerts/rule/muteAlert", + "alerting:apm.transaction_duration/alerts/rule/unmuteAlert", + "alerting:apm.transaction_duration/alerts/rule/snooze", + "alerting:apm.transaction_duration/alerts/rule/bulkEdit", + "alerting:apm.transaction_duration/alerts/rule/bulkDelete", + "alerting:apm.transaction_duration/alerts/rule/bulkEnable", + "alerting:apm.transaction_duration/alerts/rule/bulkDisable", + "alerting:apm.transaction_duration/alerts/rule/unsnooze", + "alerting:apm.transaction_duration/alerts/rule/runSoon", + "alerting:apm.transaction_duration/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_duration/alerts/rule/deleteBackfill", "alerting:apm.anomaly/apm/rule/get", "alerting:apm.anomaly/apm/rule/getRuleState", "alerting:apm.anomaly/apm/rule/getAlertSummary", @@ -928,26 +1772,74 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/apm/rule/runSoon", "alerting:apm.anomaly/apm/rule/scheduleBackfill", "alerting:apm.anomaly/apm/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/create", + "alerting:apm.anomaly/alerts/rule/delete", + "alerting:apm.anomaly/alerts/rule/update", + "alerting:apm.anomaly/alerts/rule/updateApiKey", + "alerting:apm.anomaly/alerts/rule/enable", + "alerting:apm.anomaly/alerts/rule/disable", + "alerting:apm.anomaly/alerts/rule/muteAll", + "alerting:apm.anomaly/alerts/rule/unmuteAll", + "alerting:apm.anomaly/alerts/rule/muteAlert", + "alerting:apm.anomaly/alerts/rule/unmuteAlert", + "alerting:apm.anomaly/alerts/rule/snooze", + "alerting:apm.anomaly/alerts/rule/bulkEdit", + "alerting:apm.anomaly/alerts/rule/bulkDelete", + "alerting:apm.anomaly/alerts/rule/bulkEnable", + "alerting:apm.anomaly/alerts/rule/bulkDisable", + "alerting:apm.anomaly/alerts/rule/unsnooze", + "alerting:apm.anomaly/alerts/rule/runSoon", + "alerting:apm.anomaly/alerts/rule/scheduleBackfill", + "alerting:apm.anomaly/alerts/rule/deleteBackfill", "alerting:apm.error_rate/apm/alert/get", "alerting:apm.error_rate/apm/alert/find", "alerting:apm.error_rate/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/apm/alert/getAlertSummary", "alerting:apm.error_rate/apm/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/update", "alerting:apm.transaction_error_rate/apm/alert/get", "alerting:apm.transaction_error_rate/apm/alert/find", "alerting:apm.transaction_error_rate/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/apm/alert/getAlertSummary", "alerting:apm.transaction_error_rate/apm/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/update", "alerting:apm.transaction_duration/apm/alert/get", "alerting:apm.transaction_duration/apm/alert/find", "alerting:apm.transaction_duration/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/apm/alert/getAlertSummary", "alerting:apm.transaction_duration/apm/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/update", "alerting:apm.anomaly/apm/alert/get", "alerting:apm.anomaly/apm/alert/find", "alerting:apm.anomaly/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/apm/alert/getAlertSummary", "alerting:apm.anomaly/apm/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/update", "api:infra", "app:infra", "app:logs", @@ -1012,6 +1904,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:logs.alert.document.count/logs/rule/runSoon", "alerting:logs.alert.document.count/logs/rule/scheduleBackfill", "alerting:logs.alert.document.count/logs/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", "alerting:.es-query/logs/rule/get", "alerting:.es-query/logs/rule/getRuleState", "alerting:.es-query/logs/rule/getAlertSummary", @@ -1040,6 +1960,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/logs/rule/runSoon", "alerting:.es-query/logs/rule/scheduleBackfill", "alerting:.es-query/logs/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", "alerting:observability.rules.custom_threshold/logs/rule/get", "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", @@ -1068,6 +2016,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/logs/rule/runSoon", "alerting:observability.rules.custom_threshold/logs/rule/scheduleBackfill", "alerting:observability.rules.custom_threshold/logs/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", @@ -1096,171 +2072,79 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/logs/rule/runSoon", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/scheduleBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", "alerting:logs.alert.document.count/logs/alert/get", "alerting:logs.alert.document.count/logs/alert/find", "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", "alerting:logs.alert.document.count/logs/alert/getAlertSummary", "alerting:logs.alert.document.count/logs/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", "alerting:.es-query/logs/alert/get", "alerting:.es-query/logs/alert/find", "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", "alerting:.es-query/logs/alert/getAlertSummary", "alerting:.es-query/logs/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", "alerting:observability.rules.custom_threshold/logs/alert/get", "alerting:observability.rules.custom_threshold/logs/alert/find", "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", "alerting:observability.rules.custom_threshold/logs/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", "app:observability", "ui:catalogue/observability", "ui:navLinks/observability", "ui:observability/read", "ui:observability/write", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/rule/create", - "alerting:slo.rules.burnRate/observability/rule/delete", - "alerting:slo.rules.burnRate/observability/rule/update", - "alerting:slo.rules.burnRate/observability/rule/updateApiKey", - "alerting:slo.rules.burnRate/observability/rule/enable", - "alerting:slo.rules.burnRate/observability/rule/disable", - "alerting:slo.rules.burnRate/observability/rule/muteAll", - "alerting:slo.rules.burnRate/observability/rule/unmuteAll", - "alerting:slo.rules.burnRate/observability/rule/muteAlert", - "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", - "alerting:slo.rules.burnRate/observability/rule/snooze", - "alerting:slo.rules.burnRate/observability/rule/bulkEdit", - "alerting:slo.rules.burnRate/observability/rule/bulkDelete", - "alerting:slo.rules.burnRate/observability/rule/bulkEnable", - "alerting:slo.rules.burnRate/observability/rule/bulkDisable", - "alerting:slo.rules.burnRate/observability/rule/unsnooze", - "alerting:slo.rules.burnRate/observability/rule/runSoon", - "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", - "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/create", - "alerting:observability.rules.custom_threshold/observability/rule/delete", - "alerting:observability.rules.custom_threshold/observability/rule/update", - "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/observability/rule/enable", - "alerting:observability.rules.custom_threshold/observability/rule/disable", - "alerting:observability.rules.custom_threshold/observability/rule/muteAll", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/snooze", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", - "alerting:observability.rules.custom_threshold/observability/rule/runSoon", - "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/create", - "alerting:.es-query/observability/rule/delete", - "alerting:.es-query/observability/rule/update", - "alerting:.es-query/observability/rule/updateApiKey", - "alerting:.es-query/observability/rule/enable", - "alerting:.es-query/observability/rule/disable", - "alerting:.es-query/observability/rule/muteAll", - "alerting:.es-query/observability/rule/unmuteAll", - "alerting:.es-query/observability/rule/muteAlert", - "alerting:.es-query/observability/rule/unmuteAlert", - "alerting:.es-query/observability/rule/snooze", - "alerting:.es-query/observability/rule/bulkEdit", - "alerting:.es-query/observability/rule/bulkDelete", - "alerting:.es-query/observability/rule/bulkEnable", - "alerting:.es-query/observability/rule/bulkDisable", - "alerting:.es-query/observability/rule/unsnooze", - "alerting:.es-query/observability/rule/runSoon", - "alerting:.es-query/observability/rule/scheduleBackfill", - "alerting:.es-query/observability/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/create", - "alerting:metrics.alert.inventory.threshold/observability/rule/delete", - "alerting:metrics.alert.inventory.threshold/observability/rule/update", - "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/observability/rule/enable", - "alerting:metrics.alert.inventory.threshold/observability/rule/disable", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -1401,6 +2285,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/get", "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", @@ -1429,229 +2341,398 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:slo.rules.burnRate/observability/alert/update", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/update", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/update", - "alerting:apm.error_rate/observability/alert/get", - "alerting:apm.error_rate/observability/alert/find", - "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.error_rate/observability/alert/getAlertSummary", - "alerting:apm.error_rate/observability/alert/update", - "alerting:apm.transaction_error_rate/observability/alert/get", - "alerting:apm.transaction_error_rate/observability/alert/find", - "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/alert/update", - "alerting:apm.transaction_duration/observability/alert/get", - "alerting:apm.transaction_duration/observability/alert/find", - "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_duration/observability/alert/getAlertSummary", - "alerting:apm.transaction_duration/observability/alert/update", - "alerting:apm.anomaly/observability/alert/get", - "alerting:apm.anomaly/observability/alert/find", - "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.anomaly/observability/alert/getAlertSummary", - "alerting:apm.anomaly/observability/alert/update", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", - "alerting:xpack.synthetics.alerts.tls/observability/alert/get", - "alerting:xpack.synthetics.alerts.tls/observability/alert/find", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/alert/update", - ], - "minimal_read": Array [ - "login:", - "api:apm", - "api:rac", - "app:apm", - "app:ux", - "app:kibana", - "ui:catalogue/apm", - "ui:management/insightsAndAlerting/triggersActions", - "ui:navLinks/apm", - "ui:navLinks/ux", - "ui:navLinks/kibana", - "saved_object:apm-indices/bulk_get", - "saved_object:apm-indices/get", - "saved_object:apm-indices/find", - "saved_object:apm-indices/open_point_in_time", - "saved_object:apm-indices/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:apm/show", - "ui:apm/alerting:show", - "alerting:apm.error_rate/apm/rule/get", - "alerting:apm.error_rate/apm/rule/getRuleState", - "alerting:apm.error_rate/apm/rule/getAlertSummary", - "alerting:apm.error_rate/apm/rule/getExecutionLog", - "alerting:apm.error_rate/apm/rule/getActionErrorLog", - "alerting:apm.error_rate/apm/rule/find", - "alerting:apm.error_rate/apm/rule/getRuleExecutionKPI", - "alerting:apm.error_rate/apm/rule/getBackfill", - "alerting:apm.error_rate/apm/rule/findBackfill", - "alerting:apm.transaction_error_rate/apm/rule/get", - "alerting:apm.transaction_error_rate/apm/rule/getRuleState", - "alerting:apm.transaction_error_rate/apm/rule/getAlertSummary", - "alerting:apm.transaction_error_rate/apm/rule/getExecutionLog", - "alerting:apm.transaction_error_rate/apm/rule/getActionErrorLog", - "alerting:apm.transaction_error_rate/apm/rule/find", - "alerting:apm.transaction_error_rate/apm/rule/getRuleExecutionKPI", - "alerting:apm.transaction_error_rate/apm/rule/getBackfill", - "alerting:apm.transaction_error_rate/apm/rule/findBackfill", - "alerting:apm.transaction_duration/apm/rule/get", - "alerting:apm.transaction_duration/apm/rule/getRuleState", - "alerting:apm.transaction_duration/apm/rule/getAlertSummary", - "alerting:apm.transaction_duration/apm/rule/getExecutionLog", - "alerting:apm.transaction_duration/apm/rule/getActionErrorLog", - "alerting:apm.transaction_duration/apm/rule/find", - "alerting:apm.transaction_duration/apm/rule/getRuleExecutionKPI", - "alerting:apm.transaction_duration/apm/rule/getBackfill", - "alerting:apm.transaction_duration/apm/rule/findBackfill", - "alerting:apm.anomaly/apm/rule/get", - "alerting:apm.anomaly/apm/rule/getRuleState", - "alerting:apm.anomaly/apm/rule/getAlertSummary", - "alerting:apm.anomaly/apm/rule/getExecutionLog", - "alerting:apm.anomaly/apm/rule/getActionErrorLog", - "alerting:apm.anomaly/apm/rule/find", - "alerting:apm.anomaly/apm/rule/getRuleExecutionKPI", - "alerting:apm.anomaly/apm/rule/getBackfill", - "alerting:apm.anomaly/apm/rule/findBackfill", - "alerting:apm.error_rate/apm/alert/get", - "alerting:apm.error_rate/apm/alert/find", - "alerting:apm.error_rate/apm/alert/getAuthorizedAlertsIndices", - "alerting:apm.error_rate/apm/alert/getAlertSummary", - "alerting:apm.transaction_error_rate/apm/alert/get", - "alerting:apm.transaction_error_rate/apm/alert/find", - "alerting:apm.transaction_error_rate/apm/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_error_rate/apm/alert/getAlertSummary", - "alerting:apm.transaction_duration/apm/alert/get", - "alerting:apm.transaction_duration/apm/alert/find", - "alerting:apm.transaction_duration/apm/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_duration/apm/alert/getAlertSummary", - "alerting:apm.anomaly/apm/alert/get", - "alerting:apm.anomaly/apm/alert/find", - "alerting:apm.anomaly/apm/alert/getAuthorizedAlertsIndices", - "alerting:apm.anomaly/apm/alert/getAlertSummary", - "api:infra", - "app:infra", - "app:logs", - "app:observability-logs-explorer", - "ui:catalogue/infralogging", - "ui:catalogue/logs", - "ui:navLinks/infra", - "ui:navLinks/logs", - "ui:navLinks/observability-logs-explorer", - "saved_object:infrastructure-ui-source/bulk_get", - "saved_object:infrastructure-ui-source/get", - "saved_object:infrastructure-ui-source/find", - "saved_object:infrastructure-ui-source/open_point_in_time", - "saved_object:infrastructure-ui-source/close_point_in_time", - "saved_object:infrastructure-monitoring-log-view/bulk_get", - "saved_object:infrastructure-monitoring-log-view/get", - "saved_object:infrastructure-monitoring-log-view/find", - "saved_object:infrastructure-monitoring-log-view/open_point_in_time", - "saved_object:infrastructure-monitoring-log-view/close_point_in_time", - "ui:logs/show", - "alerting:logs.alert.document.count/logs/rule/get", - "alerting:logs.alert.document.count/logs/rule/getRuleState", - "alerting:logs.alert.document.count/logs/rule/getAlertSummary", - "alerting:logs.alert.document.count/logs/rule/getExecutionLog", - "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", - "alerting:logs.alert.document.count/logs/rule/find", - "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", - "alerting:logs.alert.document.count/logs/rule/getBackfill", - "alerting:logs.alert.document.count/logs/rule/findBackfill", - "alerting:.es-query/logs/rule/get", - "alerting:.es-query/logs/rule/getRuleState", - "alerting:.es-query/logs/rule/getAlertSummary", - "alerting:.es-query/logs/rule/getExecutionLog", - "alerting:.es-query/logs/rule/getActionErrorLog", - "alerting:.es-query/logs/rule/find", - "alerting:.es-query/logs/rule/getRuleExecutionKPI", - "alerting:.es-query/logs/rule/getBackfill", - "alerting:.es-query/logs/rule/findBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/get", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", - "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/logs/rule/find", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", - "alerting:logs.alert.document.count/logs/alert/get", - "alerting:logs.alert.document.count/logs/alert/find", - "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", - "alerting:logs.alert.document.count/logs/alert/getAlertSummary", - "alerting:.es-query/logs/alert/get", - "alerting:.es-query/logs/alert/find", - "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/logs/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/alert/get", - "alerting:observability.rules.custom_threshold/logs/alert/find", - "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", - "app:observability", - "ui:catalogue/observability", - "ui:navLinks/observability", - "ui:observability/read", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/deleteBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/create", + "alerting:metrics.alert.threshold/observability/rule/delete", + "alerting:metrics.alert.threshold/observability/rule/update", + "alerting:metrics.alert.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.threshold/observability/rule/enable", + "alerting:metrics.alert.threshold/observability/rule/disable", + "alerting:metrics.alert.threshold/observability/rule/muteAll", + "alerting:metrics.alert.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.threshold/observability/rule/snooze", + "alerting:metrics.alert.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.threshold/observability/rule/runSoon", + "alerting:metrics.alert.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/create", + "alerting:metrics.alert.threshold/alerts/rule/delete", + "alerting:metrics.alert.threshold/alerts/rule/update", + "alerting:metrics.alert.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.threshold/alerts/rule/enable", + "alerting:metrics.alert.threshold/alerts/rule/disable", + "alerting:metrics.alert.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.threshold/alerts/rule/snooze", + "alerting:metrics.alert.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/alerts/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/create", + "alerting:metrics.alert.inventory.threshold/observability/rule/delete", + "alerting:metrics.alert.inventory.threshold/observability/rule/update", + "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/observability/rule/enable", + "alerting:metrics.alert.inventory.threshold/observability/rule/disable", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/create", + "alerting:metrics.alert.inventory.threshold/alerts/rule/delete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/update", + "alerting:metrics.alert.inventory.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/alerts/rule/enable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/disable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/snooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/create", + "alerting:xpack.uptime.alerts.tls/observability/rule/delete", + "alerting:xpack.uptime.alerts.tls/observability/rule/update", + "alerting:xpack.uptime.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/observability/rule/enable", + "alerting:xpack.uptime.alerts.tls/observability/rule/disable", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/create", + "alerting:xpack.uptime.alerts.tls/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/update", + "alerting:xpack.uptime.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/deleteBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/create", + "alerting:logs.alert.document.count/observability/rule/delete", + "alerting:logs.alert.document.count/observability/rule/update", + "alerting:logs.alert.document.count/observability/rule/updateApiKey", + "alerting:logs.alert.document.count/observability/rule/enable", + "alerting:logs.alert.document.count/observability/rule/disable", + "alerting:logs.alert.document.count/observability/rule/muteAll", + "alerting:logs.alert.document.count/observability/rule/unmuteAll", + "alerting:logs.alert.document.count/observability/rule/muteAlert", + "alerting:logs.alert.document.count/observability/rule/unmuteAlert", + "alerting:logs.alert.document.count/observability/rule/snooze", + "alerting:logs.alert.document.count/observability/rule/bulkEdit", + "alerting:logs.alert.document.count/observability/rule/bulkDelete", + "alerting:logs.alert.document.count/observability/rule/bulkEnable", + "alerting:logs.alert.document.count/observability/rule/bulkDisable", + "alerting:logs.alert.document.count/observability/rule/unsnooze", + "alerting:logs.alert.document.count/observability/rule/runSoon", + "alerting:logs.alert.document.count/observability/rule/scheduleBackfill", + "alerting:logs.alert.document.count/observability/rule/deleteBackfill", "alerting:slo.rules.burnRate/observability/rule/get", "alerting:slo.rules.burnRate/observability/rule/getRuleState", "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", @@ -1661,6 +2742,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", "alerting:slo.rules.burnRate/observability/rule/getBackfill", "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/create", + "alerting:slo.rules.burnRate/observability/rule/delete", + "alerting:slo.rules.burnRate/observability/rule/update", + "alerting:slo.rules.burnRate/observability/rule/updateApiKey", + "alerting:slo.rules.burnRate/observability/rule/enable", + "alerting:slo.rules.burnRate/observability/rule/disable", + "alerting:slo.rules.burnRate/observability/rule/muteAll", + "alerting:slo.rules.burnRate/observability/rule/unmuteAll", + "alerting:slo.rules.burnRate/observability/rule/muteAlert", + "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", + "alerting:slo.rules.burnRate/observability/rule/snooze", + "alerting:slo.rules.burnRate/observability/rule/bulkEdit", + "alerting:slo.rules.burnRate/observability/rule/bulkDelete", + "alerting:slo.rules.burnRate/observability/rule/bulkEnable", + "alerting:slo.rules.burnRate/observability/rule/bulkDisable", + "alerting:slo.rules.burnRate/observability/rule/unsnooze", + "alerting:slo.rules.burnRate/observability/rule/runSoon", + "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/create", + "alerting:slo.rules.burnRate/alerts/rule/delete", + "alerting:slo.rules.burnRate/alerts/rule/update", + "alerting:slo.rules.burnRate/alerts/rule/updateApiKey", + "alerting:slo.rules.burnRate/alerts/rule/enable", + "alerting:slo.rules.burnRate/alerts/rule/disable", + "alerting:slo.rules.burnRate/alerts/rule/muteAll", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAll", + "alerting:slo.rules.burnRate/alerts/rule/muteAlert", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAlert", + "alerting:slo.rules.burnRate/alerts/rule/snooze", + "alerting:slo.rules.burnRate/alerts/rule/bulkEdit", + "alerting:slo.rules.burnRate/alerts/rule/bulkDelete", + "alerting:slo.rules.burnRate/alerts/rule/bulkEnable", + "alerting:slo.rules.burnRate/alerts/rule/bulkDisable", + "alerting:slo.rules.burnRate/alerts/rule/unsnooze", + "alerting:slo.rules.burnRate/alerts/rule/runSoon", + "alerting:slo.rules.burnRate/alerts/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/alerts/rule/deleteBackfill", "alerting:observability.rules.custom_threshold/observability/rule/get", "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", @@ -1670,6 +2798,25 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/create", + "alerting:observability.rules.custom_threshold/observability/rule/delete", + "alerting:observability.rules.custom_threshold/observability/rule/update", + "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/observability/rule/enable", + "alerting:observability.rules.custom_threshold/observability/rule/disable", + "alerting:observability.rules.custom_threshold/observability/rule/muteAll", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/snooze", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", + "alerting:observability.rules.custom_threshold/observability/rule/runSoon", + "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", "alerting:.es-query/observability/rule/get", "alerting:.es-query/observability/rule/getRuleState", "alerting:.es-query/observability/rule/getAlertSummary", @@ -1679,6 +2826,25 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/observability/rule/getRuleExecutionKPI", "alerting:.es-query/observability/rule/getBackfill", "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/create", + "alerting:.es-query/observability/rule/delete", + "alerting:.es-query/observability/rule/update", + "alerting:.es-query/observability/rule/updateApiKey", + "alerting:.es-query/observability/rule/enable", + "alerting:.es-query/observability/rule/disable", + "alerting:.es-query/observability/rule/muteAll", + "alerting:.es-query/observability/rule/unmuteAll", + "alerting:.es-query/observability/rule/muteAlert", + "alerting:.es-query/observability/rule/unmuteAlert", + "alerting:.es-query/observability/rule/snooze", + "alerting:.es-query/observability/rule/bulkEdit", + "alerting:.es-query/observability/rule/bulkDelete", + "alerting:.es-query/observability/rule/bulkEnable", + "alerting:.es-query/observability/rule/bulkDisable", + "alerting:.es-query/observability/rule/unsnooze", + "alerting:.es-query/observability/rule/runSoon", + "alerting:.es-query/observability/rule/scheduleBackfill", + "alerting:.es-query/observability/rule/deleteBackfill", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", @@ -1688,115 +2854,157 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:apm.error_rate/observability/rule/get", - "alerting:apm.error_rate/observability/rule/getRuleState", - "alerting:apm.error_rate/observability/rule/getAlertSummary", - "alerting:apm.error_rate/observability/rule/getExecutionLog", - "alerting:apm.error_rate/observability/rule/getActionErrorLog", - "alerting:apm.error_rate/observability/rule/find", - "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.error_rate/observability/rule/getBackfill", - "alerting:apm.error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_error_rate/observability/rule/get", - "alerting:apm.transaction_error_rate/observability/rule/getRuleState", - "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", - "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", - "alerting:apm.transaction_error_rate/observability/rule/find", - "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_error_rate/observability/rule/getBackfill", - "alerting:apm.transaction_error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_duration/observability/rule/get", - "alerting:apm.transaction_duration/observability/rule/getRuleState", - "alerting:apm.transaction_duration/observability/rule/getAlertSummary", - "alerting:apm.transaction_duration/observability/rule/getExecutionLog", - "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", - "alerting:apm.transaction_duration/observability/rule/find", - "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_duration/observability/rule/getBackfill", - "alerting:apm.transaction_duration/observability/rule/findBackfill", - "alerting:apm.anomaly/observability/rule/get", - "alerting:apm.anomaly/observability/rule/getRuleState", - "alerting:apm.anomaly/observability/rule/getAlertSummary", - "alerting:apm.anomaly/observability/rule/getExecutionLog", - "alerting:apm.anomaly/observability/rule/getActionErrorLog", - "alerting:apm.anomaly/observability/rule/find", - "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", - "alerting:apm.anomaly/observability/rule/getBackfill", - "alerting:apm.anomaly/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/get", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/find", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/observability/alert/update", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/alert/update", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/observability/alert/update", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/observability/alert/update", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/update", "alerting:xpack.synthetics.alerts.tls/observability/alert/get", "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/update", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/update", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/update", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/update", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/update", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/update", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/update", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/update", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/update", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/update", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", ], - "read": Array [ + "minimal_read": Array [ "login:", "api:apm", "api:rac", @@ -1844,6 +3052,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/apm/rule/getRuleExecutionKPI", "alerting:apm.error_rate/apm/rule/getBackfill", "alerting:apm.error_rate/apm/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_error_rate/apm/rule/get", "alerting:apm.transaction_error_rate/apm/rule/getRuleState", "alerting:apm.transaction_error_rate/apm/rule/getAlertSummary", @@ -1853,6 +3070,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/apm/rule/getRuleExecutionKPI", "alerting:apm.transaction_error_rate/apm/rule/getBackfill", "alerting:apm.transaction_error_rate/apm/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_duration/apm/rule/get", "alerting:apm.transaction_duration/apm/rule/getRuleState", "alerting:apm.transaction_duration/apm/rule/getAlertSummary", @@ -1862,6 +3088,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/apm/rule/getRuleExecutionKPI", "alerting:apm.transaction_duration/apm/rule/getBackfill", "alerting:apm.transaction_duration/apm/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", "alerting:apm.anomaly/apm/rule/get", "alerting:apm.anomaly/apm/rule/getRuleState", "alerting:apm.anomaly/apm/rule/getAlertSummary", @@ -1871,22 +3106,47 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/apm/rule/getRuleExecutionKPI", "alerting:apm.anomaly/apm/rule/getBackfill", "alerting:apm.anomaly/apm/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", "alerting:apm.error_rate/apm/alert/get", "alerting:apm.error_rate/apm/alert/find", "alerting:apm.error_rate/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/apm/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_error_rate/apm/alert/get", "alerting:apm.transaction_error_rate/apm/alert/find", "alerting:apm.transaction_error_rate/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/apm/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_duration/apm/alert/get", "alerting:apm.transaction_duration/apm/alert/find", "alerting:apm.transaction_duration/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/apm/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", "alerting:apm.anomaly/apm/alert/get", "alerting:apm.anomaly/apm/alert/find", "alerting:apm.anomaly/apm/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/apm/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", "api:infra", "app:infra", "app:logs", @@ -1916,6 +3176,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", "alerting:logs.alert.document.count/logs/rule/getBackfill", "alerting:logs.alert.document.count/logs/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", "alerting:.es-query/logs/rule/get", "alerting:.es-query/logs/rule/getRuleState", "alerting:.es-query/logs/rule/getAlertSummary", @@ -1925,6 +3194,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/logs/rule/getRuleExecutionKPI", "alerting:.es-query/logs/rule/getBackfill", "alerting:.es-query/logs/rule/findBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", "alerting:observability.rules.custom_threshold/logs/rule/get", "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", @@ -1934,6 +3212,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", @@ -1943,71 +3230,51 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", "alerting:logs.alert.document.count/logs/alert/get", "alerting:logs.alert.document.count/logs/alert/find", "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", "alerting:logs.alert.document.count/logs/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", "alerting:.es-query/logs/alert/get", "alerting:.es-query/logs/alert/find", "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", "alerting:.es-query/logs/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", "alerting:observability.rules.custom_threshold/logs/alert/get", "alerting:observability.rules.custom_threshold/logs/alert/find", "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", "app:observability", "ui:catalogue/observability", "ui:navLinks/observability", "ui:observability/read", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -2053,6 +3320,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/get", "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", @@ -2062,26 +3338,177 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", @@ -2102,132 +3529,108 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/observability/alert/get", "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", ], - "settings_save": Array [ - "login:", - "api:apm_settings_write", - "ui:apm/settings:save", - ], - }, - "dashboard": Object { - "all": Array [ + "read": Array [ "login:", - "api:bulkGetUserProfiles", - "api:dashboardUsageStats", - "api:store_search_session", - "api:generateReport", - "api:downloadCsv", - "app:dashboards", + "api:apm", + "api:rac", + "app:apm", + "app:ux", "app:kibana", - "ui:catalogue/dashboard", - "ui:management/kibana/search_sessions", - "ui:management/insightsAndAlerting/reporting", - "ui:navLinks/dashboards", + "ui:catalogue/apm", + "ui:management/insightsAndAlerting/triggersActions", + "ui:navLinks/apm", + "ui:navLinks/ux", "ui:navLinks/kibana", - "saved_object:dashboard/bulk_get", - "saved_object:dashboard/get", - "saved_object:dashboard/find", - "saved_object:dashboard/open_point_in_time", - "saved_object:dashboard/close_point_in_time", - "saved_object:dashboard/create", - "saved_object:dashboard/bulk_create", - "saved_object:dashboard/update", - "saved_object:dashboard/bulk_update", - "saved_object:dashboard/delete", - "saved_object:dashboard/bulk_delete", - "saved_object:dashboard/share_to_space", - "saved_object:query/bulk_get", - "saved_object:query/get", - "saved_object:query/find", - "saved_object:query/open_point_in_time", - "saved_object:query/close_point_in_time", - "saved_object:query/create", - "saved_object:query/bulk_create", - "saved_object:query/update", - "saved_object:query/bulk_update", - "saved_object:query/delete", - "saved_object:query/bulk_delete", - "saved_object:query/share_to_space", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "saved_object:url/create", - "saved_object:url/bulk_create", - "saved_object:url/update", - "saved_object:url/bulk_update", - "saved_object:url/delete", - "saved_object:url/bulk_delete", - "saved_object:url/share_to_space", - "saved_object:search-session/bulk_get", - "saved_object:search-session/get", - "saved_object:search-session/find", - "saved_object:search-session/open_point_in_time", - "saved_object:search-session/close_point_in_time", - "saved_object:search-session/create", - "saved_object:search-session/bulk_create", - "saved_object:search-session/update", - "saved_object:search-session/bulk_update", - "saved_object:search-session/delete", - "saved_object:search-session/bulk_delete", - "saved_object:search-session/share_to_space", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", - "saved_object:search/bulk_get", - "saved_object:search/get", - "saved_object:search/find", - "saved_object:search/open_point_in_time", - "saved_object:search/close_point_in_time", - "saved_object:visualization/bulk_get", - "saved_object:visualization/get", - "saved_object:visualization/find", - "saved_object:visualization/open_point_in_time", - "saved_object:visualization/close_point_in_time", - "saved_object:canvas-workpad/bulk_get", - "saved_object:canvas-workpad/get", - "saved_object:canvas-workpad/find", - "saved_object:canvas-workpad/open_point_in_time", - "saved_object:canvas-workpad/close_point_in_time", - "saved_object:lens/bulk_get", - "saved_object:lens/get", - "saved_object:lens/find", - "saved_object:lens/open_point_in_time", - "saved_object:lens/close_point_in_time", - "saved_object:links/bulk_get", - "saved_object:links/get", - "saved_object:links/find", - "saved_object:links/open_point_in_time", - "saved_object:links/close_point_in_time", - "saved_object:map/bulk_get", - "saved_object:map/get", - "saved_object:map/find", - "saved_object:map/open_point_in_time", - "saved_object:map/close_point_in_time", - "saved_object:tag/bulk_get", - "saved_object:tag/get", - "saved_object:tag/find", - "saved_object:tag/open_point_in_time", - "saved_object:tag/close_point_in_time", + "saved_object:apm-indices/bulk_get", + "saved_object:apm-indices/get", + "saved_object:apm-indices/find", + "saved_object:apm-indices/open_point_in_time", + "saved_object:apm-indices/close_point_in_time", "saved_object:config/bulk_get", "saved_object:config/get", "saved_object:config/find", @@ -2238,3839 +3641,142 @@ export default function ({ getService }: FtrProviderContext) { "saved_object:config-global/find", "saved_object:config-global/open_point_in_time", "saved_object:config-global/close_point_in_time", - "ui:dashboard/createNew", - "ui:dashboard/show", - "ui:dashboard/showWriteControls", - "ui:dashboard/saveQuery", - "ui:dashboard/createShortUrl", - "ui:dashboard/storeSearchSession", - "ui:dashboard/generateScreenshot", - "ui:dashboard/downloadCsv", - "app:maps", - "ui:catalogue/maps", - "ui:navLinks/maps", - "saved_object:map/create", - "saved_object:map/bulk_create", - "saved_object:map/update", - "saved_object:map/bulk_update", - "saved_object:map/delete", - "saved_object:map/bulk_delete", - "saved_object:map/share_to_space", - "ui:maps/save", - "ui:maps/show", - "ui:maps/saveQuery", - "app:visualize", - "app:lens", - "ui:catalogue/visualize", - "ui:navLinks/visualize", - "ui:navLinks/lens", - "saved_object:visualization/create", - "saved_object:visualization/bulk_create", - "saved_object:visualization/update", - "saved_object:visualization/bulk_update", - "saved_object:visualization/delete", - "saved_object:visualization/bulk_delete", - "saved_object:visualization/share_to_space", - "saved_object:lens/create", - "saved_object:lens/bulk_create", - "saved_object:lens/update", - "saved_object:lens/bulk_update", - "saved_object:lens/delete", - "saved_object:lens/bulk_delete", - "saved_object:lens/share_to_space", - "ui:visualize/show", - "ui:visualize/delete", - "ui:visualize/save", - "ui:visualize/saveQuery", - "ui:visualize/createShortUrl", - "ui:visualize/generateScreenshot", - ], - "download_csv_report": Array [ - "login:", - "api:downloadCsv", - "ui:management/insightsAndAlerting/reporting", - "ui:dashboard/downloadCsv", - ], - "generate_report": Array [ - "login:", - "api:generateReport", - "ui:management/insightsAndAlerting/reporting", - "ui:dashboard/generateScreenshot", - ], - "minimal_all": Array [ - "login:", - "api:bulkGetUserProfiles", - "api:dashboardUsageStats", - "app:dashboards", - "app:kibana", - "ui:catalogue/dashboard", - "ui:navLinks/dashboards", - "ui:navLinks/kibana", - "saved_object:dashboard/bulk_get", - "saved_object:dashboard/get", - "saved_object:dashboard/find", - "saved_object:dashboard/open_point_in_time", - "saved_object:dashboard/close_point_in_time", - "saved_object:dashboard/create", - "saved_object:dashboard/bulk_create", - "saved_object:dashboard/update", - "saved_object:dashboard/bulk_update", - "saved_object:dashboard/delete", - "saved_object:dashboard/bulk_delete", - "saved_object:dashboard/share_to_space", - "saved_object:query/bulk_get", - "saved_object:query/get", - "saved_object:query/find", - "saved_object:query/open_point_in_time", - "saved_object:query/close_point_in_time", - "saved_object:query/create", - "saved_object:query/bulk_create", - "saved_object:query/update", - "saved_object:query/bulk_update", - "saved_object:query/delete", - "saved_object:query/bulk_delete", - "saved_object:query/share_to_space", "saved_object:telemetry/bulk_get", "saved_object:telemetry/get", "saved_object:telemetry/find", "saved_object:telemetry/open_point_in_time", "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", - "saved_object:search/bulk_get", - "saved_object:search/get", - "saved_object:search/find", - "saved_object:search/open_point_in_time", - "saved_object:search/close_point_in_time", - "saved_object:visualization/bulk_get", - "saved_object:visualization/get", - "saved_object:visualization/find", - "saved_object:visualization/open_point_in_time", - "saved_object:visualization/close_point_in_time", - "saved_object:canvas-workpad/bulk_get", - "saved_object:canvas-workpad/get", - "saved_object:canvas-workpad/find", - "saved_object:canvas-workpad/open_point_in_time", - "saved_object:canvas-workpad/close_point_in_time", - "saved_object:lens/bulk_get", - "saved_object:lens/get", - "saved_object:lens/find", - "saved_object:lens/open_point_in_time", - "saved_object:lens/close_point_in_time", - "saved_object:links/bulk_get", - "saved_object:links/get", - "saved_object:links/find", - "saved_object:links/open_point_in_time", - "saved_object:links/close_point_in_time", - "saved_object:map/bulk_get", - "saved_object:map/get", - "saved_object:map/find", - "saved_object:map/open_point_in_time", - "saved_object:map/close_point_in_time", - "saved_object:tag/bulk_get", - "saved_object:tag/get", - "saved_object:tag/find", - "saved_object:tag/open_point_in_time", - "saved_object:tag/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", "saved_object:url/bulk_get", "saved_object:url/get", "saved_object:url/find", "saved_object:url/open_point_in_time", "saved_object:url/close_point_in_time", - "ui:dashboard/createNew", - "ui:dashboard/show", - "ui:dashboard/showWriteControls", - "ui:dashboard/saveQuery", - "app:maps", - "ui:catalogue/maps", - "ui:navLinks/maps", - "saved_object:map/create", - "saved_object:map/bulk_create", - "saved_object:map/update", - "saved_object:map/bulk_update", - "saved_object:map/delete", - "saved_object:map/bulk_delete", - "saved_object:map/share_to_space", - "ui:maps/save", - "ui:maps/show", - "ui:maps/saveQuery", - "api:generateReport", - "app:visualize", - "app:lens", - "ui:catalogue/visualize", - "ui:management/insightsAndAlerting/reporting", - "ui:navLinks/visualize", - "ui:navLinks/lens", - "saved_object:visualization/create", - "saved_object:visualization/bulk_create", - "saved_object:visualization/update", - "saved_object:visualization/bulk_update", - "saved_object:visualization/delete", - "saved_object:visualization/bulk_delete", - "saved_object:visualization/share_to_space", - "saved_object:lens/create", - "saved_object:lens/bulk_create", - "saved_object:lens/update", - "saved_object:lens/bulk_update", - "saved_object:lens/delete", - "saved_object:lens/bulk_delete", - "saved_object:lens/share_to_space", - "saved_object:url/create", - "saved_object:url/bulk_create", - "saved_object:url/update", - "saved_object:url/bulk_update", - "saved_object:url/delete", - "saved_object:url/bulk_delete", - "saved_object:url/share_to_space", - "ui:visualize/show", - "ui:visualize/delete", - "ui:visualize/save", - "ui:visualize/saveQuery", - "ui:visualize/createShortUrl", - "ui:visualize/generateScreenshot", - ], - "minimal_read": Array [ - "login:", - "api:bulkGetUserProfiles", - "api:dashboardUsageStats", - "app:dashboards", - "app:kibana", - "ui:catalogue/dashboard", - "ui:navLinks/dashboards", - "ui:navLinks/kibana", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", - "saved_object:search/bulk_get", - "saved_object:search/get", - "saved_object:search/find", - "saved_object:search/open_point_in_time", - "saved_object:search/close_point_in_time", - "saved_object:visualization/bulk_get", - "saved_object:visualization/get", - "saved_object:visualization/find", - "saved_object:visualization/open_point_in_time", - "saved_object:visualization/close_point_in_time", - "saved_object:canvas-workpad/bulk_get", - "saved_object:canvas-workpad/get", - "saved_object:canvas-workpad/find", - "saved_object:canvas-workpad/open_point_in_time", - "saved_object:canvas-workpad/close_point_in_time", - "saved_object:lens/bulk_get", - "saved_object:lens/get", - "saved_object:lens/find", - "saved_object:lens/open_point_in_time", - "saved_object:lens/close_point_in_time", - "saved_object:links/bulk_get", - "saved_object:links/get", - "saved_object:links/find", - "saved_object:links/open_point_in_time", - "saved_object:links/close_point_in_time", - "saved_object:map/bulk_get", - "saved_object:map/get", - "saved_object:map/find", - "saved_object:map/open_point_in_time", - "saved_object:map/close_point_in_time", - "saved_object:dashboard/bulk_get", - "saved_object:dashboard/get", - "saved_object:dashboard/find", - "saved_object:dashboard/open_point_in_time", - "saved_object:dashboard/close_point_in_time", - "saved_object:query/bulk_get", - "saved_object:query/get", - "saved_object:query/find", - "saved_object:query/open_point_in_time", - "saved_object:query/close_point_in_time", - "saved_object:tag/bulk_get", - "saved_object:tag/get", - "saved_object:tag/find", - "saved_object:tag/open_point_in_time", - "saved_object:tag/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:dashboard/show", - "app:maps", - "ui:catalogue/maps", - "ui:navLinks/maps", - "ui:maps/show", - "app:visualize", - "app:lens", - "ui:catalogue/visualize", - "ui:navLinks/visualize", - "ui:navLinks/lens", - "saved_object:url/create", - "saved_object:url/bulk_create", - "saved_object:url/update", - "saved_object:url/bulk_update", - "saved_object:url/delete", - "saved_object:url/bulk_delete", - "saved_object:url/share_to_space", - "ui:visualize/show", - "ui:visualize/createShortUrl", - ], - "read": Array [ - "login:", - "api:bulkGetUserProfiles", - "api:dashboardUsageStats", - "app:dashboards", - "app:kibana", - "ui:catalogue/dashboard", - "ui:navLinks/dashboards", - "ui:navLinks/kibana", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "saved_object:url/create", - "saved_object:url/bulk_create", - "saved_object:url/update", - "saved_object:url/bulk_update", - "saved_object:url/delete", - "saved_object:url/bulk_delete", - "saved_object:url/share_to_space", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", - "saved_object:search/bulk_get", - "saved_object:search/get", - "saved_object:search/find", - "saved_object:search/open_point_in_time", - "saved_object:search/close_point_in_time", - "saved_object:visualization/bulk_get", - "saved_object:visualization/get", - "saved_object:visualization/find", - "saved_object:visualization/open_point_in_time", - "saved_object:visualization/close_point_in_time", - "saved_object:canvas-workpad/bulk_get", - "saved_object:canvas-workpad/get", - "saved_object:canvas-workpad/find", - "saved_object:canvas-workpad/open_point_in_time", - "saved_object:canvas-workpad/close_point_in_time", - "saved_object:lens/bulk_get", - "saved_object:lens/get", - "saved_object:lens/find", - "saved_object:lens/open_point_in_time", - "saved_object:lens/close_point_in_time", - "saved_object:links/bulk_get", - "saved_object:links/get", - "saved_object:links/find", - "saved_object:links/open_point_in_time", - "saved_object:links/close_point_in_time", - "saved_object:map/bulk_get", - "saved_object:map/get", - "saved_object:map/find", - "saved_object:map/open_point_in_time", - "saved_object:map/close_point_in_time", - "saved_object:dashboard/bulk_get", - "saved_object:dashboard/get", - "saved_object:dashboard/find", - "saved_object:dashboard/open_point_in_time", - "saved_object:dashboard/close_point_in_time", - "saved_object:query/bulk_get", - "saved_object:query/get", - "saved_object:query/find", - "saved_object:query/open_point_in_time", - "saved_object:query/close_point_in_time", - "saved_object:tag/bulk_get", - "saved_object:tag/get", - "saved_object:tag/find", - "saved_object:tag/open_point_in_time", - "saved_object:tag/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "ui:dashboard/show", - "ui:dashboard/createShortUrl", - "app:maps", - "ui:catalogue/maps", - "ui:navLinks/maps", - "ui:maps/show", - "app:visualize", - "app:lens", - "ui:catalogue/visualize", - "ui:navLinks/visualize", - "ui:navLinks/lens", - "ui:visualize/show", - "ui:visualize/createShortUrl", - ], - "store_search_session": Array [ - "login:", - "api:store_search_session", - "ui:management/kibana/search_sessions", - "saved_object:search-session/bulk_get", - "saved_object:search-session/get", - "saved_object:search-session/find", - "saved_object:search-session/open_point_in_time", - "saved_object:search-session/close_point_in_time", - "saved_object:search-session/create", - "saved_object:search-session/bulk_create", - "saved_object:search-session/update", - "saved_object:search-session/bulk_update", - "saved_object:search-session/delete", - "saved_object:search-session/bulk_delete", - "saved_object:search-session/share_to_space", - "ui:dashboard/storeSearchSession", - ], - "url_create": Array [ - "login:", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "saved_object:url/create", - "saved_object:url/bulk_create", - "saved_object:url/update", - "saved_object:url/bulk_update", - "saved_object:url/delete", - "saved_object:url/bulk_delete", - "saved_object:url/share_to_space", - "ui:dashboard/createShortUrl", - ], - }, - "discover": Object { - "all": Array [ - "login:", - "api:fileUpload:analyzeFile", - "api:store_search_session", - "api:generateReport", - "app:discover", - "app:kibana", - "ui:catalogue/discover", - "ui:management/kibana/search_sessions", - "ui:management/insightsAndAlerting/reporting", - "ui:navLinks/discover", - "ui:navLinks/kibana", - "saved_object:search/bulk_get", - "saved_object:search/get", - "saved_object:search/find", - "saved_object:search/open_point_in_time", - "saved_object:search/close_point_in_time", - "saved_object:search/create", - "saved_object:search/bulk_create", - "saved_object:search/update", - "saved_object:search/bulk_update", - "saved_object:search/delete", - "saved_object:search/bulk_delete", - "saved_object:search/share_to_space", - "saved_object:query/bulk_get", - "saved_object:query/get", - "saved_object:query/find", - "saved_object:query/open_point_in_time", - "saved_object:query/close_point_in_time", - "saved_object:query/create", - "saved_object:query/bulk_create", - "saved_object:query/update", - "saved_object:query/bulk_update", - "saved_object:query/delete", - "saved_object:query/bulk_delete", - "saved_object:query/share_to_space", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "saved_object:url/create", - "saved_object:url/bulk_create", - "saved_object:url/update", - "saved_object:url/bulk_update", - "saved_object:url/delete", - "saved_object:url/bulk_delete", - "saved_object:url/share_to_space", - "saved_object:search-session/bulk_get", - "saved_object:search-session/get", - "saved_object:search-session/find", - "saved_object:search-session/open_point_in_time", - "saved_object:search-session/close_point_in_time", - "saved_object:search-session/create", - "saved_object:search-session/bulk_create", - "saved_object:search-session/update", - "saved_object:search-session/bulk_update", - "saved_object:search-session/delete", - "saved_object:search-session/bulk_delete", - "saved_object:search-session/share_to_space", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "ui:discover/show", - "ui:discover/save", - "ui:discover/saveQuery", - "ui:discover/createShortUrl", - "ui:discover/storeSearchSession", - "ui:discover/generateCsv", - "api:rac", - "app:observability", - "ui:catalogue/observability", - "ui:navLinks/observability", - "ui:observability/read", - "ui:observability/write", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/rule/create", - "alerting:slo.rules.burnRate/observability/rule/delete", - "alerting:slo.rules.burnRate/observability/rule/update", - "alerting:slo.rules.burnRate/observability/rule/updateApiKey", - "alerting:slo.rules.burnRate/observability/rule/enable", - "alerting:slo.rules.burnRate/observability/rule/disable", - "alerting:slo.rules.burnRate/observability/rule/muteAll", - "alerting:slo.rules.burnRate/observability/rule/unmuteAll", - "alerting:slo.rules.burnRate/observability/rule/muteAlert", - "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", - "alerting:slo.rules.burnRate/observability/rule/snooze", - "alerting:slo.rules.burnRate/observability/rule/bulkEdit", - "alerting:slo.rules.burnRate/observability/rule/bulkDelete", - "alerting:slo.rules.burnRate/observability/rule/bulkEnable", - "alerting:slo.rules.burnRate/observability/rule/bulkDisable", - "alerting:slo.rules.burnRate/observability/rule/unsnooze", - "alerting:slo.rules.burnRate/observability/rule/runSoon", - "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", - "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/create", - "alerting:observability.rules.custom_threshold/observability/rule/delete", - "alerting:observability.rules.custom_threshold/observability/rule/update", - "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/observability/rule/enable", - "alerting:observability.rules.custom_threshold/observability/rule/disable", - "alerting:observability.rules.custom_threshold/observability/rule/muteAll", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/snooze", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", - "alerting:observability.rules.custom_threshold/observability/rule/runSoon", - "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/create", - "alerting:.es-query/observability/rule/delete", - "alerting:.es-query/observability/rule/update", - "alerting:.es-query/observability/rule/updateApiKey", - "alerting:.es-query/observability/rule/enable", - "alerting:.es-query/observability/rule/disable", - "alerting:.es-query/observability/rule/muteAll", - "alerting:.es-query/observability/rule/unmuteAll", - "alerting:.es-query/observability/rule/muteAlert", - "alerting:.es-query/observability/rule/unmuteAlert", - "alerting:.es-query/observability/rule/snooze", - "alerting:.es-query/observability/rule/bulkEdit", - "alerting:.es-query/observability/rule/bulkDelete", - "alerting:.es-query/observability/rule/bulkEnable", - "alerting:.es-query/observability/rule/bulkDisable", - "alerting:.es-query/observability/rule/unsnooze", - "alerting:.es-query/observability/rule/runSoon", - "alerting:.es-query/observability/rule/scheduleBackfill", - "alerting:.es-query/observability/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/create", - "alerting:metrics.alert.inventory.threshold/observability/rule/delete", - "alerting:metrics.alert.inventory.threshold/observability/rule/update", - "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/observability/rule/enable", - "alerting:metrics.alert.inventory.threshold/observability/rule/disable", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", - "alerting:apm.error_rate/observability/rule/get", - "alerting:apm.error_rate/observability/rule/getRuleState", - "alerting:apm.error_rate/observability/rule/getAlertSummary", - "alerting:apm.error_rate/observability/rule/getExecutionLog", - "alerting:apm.error_rate/observability/rule/getActionErrorLog", - "alerting:apm.error_rate/observability/rule/find", - "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.error_rate/observability/rule/getBackfill", - "alerting:apm.error_rate/observability/rule/findBackfill", - "alerting:apm.error_rate/observability/rule/create", - "alerting:apm.error_rate/observability/rule/delete", - "alerting:apm.error_rate/observability/rule/update", - "alerting:apm.error_rate/observability/rule/updateApiKey", - "alerting:apm.error_rate/observability/rule/enable", - "alerting:apm.error_rate/observability/rule/disable", - "alerting:apm.error_rate/observability/rule/muteAll", - "alerting:apm.error_rate/observability/rule/unmuteAll", - "alerting:apm.error_rate/observability/rule/muteAlert", - "alerting:apm.error_rate/observability/rule/unmuteAlert", - "alerting:apm.error_rate/observability/rule/snooze", - "alerting:apm.error_rate/observability/rule/bulkEdit", - "alerting:apm.error_rate/observability/rule/bulkDelete", - "alerting:apm.error_rate/observability/rule/bulkEnable", - "alerting:apm.error_rate/observability/rule/bulkDisable", - "alerting:apm.error_rate/observability/rule/unsnooze", - "alerting:apm.error_rate/observability/rule/runSoon", - "alerting:apm.error_rate/observability/rule/scheduleBackfill", - "alerting:apm.error_rate/observability/rule/deleteBackfill", - "alerting:apm.transaction_error_rate/observability/rule/get", - "alerting:apm.transaction_error_rate/observability/rule/getRuleState", - "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", - "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", - "alerting:apm.transaction_error_rate/observability/rule/find", - "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_error_rate/observability/rule/getBackfill", - "alerting:apm.transaction_error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_error_rate/observability/rule/create", - "alerting:apm.transaction_error_rate/observability/rule/delete", - "alerting:apm.transaction_error_rate/observability/rule/update", - "alerting:apm.transaction_error_rate/observability/rule/updateApiKey", - "alerting:apm.transaction_error_rate/observability/rule/enable", - "alerting:apm.transaction_error_rate/observability/rule/disable", - "alerting:apm.transaction_error_rate/observability/rule/muteAll", - "alerting:apm.transaction_error_rate/observability/rule/unmuteAll", - "alerting:apm.transaction_error_rate/observability/rule/muteAlert", - "alerting:apm.transaction_error_rate/observability/rule/unmuteAlert", - "alerting:apm.transaction_error_rate/observability/rule/snooze", - "alerting:apm.transaction_error_rate/observability/rule/bulkEdit", - "alerting:apm.transaction_error_rate/observability/rule/bulkDelete", - "alerting:apm.transaction_error_rate/observability/rule/bulkEnable", - "alerting:apm.transaction_error_rate/observability/rule/bulkDisable", - "alerting:apm.transaction_error_rate/observability/rule/unsnooze", - "alerting:apm.transaction_error_rate/observability/rule/runSoon", - "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", - "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", - "alerting:apm.transaction_duration/observability/rule/get", - "alerting:apm.transaction_duration/observability/rule/getRuleState", - "alerting:apm.transaction_duration/observability/rule/getAlertSummary", - "alerting:apm.transaction_duration/observability/rule/getExecutionLog", - "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", - "alerting:apm.transaction_duration/observability/rule/find", - "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_duration/observability/rule/getBackfill", - "alerting:apm.transaction_duration/observability/rule/findBackfill", - "alerting:apm.transaction_duration/observability/rule/create", - "alerting:apm.transaction_duration/observability/rule/delete", - "alerting:apm.transaction_duration/observability/rule/update", - "alerting:apm.transaction_duration/observability/rule/updateApiKey", - "alerting:apm.transaction_duration/observability/rule/enable", - "alerting:apm.transaction_duration/observability/rule/disable", - "alerting:apm.transaction_duration/observability/rule/muteAll", - "alerting:apm.transaction_duration/observability/rule/unmuteAll", - "alerting:apm.transaction_duration/observability/rule/muteAlert", - "alerting:apm.transaction_duration/observability/rule/unmuteAlert", - "alerting:apm.transaction_duration/observability/rule/snooze", - "alerting:apm.transaction_duration/observability/rule/bulkEdit", - "alerting:apm.transaction_duration/observability/rule/bulkDelete", - "alerting:apm.transaction_duration/observability/rule/bulkEnable", - "alerting:apm.transaction_duration/observability/rule/bulkDisable", - "alerting:apm.transaction_duration/observability/rule/unsnooze", - "alerting:apm.transaction_duration/observability/rule/runSoon", - "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", - "alerting:apm.transaction_duration/observability/rule/deleteBackfill", - "alerting:apm.anomaly/observability/rule/get", - "alerting:apm.anomaly/observability/rule/getRuleState", - "alerting:apm.anomaly/observability/rule/getAlertSummary", - "alerting:apm.anomaly/observability/rule/getExecutionLog", - "alerting:apm.anomaly/observability/rule/getActionErrorLog", - "alerting:apm.anomaly/observability/rule/find", - "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", - "alerting:apm.anomaly/observability/rule/getBackfill", - "alerting:apm.anomaly/observability/rule/findBackfill", - "alerting:apm.anomaly/observability/rule/create", - "alerting:apm.anomaly/observability/rule/delete", - "alerting:apm.anomaly/observability/rule/update", - "alerting:apm.anomaly/observability/rule/updateApiKey", - "alerting:apm.anomaly/observability/rule/enable", - "alerting:apm.anomaly/observability/rule/disable", - "alerting:apm.anomaly/observability/rule/muteAll", - "alerting:apm.anomaly/observability/rule/unmuteAll", - "alerting:apm.anomaly/observability/rule/muteAlert", - "alerting:apm.anomaly/observability/rule/unmuteAlert", - "alerting:apm.anomaly/observability/rule/snooze", - "alerting:apm.anomaly/observability/rule/bulkEdit", - "alerting:apm.anomaly/observability/rule/bulkDelete", - "alerting:apm.anomaly/observability/rule/bulkEnable", - "alerting:apm.anomaly/observability/rule/bulkDisable", - "alerting:apm.anomaly/observability/rule/unsnooze", - "alerting:apm.anomaly/observability/rule/runSoon", - "alerting:apm.anomaly/observability/rule/scheduleBackfill", - "alerting:apm.anomaly/observability/rule/deleteBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/create", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/delete", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/update", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/updateApiKey", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/enable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/disable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAll", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAll", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAlert", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAlert", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/snooze", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEdit", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDelete", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/get", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/find", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/create", - "alerting:xpack.synthetics.alerts.tls/observability/rule/delete", - "alerting:xpack.synthetics.alerts.tls/observability/rule/update", - "alerting:xpack.synthetics.alerts.tls/observability/rule/updateApiKey", - "alerting:xpack.synthetics.alerts.tls/observability/rule/enable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/disable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAll", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAll", - "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAlert", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAlert", - "alerting:xpack.synthetics.alerts.tls/observability/rule/snooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:slo.rules.burnRate/observability/alert/update", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/update", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/update", - "alerting:apm.error_rate/observability/alert/get", - "alerting:apm.error_rate/observability/alert/find", - "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.error_rate/observability/alert/getAlertSummary", - "alerting:apm.error_rate/observability/alert/update", - "alerting:apm.transaction_error_rate/observability/alert/get", - "alerting:apm.transaction_error_rate/observability/alert/find", - "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/alert/update", - "alerting:apm.transaction_duration/observability/alert/get", - "alerting:apm.transaction_duration/observability/alert/find", - "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_duration/observability/alert/getAlertSummary", - "alerting:apm.transaction_duration/observability/alert/update", - "alerting:apm.anomaly/observability/alert/get", - "alerting:apm.anomaly/observability/alert/find", - "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.anomaly/observability/alert/getAlertSummary", - "alerting:apm.anomaly/observability/alert/update", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", - "alerting:xpack.synthetics.alerts.tls/observability/alert/get", - "alerting:xpack.synthetics.alerts.tls/observability/alert/find", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/alert/update", - ], - "generate_report": Array [ - "login:", - "api:generateReport", - "ui:management/insightsAndAlerting/reporting", - "ui:discover/generateCsv", - ], - "minimal_all": Array [ - "login:", - "api:fileUpload:analyzeFile", - "app:discover", - "app:kibana", - "ui:catalogue/discover", - "ui:navLinks/discover", - "ui:navLinks/kibana", - "saved_object:search/bulk_get", - "saved_object:search/get", - "saved_object:search/find", - "saved_object:search/open_point_in_time", - "saved_object:search/close_point_in_time", - "saved_object:search/create", - "saved_object:search/bulk_create", - "saved_object:search/update", - "saved_object:search/bulk_update", - "saved_object:search/delete", - "saved_object:search/bulk_delete", - "saved_object:search/share_to_space", - "saved_object:query/bulk_get", - "saved_object:query/get", - "saved_object:query/find", - "saved_object:query/open_point_in_time", - "saved_object:query/close_point_in_time", - "saved_object:query/create", - "saved_object:query/bulk_create", - "saved_object:query/update", - "saved_object:query/bulk_update", - "saved_object:query/delete", - "saved_object:query/bulk_delete", - "saved_object:query/share_to_space", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:discover/show", - "ui:discover/save", - "ui:discover/saveQuery", - "api:rac", - "app:observability", - "ui:catalogue/observability", - "ui:navLinks/observability", - "ui:observability/read", - "ui:observability/write", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/rule/create", - "alerting:slo.rules.burnRate/observability/rule/delete", - "alerting:slo.rules.burnRate/observability/rule/update", - "alerting:slo.rules.burnRate/observability/rule/updateApiKey", - "alerting:slo.rules.burnRate/observability/rule/enable", - "alerting:slo.rules.burnRate/observability/rule/disable", - "alerting:slo.rules.burnRate/observability/rule/muteAll", - "alerting:slo.rules.burnRate/observability/rule/unmuteAll", - "alerting:slo.rules.burnRate/observability/rule/muteAlert", - "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", - "alerting:slo.rules.burnRate/observability/rule/snooze", - "alerting:slo.rules.burnRate/observability/rule/bulkEdit", - "alerting:slo.rules.burnRate/observability/rule/bulkDelete", - "alerting:slo.rules.burnRate/observability/rule/bulkEnable", - "alerting:slo.rules.burnRate/observability/rule/bulkDisable", - "alerting:slo.rules.burnRate/observability/rule/unsnooze", - "alerting:slo.rules.burnRate/observability/rule/runSoon", - "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", - "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/create", - "alerting:observability.rules.custom_threshold/observability/rule/delete", - "alerting:observability.rules.custom_threshold/observability/rule/update", - "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/observability/rule/enable", - "alerting:observability.rules.custom_threshold/observability/rule/disable", - "alerting:observability.rules.custom_threshold/observability/rule/muteAll", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/snooze", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", - "alerting:observability.rules.custom_threshold/observability/rule/runSoon", - "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/create", - "alerting:.es-query/observability/rule/delete", - "alerting:.es-query/observability/rule/update", - "alerting:.es-query/observability/rule/updateApiKey", - "alerting:.es-query/observability/rule/enable", - "alerting:.es-query/observability/rule/disable", - "alerting:.es-query/observability/rule/muteAll", - "alerting:.es-query/observability/rule/unmuteAll", - "alerting:.es-query/observability/rule/muteAlert", - "alerting:.es-query/observability/rule/unmuteAlert", - "alerting:.es-query/observability/rule/snooze", - "alerting:.es-query/observability/rule/bulkEdit", - "alerting:.es-query/observability/rule/bulkDelete", - "alerting:.es-query/observability/rule/bulkEnable", - "alerting:.es-query/observability/rule/bulkDisable", - "alerting:.es-query/observability/rule/unsnooze", - "alerting:.es-query/observability/rule/runSoon", - "alerting:.es-query/observability/rule/scheduleBackfill", - "alerting:.es-query/observability/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/create", - "alerting:metrics.alert.inventory.threshold/observability/rule/delete", - "alerting:metrics.alert.inventory.threshold/observability/rule/update", - "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/observability/rule/enable", - "alerting:metrics.alert.inventory.threshold/observability/rule/disable", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", - "alerting:apm.error_rate/observability/rule/get", - "alerting:apm.error_rate/observability/rule/getRuleState", - "alerting:apm.error_rate/observability/rule/getAlertSummary", - "alerting:apm.error_rate/observability/rule/getExecutionLog", - "alerting:apm.error_rate/observability/rule/getActionErrorLog", - "alerting:apm.error_rate/observability/rule/find", - "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.error_rate/observability/rule/getBackfill", - "alerting:apm.error_rate/observability/rule/findBackfill", - "alerting:apm.error_rate/observability/rule/create", - "alerting:apm.error_rate/observability/rule/delete", - "alerting:apm.error_rate/observability/rule/update", - "alerting:apm.error_rate/observability/rule/updateApiKey", - "alerting:apm.error_rate/observability/rule/enable", - "alerting:apm.error_rate/observability/rule/disable", - "alerting:apm.error_rate/observability/rule/muteAll", - "alerting:apm.error_rate/observability/rule/unmuteAll", - "alerting:apm.error_rate/observability/rule/muteAlert", - "alerting:apm.error_rate/observability/rule/unmuteAlert", - "alerting:apm.error_rate/observability/rule/snooze", - "alerting:apm.error_rate/observability/rule/bulkEdit", - "alerting:apm.error_rate/observability/rule/bulkDelete", - "alerting:apm.error_rate/observability/rule/bulkEnable", - "alerting:apm.error_rate/observability/rule/bulkDisable", - "alerting:apm.error_rate/observability/rule/unsnooze", - "alerting:apm.error_rate/observability/rule/runSoon", - "alerting:apm.error_rate/observability/rule/scheduleBackfill", - "alerting:apm.error_rate/observability/rule/deleteBackfill", - "alerting:apm.transaction_error_rate/observability/rule/get", - "alerting:apm.transaction_error_rate/observability/rule/getRuleState", - "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", - "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", - "alerting:apm.transaction_error_rate/observability/rule/find", - "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_error_rate/observability/rule/getBackfill", - "alerting:apm.transaction_error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_error_rate/observability/rule/create", - "alerting:apm.transaction_error_rate/observability/rule/delete", - "alerting:apm.transaction_error_rate/observability/rule/update", - "alerting:apm.transaction_error_rate/observability/rule/updateApiKey", - "alerting:apm.transaction_error_rate/observability/rule/enable", - "alerting:apm.transaction_error_rate/observability/rule/disable", - "alerting:apm.transaction_error_rate/observability/rule/muteAll", - "alerting:apm.transaction_error_rate/observability/rule/unmuteAll", - "alerting:apm.transaction_error_rate/observability/rule/muteAlert", - "alerting:apm.transaction_error_rate/observability/rule/unmuteAlert", - "alerting:apm.transaction_error_rate/observability/rule/snooze", - "alerting:apm.transaction_error_rate/observability/rule/bulkEdit", - "alerting:apm.transaction_error_rate/observability/rule/bulkDelete", - "alerting:apm.transaction_error_rate/observability/rule/bulkEnable", - "alerting:apm.transaction_error_rate/observability/rule/bulkDisable", - "alerting:apm.transaction_error_rate/observability/rule/unsnooze", - "alerting:apm.transaction_error_rate/observability/rule/runSoon", - "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", - "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", - "alerting:apm.transaction_duration/observability/rule/get", - "alerting:apm.transaction_duration/observability/rule/getRuleState", - "alerting:apm.transaction_duration/observability/rule/getAlertSummary", - "alerting:apm.transaction_duration/observability/rule/getExecutionLog", - "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", - "alerting:apm.transaction_duration/observability/rule/find", - "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_duration/observability/rule/getBackfill", - "alerting:apm.transaction_duration/observability/rule/findBackfill", - "alerting:apm.transaction_duration/observability/rule/create", - "alerting:apm.transaction_duration/observability/rule/delete", - "alerting:apm.transaction_duration/observability/rule/update", - "alerting:apm.transaction_duration/observability/rule/updateApiKey", - "alerting:apm.transaction_duration/observability/rule/enable", - "alerting:apm.transaction_duration/observability/rule/disable", - "alerting:apm.transaction_duration/observability/rule/muteAll", - "alerting:apm.transaction_duration/observability/rule/unmuteAll", - "alerting:apm.transaction_duration/observability/rule/muteAlert", - "alerting:apm.transaction_duration/observability/rule/unmuteAlert", - "alerting:apm.transaction_duration/observability/rule/snooze", - "alerting:apm.transaction_duration/observability/rule/bulkEdit", - "alerting:apm.transaction_duration/observability/rule/bulkDelete", - "alerting:apm.transaction_duration/observability/rule/bulkEnable", - "alerting:apm.transaction_duration/observability/rule/bulkDisable", - "alerting:apm.transaction_duration/observability/rule/unsnooze", - "alerting:apm.transaction_duration/observability/rule/runSoon", - "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", - "alerting:apm.transaction_duration/observability/rule/deleteBackfill", - "alerting:apm.anomaly/observability/rule/get", - "alerting:apm.anomaly/observability/rule/getRuleState", - "alerting:apm.anomaly/observability/rule/getAlertSummary", - "alerting:apm.anomaly/observability/rule/getExecutionLog", - "alerting:apm.anomaly/observability/rule/getActionErrorLog", - "alerting:apm.anomaly/observability/rule/find", - "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", - "alerting:apm.anomaly/observability/rule/getBackfill", - "alerting:apm.anomaly/observability/rule/findBackfill", - "alerting:apm.anomaly/observability/rule/create", - "alerting:apm.anomaly/observability/rule/delete", - "alerting:apm.anomaly/observability/rule/update", - "alerting:apm.anomaly/observability/rule/updateApiKey", - "alerting:apm.anomaly/observability/rule/enable", - "alerting:apm.anomaly/observability/rule/disable", - "alerting:apm.anomaly/observability/rule/muteAll", - "alerting:apm.anomaly/observability/rule/unmuteAll", - "alerting:apm.anomaly/observability/rule/muteAlert", - "alerting:apm.anomaly/observability/rule/unmuteAlert", - "alerting:apm.anomaly/observability/rule/snooze", - "alerting:apm.anomaly/observability/rule/bulkEdit", - "alerting:apm.anomaly/observability/rule/bulkDelete", - "alerting:apm.anomaly/observability/rule/bulkEnable", - "alerting:apm.anomaly/observability/rule/bulkDisable", - "alerting:apm.anomaly/observability/rule/unsnooze", - "alerting:apm.anomaly/observability/rule/runSoon", - "alerting:apm.anomaly/observability/rule/scheduleBackfill", - "alerting:apm.anomaly/observability/rule/deleteBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/create", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/delete", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/update", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/updateApiKey", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/enable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/disable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAll", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAll", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAlert", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAlert", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/snooze", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEdit", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDelete", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/get", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/find", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/create", - "alerting:xpack.synthetics.alerts.tls/observability/rule/delete", - "alerting:xpack.synthetics.alerts.tls/observability/rule/update", - "alerting:xpack.synthetics.alerts.tls/observability/rule/updateApiKey", - "alerting:xpack.synthetics.alerts.tls/observability/rule/enable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/disable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAll", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAll", - "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAlert", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAlert", - "alerting:xpack.synthetics.alerts.tls/observability/rule/snooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:slo.rules.burnRate/observability/alert/update", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/update", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/update", - "alerting:apm.error_rate/observability/alert/get", - "alerting:apm.error_rate/observability/alert/find", - "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.error_rate/observability/alert/getAlertSummary", - "alerting:apm.error_rate/observability/alert/update", - "alerting:apm.transaction_error_rate/observability/alert/get", - "alerting:apm.transaction_error_rate/observability/alert/find", - "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/alert/update", - "alerting:apm.transaction_duration/observability/alert/get", - "alerting:apm.transaction_duration/observability/alert/find", - "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_duration/observability/alert/getAlertSummary", - "alerting:apm.transaction_duration/observability/alert/update", - "alerting:apm.anomaly/observability/alert/get", - "alerting:apm.anomaly/observability/alert/find", - "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.anomaly/observability/alert/getAlertSummary", - "alerting:apm.anomaly/observability/alert/update", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", - "alerting:xpack.synthetics.alerts.tls/observability/alert/get", - "alerting:xpack.synthetics.alerts.tls/observability/alert/find", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/alert/update", - ], - "minimal_read": Array [ - "login:", - "app:discover", - "app:kibana", - "ui:catalogue/discover", - "ui:navLinks/discover", - "ui:navLinks/kibana", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", - "saved_object:search/bulk_get", - "saved_object:search/get", - "saved_object:search/find", - "saved_object:search/open_point_in_time", - "saved_object:search/close_point_in_time", - "saved_object:query/bulk_get", - "saved_object:query/get", - "saved_object:query/find", - "saved_object:query/open_point_in_time", - "saved_object:query/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:discover/show", - "api:rac", - "app:observability", - "ui:catalogue/observability", - "ui:navLinks/observability", - "ui:observability/read", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:apm.error_rate/observability/rule/get", - "alerting:apm.error_rate/observability/rule/getRuleState", - "alerting:apm.error_rate/observability/rule/getAlertSummary", - "alerting:apm.error_rate/observability/rule/getExecutionLog", - "alerting:apm.error_rate/observability/rule/getActionErrorLog", - "alerting:apm.error_rate/observability/rule/find", - "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.error_rate/observability/rule/getBackfill", - "alerting:apm.error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_error_rate/observability/rule/get", - "alerting:apm.transaction_error_rate/observability/rule/getRuleState", - "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", - "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", - "alerting:apm.transaction_error_rate/observability/rule/find", - "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_error_rate/observability/rule/getBackfill", - "alerting:apm.transaction_error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_duration/observability/rule/get", - "alerting:apm.transaction_duration/observability/rule/getRuleState", - "alerting:apm.transaction_duration/observability/rule/getAlertSummary", - "alerting:apm.transaction_duration/observability/rule/getExecutionLog", - "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", - "alerting:apm.transaction_duration/observability/rule/find", - "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_duration/observability/rule/getBackfill", - "alerting:apm.transaction_duration/observability/rule/findBackfill", - "alerting:apm.anomaly/observability/rule/get", - "alerting:apm.anomaly/observability/rule/getRuleState", - "alerting:apm.anomaly/observability/rule/getAlertSummary", - "alerting:apm.anomaly/observability/rule/getExecutionLog", - "alerting:apm.anomaly/observability/rule/getActionErrorLog", - "alerting:apm.anomaly/observability/rule/find", - "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", - "alerting:apm.anomaly/observability/rule/getBackfill", - "alerting:apm.anomaly/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/get", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/find", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:apm.error_rate/observability/alert/get", - "alerting:apm.error_rate/observability/alert/find", - "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/alert/get", - "alerting:apm.transaction_error_rate/observability/alert/find", - "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_duration/observability/alert/get", - "alerting:apm.transaction_duration/observability/alert/find", - "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_duration/observability/alert/getAlertSummary", - "alerting:apm.anomaly/observability/alert/get", - "alerting:apm.anomaly/observability/alert/find", - "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.anomaly/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/alert/get", - "alerting:xpack.synthetics.alerts.tls/observability/alert/find", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", - ], - "read": Array [ - "login:", - "app:discover", - "app:kibana", - "ui:catalogue/discover", - "ui:navLinks/discover", - "ui:navLinks/kibana", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "saved_object:url/create", - "saved_object:url/bulk_create", - "saved_object:url/update", - "saved_object:url/bulk_update", - "saved_object:url/delete", - "saved_object:url/bulk_delete", - "saved_object:url/share_to_space", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", - "saved_object:search/bulk_get", - "saved_object:search/get", - "saved_object:search/find", - "saved_object:search/open_point_in_time", - "saved_object:search/close_point_in_time", - "saved_object:query/bulk_get", - "saved_object:query/get", - "saved_object:query/find", - "saved_object:query/open_point_in_time", - "saved_object:query/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "ui:discover/show", - "ui:discover/createShortUrl", - "api:rac", - "app:observability", - "ui:catalogue/observability", - "ui:navLinks/observability", - "ui:observability/read", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:apm.error_rate/observability/rule/get", - "alerting:apm.error_rate/observability/rule/getRuleState", - "alerting:apm.error_rate/observability/rule/getAlertSummary", - "alerting:apm.error_rate/observability/rule/getExecutionLog", - "alerting:apm.error_rate/observability/rule/getActionErrorLog", - "alerting:apm.error_rate/observability/rule/find", - "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.error_rate/observability/rule/getBackfill", - "alerting:apm.error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_error_rate/observability/rule/get", - "alerting:apm.transaction_error_rate/observability/rule/getRuleState", - "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", - "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", - "alerting:apm.transaction_error_rate/observability/rule/find", - "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_error_rate/observability/rule/getBackfill", - "alerting:apm.transaction_error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_duration/observability/rule/get", - "alerting:apm.transaction_duration/observability/rule/getRuleState", - "alerting:apm.transaction_duration/observability/rule/getAlertSummary", - "alerting:apm.transaction_duration/observability/rule/getExecutionLog", - "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", - "alerting:apm.transaction_duration/observability/rule/find", - "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_duration/observability/rule/getBackfill", - "alerting:apm.transaction_duration/observability/rule/findBackfill", - "alerting:apm.anomaly/observability/rule/get", - "alerting:apm.anomaly/observability/rule/getRuleState", - "alerting:apm.anomaly/observability/rule/getAlertSummary", - "alerting:apm.anomaly/observability/rule/getExecutionLog", - "alerting:apm.anomaly/observability/rule/getActionErrorLog", - "alerting:apm.anomaly/observability/rule/find", - "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", - "alerting:apm.anomaly/observability/rule/getBackfill", - "alerting:apm.anomaly/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/get", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/find", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:apm.error_rate/observability/alert/get", - "alerting:apm.error_rate/observability/alert/find", - "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/alert/get", - "alerting:apm.transaction_error_rate/observability/alert/find", - "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_duration/observability/alert/get", - "alerting:apm.transaction_duration/observability/alert/find", - "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_duration/observability/alert/getAlertSummary", - "alerting:apm.anomaly/observability/alert/get", - "alerting:apm.anomaly/observability/alert/find", - "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.anomaly/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/alert/get", - "alerting:xpack.synthetics.alerts.tls/observability/alert/find", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", - ], - "store_search_session": Array [ - "login:", - "api:store_search_session", - "ui:management/kibana/search_sessions", - "saved_object:search-session/bulk_get", - "saved_object:search-session/get", - "saved_object:search-session/find", - "saved_object:search-session/open_point_in_time", - "saved_object:search-session/close_point_in_time", - "saved_object:search-session/create", - "saved_object:search-session/bulk_create", - "saved_object:search-session/update", - "saved_object:search-session/bulk_update", - "saved_object:search-session/delete", - "saved_object:search-session/bulk_delete", - "saved_object:search-session/share_to_space", - "ui:discover/storeSearchSession", - ], - "url_create": Array [ - "login:", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "saved_object:url/create", - "saved_object:url/bulk_create", - "saved_object:url/update", - "saved_object:url/bulk_update", - "saved_object:url/delete", - "saved_object:url/bulk_delete", - "saved_object:url/share_to_space", - "ui:discover/createShortUrl", - ], - }, - "fleetv2": Object { - "all": Array [ - "login:", - "api:fleet-read", - "api:fleet-all", - "app:fleet", - "ui:catalogue/fleet", - "ui:navLinks/fleet", - "saved_object:ingest-outputs/bulk_get", - "saved_object:ingest-outputs/get", - "saved_object:ingest-outputs/find", - "saved_object:ingest-outputs/open_point_in_time", - "saved_object:ingest-outputs/close_point_in_time", - "saved_object:ingest-outputs/create", - "saved_object:ingest-outputs/bulk_create", - "saved_object:ingest-outputs/update", - "saved_object:ingest-outputs/bulk_update", - "saved_object:ingest-outputs/delete", - "saved_object:ingest-outputs/bulk_delete", - "saved_object:ingest-outputs/share_to_space", - "saved_object:ingest-agent-policies/bulk_get", - "saved_object:ingest-agent-policies/get", - "saved_object:ingest-agent-policies/find", - "saved_object:ingest-agent-policies/open_point_in_time", - "saved_object:ingest-agent-policies/close_point_in_time", - "saved_object:ingest-agent-policies/create", - "saved_object:ingest-agent-policies/bulk_create", - "saved_object:ingest-agent-policies/update", - "saved_object:ingest-agent-policies/bulk_update", - "saved_object:ingest-agent-policies/delete", - "saved_object:ingest-agent-policies/bulk_delete", - "saved_object:ingest-agent-policies/share_to_space", - "saved_object:fleet-agent-policies/bulk_get", - "saved_object:fleet-agent-policies/get", - "saved_object:fleet-agent-policies/find", - "saved_object:fleet-agent-policies/open_point_in_time", - "saved_object:fleet-agent-policies/close_point_in_time", - "saved_object:fleet-agent-policies/create", - "saved_object:fleet-agent-policies/bulk_create", - "saved_object:fleet-agent-policies/update", - "saved_object:fleet-agent-policies/bulk_update", - "saved_object:fleet-agent-policies/delete", - "saved_object:fleet-agent-policies/bulk_delete", - "saved_object:fleet-agent-policies/share_to_space", - "saved_object:ingest-package-policies/bulk_get", - "saved_object:ingest-package-policies/get", - "saved_object:ingest-package-policies/find", - "saved_object:ingest-package-policies/open_point_in_time", - "saved_object:ingest-package-policies/close_point_in_time", - "saved_object:ingest-package-policies/create", - "saved_object:ingest-package-policies/bulk_create", - "saved_object:ingest-package-policies/update", - "saved_object:ingest-package-policies/bulk_update", - "saved_object:ingest-package-policies/delete", - "saved_object:ingest-package-policies/bulk_delete", - "saved_object:ingest-package-policies/share_to_space", - "saved_object:fleet-package-policies/bulk_get", - "saved_object:fleet-package-policies/get", - "saved_object:fleet-package-policies/find", - "saved_object:fleet-package-policies/open_point_in_time", - "saved_object:fleet-package-policies/close_point_in_time", - "saved_object:fleet-package-policies/create", - "saved_object:fleet-package-policies/bulk_create", - "saved_object:fleet-package-policies/update", - "saved_object:fleet-package-policies/bulk_update", - "saved_object:fleet-package-policies/delete", - "saved_object:fleet-package-policies/bulk_delete", - "saved_object:fleet-package-policies/share_to_space", - "saved_object:epm-packages/bulk_get", - "saved_object:epm-packages/get", - "saved_object:epm-packages/find", - "saved_object:epm-packages/open_point_in_time", - "saved_object:epm-packages/close_point_in_time", - "saved_object:epm-packages/create", - "saved_object:epm-packages/bulk_create", - "saved_object:epm-packages/update", - "saved_object:epm-packages/bulk_update", - "saved_object:epm-packages/delete", - "saved_object:epm-packages/bulk_delete", - "saved_object:epm-packages/share_to_space", - "saved_object:epm-packages-assets/bulk_get", - "saved_object:epm-packages-assets/get", - "saved_object:epm-packages-assets/find", - "saved_object:epm-packages-assets/open_point_in_time", - "saved_object:epm-packages-assets/close_point_in_time", - "saved_object:epm-packages-assets/create", - "saved_object:epm-packages-assets/bulk_create", - "saved_object:epm-packages-assets/update", - "saved_object:epm-packages-assets/bulk_update", - "saved_object:epm-packages-assets/delete", - "saved_object:epm-packages-assets/bulk_delete", - "saved_object:epm-packages-assets/share_to_space", - "saved_object:fleet-preconfiguration-deletion-record/bulk_get", - "saved_object:fleet-preconfiguration-deletion-record/get", - "saved_object:fleet-preconfiguration-deletion-record/find", - "saved_object:fleet-preconfiguration-deletion-record/open_point_in_time", - "saved_object:fleet-preconfiguration-deletion-record/close_point_in_time", - "saved_object:fleet-preconfiguration-deletion-record/create", - "saved_object:fleet-preconfiguration-deletion-record/bulk_create", - "saved_object:fleet-preconfiguration-deletion-record/update", - "saved_object:fleet-preconfiguration-deletion-record/bulk_update", - "saved_object:fleet-preconfiguration-deletion-record/delete", - "saved_object:fleet-preconfiguration-deletion-record/bulk_delete", - "saved_object:fleet-preconfiguration-deletion-record/share_to_space", - "saved_object:ingest-download-sources/bulk_get", - "saved_object:ingest-download-sources/get", - "saved_object:ingest-download-sources/find", - "saved_object:ingest-download-sources/open_point_in_time", - "saved_object:ingest-download-sources/close_point_in_time", - "saved_object:ingest-download-sources/create", - "saved_object:ingest-download-sources/bulk_create", - "saved_object:ingest-download-sources/update", - "saved_object:ingest-download-sources/bulk_update", - "saved_object:ingest-download-sources/delete", - "saved_object:ingest-download-sources/bulk_delete", - "saved_object:ingest-download-sources/share_to_space", - "saved_object:fleet-fleet-server-host/bulk_get", - "saved_object:fleet-fleet-server-host/get", - "saved_object:fleet-fleet-server-host/find", - "saved_object:fleet-fleet-server-host/open_point_in_time", - "saved_object:fleet-fleet-server-host/close_point_in_time", - "saved_object:fleet-fleet-server-host/create", - "saved_object:fleet-fleet-server-host/bulk_create", - "saved_object:fleet-fleet-server-host/update", - "saved_object:fleet-fleet-server-host/bulk_update", - "saved_object:fleet-fleet-server-host/delete", - "saved_object:fleet-fleet-server-host/bulk_delete", - "saved_object:fleet-fleet-server-host/share_to_space", - "saved_object:fleet-proxy/bulk_get", - "saved_object:fleet-proxy/get", - "saved_object:fleet-proxy/find", - "saved_object:fleet-proxy/open_point_in_time", - "saved_object:fleet-proxy/close_point_in_time", - "saved_object:fleet-proxy/create", - "saved_object:fleet-proxy/bulk_create", - "saved_object:fleet-proxy/update", - "saved_object:fleet-proxy/bulk_update", - "saved_object:fleet-proxy/delete", - "saved_object:fleet-proxy/bulk_delete", - "saved_object:fleet-proxy/share_to_space", - "saved_object:fleet-space-settings/bulk_get", - "saved_object:fleet-space-settings/get", - "saved_object:fleet-space-settings/find", - "saved_object:fleet-space-settings/open_point_in_time", - "saved_object:fleet-space-settings/close_point_in_time", - "saved_object:fleet-space-settings/create", - "saved_object:fleet-space-settings/bulk_create", - "saved_object:fleet-space-settings/update", - "saved_object:fleet-space-settings/bulk_update", - "saved_object:fleet-space-settings/delete", - "saved_object:fleet-space-settings/bulk_delete", - "saved_object:fleet-space-settings/share_to_space", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:fleetv2/read", - "ui:fleetv2/all", - "api:infra", - "api:rac", - "app:infra", - "app:logs", - "app:kibana", - "app:observability-logs-explorer", - "ui:catalogue/infralogging", - "ui:catalogue/logs", - "ui:management/insightsAndAlerting/triggersActions", - "ui:navLinks/infra", - "ui:navLinks/logs", - "ui:navLinks/kibana", - "ui:navLinks/observability-logs-explorer", - "saved_object:infrastructure-ui-source/bulk_get", - "saved_object:infrastructure-ui-source/get", - "saved_object:infrastructure-ui-source/find", - "saved_object:infrastructure-ui-source/open_point_in_time", - "saved_object:infrastructure-ui-source/close_point_in_time", - "saved_object:infrastructure-ui-source/create", - "saved_object:infrastructure-ui-source/bulk_create", - "saved_object:infrastructure-ui-source/update", - "saved_object:infrastructure-ui-source/bulk_update", - "saved_object:infrastructure-ui-source/delete", - "saved_object:infrastructure-ui-source/bulk_delete", - "saved_object:infrastructure-ui-source/share_to_space", - "saved_object:infrastructure-monitoring-log-view/bulk_get", - "saved_object:infrastructure-monitoring-log-view/get", - "saved_object:infrastructure-monitoring-log-view/find", - "saved_object:infrastructure-monitoring-log-view/open_point_in_time", - "saved_object:infrastructure-monitoring-log-view/close_point_in_time", - "saved_object:infrastructure-monitoring-log-view/create", - "saved_object:infrastructure-monitoring-log-view/bulk_create", - "saved_object:infrastructure-monitoring-log-view/update", - "saved_object:infrastructure-monitoring-log-view/bulk_update", - "saved_object:infrastructure-monitoring-log-view/delete", - "saved_object:infrastructure-monitoring-log-view/bulk_delete", - "saved_object:infrastructure-monitoring-log-view/share_to_space", - "ui:logs/show", - "ui:logs/configureSource", - "ui:logs/save", - "alerting:logs.alert.document.count/logs/rule/get", - "alerting:logs.alert.document.count/logs/rule/getRuleState", - "alerting:logs.alert.document.count/logs/rule/getAlertSummary", - "alerting:logs.alert.document.count/logs/rule/getExecutionLog", - "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", - "alerting:logs.alert.document.count/logs/rule/find", - "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", - "alerting:logs.alert.document.count/logs/rule/getBackfill", - "alerting:logs.alert.document.count/logs/rule/findBackfill", - "alerting:logs.alert.document.count/logs/rule/create", - "alerting:logs.alert.document.count/logs/rule/delete", - "alerting:logs.alert.document.count/logs/rule/update", - "alerting:logs.alert.document.count/logs/rule/updateApiKey", - "alerting:logs.alert.document.count/logs/rule/enable", - "alerting:logs.alert.document.count/logs/rule/disable", - "alerting:logs.alert.document.count/logs/rule/muteAll", - "alerting:logs.alert.document.count/logs/rule/unmuteAll", - "alerting:logs.alert.document.count/logs/rule/muteAlert", - "alerting:logs.alert.document.count/logs/rule/unmuteAlert", - "alerting:logs.alert.document.count/logs/rule/snooze", - "alerting:logs.alert.document.count/logs/rule/bulkEdit", - "alerting:logs.alert.document.count/logs/rule/bulkDelete", - "alerting:logs.alert.document.count/logs/rule/bulkEnable", - "alerting:logs.alert.document.count/logs/rule/bulkDisable", - "alerting:logs.alert.document.count/logs/rule/unsnooze", - "alerting:logs.alert.document.count/logs/rule/runSoon", - "alerting:logs.alert.document.count/logs/rule/scheduleBackfill", - "alerting:logs.alert.document.count/logs/rule/deleteBackfill", - "alerting:.es-query/logs/rule/get", - "alerting:.es-query/logs/rule/getRuleState", - "alerting:.es-query/logs/rule/getAlertSummary", - "alerting:.es-query/logs/rule/getExecutionLog", - "alerting:.es-query/logs/rule/getActionErrorLog", - "alerting:.es-query/logs/rule/find", - "alerting:.es-query/logs/rule/getRuleExecutionKPI", - "alerting:.es-query/logs/rule/getBackfill", - "alerting:.es-query/logs/rule/findBackfill", - "alerting:.es-query/logs/rule/create", - "alerting:.es-query/logs/rule/delete", - "alerting:.es-query/logs/rule/update", - "alerting:.es-query/logs/rule/updateApiKey", - "alerting:.es-query/logs/rule/enable", - "alerting:.es-query/logs/rule/disable", - "alerting:.es-query/logs/rule/muteAll", - "alerting:.es-query/logs/rule/unmuteAll", - "alerting:.es-query/logs/rule/muteAlert", - "alerting:.es-query/logs/rule/unmuteAlert", - "alerting:.es-query/logs/rule/snooze", - "alerting:.es-query/logs/rule/bulkEdit", - "alerting:.es-query/logs/rule/bulkDelete", - "alerting:.es-query/logs/rule/bulkEnable", - "alerting:.es-query/logs/rule/bulkDisable", - "alerting:.es-query/logs/rule/unsnooze", - "alerting:.es-query/logs/rule/runSoon", - "alerting:.es-query/logs/rule/scheduleBackfill", - "alerting:.es-query/logs/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/get", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", - "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/logs/rule/find", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/create", - "alerting:observability.rules.custom_threshold/logs/rule/delete", - "alerting:observability.rules.custom_threshold/logs/rule/update", - "alerting:observability.rules.custom_threshold/logs/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/logs/rule/enable", - "alerting:observability.rules.custom_threshold/logs/rule/disable", - "alerting:observability.rules.custom_threshold/logs/rule/muteAll", - "alerting:observability.rules.custom_threshold/logs/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/logs/rule/muteAlert", - "alerting:observability.rules.custom_threshold/logs/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/logs/rule/snooze", - "alerting:observability.rules.custom_threshold/logs/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/logs/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/logs/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/logs/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/logs/rule/unsnooze", - "alerting:observability.rules.custom_threshold/logs/rule/runSoon", - "alerting:observability.rules.custom_threshold/logs/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/deleteBackfill", - "alerting:logs.alert.document.count/logs/alert/get", - "alerting:logs.alert.document.count/logs/alert/find", - "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", - "alerting:logs.alert.document.count/logs/alert/getAlertSummary", - "alerting:logs.alert.document.count/logs/alert/update", - "alerting:.es-query/logs/alert/get", - "alerting:.es-query/logs/alert/find", - "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/logs/alert/getAlertSummary", - "alerting:.es-query/logs/alert/update", - "alerting:observability.rules.custom_threshold/logs/alert/get", - "alerting:observability.rules.custom_threshold/logs/alert/find", - "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/update", - ], - "minimal_all": Array [ - "login:", - "api:fleet-read", - "api:fleet-all", - "app:fleet", - "ui:catalogue/fleet", - "ui:navLinks/fleet", - "saved_object:ingest-outputs/bulk_get", - "saved_object:ingest-outputs/get", - "saved_object:ingest-outputs/find", - "saved_object:ingest-outputs/open_point_in_time", - "saved_object:ingest-outputs/close_point_in_time", - "saved_object:ingest-outputs/create", - "saved_object:ingest-outputs/bulk_create", - "saved_object:ingest-outputs/update", - "saved_object:ingest-outputs/bulk_update", - "saved_object:ingest-outputs/delete", - "saved_object:ingest-outputs/bulk_delete", - "saved_object:ingest-outputs/share_to_space", - "saved_object:ingest-agent-policies/bulk_get", - "saved_object:ingest-agent-policies/get", - "saved_object:ingest-agent-policies/find", - "saved_object:ingest-agent-policies/open_point_in_time", - "saved_object:ingest-agent-policies/close_point_in_time", - "saved_object:ingest-agent-policies/create", - "saved_object:ingest-agent-policies/bulk_create", - "saved_object:ingest-agent-policies/update", - "saved_object:ingest-agent-policies/bulk_update", - "saved_object:ingest-agent-policies/delete", - "saved_object:ingest-agent-policies/bulk_delete", - "saved_object:ingest-agent-policies/share_to_space", - "saved_object:fleet-agent-policies/bulk_get", - "saved_object:fleet-agent-policies/get", - "saved_object:fleet-agent-policies/find", - "saved_object:fleet-agent-policies/open_point_in_time", - "saved_object:fleet-agent-policies/close_point_in_time", - "saved_object:fleet-agent-policies/create", - "saved_object:fleet-agent-policies/bulk_create", - "saved_object:fleet-agent-policies/update", - "saved_object:fleet-agent-policies/bulk_update", - "saved_object:fleet-agent-policies/delete", - "saved_object:fleet-agent-policies/bulk_delete", - "saved_object:fleet-agent-policies/share_to_space", - "saved_object:ingest-package-policies/bulk_get", - "saved_object:ingest-package-policies/get", - "saved_object:ingest-package-policies/find", - "saved_object:ingest-package-policies/open_point_in_time", - "saved_object:ingest-package-policies/close_point_in_time", - "saved_object:ingest-package-policies/create", - "saved_object:ingest-package-policies/bulk_create", - "saved_object:ingest-package-policies/update", - "saved_object:ingest-package-policies/bulk_update", - "saved_object:ingest-package-policies/delete", - "saved_object:ingest-package-policies/bulk_delete", - "saved_object:ingest-package-policies/share_to_space", - "saved_object:fleet-package-policies/bulk_get", - "saved_object:fleet-package-policies/get", - "saved_object:fleet-package-policies/find", - "saved_object:fleet-package-policies/open_point_in_time", - "saved_object:fleet-package-policies/close_point_in_time", - "saved_object:fleet-package-policies/create", - "saved_object:fleet-package-policies/bulk_create", - "saved_object:fleet-package-policies/update", - "saved_object:fleet-package-policies/bulk_update", - "saved_object:fleet-package-policies/delete", - "saved_object:fleet-package-policies/bulk_delete", - "saved_object:fleet-package-policies/share_to_space", - "saved_object:epm-packages/bulk_get", - "saved_object:epm-packages/get", - "saved_object:epm-packages/find", - "saved_object:epm-packages/open_point_in_time", - "saved_object:epm-packages/close_point_in_time", - "saved_object:epm-packages/create", - "saved_object:epm-packages/bulk_create", - "saved_object:epm-packages/update", - "saved_object:epm-packages/bulk_update", - "saved_object:epm-packages/delete", - "saved_object:epm-packages/bulk_delete", - "saved_object:epm-packages/share_to_space", - "saved_object:epm-packages-assets/bulk_get", - "saved_object:epm-packages-assets/get", - "saved_object:epm-packages-assets/find", - "saved_object:epm-packages-assets/open_point_in_time", - "saved_object:epm-packages-assets/close_point_in_time", - "saved_object:epm-packages-assets/create", - "saved_object:epm-packages-assets/bulk_create", - "saved_object:epm-packages-assets/update", - "saved_object:epm-packages-assets/bulk_update", - "saved_object:epm-packages-assets/delete", - "saved_object:epm-packages-assets/bulk_delete", - "saved_object:epm-packages-assets/share_to_space", - "saved_object:fleet-preconfiguration-deletion-record/bulk_get", - "saved_object:fleet-preconfiguration-deletion-record/get", - "saved_object:fleet-preconfiguration-deletion-record/find", - "saved_object:fleet-preconfiguration-deletion-record/open_point_in_time", - "saved_object:fleet-preconfiguration-deletion-record/close_point_in_time", - "saved_object:fleet-preconfiguration-deletion-record/create", - "saved_object:fleet-preconfiguration-deletion-record/bulk_create", - "saved_object:fleet-preconfiguration-deletion-record/update", - "saved_object:fleet-preconfiguration-deletion-record/bulk_update", - "saved_object:fleet-preconfiguration-deletion-record/delete", - "saved_object:fleet-preconfiguration-deletion-record/bulk_delete", - "saved_object:fleet-preconfiguration-deletion-record/share_to_space", - "saved_object:ingest-download-sources/bulk_get", - "saved_object:ingest-download-sources/get", - "saved_object:ingest-download-sources/find", - "saved_object:ingest-download-sources/open_point_in_time", - "saved_object:ingest-download-sources/close_point_in_time", - "saved_object:ingest-download-sources/create", - "saved_object:ingest-download-sources/bulk_create", - "saved_object:ingest-download-sources/update", - "saved_object:ingest-download-sources/bulk_update", - "saved_object:ingest-download-sources/delete", - "saved_object:ingest-download-sources/bulk_delete", - "saved_object:ingest-download-sources/share_to_space", - "saved_object:fleet-fleet-server-host/bulk_get", - "saved_object:fleet-fleet-server-host/get", - "saved_object:fleet-fleet-server-host/find", - "saved_object:fleet-fleet-server-host/open_point_in_time", - "saved_object:fleet-fleet-server-host/close_point_in_time", - "saved_object:fleet-fleet-server-host/create", - "saved_object:fleet-fleet-server-host/bulk_create", - "saved_object:fleet-fleet-server-host/update", - "saved_object:fleet-fleet-server-host/bulk_update", - "saved_object:fleet-fleet-server-host/delete", - "saved_object:fleet-fleet-server-host/bulk_delete", - "saved_object:fleet-fleet-server-host/share_to_space", - "saved_object:fleet-proxy/bulk_get", - "saved_object:fleet-proxy/get", - "saved_object:fleet-proxy/find", - "saved_object:fleet-proxy/open_point_in_time", - "saved_object:fleet-proxy/close_point_in_time", - "saved_object:fleet-proxy/create", - "saved_object:fleet-proxy/bulk_create", - "saved_object:fleet-proxy/update", - "saved_object:fleet-proxy/bulk_update", - "saved_object:fleet-proxy/delete", - "saved_object:fleet-proxy/bulk_delete", - "saved_object:fleet-proxy/share_to_space", - "saved_object:fleet-space-settings/bulk_get", - "saved_object:fleet-space-settings/get", - "saved_object:fleet-space-settings/find", - "saved_object:fleet-space-settings/open_point_in_time", - "saved_object:fleet-space-settings/close_point_in_time", - "saved_object:fleet-space-settings/create", - "saved_object:fleet-space-settings/bulk_create", - "saved_object:fleet-space-settings/update", - "saved_object:fleet-space-settings/bulk_update", - "saved_object:fleet-space-settings/delete", - "saved_object:fleet-space-settings/bulk_delete", - "saved_object:fleet-space-settings/share_to_space", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:fleetv2/read", - "ui:fleetv2/all", - "api:infra", - "api:rac", - "app:infra", - "app:logs", - "app:kibana", - "app:observability-logs-explorer", - "ui:catalogue/infralogging", - "ui:catalogue/logs", - "ui:management/insightsAndAlerting/triggersActions", - "ui:navLinks/infra", - "ui:navLinks/logs", - "ui:navLinks/kibana", - "ui:navLinks/observability-logs-explorer", - "saved_object:infrastructure-ui-source/bulk_get", - "saved_object:infrastructure-ui-source/get", - "saved_object:infrastructure-ui-source/find", - "saved_object:infrastructure-ui-source/open_point_in_time", - "saved_object:infrastructure-ui-source/close_point_in_time", - "saved_object:infrastructure-ui-source/create", - "saved_object:infrastructure-ui-source/bulk_create", - "saved_object:infrastructure-ui-source/update", - "saved_object:infrastructure-ui-source/bulk_update", - "saved_object:infrastructure-ui-source/delete", - "saved_object:infrastructure-ui-source/bulk_delete", - "saved_object:infrastructure-ui-source/share_to_space", - "saved_object:infrastructure-monitoring-log-view/bulk_get", - "saved_object:infrastructure-monitoring-log-view/get", - "saved_object:infrastructure-monitoring-log-view/find", - "saved_object:infrastructure-monitoring-log-view/open_point_in_time", - "saved_object:infrastructure-monitoring-log-view/close_point_in_time", - "saved_object:infrastructure-monitoring-log-view/create", - "saved_object:infrastructure-monitoring-log-view/bulk_create", - "saved_object:infrastructure-monitoring-log-view/update", - "saved_object:infrastructure-monitoring-log-view/bulk_update", - "saved_object:infrastructure-monitoring-log-view/delete", - "saved_object:infrastructure-monitoring-log-view/bulk_delete", - "saved_object:infrastructure-monitoring-log-view/share_to_space", - "ui:logs/show", - "ui:logs/configureSource", - "ui:logs/save", - "alerting:logs.alert.document.count/logs/rule/get", - "alerting:logs.alert.document.count/logs/rule/getRuleState", - "alerting:logs.alert.document.count/logs/rule/getAlertSummary", - "alerting:logs.alert.document.count/logs/rule/getExecutionLog", - "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", - "alerting:logs.alert.document.count/logs/rule/find", - "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", - "alerting:logs.alert.document.count/logs/rule/getBackfill", - "alerting:logs.alert.document.count/logs/rule/findBackfill", - "alerting:logs.alert.document.count/logs/rule/create", - "alerting:logs.alert.document.count/logs/rule/delete", - "alerting:logs.alert.document.count/logs/rule/update", - "alerting:logs.alert.document.count/logs/rule/updateApiKey", - "alerting:logs.alert.document.count/logs/rule/enable", - "alerting:logs.alert.document.count/logs/rule/disable", - "alerting:logs.alert.document.count/logs/rule/muteAll", - "alerting:logs.alert.document.count/logs/rule/unmuteAll", - "alerting:logs.alert.document.count/logs/rule/muteAlert", - "alerting:logs.alert.document.count/logs/rule/unmuteAlert", - "alerting:logs.alert.document.count/logs/rule/snooze", - "alerting:logs.alert.document.count/logs/rule/bulkEdit", - "alerting:logs.alert.document.count/logs/rule/bulkDelete", - "alerting:logs.alert.document.count/logs/rule/bulkEnable", - "alerting:logs.alert.document.count/logs/rule/bulkDisable", - "alerting:logs.alert.document.count/logs/rule/unsnooze", - "alerting:logs.alert.document.count/logs/rule/runSoon", - "alerting:logs.alert.document.count/logs/rule/scheduleBackfill", - "alerting:logs.alert.document.count/logs/rule/deleteBackfill", - "alerting:.es-query/logs/rule/get", - "alerting:.es-query/logs/rule/getRuleState", - "alerting:.es-query/logs/rule/getAlertSummary", - "alerting:.es-query/logs/rule/getExecutionLog", - "alerting:.es-query/logs/rule/getActionErrorLog", - "alerting:.es-query/logs/rule/find", - "alerting:.es-query/logs/rule/getRuleExecutionKPI", - "alerting:.es-query/logs/rule/getBackfill", - "alerting:.es-query/logs/rule/findBackfill", - "alerting:.es-query/logs/rule/create", - "alerting:.es-query/logs/rule/delete", - "alerting:.es-query/logs/rule/update", - "alerting:.es-query/logs/rule/updateApiKey", - "alerting:.es-query/logs/rule/enable", - "alerting:.es-query/logs/rule/disable", - "alerting:.es-query/logs/rule/muteAll", - "alerting:.es-query/logs/rule/unmuteAll", - "alerting:.es-query/logs/rule/muteAlert", - "alerting:.es-query/logs/rule/unmuteAlert", - "alerting:.es-query/logs/rule/snooze", - "alerting:.es-query/logs/rule/bulkEdit", - "alerting:.es-query/logs/rule/bulkDelete", - "alerting:.es-query/logs/rule/bulkEnable", - "alerting:.es-query/logs/rule/bulkDisable", - "alerting:.es-query/logs/rule/unsnooze", - "alerting:.es-query/logs/rule/runSoon", - "alerting:.es-query/logs/rule/scheduleBackfill", - "alerting:.es-query/logs/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/get", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", - "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/logs/rule/find", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/create", - "alerting:observability.rules.custom_threshold/logs/rule/delete", - "alerting:observability.rules.custom_threshold/logs/rule/update", - "alerting:observability.rules.custom_threshold/logs/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/logs/rule/enable", - "alerting:observability.rules.custom_threshold/logs/rule/disable", - "alerting:observability.rules.custom_threshold/logs/rule/muteAll", - "alerting:observability.rules.custom_threshold/logs/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/logs/rule/muteAlert", - "alerting:observability.rules.custom_threshold/logs/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/logs/rule/snooze", - "alerting:observability.rules.custom_threshold/logs/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/logs/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/logs/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/logs/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/logs/rule/unsnooze", - "alerting:observability.rules.custom_threshold/logs/rule/runSoon", - "alerting:observability.rules.custom_threshold/logs/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/deleteBackfill", - "alerting:logs.alert.document.count/logs/alert/get", - "alerting:logs.alert.document.count/logs/alert/find", - "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", - "alerting:logs.alert.document.count/logs/alert/getAlertSummary", - "alerting:logs.alert.document.count/logs/alert/update", - "alerting:.es-query/logs/alert/get", - "alerting:.es-query/logs/alert/find", - "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/logs/alert/getAlertSummary", - "alerting:.es-query/logs/alert/update", - "alerting:observability.rules.custom_threshold/logs/alert/get", - "alerting:observability.rules.custom_threshold/logs/alert/find", - "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/update", - ], - "minimal_read": Array [ - "login:", - "api:fleet-read", - "app:fleet", - "ui:catalogue/fleet", - "ui:navLinks/fleet", - "saved_object:ingest-outputs/bulk_get", - "saved_object:ingest-outputs/get", - "saved_object:ingest-outputs/find", - "saved_object:ingest-outputs/open_point_in_time", - "saved_object:ingest-outputs/close_point_in_time", - "saved_object:ingest-agent-policies/bulk_get", - "saved_object:ingest-agent-policies/get", - "saved_object:ingest-agent-policies/find", - "saved_object:ingest-agent-policies/open_point_in_time", - "saved_object:ingest-agent-policies/close_point_in_time", - "saved_object:fleet-agent-policies/bulk_get", - "saved_object:fleet-agent-policies/get", - "saved_object:fleet-agent-policies/find", - "saved_object:fleet-agent-policies/open_point_in_time", - "saved_object:fleet-agent-policies/close_point_in_time", - "saved_object:ingest-package-policies/bulk_get", - "saved_object:ingest-package-policies/get", - "saved_object:ingest-package-policies/find", - "saved_object:ingest-package-policies/open_point_in_time", - "saved_object:ingest-package-policies/close_point_in_time", - "saved_object:fleet-package-policies/bulk_get", - "saved_object:fleet-package-policies/get", - "saved_object:fleet-package-policies/find", - "saved_object:fleet-package-policies/open_point_in_time", - "saved_object:fleet-package-policies/close_point_in_time", - "saved_object:epm-packages/bulk_get", - "saved_object:epm-packages/get", - "saved_object:epm-packages/find", - "saved_object:epm-packages/open_point_in_time", - "saved_object:epm-packages/close_point_in_time", - "saved_object:epm-packages-assets/bulk_get", - "saved_object:epm-packages-assets/get", - "saved_object:epm-packages-assets/find", - "saved_object:epm-packages-assets/open_point_in_time", - "saved_object:epm-packages-assets/close_point_in_time", - "saved_object:fleet-preconfiguration-deletion-record/bulk_get", - "saved_object:fleet-preconfiguration-deletion-record/get", - "saved_object:fleet-preconfiguration-deletion-record/find", - "saved_object:fleet-preconfiguration-deletion-record/open_point_in_time", - "saved_object:fleet-preconfiguration-deletion-record/close_point_in_time", - "saved_object:ingest-download-sources/bulk_get", - "saved_object:ingest-download-sources/get", - "saved_object:ingest-download-sources/find", - "saved_object:ingest-download-sources/open_point_in_time", - "saved_object:ingest-download-sources/close_point_in_time", - "saved_object:fleet-fleet-server-host/bulk_get", - "saved_object:fleet-fleet-server-host/get", - "saved_object:fleet-fleet-server-host/find", - "saved_object:fleet-fleet-server-host/open_point_in_time", - "saved_object:fleet-fleet-server-host/close_point_in_time", - "saved_object:fleet-proxy/bulk_get", - "saved_object:fleet-proxy/get", - "saved_object:fleet-proxy/find", - "saved_object:fleet-proxy/open_point_in_time", - "saved_object:fleet-proxy/close_point_in_time", - "saved_object:fleet-space-settings/bulk_get", - "saved_object:fleet-space-settings/get", - "saved_object:fleet-space-settings/find", - "saved_object:fleet-space-settings/open_point_in_time", - "saved_object:fleet-space-settings/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:fleetv2/read", - "api:infra", - "api:rac", - "app:infra", - "app:logs", - "app:kibana", - "app:observability-logs-explorer", - "ui:catalogue/infralogging", - "ui:catalogue/logs", - "ui:management/insightsAndAlerting/triggersActions", - "ui:navLinks/infra", - "ui:navLinks/logs", - "ui:navLinks/kibana", - "ui:navLinks/observability-logs-explorer", - "saved_object:infrastructure-ui-source/bulk_get", - "saved_object:infrastructure-ui-source/get", - "saved_object:infrastructure-ui-source/find", - "saved_object:infrastructure-ui-source/open_point_in_time", - "saved_object:infrastructure-ui-source/close_point_in_time", - "saved_object:infrastructure-monitoring-log-view/bulk_get", - "saved_object:infrastructure-monitoring-log-view/get", - "saved_object:infrastructure-monitoring-log-view/find", - "saved_object:infrastructure-monitoring-log-view/open_point_in_time", - "saved_object:infrastructure-monitoring-log-view/close_point_in_time", - "ui:logs/show", - "alerting:logs.alert.document.count/logs/rule/get", - "alerting:logs.alert.document.count/logs/rule/getRuleState", - "alerting:logs.alert.document.count/logs/rule/getAlertSummary", - "alerting:logs.alert.document.count/logs/rule/getExecutionLog", - "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", - "alerting:logs.alert.document.count/logs/rule/find", - "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", - "alerting:logs.alert.document.count/logs/rule/getBackfill", - "alerting:logs.alert.document.count/logs/rule/findBackfill", - "alerting:.es-query/logs/rule/get", - "alerting:.es-query/logs/rule/getRuleState", - "alerting:.es-query/logs/rule/getAlertSummary", - "alerting:.es-query/logs/rule/getExecutionLog", - "alerting:.es-query/logs/rule/getActionErrorLog", - "alerting:.es-query/logs/rule/find", - "alerting:.es-query/logs/rule/getRuleExecutionKPI", - "alerting:.es-query/logs/rule/getBackfill", - "alerting:.es-query/logs/rule/findBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/get", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", - "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/logs/rule/find", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", - "alerting:logs.alert.document.count/logs/alert/get", - "alerting:logs.alert.document.count/logs/alert/find", - "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", - "alerting:logs.alert.document.count/logs/alert/getAlertSummary", - "alerting:.es-query/logs/alert/get", - "alerting:.es-query/logs/alert/find", - "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/logs/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/alert/get", - "alerting:observability.rules.custom_threshold/logs/alert/find", - "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", - ], - "read": Array [ - "login:", - "api:fleet-read", - "app:fleet", - "ui:catalogue/fleet", - "ui:navLinks/fleet", - "saved_object:ingest-outputs/bulk_get", - "saved_object:ingest-outputs/get", - "saved_object:ingest-outputs/find", - "saved_object:ingest-outputs/open_point_in_time", - "saved_object:ingest-outputs/close_point_in_time", - "saved_object:ingest-agent-policies/bulk_get", - "saved_object:ingest-agent-policies/get", - "saved_object:ingest-agent-policies/find", - "saved_object:ingest-agent-policies/open_point_in_time", - "saved_object:ingest-agent-policies/close_point_in_time", - "saved_object:fleet-agent-policies/bulk_get", - "saved_object:fleet-agent-policies/get", - "saved_object:fleet-agent-policies/find", - "saved_object:fleet-agent-policies/open_point_in_time", - "saved_object:fleet-agent-policies/close_point_in_time", - "saved_object:ingest-package-policies/bulk_get", - "saved_object:ingest-package-policies/get", - "saved_object:ingest-package-policies/find", - "saved_object:ingest-package-policies/open_point_in_time", - "saved_object:ingest-package-policies/close_point_in_time", - "saved_object:fleet-package-policies/bulk_get", - "saved_object:fleet-package-policies/get", - "saved_object:fleet-package-policies/find", - "saved_object:fleet-package-policies/open_point_in_time", - "saved_object:fleet-package-policies/close_point_in_time", - "saved_object:epm-packages/bulk_get", - "saved_object:epm-packages/get", - "saved_object:epm-packages/find", - "saved_object:epm-packages/open_point_in_time", - "saved_object:epm-packages/close_point_in_time", - "saved_object:epm-packages-assets/bulk_get", - "saved_object:epm-packages-assets/get", - "saved_object:epm-packages-assets/find", - "saved_object:epm-packages-assets/open_point_in_time", - "saved_object:epm-packages-assets/close_point_in_time", - "saved_object:fleet-preconfiguration-deletion-record/bulk_get", - "saved_object:fleet-preconfiguration-deletion-record/get", - "saved_object:fleet-preconfiguration-deletion-record/find", - "saved_object:fleet-preconfiguration-deletion-record/open_point_in_time", - "saved_object:fleet-preconfiguration-deletion-record/close_point_in_time", - "saved_object:ingest-download-sources/bulk_get", - "saved_object:ingest-download-sources/get", - "saved_object:ingest-download-sources/find", - "saved_object:ingest-download-sources/open_point_in_time", - "saved_object:ingest-download-sources/close_point_in_time", - "saved_object:fleet-fleet-server-host/bulk_get", - "saved_object:fleet-fleet-server-host/get", - "saved_object:fleet-fleet-server-host/find", - "saved_object:fleet-fleet-server-host/open_point_in_time", - "saved_object:fleet-fleet-server-host/close_point_in_time", - "saved_object:fleet-proxy/bulk_get", - "saved_object:fleet-proxy/get", - "saved_object:fleet-proxy/find", - "saved_object:fleet-proxy/open_point_in_time", - "saved_object:fleet-proxy/close_point_in_time", - "saved_object:fleet-space-settings/bulk_get", - "saved_object:fleet-space-settings/get", - "saved_object:fleet-space-settings/find", - "saved_object:fleet-space-settings/open_point_in_time", - "saved_object:fleet-space-settings/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:fleetv2/read", - "api:infra", - "api:rac", - "app:infra", - "app:logs", - "app:kibana", - "app:observability-logs-explorer", - "ui:catalogue/infralogging", - "ui:catalogue/logs", - "ui:management/insightsAndAlerting/triggersActions", - "ui:navLinks/infra", - "ui:navLinks/logs", - "ui:navLinks/kibana", - "ui:navLinks/observability-logs-explorer", - "saved_object:infrastructure-ui-source/bulk_get", - "saved_object:infrastructure-ui-source/get", - "saved_object:infrastructure-ui-source/find", - "saved_object:infrastructure-ui-source/open_point_in_time", - "saved_object:infrastructure-ui-source/close_point_in_time", - "saved_object:infrastructure-monitoring-log-view/bulk_get", - "saved_object:infrastructure-monitoring-log-view/get", - "saved_object:infrastructure-monitoring-log-view/find", - "saved_object:infrastructure-monitoring-log-view/open_point_in_time", - "saved_object:infrastructure-monitoring-log-view/close_point_in_time", - "ui:logs/show", - "alerting:logs.alert.document.count/logs/rule/get", - "alerting:logs.alert.document.count/logs/rule/getRuleState", - "alerting:logs.alert.document.count/logs/rule/getAlertSummary", - "alerting:logs.alert.document.count/logs/rule/getExecutionLog", - "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", - "alerting:logs.alert.document.count/logs/rule/find", - "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", - "alerting:logs.alert.document.count/logs/rule/getBackfill", - "alerting:logs.alert.document.count/logs/rule/findBackfill", - "alerting:.es-query/logs/rule/get", - "alerting:.es-query/logs/rule/getRuleState", - "alerting:.es-query/logs/rule/getAlertSummary", - "alerting:.es-query/logs/rule/getExecutionLog", - "alerting:.es-query/logs/rule/getActionErrorLog", - "alerting:.es-query/logs/rule/find", - "alerting:.es-query/logs/rule/getRuleExecutionKPI", - "alerting:.es-query/logs/rule/getBackfill", - "alerting:.es-query/logs/rule/findBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/get", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", - "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/logs/rule/find", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", - "alerting:logs.alert.document.count/logs/alert/get", - "alerting:logs.alert.document.count/logs/alert/find", - "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", - "alerting:logs.alert.document.count/logs/alert/getAlertSummary", - "alerting:.es-query/logs/alert/get", - "alerting:.es-query/logs/alert/find", - "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/logs/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/alert/get", - "alerting:observability.rules.custom_threshold/logs/alert/find", - "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", - ], - }, - "infrastructure": Object { - "all": Array [ - "login:", - "api:infra", - "api:rac", - "app:infra", - "app:metrics", - "app:kibana", - "ui:catalogue/infraops", - "ui:catalogue/metrics", - "ui:management/insightsAndAlerting/triggersActions", - "ui:navLinks/infra", - "ui:navLinks/metrics", - "ui:navLinks/kibana", - "saved_object:infrastructure-ui-source/bulk_get", - "saved_object:infrastructure-ui-source/get", - "saved_object:infrastructure-ui-source/find", - "saved_object:infrastructure-ui-source/open_point_in_time", - "saved_object:infrastructure-ui-source/close_point_in_time", - "saved_object:infrastructure-ui-source/create", - "saved_object:infrastructure-ui-source/bulk_create", - "saved_object:infrastructure-ui-source/update", - "saved_object:infrastructure-ui-source/bulk_update", - "saved_object:infrastructure-ui-source/delete", - "saved_object:infrastructure-ui-source/bulk_delete", - "saved_object:infrastructure-ui-source/share_to_space", - "saved_object:metrics-data-source/bulk_get", - "saved_object:metrics-data-source/get", - "saved_object:metrics-data-source/find", - "saved_object:metrics-data-source/open_point_in_time", - "saved_object:metrics-data-source/close_point_in_time", - "saved_object:metrics-data-source/create", - "saved_object:metrics-data-source/bulk_create", - "saved_object:metrics-data-source/update", - "saved_object:metrics-data-source/bulk_update", - "saved_object:metrics-data-source/delete", - "saved_object:metrics-data-source/bulk_delete", - "saved_object:metrics-data-source/share_to_space", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:infrastructure/show", - "ui:infrastructure/configureSource", - "ui:infrastructure/save", - "alerting:metrics.alert.threshold/infrastructure/rule/get", - "alerting:metrics.alert.threshold/infrastructure/rule/getRuleState", - "alerting:metrics.alert.threshold/infrastructure/rule/getAlertSummary", - "alerting:metrics.alert.threshold/infrastructure/rule/getExecutionLog", - "alerting:metrics.alert.threshold/infrastructure/rule/getActionErrorLog", - "alerting:metrics.alert.threshold/infrastructure/rule/find", - "alerting:metrics.alert.threshold/infrastructure/rule/getRuleExecutionKPI", - "alerting:metrics.alert.threshold/infrastructure/rule/getBackfill", - "alerting:metrics.alert.threshold/infrastructure/rule/findBackfill", - "alerting:metrics.alert.threshold/infrastructure/rule/create", - "alerting:metrics.alert.threshold/infrastructure/rule/delete", - "alerting:metrics.alert.threshold/infrastructure/rule/update", - "alerting:metrics.alert.threshold/infrastructure/rule/updateApiKey", - "alerting:metrics.alert.threshold/infrastructure/rule/enable", - "alerting:metrics.alert.threshold/infrastructure/rule/disable", - "alerting:metrics.alert.threshold/infrastructure/rule/muteAll", - "alerting:metrics.alert.threshold/infrastructure/rule/unmuteAll", - "alerting:metrics.alert.threshold/infrastructure/rule/muteAlert", - "alerting:metrics.alert.threshold/infrastructure/rule/unmuteAlert", - "alerting:metrics.alert.threshold/infrastructure/rule/snooze", - "alerting:metrics.alert.threshold/infrastructure/rule/bulkEdit", - "alerting:metrics.alert.threshold/infrastructure/rule/bulkDelete", - "alerting:metrics.alert.threshold/infrastructure/rule/bulkEnable", - "alerting:metrics.alert.threshold/infrastructure/rule/bulkDisable", - "alerting:metrics.alert.threshold/infrastructure/rule/unsnooze", - "alerting:metrics.alert.threshold/infrastructure/rule/runSoon", - "alerting:metrics.alert.threshold/infrastructure/rule/scheduleBackfill", - "alerting:metrics.alert.threshold/infrastructure/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/get", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/find", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/create", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/delete", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/update", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/enable", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/disable", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/snooze", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/deleteBackfill", - "alerting:.es-query/infrastructure/rule/get", - "alerting:.es-query/infrastructure/rule/getRuleState", - "alerting:.es-query/infrastructure/rule/getAlertSummary", - "alerting:.es-query/infrastructure/rule/getExecutionLog", - "alerting:.es-query/infrastructure/rule/getActionErrorLog", - "alerting:.es-query/infrastructure/rule/find", - "alerting:.es-query/infrastructure/rule/getRuleExecutionKPI", - "alerting:.es-query/infrastructure/rule/getBackfill", - "alerting:.es-query/infrastructure/rule/findBackfill", - "alerting:.es-query/infrastructure/rule/create", - "alerting:.es-query/infrastructure/rule/delete", - "alerting:.es-query/infrastructure/rule/update", - "alerting:.es-query/infrastructure/rule/updateApiKey", - "alerting:.es-query/infrastructure/rule/enable", - "alerting:.es-query/infrastructure/rule/disable", - "alerting:.es-query/infrastructure/rule/muteAll", - "alerting:.es-query/infrastructure/rule/unmuteAll", - "alerting:.es-query/infrastructure/rule/muteAlert", - "alerting:.es-query/infrastructure/rule/unmuteAlert", - "alerting:.es-query/infrastructure/rule/snooze", - "alerting:.es-query/infrastructure/rule/bulkEdit", - "alerting:.es-query/infrastructure/rule/bulkDelete", - "alerting:.es-query/infrastructure/rule/bulkEnable", - "alerting:.es-query/infrastructure/rule/bulkDisable", - "alerting:.es-query/infrastructure/rule/unsnooze", - "alerting:.es-query/infrastructure/rule/runSoon", - "alerting:.es-query/infrastructure/rule/scheduleBackfill", - "alerting:.es-query/infrastructure/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/infrastructure/rule/get", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleState", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/infrastructure/rule/find", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getBackfill", - "alerting:observability.rules.custom_threshold/infrastructure/rule/findBackfill", - "alerting:observability.rules.custom_threshold/infrastructure/rule/create", - "alerting:observability.rules.custom_threshold/infrastructure/rule/delete", - "alerting:observability.rules.custom_threshold/infrastructure/rule/update", - "alerting:observability.rules.custom_threshold/infrastructure/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/infrastructure/rule/enable", - "alerting:observability.rules.custom_threshold/infrastructure/rule/disable", - "alerting:observability.rules.custom_threshold/infrastructure/rule/muteAll", - "alerting:observability.rules.custom_threshold/infrastructure/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/infrastructure/rule/muteAlert", - "alerting:observability.rules.custom_threshold/infrastructure/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/infrastructure/rule/snooze", - "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/infrastructure/rule/unsnooze", - "alerting:observability.rules.custom_threshold/infrastructure/rule/runSoon", - "alerting:observability.rules.custom_threshold/infrastructure/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/infrastructure/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/deleteBackfill", - "alerting:metrics.alert.threshold/infrastructure/alert/get", - "alerting:metrics.alert.threshold/infrastructure/alert/find", - "alerting:metrics.alert.threshold/infrastructure/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.threshold/infrastructure/alert/getAlertSummary", - "alerting:metrics.alert.threshold/infrastructure/alert/update", - "alerting:metrics.alert.inventory.threshold/infrastructure/alert/get", - "alerting:metrics.alert.inventory.threshold/infrastructure/alert/find", - "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/infrastructure/alert/update", - "alerting:.es-query/infrastructure/alert/get", - "alerting:.es-query/infrastructure/alert/find", - "alerting:.es-query/infrastructure/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/infrastructure/alert/getAlertSummary", - "alerting:.es-query/infrastructure/alert/update", - "alerting:observability.rules.custom_threshold/infrastructure/alert/get", - "alerting:observability.rules.custom_threshold/infrastructure/alert/find", - "alerting:observability.rules.custom_threshold/infrastructure/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/infrastructure/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/infrastructure/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/update", - "app:logs", - "app:observability-logs-explorer", - "ui:catalogue/infralogging", - "ui:catalogue/logs", - "ui:navLinks/logs", - "ui:navLinks/observability-logs-explorer", - "saved_object:infrastructure-monitoring-log-view/bulk_get", - "saved_object:infrastructure-monitoring-log-view/get", - "saved_object:infrastructure-monitoring-log-view/find", - "saved_object:infrastructure-monitoring-log-view/open_point_in_time", - "saved_object:infrastructure-monitoring-log-view/close_point_in_time", - "saved_object:infrastructure-monitoring-log-view/create", - "saved_object:infrastructure-monitoring-log-view/bulk_create", - "saved_object:infrastructure-monitoring-log-view/update", - "saved_object:infrastructure-monitoring-log-view/bulk_update", - "saved_object:infrastructure-monitoring-log-view/delete", - "saved_object:infrastructure-monitoring-log-view/bulk_delete", - "saved_object:infrastructure-monitoring-log-view/share_to_space", - "ui:logs/show", - "ui:logs/configureSource", - "ui:logs/save", - "alerting:logs.alert.document.count/logs/rule/get", - "alerting:logs.alert.document.count/logs/rule/getRuleState", - "alerting:logs.alert.document.count/logs/rule/getAlertSummary", - "alerting:logs.alert.document.count/logs/rule/getExecutionLog", - "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", - "alerting:logs.alert.document.count/logs/rule/find", - "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", - "alerting:logs.alert.document.count/logs/rule/getBackfill", - "alerting:logs.alert.document.count/logs/rule/findBackfill", - "alerting:logs.alert.document.count/logs/rule/create", - "alerting:logs.alert.document.count/logs/rule/delete", - "alerting:logs.alert.document.count/logs/rule/update", - "alerting:logs.alert.document.count/logs/rule/updateApiKey", - "alerting:logs.alert.document.count/logs/rule/enable", - "alerting:logs.alert.document.count/logs/rule/disable", - "alerting:logs.alert.document.count/logs/rule/muteAll", - "alerting:logs.alert.document.count/logs/rule/unmuteAll", - "alerting:logs.alert.document.count/logs/rule/muteAlert", - "alerting:logs.alert.document.count/logs/rule/unmuteAlert", - "alerting:logs.alert.document.count/logs/rule/snooze", - "alerting:logs.alert.document.count/logs/rule/bulkEdit", - "alerting:logs.alert.document.count/logs/rule/bulkDelete", - "alerting:logs.alert.document.count/logs/rule/bulkEnable", - "alerting:logs.alert.document.count/logs/rule/bulkDisable", - "alerting:logs.alert.document.count/logs/rule/unsnooze", - "alerting:logs.alert.document.count/logs/rule/runSoon", - "alerting:logs.alert.document.count/logs/rule/scheduleBackfill", - "alerting:logs.alert.document.count/logs/rule/deleteBackfill", - "alerting:.es-query/logs/rule/get", - "alerting:.es-query/logs/rule/getRuleState", - "alerting:.es-query/logs/rule/getAlertSummary", - "alerting:.es-query/logs/rule/getExecutionLog", - "alerting:.es-query/logs/rule/getActionErrorLog", - "alerting:.es-query/logs/rule/find", - "alerting:.es-query/logs/rule/getRuleExecutionKPI", - "alerting:.es-query/logs/rule/getBackfill", - "alerting:.es-query/logs/rule/findBackfill", - "alerting:.es-query/logs/rule/create", - "alerting:.es-query/logs/rule/delete", - "alerting:.es-query/logs/rule/update", - "alerting:.es-query/logs/rule/updateApiKey", - "alerting:.es-query/logs/rule/enable", - "alerting:.es-query/logs/rule/disable", - "alerting:.es-query/logs/rule/muteAll", - "alerting:.es-query/logs/rule/unmuteAll", - "alerting:.es-query/logs/rule/muteAlert", - "alerting:.es-query/logs/rule/unmuteAlert", - "alerting:.es-query/logs/rule/snooze", - "alerting:.es-query/logs/rule/bulkEdit", - "alerting:.es-query/logs/rule/bulkDelete", - "alerting:.es-query/logs/rule/bulkEnable", - "alerting:.es-query/logs/rule/bulkDisable", - "alerting:.es-query/logs/rule/unsnooze", - "alerting:.es-query/logs/rule/runSoon", - "alerting:.es-query/logs/rule/scheduleBackfill", - "alerting:.es-query/logs/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/get", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", - "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/logs/rule/find", - "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/create", - "alerting:observability.rules.custom_threshold/logs/rule/delete", - "alerting:observability.rules.custom_threshold/logs/rule/update", - "alerting:observability.rules.custom_threshold/logs/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/logs/rule/enable", - "alerting:observability.rules.custom_threshold/logs/rule/disable", - "alerting:observability.rules.custom_threshold/logs/rule/muteAll", - "alerting:observability.rules.custom_threshold/logs/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/logs/rule/muteAlert", - "alerting:observability.rules.custom_threshold/logs/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/logs/rule/snooze", - "alerting:observability.rules.custom_threshold/logs/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/logs/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/logs/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/logs/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/logs/rule/unsnooze", - "alerting:observability.rules.custom_threshold/logs/rule/runSoon", - "alerting:observability.rules.custom_threshold/logs/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/deleteBackfill", - "alerting:logs.alert.document.count/logs/alert/get", - "alerting:logs.alert.document.count/logs/alert/find", - "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", - "alerting:logs.alert.document.count/logs/alert/getAlertSummary", - "alerting:logs.alert.document.count/logs/alert/update", - "alerting:.es-query/logs/alert/get", - "alerting:.es-query/logs/alert/find", - "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/logs/alert/getAlertSummary", - "alerting:.es-query/logs/alert/update", - "alerting:observability.rules.custom_threshold/logs/alert/get", - "alerting:observability.rules.custom_threshold/logs/alert/find", - "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/update", - "app:observability", - "ui:catalogue/observability", - "ui:navLinks/observability", - "ui:observability/read", - "ui:observability/write", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/rule/create", - "alerting:slo.rules.burnRate/observability/rule/delete", - "alerting:slo.rules.burnRate/observability/rule/update", - "alerting:slo.rules.burnRate/observability/rule/updateApiKey", - "alerting:slo.rules.burnRate/observability/rule/enable", - "alerting:slo.rules.burnRate/observability/rule/disable", - "alerting:slo.rules.burnRate/observability/rule/muteAll", - "alerting:slo.rules.burnRate/observability/rule/unmuteAll", - "alerting:slo.rules.burnRate/observability/rule/muteAlert", - "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", - "alerting:slo.rules.burnRate/observability/rule/snooze", - "alerting:slo.rules.burnRate/observability/rule/bulkEdit", - "alerting:slo.rules.burnRate/observability/rule/bulkDelete", - "alerting:slo.rules.burnRate/observability/rule/bulkEnable", - "alerting:slo.rules.burnRate/observability/rule/bulkDisable", - "alerting:slo.rules.burnRate/observability/rule/unsnooze", - "alerting:slo.rules.burnRate/observability/rule/runSoon", - "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", - "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/create", - "alerting:observability.rules.custom_threshold/observability/rule/delete", - "alerting:observability.rules.custom_threshold/observability/rule/update", - "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/observability/rule/enable", - "alerting:observability.rules.custom_threshold/observability/rule/disable", - "alerting:observability.rules.custom_threshold/observability/rule/muteAll", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/snooze", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", - "alerting:observability.rules.custom_threshold/observability/rule/runSoon", - "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/create", - "alerting:.es-query/observability/rule/delete", - "alerting:.es-query/observability/rule/update", - "alerting:.es-query/observability/rule/updateApiKey", - "alerting:.es-query/observability/rule/enable", - "alerting:.es-query/observability/rule/disable", - "alerting:.es-query/observability/rule/muteAll", - "alerting:.es-query/observability/rule/unmuteAll", - "alerting:.es-query/observability/rule/muteAlert", - "alerting:.es-query/observability/rule/unmuteAlert", - "alerting:.es-query/observability/rule/snooze", - "alerting:.es-query/observability/rule/bulkEdit", - "alerting:.es-query/observability/rule/bulkDelete", - "alerting:.es-query/observability/rule/bulkEnable", - "alerting:.es-query/observability/rule/bulkDisable", - "alerting:.es-query/observability/rule/unsnooze", - "alerting:.es-query/observability/rule/runSoon", - "alerting:.es-query/observability/rule/scheduleBackfill", - "alerting:.es-query/observability/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/create", - "alerting:metrics.alert.inventory.threshold/observability/rule/delete", - "alerting:metrics.alert.inventory.threshold/observability/rule/update", - "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/observability/rule/enable", - "alerting:metrics.alert.inventory.threshold/observability/rule/disable", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", - "alerting:apm.error_rate/observability/rule/get", - "alerting:apm.error_rate/observability/rule/getRuleState", - "alerting:apm.error_rate/observability/rule/getAlertSummary", - "alerting:apm.error_rate/observability/rule/getExecutionLog", - "alerting:apm.error_rate/observability/rule/getActionErrorLog", - "alerting:apm.error_rate/observability/rule/find", - "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.error_rate/observability/rule/getBackfill", - "alerting:apm.error_rate/observability/rule/findBackfill", - "alerting:apm.error_rate/observability/rule/create", - "alerting:apm.error_rate/observability/rule/delete", - "alerting:apm.error_rate/observability/rule/update", - "alerting:apm.error_rate/observability/rule/updateApiKey", - "alerting:apm.error_rate/observability/rule/enable", - "alerting:apm.error_rate/observability/rule/disable", - "alerting:apm.error_rate/observability/rule/muteAll", - "alerting:apm.error_rate/observability/rule/unmuteAll", - "alerting:apm.error_rate/observability/rule/muteAlert", - "alerting:apm.error_rate/observability/rule/unmuteAlert", - "alerting:apm.error_rate/observability/rule/snooze", - "alerting:apm.error_rate/observability/rule/bulkEdit", - "alerting:apm.error_rate/observability/rule/bulkDelete", - "alerting:apm.error_rate/observability/rule/bulkEnable", - "alerting:apm.error_rate/observability/rule/bulkDisable", - "alerting:apm.error_rate/observability/rule/unsnooze", - "alerting:apm.error_rate/observability/rule/runSoon", - "alerting:apm.error_rate/observability/rule/scheduleBackfill", - "alerting:apm.error_rate/observability/rule/deleteBackfill", - "alerting:apm.transaction_error_rate/observability/rule/get", - "alerting:apm.transaction_error_rate/observability/rule/getRuleState", - "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", - "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", - "alerting:apm.transaction_error_rate/observability/rule/find", - "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_error_rate/observability/rule/getBackfill", - "alerting:apm.transaction_error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_error_rate/observability/rule/create", - "alerting:apm.transaction_error_rate/observability/rule/delete", - "alerting:apm.transaction_error_rate/observability/rule/update", - "alerting:apm.transaction_error_rate/observability/rule/updateApiKey", - "alerting:apm.transaction_error_rate/observability/rule/enable", - "alerting:apm.transaction_error_rate/observability/rule/disable", - "alerting:apm.transaction_error_rate/observability/rule/muteAll", - "alerting:apm.transaction_error_rate/observability/rule/unmuteAll", - "alerting:apm.transaction_error_rate/observability/rule/muteAlert", - "alerting:apm.transaction_error_rate/observability/rule/unmuteAlert", - "alerting:apm.transaction_error_rate/observability/rule/snooze", - "alerting:apm.transaction_error_rate/observability/rule/bulkEdit", - "alerting:apm.transaction_error_rate/observability/rule/bulkDelete", - "alerting:apm.transaction_error_rate/observability/rule/bulkEnable", - "alerting:apm.transaction_error_rate/observability/rule/bulkDisable", - "alerting:apm.transaction_error_rate/observability/rule/unsnooze", - "alerting:apm.transaction_error_rate/observability/rule/runSoon", - "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", - "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", - "alerting:apm.transaction_duration/observability/rule/get", - "alerting:apm.transaction_duration/observability/rule/getRuleState", - "alerting:apm.transaction_duration/observability/rule/getAlertSummary", - "alerting:apm.transaction_duration/observability/rule/getExecutionLog", - "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", - "alerting:apm.transaction_duration/observability/rule/find", - "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_duration/observability/rule/getBackfill", - "alerting:apm.transaction_duration/observability/rule/findBackfill", - "alerting:apm.transaction_duration/observability/rule/create", - "alerting:apm.transaction_duration/observability/rule/delete", - "alerting:apm.transaction_duration/observability/rule/update", - "alerting:apm.transaction_duration/observability/rule/updateApiKey", - "alerting:apm.transaction_duration/observability/rule/enable", - "alerting:apm.transaction_duration/observability/rule/disable", - "alerting:apm.transaction_duration/observability/rule/muteAll", - "alerting:apm.transaction_duration/observability/rule/unmuteAll", - "alerting:apm.transaction_duration/observability/rule/muteAlert", - "alerting:apm.transaction_duration/observability/rule/unmuteAlert", - "alerting:apm.transaction_duration/observability/rule/snooze", - "alerting:apm.transaction_duration/observability/rule/bulkEdit", - "alerting:apm.transaction_duration/observability/rule/bulkDelete", - "alerting:apm.transaction_duration/observability/rule/bulkEnable", - "alerting:apm.transaction_duration/observability/rule/bulkDisable", - "alerting:apm.transaction_duration/observability/rule/unsnooze", - "alerting:apm.transaction_duration/observability/rule/runSoon", - "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", - "alerting:apm.transaction_duration/observability/rule/deleteBackfill", - "alerting:apm.anomaly/observability/rule/get", - "alerting:apm.anomaly/observability/rule/getRuleState", - "alerting:apm.anomaly/observability/rule/getAlertSummary", - "alerting:apm.anomaly/observability/rule/getExecutionLog", - "alerting:apm.anomaly/observability/rule/getActionErrorLog", - "alerting:apm.anomaly/observability/rule/find", - "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", - "alerting:apm.anomaly/observability/rule/getBackfill", - "alerting:apm.anomaly/observability/rule/findBackfill", - "alerting:apm.anomaly/observability/rule/create", - "alerting:apm.anomaly/observability/rule/delete", - "alerting:apm.anomaly/observability/rule/update", - "alerting:apm.anomaly/observability/rule/updateApiKey", - "alerting:apm.anomaly/observability/rule/enable", - "alerting:apm.anomaly/observability/rule/disable", - "alerting:apm.anomaly/observability/rule/muteAll", - "alerting:apm.anomaly/observability/rule/unmuteAll", - "alerting:apm.anomaly/observability/rule/muteAlert", - "alerting:apm.anomaly/observability/rule/unmuteAlert", - "alerting:apm.anomaly/observability/rule/snooze", - "alerting:apm.anomaly/observability/rule/bulkEdit", - "alerting:apm.anomaly/observability/rule/bulkDelete", - "alerting:apm.anomaly/observability/rule/bulkEnable", - "alerting:apm.anomaly/observability/rule/bulkDisable", - "alerting:apm.anomaly/observability/rule/unsnooze", - "alerting:apm.anomaly/observability/rule/runSoon", - "alerting:apm.anomaly/observability/rule/scheduleBackfill", - "alerting:apm.anomaly/observability/rule/deleteBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/create", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/delete", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/update", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/updateApiKey", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/enable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/disable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAll", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAll", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAlert", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAlert", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/snooze", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEdit", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDelete", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/get", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/find", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/create", - "alerting:xpack.synthetics.alerts.tls/observability/rule/delete", - "alerting:xpack.synthetics.alerts.tls/observability/rule/update", - "alerting:xpack.synthetics.alerts.tls/observability/rule/updateApiKey", - "alerting:xpack.synthetics.alerts.tls/observability/rule/enable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/disable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAll", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAll", - "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAlert", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAlert", - "alerting:xpack.synthetics.alerts.tls/observability/rule/snooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:slo.rules.burnRate/observability/alert/update", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/update", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/update", - "alerting:apm.error_rate/observability/alert/get", - "alerting:apm.error_rate/observability/alert/find", - "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.error_rate/observability/alert/getAlertSummary", - "alerting:apm.error_rate/observability/alert/update", - "alerting:apm.transaction_error_rate/observability/alert/get", - "alerting:apm.transaction_error_rate/observability/alert/find", - "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/alert/update", - "alerting:apm.transaction_duration/observability/alert/get", - "alerting:apm.transaction_duration/observability/alert/find", - "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.transaction_duration/observability/alert/getAlertSummary", - "alerting:apm.transaction_duration/observability/alert/update", - "alerting:apm.anomaly/observability/alert/get", - "alerting:apm.anomaly/observability/alert/find", - "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", - "alerting:apm.anomaly/observability/alert/getAlertSummary", - "alerting:apm.anomaly/observability/alert/update", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", - "alerting:xpack.synthetics.alerts.tls/observability/alert/get", - "alerting:xpack.synthetics.alerts.tls/observability/alert/find", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/alert/update", - ], - "minimal_all": Array [ - "login:", - "api:infra", - "api:rac", - "app:infra", - "app:metrics", - "app:kibana", - "ui:catalogue/infraops", - "ui:catalogue/metrics", - "ui:management/insightsAndAlerting/triggersActions", - "ui:navLinks/infra", - "ui:navLinks/metrics", - "ui:navLinks/kibana", - "saved_object:infrastructure-ui-source/bulk_get", - "saved_object:infrastructure-ui-source/get", - "saved_object:infrastructure-ui-source/find", - "saved_object:infrastructure-ui-source/open_point_in_time", - "saved_object:infrastructure-ui-source/close_point_in_time", - "saved_object:infrastructure-ui-source/create", - "saved_object:infrastructure-ui-source/bulk_create", - "saved_object:infrastructure-ui-source/update", - "saved_object:infrastructure-ui-source/bulk_update", - "saved_object:infrastructure-ui-source/delete", - "saved_object:infrastructure-ui-source/bulk_delete", - "saved_object:infrastructure-ui-source/share_to_space", - "saved_object:metrics-data-source/bulk_get", - "saved_object:metrics-data-source/get", - "saved_object:metrics-data-source/find", - "saved_object:metrics-data-source/open_point_in_time", - "saved_object:metrics-data-source/close_point_in_time", - "saved_object:metrics-data-source/create", - "saved_object:metrics-data-source/bulk_create", - "saved_object:metrics-data-source/update", - "saved_object:metrics-data-source/bulk_update", - "saved_object:metrics-data-source/delete", - "saved_object:metrics-data-source/bulk_delete", - "saved_object:metrics-data-source/share_to_space", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "ui:infrastructure/show", - "ui:infrastructure/configureSource", - "ui:infrastructure/save", - "alerting:metrics.alert.threshold/infrastructure/rule/get", - "alerting:metrics.alert.threshold/infrastructure/rule/getRuleState", - "alerting:metrics.alert.threshold/infrastructure/rule/getAlertSummary", - "alerting:metrics.alert.threshold/infrastructure/rule/getExecutionLog", - "alerting:metrics.alert.threshold/infrastructure/rule/getActionErrorLog", - "alerting:metrics.alert.threshold/infrastructure/rule/find", - "alerting:metrics.alert.threshold/infrastructure/rule/getRuleExecutionKPI", - "alerting:metrics.alert.threshold/infrastructure/rule/getBackfill", - "alerting:metrics.alert.threshold/infrastructure/rule/findBackfill", - "alerting:metrics.alert.threshold/infrastructure/rule/create", - "alerting:metrics.alert.threshold/infrastructure/rule/delete", - "alerting:metrics.alert.threshold/infrastructure/rule/update", - "alerting:metrics.alert.threshold/infrastructure/rule/updateApiKey", - "alerting:metrics.alert.threshold/infrastructure/rule/enable", - "alerting:metrics.alert.threshold/infrastructure/rule/disable", - "alerting:metrics.alert.threshold/infrastructure/rule/muteAll", - "alerting:metrics.alert.threshold/infrastructure/rule/unmuteAll", - "alerting:metrics.alert.threshold/infrastructure/rule/muteAlert", - "alerting:metrics.alert.threshold/infrastructure/rule/unmuteAlert", - "alerting:metrics.alert.threshold/infrastructure/rule/snooze", - "alerting:metrics.alert.threshold/infrastructure/rule/bulkEdit", - "alerting:metrics.alert.threshold/infrastructure/rule/bulkDelete", - "alerting:metrics.alert.threshold/infrastructure/rule/bulkEnable", - "alerting:metrics.alert.threshold/infrastructure/rule/bulkDisable", - "alerting:metrics.alert.threshold/infrastructure/rule/unsnooze", - "alerting:metrics.alert.threshold/infrastructure/rule/runSoon", - "alerting:metrics.alert.threshold/infrastructure/rule/scheduleBackfill", - "alerting:metrics.alert.threshold/infrastructure/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/get", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/find", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/create", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/delete", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/update", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/enable", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/disable", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/snooze", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/infrastructure/rule/deleteBackfill", - "alerting:.es-query/infrastructure/rule/get", - "alerting:.es-query/infrastructure/rule/getRuleState", - "alerting:.es-query/infrastructure/rule/getAlertSummary", - "alerting:.es-query/infrastructure/rule/getExecutionLog", - "alerting:.es-query/infrastructure/rule/getActionErrorLog", - "alerting:.es-query/infrastructure/rule/find", - "alerting:.es-query/infrastructure/rule/getRuleExecutionKPI", - "alerting:.es-query/infrastructure/rule/getBackfill", - "alerting:.es-query/infrastructure/rule/findBackfill", - "alerting:.es-query/infrastructure/rule/create", - "alerting:.es-query/infrastructure/rule/delete", - "alerting:.es-query/infrastructure/rule/update", - "alerting:.es-query/infrastructure/rule/updateApiKey", - "alerting:.es-query/infrastructure/rule/enable", - "alerting:.es-query/infrastructure/rule/disable", - "alerting:.es-query/infrastructure/rule/muteAll", - "alerting:.es-query/infrastructure/rule/unmuteAll", - "alerting:.es-query/infrastructure/rule/muteAlert", - "alerting:.es-query/infrastructure/rule/unmuteAlert", - "alerting:.es-query/infrastructure/rule/snooze", - "alerting:.es-query/infrastructure/rule/bulkEdit", - "alerting:.es-query/infrastructure/rule/bulkDelete", - "alerting:.es-query/infrastructure/rule/bulkEnable", - "alerting:.es-query/infrastructure/rule/bulkDisable", - "alerting:.es-query/infrastructure/rule/unsnooze", - "alerting:.es-query/infrastructure/rule/runSoon", - "alerting:.es-query/infrastructure/rule/scheduleBackfill", - "alerting:.es-query/infrastructure/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/infrastructure/rule/get", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleState", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/infrastructure/rule/find", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/infrastructure/rule/getBackfill", - "alerting:observability.rules.custom_threshold/infrastructure/rule/findBackfill", - "alerting:observability.rules.custom_threshold/infrastructure/rule/create", - "alerting:observability.rules.custom_threshold/infrastructure/rule/delete", - "alerting:observability.rules.custom_threshold/infrastructure/rule/update", - "alerting:observability.rules.custom_threshold/infrastructure/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/infrastructure/rule/enable", - "alerting:observability.rules.custom_threshold/infrastructure/rule/disable", - "alerting:observability.rules.custom_threshold/infrastructure/rule/muteAll", - "alerting:observability.rules.custom_threshold/infrastructure/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/infrastructure/rule/muteAlert", - "alerting:observability.rules.custom_threshold/infrastructure/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/infrastructure/rule/snooze", - "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/infrastructure/rule/unsnooze", - "alerting:observability.rules.custom_threshold/infrastructure/rule/runSoon", - "alerting:observability.rules.custom_threshold/infrastructure/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/infrastructure/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/deleteBackfill", - "alerting:metrics.alert.threshold/infrastructure/alert/get", - "alerting:metrics.alert.threshold/infrastructure/alert/find", - "alerting:metrics.alert.threshold/infrastructure/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.threshold/infrastructure/alert/getAlertSummary", - "alerting:metrics.alert.threshold/infrastructure/alert/update", - "alerting:metrics.alert.inventory.threshold/infrastructure/alert/get", - "alerting:metrics.alert.inventory.threshold/infrastructure/alert/find", - "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/infrastructure/alert/update", - "alerting:.es-query/infrastructure/alert/get", - "alerting:.es-query/infrastructure/alert/find", - "alerting:.es-query/infrastructure/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/infrastructure/alert/getAlertSummary", - "alerting:.es-query/infrastructure/alert/update", - "alerting:observability.rules.custom_threshold/infrastructure/alert/get", - "alerting:observability.rules.custom_threshold/infrastructure/alert/find", - "alerting:observability.rules.custom_threshold/infrastructure/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/infrastructure/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/infrastructure/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/update", + "ui:apm/show", + "ui:apm/alerting:show", + "alerting:apm.error_rate/apm/rule/get", + "alerting:apm.error_rate/apm/rule/getRuleState", + "alerting:apm.error_rate/apm/rule/getAlertSummary", + "alerting:apm.error_rate/apm/rule/getExecutionLog", + "alerting:apm.error_rate/apm/rule/getActionErrorLog", + "alerting:apm.error_rate/apm/rule/find", + "alerting:apm.error_rate/apm/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/apm/rule/getBackfill", + "alerting:apm.error_rate/apm/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/apm/rule/get", + "alerting:apm.transaction_error_rate/apm/rule/getRuleState", + "alerting:apm.transaction_error_rate/apm/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/apm/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/apm/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/apm/rule/find", + "alerting:apm.transaction_error_rate/apm/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/apm/rule/getBackfill", + "alerting:apm.transaction_error_rate/apm/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/apm/rule/get", + "alerting:apm.transaction_duration/apm/rule/getRuleState", + "alerting:apm.transaction_duration/apm/rule/getAlertSummary", + "alerting:apm.transaction_duration/apm/rule/getExecutionLog", + "alerting:apm.transaction_duration/apm/rule/getActionErrorLog", + "alerting:apm.transaction_duration/apm/rule/find", + "alerting:apm.transaction_duration/apm/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/apm/rule/getBackfill", + "alerting:apm.transaction_duration/apm/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.anomaly/apm/rule/get", + "alerting:apm.anomaly/apm/rule/getRuleState", + "alerting:apm.anomaly/apm/rule/getAlertSummary", + "alerting:apm.anomaly/apm/rule/getExecutionLog", + "alerting:apm.anomaly/apm/rule/getActionErrorLog", + "alerting:apm.anomaly/apm/rule/find", + "alerting:apm.anomaly/apm/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/apm/rule/getBackfill", + "alerting:apm.anomaly/apm/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.error_rate/apm/alert/get", + "alerting:apm.error_rate/apm/alert/find", + "alerting:apm.error_rate/apm/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/apm/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/apm/alert/get", + "alerting:apm.transaction_error_rate/apm/alert/find", + "alerting:apm.transaction_error_rate/apm/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/apm/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/apm/alert/get", + "alerting:apm.transaction_duration/apm/alert/find", + "alerting:apm.transaction_duration/apm/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/apm/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/apm/alert/get", + "alerting:apm.anomaly/apm/alert/find", + "alerting:apm.anomaly/apm/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/apm/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "api:infra", + "app:infra", "app:logs", "app:observability-logs-explorer", "ui:catalogue/infralogging", "ui:catalogue/logs", + "ui:navLinks/infra", "ui:navLinks/logs", "ui:navLinks/observability-logs-explorer", + "saved_object:infrastructure-ui-source/bulk_get", + "saved_object:infrastructure-ui-source/get", + "saved_object:infrastructure-ui-source/find", + "saved_object:infrastructure-ui-source/open_point_in_time", + "saved_object:infrastructure-ui-source/close_point_in_time", "saved_object:infrastructure-monitoring-log-view/bulk_get", "saved_object:infrastructure-monitoring-log-view/get", "saved_object:infrastructure-monitoring-log-view/find", "saved_object:infrastructure-monitoring-log-view/open_point_in_time", "saved_object:infrastructure-monitoring-log-view/close_point_in_time", - "saved_object:infrastructure-monitoring-log-view/create", - "saved_object:infrastructure-monitoring-log-view/bulk_create", - "saved_object:infrastructure-monitoring-log-view/update", - "saved_object:infrastructure-monitoring-log-view/bulk_update", - "saved_object:infrastructure-monitoring-log-view/delete", - "saved_object:infrastructure-monitoring-log-view/bulk_delete", - "saved_object:infrastructure-monitoring-log-view/share_to_space", "ui:logs/show", - "ui:logs/configureSource", - "ui:logs/save", "alerting:logs.alert.document.count/logs/rule/get", "alerting:logs.alert.document.count/logs/rule/getRuleState", "alerting:logs.alert.document.count/logs/rule/getAlertSummary", @@ -6080,25 +3786,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", "alerting:logs.alert.document.count/logs/rule/getBackfill", "alerting:logs.alert.document.count/logs/rule/findBackfill", - "alerting:logs.alert.document.count/logs/rule/create", - "alerting:logs.alert.document.count/logs/rule/delete", - "alerting:logs.alert.document.count/logs/rule/update", - "alerting:logs.alert.document.count/logs/rule/updateApiKey", - "alerting:logs.alert.document.count/logs/rule/enable", - "alerting:logs.alert.document.count/logs/rule/disable", - "alerting:logs.alert.document.count/logs/rule/muteAll", - "alerting:logs.alert.document.count/logs/rule/unmuteAll", - "alerting:logs.alert.document.count/logs/rule/muteAlert", - "alerting:logs.alert.document.count/logs/rule/unmuteAlert", - "alerting:logs.alert.document.count/logs/rule/snooze", - "alerting:logs.alert.document.count/logs/rule/bulkEdit", - "alerting:logs.alert.document.count/logs/rule/bulkDelete", - "alerting:logs.alert.document.count/logs/rule/bulkEnable", - "alerting:logs.alert.document.count/logs/rule/bulkDisable", - "alerting:logs.alert.document.count/logs/rule/unsnooze", - "alerting:logs.alert.document.count/logs/rule/runSoon", - "alerting:logs.alert.document.count/logs/rule/scheduleBackfill", - "alerting:logs.alert.document.count/logs/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", "alerting:.es-query/logs/rule/get", "alerting:.es-query/logs/rule/getRuleState", "alerting:.es-query/logs/rule/getAlertSummary", @@ -6108,25 +3804,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/logs/rule/getRuleExecutionKPI", "alerting:.es-query/logs/rule/getBackfill", "alerting:.es-query/logs/rule/findBackfill", - "alerting:.es-query/logs/rule/create", - "alerting:.es-query/logs/rule/delete", - "alerting:.es-query/logs/rule/update", - "alerting:.es-query/logs/rule/updateApiKey", - "alerting:.es-query/logs/rule/enable", - "alerting:.es-query/logs/rule/disable", - "alerting:.es-query/logs/rule/muteAll", - "alerting:.es-query/logs/rule/unmuteAll", - "alerting:.es-query/logs/rule/muteAlert", - "alerting:.es-query/logs/rule/unmuteAlert", - "alerting:.es-query/logs/rule/snooze", - "alerting:.es-query/logs/rule/bulkEdit", - "alerting:.es-query/logs/rule/bulkDelete", - "alerting:.es-query/logs/rule/bulkEnable", - "alerting:.es-query/logs/rule/bulkDisable", - "alerting:.es-query/logs/rule/unsnooze", - "alerting:.es-query/logs/rule/runSoon", - "alerting:.es-query/logs/rule/scheduleBackfill", - "alerting:.es-query/logs/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", "alerting:observability.rules.custom_threshold/logs/rule/get", "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", @@ -6136,25 +3822,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/create", - "alerting:observability.rules.custom_threshold/logs/rule/delete", - "alerting:observability.rules.custom_threshold/logs/rule/update", - "alerting:observability.rules.custom_threshold/logs/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/logs/rule/enable", - "alerting:observability.rules.custom_threshold/logs/rule/disable", - "alerting:observability.rules.custom_threshold/logs/rule/muteAll", - "alerting:observability.rules.custom_threshold/logs/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/logs/rule/muteAlert", - "alerting:observability.rules.custom_threshold/logs/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/logs/rule/snooze", - "alerting:observability.rules.custom_threshold/logs/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/logs/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/logs/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/logs/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/logs/rule/unsnooze", - "alerting:observability.rules.custom_threshold/logs/rule/runSoon", - "alerting:observability.rules.custom_threshold/logs/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/logs/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", @@ -6164,50 +3840,2996 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/logs/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", "alerting:logs.alert.document.count/logs/alert/get", "alerting:logs.alert.document.count/logs/alert/find", "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", "alerting:logs.alert.document.count/logs/alert/getAlertSummary", - "alerting:logs.alert.document.count/logs/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", "alerting:.es-query/logs/alert/get", "alerting:.es-query/logs/alert/find", "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", "alerting:.es-query/logs/alert/getAlertSummary", - "alerting:.es-query/logs/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", "alerting:observability.rules.custom_threshold/logs/alert/get", "alerting:observability.rules.custom_threshold/logs/alert/find", "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/logs/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/logs/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "app:observability", + "ui:catalogue/observability", + "ui:navLinks/observability", + "ui:observability/read", + "alerting:apm.error_rate/observability/rule/get", + "alerting:apm.error_rate/observability/rule/getRuleState", + "alerting:apm.error_rate/observability/rule/getAlertSummary", + "alerting:apm.error_rate/observability/rule/getExecutionLog", + "alerting:apm.error_rate/observability/rule/getActionErrorLog", + "alerting:apm.error_rate/observability/rule/find", + "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/observability/rule/getBackfill", + "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/observability/rule/get", + "alerting:apm.transaction_error_rate/observability/rule/getRuleState", + "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/observability/rule/find", + "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/observability/rule/getBackfill", + "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_duration/observability/rule/get", + "alerting:apm.transaction_duration/observability/rule/getRuleState", + "alerting:apm.transaction_duration/observability/rule/getAlertSummary", + "alerting:apm.transaction_duration/observability/rule/getExecutionLog", + "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", + "alerting:apm.transaction_duration/observability/rule/find", + "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/observability/rule/getBackfill", + "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.anomaly/observability/rule/get", + "alerting:apm.anomaly/observability/rule/getRuleState", + "alerting:apm.anomaly/observability/rule/getAlertSummary", + "alerting:apm.anomaly/observability/rule/getExecutionLog", + "alerting:apm.anomaly/observability/rule/getActionErrorLog", + "alerting:apm.anomaly/observability/rule/find", + "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/observability/rule/getBackfill", + "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/get", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/find", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:apm.error_rate/observability/alert/get", + "alerting:apm.error_rate/observability/alert/find", + "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/alert/get", + "alerting:apm.transaction_error_rate/observability/alert/find", + "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/observability/alert/get", + "alerting:apm.transaction_duration/observability/alert/find", + "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.anomaly/observability/alert/get", + "alerting:apm.anomaly/observability/alert/find", + "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/alert/get", + "alerting:xpack.synthetics.alerts.tls/observability/alert/find", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + ], + "settings_save": Array [ + "login:", + "api:apm_settings_write", + "ui:apm/settings:save", + ], + }, + "dashboard": Object { + "all": Array [ + "login:", + "api:bulkGetUserProfiles", + "api:dashboardUsageStats", + "api:store_search_session", + "api:generateReport", + "api:downloadCsv", + "app:dashboards", + "app:kibana", + "ui:catalogue/dashboard", + "ui:management/kibana/search_sessions", + "ui:management/insightsAndAlerting/reporting", + "ui:navLinks/dashboards", + "ui:navLinks/kibana", + "saved_object:dashboard/bulk_get", + "saved_object:dashboard/get", + "saved_object:dashboard/find", + "saved_object:dashboard/open_point_in_time", + "saved_object:dashboard/close_point_in_time", + "saved_object:dashboard/create", + "saved_object:dashboard/bulk_create", + "saved_object:dashboard/update", + "saved_object:dashboard/bulk_update", + "saved_object:dashboard/delete", + "saved_object:dashboard/bulk_delete", + "saved_object:dashboard/share_to_space", + "saved_object:query/bulk_get", + "saved_object:query/get", + "saved_object:query/find", + "saved_object:query/open_point_in_time", + "saved_object:query/close_point_in_time", + "saved_object:query/create", + "saved_object:query/bulk_create", + "saved_object:query/update", + "saved_object:query/bulk_update", + "saved_object:query/delete", + "saved_object:query/bulk_delete", + "saved_object:query/share_to_space", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "saved_object:url/create", + "saved_object:url/bulk_create", + "saved_object:url/update", + "saved_object:url/bulk_update", + "saved_object:url/delete", + "saved_object:url/bulk_delete", + "saved_object:url/share_to_space", + "saved_object:search-session/bulk_get", + "saved_object:search-session/get", + "saved_object:search-session/find", + "saved_object:search-session/open_point_in_time", + "saved_object:search-session/close_point_in_time", + "saved_object:search-session/create", + "saved_object:search-session/bulk_create", + "saved_object:search-session/update", + "saved_object:search-session/bulk_update", + "saved_object:search-session/delete", + "saved_object:search-session/bulk_delete", + "saved_object:search-session/share_to_space", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", + "saved_object:search/bulk_get", + "saved_object:search/get", + "saved_object:search/find", + "saved_object:search/open_point_in_time", + "saved_object:search/close_point_in_time", + "saved_object:visualization/bulk_get", + "saved_object:visualization/get", + "saved_object:visualization/find", + "saved_object:visualization/open_point_in_time", + "saved_object:visualization/close_point_in_time", + "saved_object:canvas-workpad/bulk_get", + "saved_object:canvas-workpad/get", + "saved_object:canvas-workpad/find", + "saved_object:canvas-workpad/open_point_in_time", + "saved_object:canvas-workpad/close_point_in_time", + "saved_object:lens/bulk_get", + "saved_object:lens/get", + "saved_object:lens/find", + "saved_object:lens/open_point_in_time", + "saved_object:lens/close_point_in_time", + "saved_object:links/bulk_get", + "saved_object:links/get", + "saved_object:links/find", + "saved_object:links/open_point_in_time", + "saved_object:links/close_point_in_time", + "saved_object:map/bulk_get", + "saved_object:map/get", + "saved_object:map/find", + "saved_object:map/open_point_in_time", + "saved_object:map/close_point_in_time", + "saved_object:tag/bulk_get", + "saved_object:tag/get", + "saved_object:tag/find", + "saved_object:tag/open_point_in_time", + "saved_object:tag/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "ui:dashboard/createNew", + "ui:dashboard/show", + "ui:dashboard/showWriteControls", + "ui:dashboard/saveQuery", + "ui:dashboard/createShortUrl", + "ui:dashboard/storeSearchSession", + "ui:dashboard/generateScreenshot", + "ui:dashboard/downloadCsv", + "app:maps", + "ui:catalogue/maps", + "ui:navLinks/maps", + "saved_object:map/create", + "saved_object:map/bulk_create", + "saved_object:map/update", + "saved_object:map/bulk_update", + "saved_object:map/delete", + "saved_object:map/bulk_delete", + "saved_object:map/share_to_space", + "ui:maps/save", + "ui:maps/show", + "ui:maps/saveQuery", + "app:visualize", + "app:lens", + "ui:catalogue/visualize", + "ui:navLinks/visualize", + "ui:navLinks/lens", + "saved_object:visualization/create", + "saved_object:visualization/bulk_create", + "saved_object:visualization/update", + "saved_object:visualization/bulk_update", + "saved_object:visualization/delete", + "saved_object:visualization/bulk_delete", + "saved_object:visualization/share_to_space", + "saved_object:lens/create", + "saved_object:lens/bulk_create", + "saved_object:lens/update", + "saved_object:lens/bulk_update", + "saved_object:lens/delete", + "saved_object:lens/bulk_delete", + "saved_object:lens/share_to_space", + "ui:visualize/show", + "ui:visualize/delete", + "ui:visualize/save", + "ui:visualize/saveQuery", + "ui:visualize/createShortUrl", + "ui:visualize/generateScreenshot", + ], + "download_csv_report": Array [ + "login:", + "api:downloadCsv", + "ui:management/insightsAndAlerting/reporting", + "ui:dashboard/downloadCsv", + ], + "generate_report": Array [ + "login:", + "api:generateReport", + "ui:management/insightsAndAlerting/reporting", + "ui:dashboard/generateScreenshot", + ], + "minimal_all": Array [ + "login:", + "api:bulkGetUserProfiles", + "api:dashboardUsageStats", + "app:dashboards", + "app:kibana", + "ui:catalogue/dashboard", + "ui:navLinks/dashboards", + "ui:navLinks/kibana", + "saved_object:dashboard/bulk_get", + "saved_object:dashboard/get", + "saved_object:dashboard/find", + "saved_object:dashboard/open_point_in_time", + "saved_object:dashboard/close_point_in_time", + "saved_object:dashboard/create", + "saved_object:dashboard/bulk_create", + "saved_object:dashboard/update", + "saved_object:dashboard/bulk_update", + "saved_object:dashboard/delete", + "saved_object:dashboard/bulk_delete", + "saved_object:dashboard/share_to_space", + "saved_object:query/bulk_get", + "saved_object:query/get", + "saved_object:query/find", + "saved_object:query/open_point_in_time", + "saved_object:query/close_point_in_time", + "saved_object:query/create", + "saved_object:query/bulk_create", + "saved_object:query/update", + "saved_object:query/bulk_update", + "saved_object:query/delete", + "saved_object:query/bulk_delete", + "saved_object:query/share_to_space", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", + "saved_object:search/bulk_get", + "saved_object:search/get", + "saved_object:search/find", + "saved_object:search/open_point_in_time", + "saved_object:search/close_point_in_time", + "saved_object:visualization/bulk_get", + "saved_object:visualization/get", + "saved_object:visualization/find", + "saved_object:visualization/open_point_in_time", + "saved_object:visualization/close_point_in_time", + "saved_object:canvas-workpad/bulk_get", + "saved_object:canvas-workpad/get", + "saved_object:canvas-workpad/find", + "saved_object:canvas-workpad/open_point_in_time", + "saved_object:canvas-workpad/close_point_in_time", + "saved_object:lens/bulk_get", + "saved_object:lens/get", + "saved_object:lens/find", + "saved_object:lens/open_point_in_time", + "saved_object:lens/close_point_in_time", + "saved_object:links/bulk_get", + "saved_object:links/get", + "saved_object:links/find", + "saved_object:links/open_point_in_time", + "saved_object:links/close_point_in_time", + "saved_object:map/bulk_get", + "saved_object:map/get", + "saved_object:map/find", + "saved_object:map/open_point_in_time", + "saved_object:map/close_point_in_time", + "saved_object:tag/bulk_get", + "saved_object:tag/get", + "saved_object:tag/find", + "saved_object:tag/open_point_in_time", + "saved_object:tag/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:dashboard/createNew", + "ui:dashboard/show", + "ui:dashboard/showWriteControls", + "ui:dashboard/saveQuery", + "app:maps", + "ui:catalogue/maps", + "ui:navLinks/maps", + "saved_object:map/create", + "saved_object:map/bulk_create", + "saved_object:map/update", + "saved_object:map/bulk_update", + "saved_object:map/delete", + "saved_object:map/bulk_delete", + "saved_object:map/share_to_space", + "ui:maps/save", + "ui:maps/show", + "ui:maps/saveQuery", + "api:generateReport", + "app:visualize", + "app:lens", + "ui:catalogue/visualize", + "ui:management/insightsAndAlerting/reporting", + "ui:navLinks/visualize", + "ui:navLinks/lens", + "saved_object:visualization/create", + "saved_object:visualization/bulk_create", + "saved_object:visualization/update", + "saved_object:visualization/bulk_update", + "saved_object:visualization/delete", + "saved_object:visualization/bulk_delete", + "saved_object:visualization/share_to_space", + "saved_object:lens/create", + "saved_object:lens/bulk_create", + "saved_object:lens/update", + "saved_object:lens/bulk_update", + "saved_object:lens/delete", + "saved_object:lens/bulk_delete", + "saved_object:lens/share_to_space", + "saved_object:url/create", + "saved_object:url/bulk_create", + "saved_object:url/update", + "saved_object:url/bulk_update", + "saved_object:url/delete", + "saved_object:url/bulk_delete", + "saved_object:url/share_to_space", + "ui:visualize/show", + "ui:visualize/delete", + "ui:visualize/save", + "ui:visualize/saveQuery", + "ui:visualize/createShortUrl", + "ui:visualize/generateScreenshot", + ], + "minimal_read": Array [ + "login:", + "api:bulkGetUserProfiles", + "api:dashboardUsageStats", + "app:dashboards", + "app:kibana", + "ui:catalogue/dashboard", + "ui:navLinks/dashboards", + "ui:navLinks/kibana", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", + "saved_object:search/bulk_get", + "saved_object:search/get", + "saved_object:search/find", + "saved_object:search/open_point_in_time", + "saved_object:search/close_point_in_time", + "saved_object:visualization/bulk_get", + "saved_object:visualization/get", + "saved_object:visualization/find", + "saved_object:visualization/open_point_in_time", + "saved_object:visualization/close_point_in_time", + "saved_object:canvas-workpad/bulk_get", + "saved_object:canvas-workpad/get", + "saved_object:canvas-workpad/find", + "saved_object:canvas-workpad/open_point_in_time", + "saved_object:canvas-workpad/close_point_in_time", + "saved_object:lens/bulk_get", + "saved_object:lens/get", + "saved_object:lens/find", + "saved_object:lens/open_point_in_time", + "saved_object:lens/close_point_in_time", + "saved_object:links/bulk_get", + "saved_object:links/get", + "saved_object:links/find", + "saved_object:links/open_point_in_time", + "saved_object:links/close_point_in_time", + "saved_object:map/bulk_get", + "saved_object:map/get", + "saved_object:map/find", + "saved_object:map/open_point_in_time", + "saved_object:map/close_point_in_time", + "saved_object:dashboard/bulk_get", + "saved_object:dashboard/get", + "saved_object:dashboard/find", + "saved_object:dashboard/open_point_in_time", + "saved_object:dashboard/close_point_in_time", + "saved_object:query/bulk_get", + "saved_object:query/get", + "saved_object:query/find", + "saved_object:query/open_point_in_time", + "saved_object:query/close_point_in_time", + "saved_object:tag/bulk_get", + "saved_object:tag/get", + "saved_object:tag/find", + "saved_object:tag/open_point_in_time", + "saved_object:tag/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:dashboard/show", + "app:maps", + "ui:catalogue/maps", + "ui:navLinks/maps", + "ui:maps/show", + "app:visualize", + "app:lens", + "ui:catalogue/visualize", + "ui:navLinks/visualize", + "ui:navLinks/lens", + "saved_object:url/create", + "saved_object:url/bulk_create", + "saved_object:url/update", + "saved_object:url/bulk_update", + "saved_object:url/delete", + "saved_object:url/bulk_delete", + "saved_object:url/share_to_space", + "ui:visualize/show", + "ui:visualize/createShortUrl", + ], + "read": Array [ + "login:", + "api:bulkGetUserProfiles", + "api:dashboardUsageStats", + "app:dashboards", + "app:kibana", + "ui:catalogue/dashboard", + "ui:navLinks/dashboards", + "ui:navLinks/kibana", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "saved_object:url/create", + "saved_object:url/bulk_create", + "saved_object:url/update", + "saved_object:url/bulk_update", + "saved_object:url/delete", + "saved_object:url/bulk_delete", + "saved_object:url/share_to_space", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", + "saved_object:search/bulk_get", + "saved_object:search/get", + "saved_object:search/find", + "saved_object:search/open_point_in_time", + "saved_object:search/close_point_in_time", + "saved_object:visualization/bulk_get", + "saved_object:visualization/get", + "saved_object:visualization/find", + "saved_object:visualization/open_point_in_time", + "saved_object:visualization/close_point_in_time", + "saved_object:canvas-workpad/bulk_get", + "saved_object:canvas-workpad/get", + "saved_object:canvas-workpad/find", + "saved_object:canvas-workpad/open_point_in_time", + "saved_object:canvas-workpad/close_point_in_time", + "saved_object:lens/bulk_get", + "saved_object:lens/get", + "saved_object:lens/find", + "saved_object:lens/open_point_in_time", + "saved_object:lens/close_point_in_time", + "saved_object:links/bulk_get", + "saved_object:links/get", + "saved_object:links/find", + "saved_object:links/open_point_in_time", + "saved_object:links/close_point_in_time", + "saved_object:map/bulk_get", + "saved_object:map/get", + "saved_object:map/find", + "saved_object:map/open_point_in_time", + "saved_object:map/close_point_in_time", + "saved_object:dashboard/bulk_get", + "saved_object:dashboard/get", + "saved_object:dashboard/find", + "saved_object:dashboard/open_point_in_time", + "saved_object:dashboard/close_point_in_time", + "saved_object:query/bulk_get", + "saved_object:query/get", + "saved_object:query/find", + "saved_object:query/open_point_in_time", + "saved_object:query/close_point_in_time", + "saved_object:tag/bulk_get", + "saved_object:tag/get", + "saved_object:tag/find", + "saved_object:tag/open_point_in_time", + "saved_object:tag/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "ui:dashboard/show", + "ui:dashboard/createShortUrl", + "app:maps", + "ui:catalogue/maps", + "ui:navLinks/maps", + "ui:maps/show", + "app:visualize", + "app:lens", + "ui:catalogue/visualize", + "ui:navLinks/visualize", + "ui:navLinks/lens", + "ui:visualize/show", + "ui:visualize/createShortUrl", + ], + "store_search_session": Array [ + "login:", + "api:store_search_session", + "ui:management/kibana/search_sessions", + "saved_object:search-session/bulk_get", + "saved_object:search-session/get", + "saved_object:search-session/find", + "saved_object:search-session/open_point_in_time", + "saved_object:search-session/close_point_in_time", + "saved_object:search-session/create", + "saved_object:search-session/bulk_create", + "saved_object:search-session/update", + "saved_object:search-session/bulk_update", + "saved_object:search-session/delete", + "saved_object:search-session/bulk_delete", + "saved_object:search-session/share_to_space", + "ui:dashboard/storeSearchSession", + ], + "url_create": Array [ + "login:", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "saved_object:url/create", + "saved_object:url/bulk_create", + "saved_object:url/update", + "saved_object:url/bulk_update", + "saved_object:url/delete", + "saved_object:url/bulk_delete", + "saved_object:url/share_to_space", + "ui:dashboard/createShortUrl", + ], + }, + "discover": Object { + "all": Array [ + "login:", + "api:fileUpload:analyzeFile", + "api:store_search_session", + "api:generateReport", + "app:discover", + "app:kibana", + "ui:catalogue/discover", + "ui:management/kibana/search_sessions", + "ui:management/insightsAndAlerting/reporting", + "ui:navLinks/discover", + "ui:navLinks/kibana", + "saved_object:search/bulk_get", + "saved_object:search/get", + "saved_object:search/find", + "saved_object:search/open_point_in_time", + "saved_object:search/close_point_in_time", + "saved_object:search/create", + "saved_object:search/bulk_create", + "saved_object:search/update", + "saved_object:search/bulk_update", + "saved_object:search/delete", + "saved_object:search/bulk_delete", + "saved_object:search/share_to_space", + "saved_object:query/bulk_get", + "saved_object:query/get", + "saved_object:query/find", + "saved_object:query/open_point_in_time", + "saved_object:query/close_point_in_time", + "saved_object:query/create", + "saved_object:query/bulk_create", + "saved_object:query/update", + "saved_object:query/bulk_update", + "saved_object:query/delete", + "saved_object:query/bulk_delete", + "saved_object:query/share_to_space", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "saved_object:url/create", + "saved_object:url/bulk_create", + "saved_object:url/update", + "saved_object:url/bulk_update", + "saved_object:url/delete", + "saved_object:url/bulk_delete", + "saved_object:url/share_to_space", + "saved_object:search-session/bulk_get", + "saved_object:search-session/get", + "saved_object:search-session/find", + "saved_object:search-session/open_point_in_time", + "saved_object:search-session/close_point_in_time", + "saved_object:search-session/create", + "saved_object:search-session/bulk_create", + "saved_object:search-session/update", + "saved_object:search-session/bulk_update", + "saved_object:search-session/delete", + "saved_object:search-session/bulk_delete", + "saved_object:search-session/share_to_space", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "ui:discover/show", + "ui:discover/save", + "ui:discover/saveQuery", + "ui:discover/createShortUrl", + "ui:discover/storeSearchSession", + "ui:discover/generateCsv", + "api:rac", + "app:observability", + "ui:catalogue/observability", + "ui:navLinks/observability", + "ui:observability/read", + "ui:observability/write", + "alerting:apm.error_rate/observability/rule/get", + "alerting:apm.error_rate/observability/rule/getRuleState", + "alerting:apm.error_rate/observability/rule/getAlertSummary", + "alerting:apm.error_rate/observability/rule/getExecutionLog", + "alerting:apm.error_rate/observability/rule/getActionErrorLog", + "alerting:apm.error_rate/observability/rule/find", + "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/observability/rule/getBackfill", + "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/observability/rule/create", + "alerting:apm.error_rate/observability/rule/delete", + "alerting:apm.error_rate/observability/rule/update", + "alerting:apm.error_rate/observability/rule/updateApiKey", + "alerting:apm.error_rate/observability/rule/enable", + "alerting:apm.error_rate/observability/rule/disable", + "alerting:apm.error_rate/observability/rule/muteAll", + "alerting:apm.error_rate/observability/rule/unmuteAll", + "alerting:apm.error_rate/observability/rule/muteAlert", + "alerting:apm.error_rate/observability/rule/unmuteAlert", + "alerting:apm.error_rate/observability/rule/snooze", + "alerting:apm.error_rate/observability/rule/bulkEdit", + "alerting:apm.error_rate/observability/rule/bulkDelete", + "alerting:apm.error_rate/observability/rule/bulkEnable", + "alerting:apm.error_rate/observability/rule/bulkDisable", + "alerting:apm.error_rate/observability/rule/unsnooze", + "alerting:apm.error_rate/observability/rule/runSoon", + "alerting:apm.error_rate/observability/rule/scheduleBackfill", + "alerting:apm.error_rate/observability/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/create", + "alerting:apm.error_rate/alerts/rule/delete", + "alerting:apm.error_rate/alerts/rule/update", + "alerting:apm.error_rate/alerts/rule/updateApiKey", + "alerting:apm.error_rate/alerts/rule/enable", + "alerting:apm.error_rate/alerts/rule/disable", + "alerting:apm.error_rate/alerts/rule/muteAll", + "alerting:apm.error_rate/alerts/rule/unmuteAll", + "alerting:apm.error_rate/alerts/rule/muteAlert", + "alerting:apm.error_rate/alerts/rule/unmuteAlert", + "alerting:apm.error_rate/alerts/rule/snooze", + "alerting:apm.error_rate/alerts/rule/bulkEdit", + "alerting:apm.error_rate/alerts/rule/bulkDelete", + "alerting:apm.error_rate/alerts/rule/bulkEnable", + "alerting:apm.error_rate/alerts/rule/bulkDisable", + "alerting:apm.error_rate/alerts/rule/unsnooze", + "alerting:apm.error_rate/alerts/rule/runSoon", + "alerting:apm.error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.error_rate/alerts/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/observability/rule/get", + "alerting:apm.transaction_error_rate/observability/rule/getRuleState", + "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/observability/rule/find", + "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/observability/rule/getBackfill", + "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/observability/rule/create", + "alerting:apm.transaction_error_rate/observability/rule/delete", + "alerting:apm.transaction_error_rate/observability/rule/update", + "alerting:apm.transaction_error_rate/observability/rule/updateApiKey", + "alerting:apm.transaction_error_rate/observability/rule/enable", + "alerting:apm.transaction_error_rate/observability/rule/disable", + "alerting:apm.transaction_error_rate/observability/rule/muteAll", + "alerting:apm.transaction_error_rate/observability/rule/unmuteAll", + "alerting:apm.transaction_error_rate/observability/rule/muteAlert", + "alerting:apm.transaction_error_rate/observability/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/observability/rule/snooze", + "alerting:apm.transaction_error_rate/observability/rule/bulkEdit", + "alerting:apm.transaction_error_rate/observability/rule/bulkDelete", + "alerting:apm.transaction_error_rate/observability/rule/bulkEnable", + "alerting:apm.transaction_error_rate/observability/rule/bulkDisable", + "alerting:apm.transaction_error_rate/observability/rule/unsnooze", + "alerting:apm.transaction_error_rate/observability/rule/runSoon", + "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/create", + "alerting:apm.transaction_error_rate/alerts/rule/delete", + "alerting:apm.transaction_error_rate/alerts/rule/update", + "alerting:apm.transaction_error_rate/alerts/rule/updateApiKey", + "alerting:apm.transaction_error_rate/alerts/rule/enable", + "alerting:apm.transaction_error_rate/alerts/rule/disable", + "alerting:apm.transaction_error_rate/alerts/rule/muteAll", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAll", + "alerting:apm.transaction_error_rate/alerts/rule/muteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/snooze", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEdit", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDelete", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEnable", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDisable", + "alerting:apm.transaction_error_rate/alerts/rule/unsnooze", + "alerting:apm.transaction_error_rate/alerts/rule/runSoon", + "alerting:apm.transaction_error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/deleteBackfill", + "alerting:apm.transaction_duration/observability/rule/get", + "alerting:apm.transaction_duration/observability/rule/getRuleState", + "alerting:apm.transaction_duration/observability/rule/getAlertSummary", + "alerting:apm.transaction_duration/observability/rule/getExecutionLog", + "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", + "alerting:apm.transaction_duration/observability/rule/find", + "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/observability/rule/getBackfill", + "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/observability/rule/create", + "alerting:apm.transaction_duration/observability/rule/delete", + "alerting:apm.transaction_duration/observability/rule/update", + "alerting:apm.transaction_duration/observability/rule/updateApiKey", + "alerting:apm.transaction_duration/observability/rule/enable", + "alerting:apm.transaction_duration/observability/rule/disable", + "alerting:apm.transaction_duration/observability/rule/muteAll", + "alerting:apm.transaction_duration/observability/rule/unmuteAll", + "alerting:apm.transaction_duration/observability/rule/muteAlert", + "alerting:apm.transaction_duration/observability/rule/unmuteAlert", + "alerting:apm.transaction_duration/observability/rule/snooze", + "alerting:apm.transaction_duration/observability/rule/bulkEdit", + "alerting:apm.transaction_duration/observability/rule/bulkDelete", + "alerting:apm.transaction_duration/observability/rule/bulkEnable", + "alerting:apm.transaction_duration/observability/rule/bulkDisable", + "alerting:apm.transaction_duration/observability/rule/unsnooze", + "alerting:apm.transaction_duration/observability/rule/runSoon", + "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", + "alerting:apm.transaction_duration/observability/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/create", + "alerting:apm.transaction_duration/alerts/rule/delete", + "alerting:apm.transaction_duration/alerts/rule/update", + "alerting:apm.transaction_duration/alerts/rule/updateApiKey", + "alerting:apm.transaction_duration/alerts/rule/enable", + "alerting:apm.transaction_duration/alerts/rule/disable", + "alerting:apm.transaction_duration/alerts/rule/muteAll", + "alerting:apm.transaction_duration/alerts/rule/unmuteAll", + "alerting:apm.transaction_duration/alerts/rule/muteAlert", + "alerting:apm.transaction_duration/alerts/rule/unmuteAlert", + "alerting:apm.transaction_duration/alerts/rule/snooze", + "alerting:apm.transaction_duration/alerts/rule/bulkEdit", + "alerting:apm.transaction_duration/alerts/rule/bulkDelete", + "alerting:apm.transaction_duration/alerts/rule/bulkEnable", + "alerting:apm.transaction_duration/alerts/rule/bulkDisable", + "alerting:apm.transaction_duration/alerts/rule/unsnooze", + "alerting:apm.transaction_duration/alerts/rule/runSoon", + "alerting:apm.transaction_duration/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_duration/alerts/rule/deleteBackfill", + "alerting:apm.anomaly/observability/rule/get", + "alerting:apm.anomaly/observability/rule/getRuleState", + "alerting:apm.anomaly/observability/rule/getAlertSummary", + "alerting:apm.anomaly/observability/rule/getExecutionLog", + "alerting:apm.anomaly/observability/rule/getActionErrorLog", + "alerting:apm.anomaly/observability/rule/find", + "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/observability/rule/getBackfill", + "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/observability/rule/create", + "alerting:apm.anomaly/observability/rule/delete", + "alerting:apm.anomaly/observability/rule/update", + "alerting:apm.anomaly/observability/rule/updateApiKey", + "alerting:apm.anomaly/observability/rule/enable", + "alerting:apm.anomaly/observability/rule/disable", + "alerting:apm.anomaly/observability/rule/muteAll", + "alerting:apm.anomaly/observability/rule/unmuteAll", + "alerting:apm.anomaly/observability/rule/muteAlert", + "alerting:apm.anomaly/observability/rule/unmuteAlert", + "alerting:apm.anomaly/observability/rule/snooze", + "alerting:apm.anomaly/observability/rule/bulkEdit", + "alerting:apm.anomaly/observability/rule/bulkDelete", + "alerting:apm.anomaly/observability/rule/bulkEnable", + "alerting:apm.anomaly/observability/rule/bulkDisable", + "alerting:apm.anomaly/observability/rule/unsnooze", + "alerting:apm.anomaly/observability/rule/runSoon", + "alerting:apm.anomaly/observability/rule/scheduleBackfill", + "alerting:apm.anomaly/observability/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/create", + "alerting:apm.anomaly/alerts/rule/delete", + "alerting:apm.anomaly/alerts/rule/update", + "alerting:apm.anomaly/alerts/rule/updateApiKey", + "alerting:apm.anomaly/alerts/rule/enable", + "alerting:apm.anomaly/alerts/rule/disable", + "alerting:apm.anomaly/alerts/rule/muteAll", + "alerting:apm.anomaly/alerts/rule/unmuteAll", + "alerting:apm.anomaly/alerts/rule/muteAlert", + "alerting:apm.anomaly/alerts/rule/unmuteAlert", + "alerting:apm.anomaly/alerts/rule/snooze", + "alerting:apm.anomaly/alerts/rule/bulkEdit", + "alerting:apm.anomaly/alerts/rule/bulkDelete", + "alerting:apm.anomaly/alerts/rule/bulkEnable", + "alerting:apm.anomaly/alerts/rule/bulkDisable", + "alerting:apm.anomaly/alerts/rule/unsnooze", + "alerting:apm.anomaly/alerts/rule/runSoon", + "alerting:apm.anomaly/alerts/rule/scheduleBackfill", + "alerting:apm.anomaly/alerts/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/get", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/find", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/create", + "alerting:xpack.synthetics.alerts.tls/observability/rule/delete", + "alerting:xpack.synthetics.alerts.tls/observability/rule/update", + "alerting:xpack.synthetics.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/observability/rule/enable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/disable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/observability/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/deleteBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/create", + "alerting:metrics.alert.threshold/observability/rule/delete", + "alerting:metrics.alert.threshold/observability/rule/update", + "alerting:metrics.alert.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.threshold/observability/rule/enable", + "alerting:metrics.alert.threshold/observability/rule/disable", + "alerting:metrics.alert.threshold/observability/rule/muteAll", + "alerting:metrics.alert.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.threshold/observability/rule/snooze", + "alerting:metrics.alert.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.threshold/observability/rule/runSoon", + "alerting:metrics.alert.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/create", + "alerting:metrics.alert.threshold/alerts/rule/delete", + "alerting:metrics.alert.threshold/alerts/rule/update", + "alerting:metrics.alert.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.threshold/alerts/rule/enable", + "alerting:metrics.alert.threshold/alerts/rule/disable", + "alerting:metrics.alert.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.threshold/alerts/rule/snooze", + "alerting:metrics.alert.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/alerts/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/create", + "alerting:metrics.alert.inventory.threshold/observability/rule/delete", + "alerting:metrics.alert.inventory.threshold/observability/rule/update", + "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/observability/rule/enable", + "alerting:metrics.alert.inventory.threshold/observability/rule/disable", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/create", + "alerting:metrics.alert.inventory.threshold/alerts/rule/delete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/update", + "alerting:metrics.alert.inventory.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/alerts/rule/enable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/disable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/snooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/create", + "alerting:xpack.uptime.alerts.tls/observability/rule/delete", + "alerting:xpack.uptime.alerts.tls/observability/rule/update", + "alerting:xpack.uptime.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/observability/rule/enable", + "alerting:xpack.uptime.alerts.tls/observability/rule/disable", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/create", + "alerting:xpack.uptime.alerts.tls/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/update", + "alerting:xpack.uptime.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/deleteBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/create", + "alerting:logs.alert.document.count/observability/rule/delete", + "alerting:logs.alert.document.count/observability/rule/update", + "alerting:logs.alert.document.count/observability/rule/updateApiKey", + "alerting:logs.alert.document.count/observability/rule/enable", + "alerting:logs.alert.document.count/observability/rule/disable", + "alerting:logs.alert.document.count/observability/rule/muteAll", + "alerting:logs.alert.document.count/observability/rule/unmuteAll", + "alerting:logs.alert.document.count/observability/rule/muteAlert", + "alerting:logs.alert.document.count/observability/rule/unmuteAlert", + "alerting:logs.alert.document.count/observability/rule/snooze", + "alerting:logs.alert.document.count/observability/rule/bulkEdit", + "alerting:logs.alert.document.count/observability/rule/bulkDelete", + "alerting:logs.alert.document.count/observability/rule/bulkEnable", + "alerting:logs.alert.document.count/observability/rule/bulkDisable", + "alerting:logs.alert.document.count/observability/rule/unsnooze", + "alerting:logs.alert.document.count/observability/rule/runSoon", + "alerting:logs.alert.document.count/observability/rule/scheduleBackfill", + "alerting:logs.alert.document.count/observability/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/create", + "alerting:slo.rules.burnRate/observability/rule/delete", + "alerting:slo.rules.burnRate/observability/rule/update", + "alerting:slo.rules.burnRate/observability/rule/updateApiKey", + "alerting:slo.rules.burnRate/observability/rule/enable", + "alerting:slo.rules.burnRate/observability/rule/disable", + "alerting:slo.rules.burnRate/observability/rule/muteAll", + "alerting:slo.rules.burnRate/observability/rule/unmuteAll", + "alerting:slo.rules.burnRate/observability/rule/muteAlert", + "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", + "alerting:slo.rules.burnRate/observability/rule/snooze", + "alerting:slo.rules.burnRate/observability/rule/bulkEdit", + "alerting:slo.rules.burnRate/observability/rule/bulkDelete", + "alerting:slo.rules.burnRate/observability/rule/bulkEnable", + "alerting:slo.rules.burnRate/observability/rule/bulkDisable", + "alerting:slo.rules.burnRate/observability/rule/unsnooze", + "alerting:slo.rules.burnRate/observability/rule/runSoon", + "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/create", + "alerting:slo.rules.burnRate/alerts/rule/delete", + "alerting:slo.rules.burnRate/alerts/rule/update", + "alerting:slo.rules.burnRate/alerts/rule/updateApiKey", + "alerting:slo.rules.burnRate/alerts/rule/enable", + "alerting:slo.rules.burnRate/alerts/rule/disable", + "alerting:slo.rules.burnRate/alerts/rule/muteAll", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAll", + "alerting:slo.rules.burnRate/alerts/rule/muteAlert", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAlert", + "alerting:slo.rules.burnRate/alerts/rule/snooze", + "alerting:slo.rules.burnRate/alerts/rule/bulkEdit", + "alerting:slo.rules.burnRate/alerts/rule/bulkDelete", + "alerting:slo.rules.burnRate/alerts/rule/bulkEnable", + "alerting:slo.rules.burnRate/alerts/rule/bulkDisable", + "alerting:slo.rules.burnRate/alerts/rule/unsnooze", + "alerting:slo.rules.burnRate/alerts/rule/runSoon", + "alerting:slo.rules.burnRate/alerts/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/alerts/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/create", + "alerting:observability.rules.custom_threshold/observability/rule/delete", + "alerting:observability.rules.custom_threshold/observability/rule/update", + "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/observability/rule/enable", + "alerting:observability.rules.custom_threshold/observability/rule/disable", + "alerting:observability.rules.custom_threshold/observability/rule/muteAll", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/snooze", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", + "alerting:observability.rules.custom_threshold/observability/rule/runSoon", + "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/create", + "alerting:.es-query/observability/rule/delete", + "alerting:.es-query/observability/rule/update", + "alerting:.es-query/observability/rule/updateApiKey", + "alerting:.es-query/observability/rule/enable", + "alerting:.es-query/observability/rule/disable", + "alerting:.es-query/observability/rule/muteAll", + "alerting:.es-query/observability/rule/unmuteAll", + "alerting:.es-query/observability/rule/muteAlert", + "alerting:.es-query/observability/rule/unmuteAlert", + "alerting:.es-query/observability/rule/snooze", + "alerting:.es-query/observability/rule/bulkEdit", + "alerting:.es-query/observability/rule/bulkDelete", + "alerting:.es-query/observability/rule/bulkEnable", + "alerting:.es-query/observability/rule/bulkDisable", + "alerting:.es-query/observability/rule/unsnooze", + "alerting:.es-query/observability/rule/runSoon", + "alerting:.es-query/observability/rule/scheduleBackfill", + "alerting:.es-query/observability/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", + "alerting:apm.error_rate/observability/alert/get", + "alerting:apm.error_rate/observability/alert/find", + "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/update", + "alerting:apm.transaction_error_rate/observability/alert/get", + "alerting:apm.transaction_error_rate/observability/alert/find", + "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/update", + "alerting:apm.transaction_duration/observability/alert/get", + "alerting:apm.transaction_duration/observability/alert/find", + "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/update", + "alerting:apm.anomaly/observability/alert/get", + "alerting:apm.anomaly/observability/alert/find", + "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/observability/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.synthetics.alerts.tls/observability/alert/get", + "alerting:xpack.synthetics.alerts.tls/observability/alert/find", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/update", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/update", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/update", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/update", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/update", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/update", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/update", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/update", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", + ], + "generate_report": Array [ + "login:", + "api:generateReport", + "ui:management/insightsAndAlerting/reporting", + "ui:discover/generateCsv", + ], + "minimal_all": Array [ + "login:", + "api:fileUpload:analyzeFile", + "app:discover", + "app:kibana", + "ui:catalogue/discover", + "ui:navLinks/discover", + "ui:navLinks/kibana", + "saved_object:search/bulk_get", + "saved_object:search/get", + "saved_object:search/find", + "saved_object:search/open_point_in_time", + "saved_object:search/close_point_in_time", + "saved_object:search/create", + "saved_object:search/bulk_create", + "saved_object:search/update", + "saved_object:search/bulk_update", + "saved_object:search/delete", + "saved_object:search/bulk_delete", + "saved_object:search/share_to_space", + "saved_object:query/bulk_get", + "saved_object:query/get", + "saved_object:query/find", + "saved_object:query/open_point_in_time", + "saved_object:query/close_point_in_time", + "saved_object:query/create", + "saved_object:query/bulk_create", + "saved_object:query/update", + "saved_object:query/bulk_update", + "saved_object:query/delete", + "saved_object:query/bulk_delete", + "saved_object:query/share_to_space", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:discover/show", + "ui:discover/save", + "ui:discover/saveQuery", + "api:rac", "app:observability", "ui:catalogue/observability", "ui:navLinks/observability", "ui:observability/read", "ui:observability/write", + "alerting:apm.error_rate/observability/rule/get", + "alerting:apm.error_rate/observability/rule/getRuleState", + "alerting:apm.error_rate/observability/rule/getAlertSummary", + "alerting:apm.error_rate/observability/rule/getExecutionLog", + "alerting:apm.error_rate/observability/rule/getActionErrorLog", + "alerting:apm.error_rate/observability/rule/find", + "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/observability/rule/getBackfill", + "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/observability/rule/create", + "alerting:apm.error_rate/observability/rule/delete", + "alerting:apm.error_rate/observability/rule/update", + "alerting:apm.error_rate/observability/rule/updateApiKey", + "alerting:apm.error_rate/observability/rule/enable", + "alerting:apm.error_rate/observability/rule/disable", + "alerting:apm.error_rate/observability/rule/muteAll", + "alerting:apm.error_rate/observability/rule/unmuteAll", + "alerting:apm.error_rate/observability/rule/muteAlert", + "alerting:apm.error_rate/observability/rule/unmuteAlert", + "alerting:apm.error_rate/observability/rule/snooze", + "alerting:apm.error_rate/observability/rule/bulkEdit", + "alerting:apm.error_rate/observability/rule/bulkDelete", + "alerting:apm.error_rate/observability/rule/bulkEnable", + "alerting:apm.error_rate/observability/rule/bulkDisable", + "alerting:apm.error_rate/observability/rule/unsnooze", + "alerting:apm.error_rate/observability/rule/runSoon", + "alerting:apm.error_rate/observability/rule/scheduleBackfill", + "alerting:apm.error_rate/observability/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/create", + "alerting:apm.error_rate/alerts/rule/delete", + "alerting:apm.error_rate/alerts/rule/update", + "alerting:apm.error_rate/alerts/rule/updateApiKey", + "alerting:apm.error_rate/alerts/rule/enable", + "alerting:apm.error_rate/alerts/rule/disable", + "alerting:apm.error_rate/alerts/rule/muteAll", + "alerting:apm.error_rate/alerts/rule/unmuteAll", + "alerting:apm.error_rate/alerts/rule/muteAlert", + "alerting:apm.error_rate/alerts/rule/unmuteAlert", + "alerting:apm.error_rate/alerts/rule/snooze", + "alerting:apm.error_rate/alerts/rule/bulkEdit", + "alerting:apm.error_rate/alerts/rule/bulkDelete", + "alerting:apm.error_rate/alerts/rule/bulkEnable", + "alerting:apm.error_rate/alerts/rule/bulkDisable", + "alerting:apm.error_rate/alerts/rule/unsnooze", + "alerting:apm.error_rate/alerts/rule/runSoon", + "alerting:apm.error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.error_rate/alerts/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/observability/rule/get", + "alerting:apm.transaction_error_rate/observability/rule/getRuleState", + "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/observability/rule/find", + "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/observability/rule/getBackfill", + "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/observability/rule/create", + "alerting:apm.transaction_error_rate/observability/rule/delete", + "alerting:apm.transaction_error_rate/observability/rule/update", + "alerting:apm.transaction_error_rate/observability/rule/updateApiKey", + "alerting:apm.transaction_error_rate/observability/rule/enable", + "alerting:apm.transaction_error_rate/observability/rule/disable", + "alerting:apm.transaction_error_rate/observability/rule/muteAll", + "alerting:apm.transaction_error_rate/observability/rule/unmuteAll", + "alerting:apm.transaction_error_rate/observability/rule/muteAlert", + "alerting:apm.transaction_error_rate/observability/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/observability/rule/snooze", + "alerting:apm.transaction_error_rate/observability/rule/bulkEdit", + "alerting:apm.transaction_error_rate/observability/rule/bulkDelete", + "alerting:apm.transaction_error_rate/observability/rule/bulkEnable", + "alerting:apm.transaction_error_rate/observability/rule/bulkDisable", + "alerting:apm.transaction_error_rate/observability/rule/unsnooze", + "alerting:apm.transaction_error_rate/observability/rule/runSoon", + "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/create", + "alerting:apm.transaction_error_rate/alerts/rule/delete", + "alerting:apm.transaction_error_rate/alerts/rule/update", + "alerting:apm.transaction_error_rate/alerts/rule/updateApiKey", + "alerting:apm.transaction_error_rate/alerts/rule/enable", + "alerting:apm.transaction_error_rate/alerts/rule/disable", + "alerting:apm.transaction_error_rate/alerts/rule/muteAll", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAll", + "alerting:apm.transaction_error_rate/alerts/rule/muteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/snooze", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEdit", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDelete", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEnable", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDisable", + "alerting:apm.transaction_error_rate/alerts/rule/unsnooze", + "alerting:apm.transaction_error_rate/alerts/rule/runSoon", + "alerting:apm.transaction_error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/deleteBackfill", + "alerting:apm.transaction_duration/observability/rule/get", + "alerting:apm.transaction_duration/observability/rule/getRuleState", + "alerting:apm.transaction_duration/observability/rule/getAlertSummary", + "alerting:apm.transaction_duration/observability/rule/getExecutionLog", + "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", + "alerting:apm.transaction_duration/observability/rule/find", + "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/observability/rule/getBackfill", + "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/observability/rule/create", + "alerting:apm.transaction_duration/observability/rule/delete", + "alerting:apm.transaction_duration/observability/rule/update", + "alerting:apm.transaction_duration/observability/rule/updateApiKey", + "alerting:apm.transaction_duration/observability/rule/enable", + "alerting:apm.transaction_duration/observability/rule/disable", + "alerting:apm.transaction_duration/observability/rule/muteAll", + "alerting:apm.transaction_duration/observability/rule/unmuteAll", + "alerting:apm.transaction_duration/observability/rule/muteAlert", + "alerting:apm.transaction_duration/observability/rule/unmuteAlert", + "alerting:apm.transaction_duration/observability/rule/snooze", + "alerting:apm.transaction_duration/observability/rule/bulkEdit", + "alerting:apm.transaction_duration/observability/rule/bulkDelete", + "alerting:apm.transaction_duration/observability/rule/bulkEnable", + "alerting:apm.transaction_duration/observability/rule/bulkDisable", + "alerting:apm.transaction_duration/observability/rule/unsnooze", + "alerting:apm.transaction_duration/observability/rule/runSoon", + "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", + "alerting:apm.transaction_duration/observability/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/create", + "alerting:apm.transaction_duration/alerts/rule/delete", + "alerting:apm.transaction_duration/alerts/rule/update", + "alerting:apm.transaction_duration/alerts/rule/updateApiKey", + "alerting:apm.transaction_duration/alerts/rule/enable", + "alerting:apm.transaction_duration/alerts/rule/disable", + "alerting:apm.transaction_duration/alerts/rule/muteAll", + "alerting:apm.transaction_duration/alerts/rule/unmuteAll", + "alerting:apm.transaction_duration/alerts/rule/muteAlert", + "alerting:apm.transaction_duration/alerts/rule/unmuteAlert", + "alerting:apm.transaction_duration/alerts/rule/snooze", + "alerting:apm.transaction_duration/alerts/rule/bulkEdit", + "alerting:apm.transaction_duration/alerts/rule/bulkDelete", + "alerting:apm.transaction_duration/alerts/rule/bulkEnable", + "alerting:apm.transaction_duration/alerts/rule/bulkDisable", + "alerting:apm.transaction_duration/alerts/rule/unsnooze", + "alerting:apm.transaction_duration/alerts/rule/runSoon", + "alerting:apm.transaction_duration/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_duration/alerts/rule/deleteBackfill", + "alerting:apm.anomaly/observability/rule/get", + "alerting:apm.anomaly/observability/rule/getRuleState", + "alerting:apm.anomaly/observability/rule/getAlertSummary", + "alerting:apm.anomaly/observability/rule/getExecutionLog", + "alerting:apm.anomaly/observability/rule/getActionErrorLog", + "alerting:apm.anomaly/observability/rule/find", + "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/observability/rule/getBackfill", + "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/observability/rule/create", + "alerting:apm.anomaly/observability/rule/delete", + "alerting:apm.anomaly/observability/rule/update", + "alerting:apm.anomaly/observability/rule/updateApiKey", + "alerting:apm.anomaly/observability/rule/enable", + "alerting:apm.anomaly/observability/rule/disable", + "alerting:apm.anomaly/observability/rule/muteAll", + "alerting:apm.anomaly/observability/rule/unmuteAll", + "alerting:apm.anomaly/observability/rule/muteAlert", + "alerting:apm.anomaly/observability/rule/unmuteAlert", + "alerting:apm.anomaly/observability/rule/snooze", + "alerting:apm.anomaly/observability/rule/bulkEdit", + "alerting:apm.anomaly/observability/rule/bulkDelete", + "alerting:apm.anomaly/observability/rule/bulkEnable", + "alerting:apm.anomaly/observability/rule/bulkDisable", + "alerting:apm.anomaly/observability/rule/unsnooze", + "alerting:apm.anomaly/observability/rule/runSoon", + "alerting:apm.anomaly/observability/rule/scheduleBackfill", + "alerting:apm.anomaly/observability/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/create", + "alerting:apm.anomaly/alerts/rule/delete", + "alerting:apm.anomaly/alerts/rule/update", + "alerting:apm.anomaly/alerts/rule/updateApiKey", + "alerting:apm.anomaly/alerts/rule/enable", + "alerting:apm.anomaly/alerts/rule/disable", + "alerting:apm.anomaly/alerts/rule/muteAll", + "alerting:apm.anomaly/alerts/rule/unmuteAll", + "alerting:apm.anomaly/alerts/rule/muteAlert", + "alerting:apm.anomaly/alerts/rule/unmuteAlert", + "alerting:apm.anomaly/alerts/rule/snooze", + "alerting:apm.anomaly/alerts/rule/bulkEdit", + "alerting:apm.anomaly/alerts/rule/bulkDelete", + "alerting:apm.anomaly/alerts/rule/bulkEnable", + "alerting:apm.anomaly/alerts/rule/bulkDisable", + "alerting:apm.anomaly/alerts/rule/unsnooze", + "alerting:apm.anomaly/alerts/rule/runSoon", + "alerting:apm.anomaly/alerts/rule/scheduleBackfill", + "alerting:apm.anomaly/alerts/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/get", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/find", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/create", + "alerting:xpack.synthetics.alerts.tls/observability/rule/delete", + "alerting:xpack.synthetics.alerts.tls/observability/rule/update", + "alerting:xpack.synthetics.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/observability/rule/enable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/disable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/observability/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/deleteBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/create", + "alerting:metrics.alert.threshold/observability/rule/delete", + "alerting:metrics.alert.threshold/observability/rule/update", + "alerting:metrics.alert.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.threshold/observability/rule/enable", + "alerting:metrics.alert.threshold/observability/rule/disable", + "alerting:metrics.alert.threshold/observability/rule/muteAll", + "alerting:metrics.alert.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.threshold/observability/rule/snooze", + "alerting:metrics.alert.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.threshold/observability/rule/runSoon", + "alerting:metrics.alert.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/create", + "alerting:metrics.alert.threshold/alerts/rule/delete", + "alerting:metrics.alert.threshold/alerts/rule/update", + "alerting:metrics.alert.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.threshold/alerts/rule/enable", + "alerting:metrics.alert.threshold/alerts/rule/disable", + "alerting:metrics.alert.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.threshold/alerts/rule/snooze", + "alerting:metrics.alert.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/alerts/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/create", + "alerting:metrics.alert.inventory.threshold/observability/rule/delete", + "alerting:metrics.alert.inventory.threshold/observability/rule/update", + "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/observability/rule/enable", + "alerting:metrics.alert.inventory.threshold/observability/rule/disable", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/create", + "alerting:metrics.alert.inventory.threshold/alerts/rule/delete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/update", + "alerting:metrics.alert.inventory.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/alerts/rule/enable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/disable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/snooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/create", + "alerting:xpack.uptime.alerts.tls/observability/rule/delete", + "alerting:xpack.uptime.alerts.tls/observability/rule/update", + "alerting:xpack.uptime.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/observability/rule/enable", + "alerting:xpack.uptime.alerts.tls/observability/rule/disable", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/create", + "alerting:xpack.uptime.alerts.tls/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/update", + "alerting:xpack.uptime.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/deleteBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/create", + "alerting:logs.alert.document.count/observability/rule/delete", + "alerting:logs.alert.document.count/observability/rule/update", + "alerting:logs.alert.document.count/observability/rule/updateApiKey", + "alerting:logs.alert.document.count/observability/rule/enable", + "alerting:logs.alert.document.count/observability/rule/disable", + "alerting:logs.alert.document.count/observability/rule/muteAll", + "alerting:logs.alert.document.count/observability/rule/unmuteAll", + "alerting:logs.alert.document.count/observability/rule/muteAlert", + "alerting:logs.alert.document.count/observability/rule/unmuteAlert", + "alerting:logs.alert.document.count/observability/rule/snooze", + "alerting:logs.alert.document.count/observability/rule/bulkEdit", + "alerting:logs.alert.document.count/observability/rule/bulkDelete", + "alerting:logs.alert.document.count/observability/rule/bulkEnable", + "alerting:logs.alert.document.count/observability/rule/bulkDisable", + "alerting:logs.alert.document.count/observability/rule/unsnooze", + "alerting:logs.alert.document.count/observability/rule/runSoon", + "alerting:logs.alert.document.count/observability/rule/scheduleBackfill", + "alerting:logs.alert.document.count/observability/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", "alerting:slo.rules.burnRate/observability/rule/get", "alerting:slo.rules.burnRate/observability/rule/getRuleState", "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", @@ -6236,6 +6858,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:slo.rules.burnRate/observability/rule/runSoon", "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/create", + "alerting:slo.rules.burnRate/alerts/rule/delete", + "alerting:slo.rules.burnRate/alerts/rule/update", + "alerting:slo.rules.burnRate/alerts/rule/updateApiKey", + "alerting:slo.rules.burnRate/alerts/rule/enable", + "alerting:slo.rules.burnRate/alerts/rule/disable", + "alerting:slo.rules.burnRate/alerts/rule/muteAll", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAll", + "alerting:slo.rules.burnRate/alerts/rule/muteAlert", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAlert", + "alerting:slo.rules.burnRate/alerts/rule/snooze", + "alerting:slo.rules.burnRate/alerts/rule/bulkEdit", + "alerting:slo.rules.burnRate/alerts/rule/bulkDelete", + "alerting:slo.rules.burnRate/alerts/rule/bulkEnable", + "alerting:slo.rules.burnRate/alerts/rule/bulkDisable", + "alerting:slo.rules.burnRate/alerts/rule/unsnooze", + "alerting:slo.rules.burnRate/alerts/rule/runSoon", + "alerting:slo.rules.burnRate/alerts/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/alerts/rule/deleteBackfill", "alerting:observability.rules.custom_threshold/observability/rule/get", "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", @@ -6264,6 +6914,635 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/observability/rule/runSoon", "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/create", + "alerting:.es-query/observability/rule/delete", + "alerting:.es-query/observability/rule/update", + "alerting:.es-query/observability/rule/updateApiKey", + "alerting:.es-query/observability/rule/enable", + "alerting:.es-query/observability/rule/disable", + "alerting:.es-query/observability/rule/muteAll", + "alerting:.es-query/observability/rule/unmuteAll", + "alerting:.es-query/observability/rule/muteAlert", + "alerting:.es-query/observability/rule/unmuteAlert", + "alerting:.es-query/observability/rule/snooze", + "alerting:.es-query/observability/rule/bulkEdit", + "alerting:.es-query/observability/rule/bulkDelete", + "alerting:.es-query/observability/rule/bulkEnable", + "alerting:.es-query/observability/rule/bulkDisable", + "alerting:.es-query/observability/rule/unsnooze", + "alerting:.es-query/observability/rule/runSoon", + "alerting:.es-query/observability/rule/scheduleBackfill", + "alerting:.es-query/observability/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", + "alerting:apm.error_rate/observability/alert/get", + "alerting:apm.error_rate/observability/alert/find", + "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/update", + "alerting:apm.transaction_error_rate/observability/alert/get", + "alerting:apm.transaction_error_rate/observability/alert/find", + "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/update", + "alerting:apm.transaction_duration/observability/alert/get", + "alerting:apm.transaction_duration/observability/alert/find", + "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/update", + "alerting:apm.anomaly/observability/alert/get", + "alerting:apm.anomaly/observability/alert/find", + "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/observability/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.synthetics.alerts.tls/observability/alert/get", + "alerting:xpack.synthetics.alerts.tls/observability/alert/find", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/update", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/update", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/update", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/update", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/update", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/update", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/update", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/update", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", + ], + "minimal_read": Array [ + "login:", + "app:discover", + "app:kibana", + "ui:catalogue/discover", + "ui:navLinks/discover", + "ui:navLinks/kibana", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", + "saved_object:search/bulk_get", + "saved_object:search/get", + "saved_object:search/find", + "saved_object:search/open_point_in_time", + "saved_object:search/close_point_in_time", + "saved_object:query/bulk_get", + "saved_object:query/get", + "saved_object:query/find", + "saved_object:query/open_point_in_time", + "saved_object:query/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:discover/show", + "api:rac", + "app:observability", + "ui:catalogue/observability", + "ui:navLinks/observability", + "ui:observability/read", + "alerting:apm.error_rate/observability/rule/get", + "alerting:apm.error_rate/observability/rule/getRuleState", + "alerting:apm.error_rate/observability/rule/getAlertSummary", + "alerting:apm.error_rate/observability/rule/getExecutionLog", + "alerting:apm.error_rate/observability/rule/getActionErrorLog", + "alerting:apm.error_rate/observability/rule/find", + "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/observability/rule/getBackfill", + "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/observability/rule/get", + "alerting:apm.transaction_error_rate/observability/rule/getRuleState", + "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/observability/rule/find", + "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/observability/rule/getBackfill", + "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/observability/rule/get", + "alerting:apm.transaction_duration/observability/rule/getRuleState", + "alerting:apm.transaction_duration/observability/rule/getAlertSummary", + "alerting:apm.transaction_duration/observability/rule/getExecutionLog", + "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", + "alerting:apm.transaction_duration/observability/rule/find", + "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/observability/rule/getBackfill", + "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.anomaly/observability/rule/get", + "alerting:apm.anomaly/observability/rule/getRuleState", + "alerting:apm.anomaly/observability/rule/getAlertSummary", + "alerting:apm.anomaly/observability/rule/getExecutionLog", + "alerting:apm.anomaly/observability/rule/getActionErrorLog", + "alerting:apm.anomaly/observability/rule/find", + "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/observability/rule/getBackfill", + "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/get", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/find", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", "alerting:.es-query/observability/rule/get", "alerting:.es-query/observability/rule/getRuleState", "alerting:.es-query/observability/rule/getAlertSummary", @@ -6273,25 +7552,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/observability/rule/getRuleExecutionKPI", "alerting:.es-query/observability/rule/getBackfill", "alerting:.es-query/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/create", - "alerting:.es-query/observability/rule/delete", - "alerting:.es-query/observability/rule/update", - "alerting:.es-query/observability/rule/updateApiKey", - "alerting:.es-query/observability/rule/enable", - "alerting:.es-query/observability/rule/disable", - "alerting:.es-query/observability/rule/muteAll", - "alerting:.es-query/observability/rule/unmuteAll", - "alerting:.es-query/observability/rule/muteAlert", - "alerting:.es-query/observability/rule/unmuteAlert", - "alerting:.es-query/observability/rule/snooze", - "alerting:.es-query/observability/rule/bulkEdit", - "alerting:.es-query/observability/rule/bulkDelete", - "alerting:.es-query/observability/rule/bulkEnable", - "alerting:.es-query/observability/rule/bulkDisable", - "alerting:.es-query/observability/rule/unsnooze", - "alerting:.es-query/observability/rule/runSoon", - "alerting:.es-query/observability/rule/scheduleBackfill", - "alerting:.es-query/observability/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", @@ -6301,53 +7570,208 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/create", - "alerting:metrics.alert.inventory.threshold/observability/rule/delete", - "alerting:metrics.alert.inventory.threshold/observability/rule/update", - "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/observability/rule/enable", - "alerting:metrics.alert.inventory.threshold/observability/rule/disable", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:apm.error_rate/observability/alert/get", + "alerting:apm.error_rate/observability/alert/find", + "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/alert/get", + "alerting:apm.transaction_error_rate/observability/alert/find", + "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/observability/alert/get", + "alerting:apm.transaction_duration/observability/alert/find", + "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/observability/alert/get", + "alerting:apm.anomaly/observability/alert/find", + "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/alert/get", + "alerting:xpack.synthetics.alerts.tls/observability/alert/find", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + ], + "read": Array [ + "login:", + "app:discover", + "app:kibana", + "ui:catalogue/discover", + "ui:navLinks/discover", + "ui:navLinks/kibana", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "saved_object:url/create", + "saved_object:url/bulk_create", + "saved_object:url/update", + "saved_object:url/bulk_update", + "saved_object:url/delete", + "saved_object:url/bulk_delete", + "saved_object:url/share_to_space", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", + "saved_object:search/bulk_get", + "saved_object:search/get", + "saved_object:search/find", + "saved_object:search/open_point_in_time", + "saved_object:search/close_point_in_time", + "saved_object:query/bulk_get", + "saved_object:query/get", + "saved_object:query/find", + "saved_object:query/open_point_in_time", + "saved_object:query/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "ui:discover/show", + "ui:discover/createShortUrl", + "api:rac", + "app:observability", + "ui:catalogue/observability", + "ui:navLinks/observability", + "ui:observability/read", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -6357,81 +7781,51 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.error_rate/observability/rule/getBackfill", "alerting:apm.error_rate/observability/rule/findBackfill", - "alerting:apm.error_rate/observability/rule/create", - "alerting:apm.error_rate/observability/rule/delete", - "alerting:apm.error_rate/observability/rule/update", - "alerting:apm.error_rate/observability/rule/updateApiKey", - "alerting:apm.error_rate/observability/rule/enable", - "alerting:apm.error_rate/observability/rule/disable", - "alerting:apm.error_rate/observability/rule/muteAll", - "alerting:apm.error_rate/observability/rule/unmuteAll", - "alerting:apm.error_rate/observability/rule/muteAlert", - "alerting:apm.error_rate/observability/rule/unmuteAlert", - "alerting:apm.error_rate/observability/rule/snooze", - "alerting:apm.error_rate/observability/rule/bulkEdit", - "alerting:apm.error_rate/observability/rule/bulkDelete", - "alerting:apm.error_rate/observability/rule/bulkEnable", - "alerting:apm.error_rate/observability/rule/bulkDisable", - "alerting:apm.error_rate/observability/rule/unsnooze", - "alerting:apm.error_rate/observability/rule/runSoon", - "alerting:apm.error_rate/observability/rule/scheduleBackfill", - "alerting:apm.error_rate/observability/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", - "alerting:apm.transaction_error_rate/observability/rule/getRuleState", - "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", - "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", - "alerting:apm.transaction_error_rate/observability/rule/find", - "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_error_rate/observability/rule/getBackfill", - "alerting:apm.transaction_error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_error_rate/observability/rule/create", - "alerting:apm.transaction_error_rate/observability/rule/delete", - "alerting:apm.transaction_error_rate/observability/rule/update", - "alerting:apm.transaction_error_rate/observability/rule/updateApiKey", - "alerting:apm.transaction_error_rate/observability/rule/enable", - "alerting:apm.transaction_error_rate/observability/rule/disable", - "alerting:apm.transaction_error_rate/observability/rule/muteAll", - "alerting:apm.transaction_error_rate/observability/rule/unmuteAll", - "alerting:apm.transaction_error_rate/observability/rule/muteAlert", - "alerting:apm.transaction_error_rate/observability/rule/unmuteAlert", - "alerting:apm.transaction_error_rate/observability/rule/snooze", - "alerting:apm.transaction_error_rate/observability/rule/bulkEdit", - "alerting:apm.transaction_error_rate/observability/rule/bulkDelete", - "alerting:apm.transaction_error_rate/observability/rule/bulkEnable", - "alerting:apm.transaction_error_rate/observability/rule/bulkDisable", - "alerting:apm.transaction_error_rate/observability/rule/unsnooze", - "alerting:apm.transaction_error_rate/observability/rule/runSoon", - "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", - "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", - "alerting:apm.transaction_duration/observability/rule/get", - "alerting:apm.transaction_duration/observability/rule/getRuleState", - "alerting:apm.transaction_duration/observability/rule/getAlertSummary", - "alerting:apm.transaction_duration/observability/rule/getExecutionLog", - "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", - "alerting:apm.transaction_duration/observability/rule/find", - "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", - "alerting:apm.transaction_duration/observability/rule/getBackfill", - "alerting:apm.transaction_duration/observability/rule/findBackfill", - "alerting:apm.transaction_duration/observability/rule/create", - "alerting:apm.transaction_duration/observability/rule/delete", - "alerting:apm.transaction_duration/observability/rule/update", - "alerting:apm.transaction_duration/observability/rule/updateApiKey", - "alerting:apm.transaction_duration/observability/rule/enable", - "alerting:apm.transaction_duration/observability/rule/disable", - "alerting:apm.transaction_duration/observability/rule/muteAll", - "alerting:apm.transaction_duration/observability/rule/unmuteAll", - "alerting:apm.transaction_duration/observability/rule/muteAlert", - "alerting:apm.transaction_duration/observability/rule/unmuteAlert", - "alerting:apm.transaction_duration/observability/rule/snooze", - "alerting:apm.transaction_duration/observability/rule/bulkEdit", - "alerting:apm.transaction_duration/observability/rule/bulkDelete", - "alerting:apm.transaction_duration/observability/rule/bulkEnable", - "alerting:apm.transaction_duration/observability/rule/bulkDisable", - "alerting:apm.transaction_duration/observability/rule/unsnooze", - "alerting:apm.transaction_duration/observability/rule/runSoon", - "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", - "alerting:apm.transaction_duration/observability/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/observability/rule/getRuleState", + "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/observability/rule/find", + "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/observability/rule/getBackfill", + "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/observability/rule/get", + "alerting:apm.transaction_duration/observability/rule/getRuleState", + "alerting:apm.transaction_duration/observability/rule/getAlertSummary", + "alerting:apm.transaction_duration/observability/rule/getExecutionLog", + "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", + "alerting:apm.transaction_duration/observability/rule/find", + "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/observability/rule/getBackfill", + "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -6441,25 +7835,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", "alerting:apm.anomaly/observability/rule/getBackfill", "alerting:apm.anomaly/observability/rule/findBackfill", - "alerting:apm.anomaly/observability/rule/create", - "alerting:apm.anomaly/observability/rule/delete", - "alerting:apm.anomaly/observability/rule/update", - "alerting:apm.anomaly/observability/rule/updateApiKey", - "alerting:apm.anomaly/observability/rule/enable", - "alerting:apm.anomaly/observability/rule/disable", - "alerting:apm.anomaly/observability/rule/muteAll", - "alerting:apm.anomaly/observability/rule/unmuteAll", - "alerting:apm.anomaly/observability/rule/muteAlert", - "alerting:apm.anomaly/observability/rule/unmuteAlert", - "alerting:apm.anomaly/observability/rule/snooze", - "alerting:apm.anomaly/observability/rule/bulkEdit", - "alerting:apm.anomaly/observability/rule/bulkDelete", - "alerting:apm.anomaly/observability/rule/bulkEnable", - "alerting:apm.anomaly/observability/rule/bulkDisable", - "alerting:apm.anomaly/observability/rule/unsnooze", - "alerting:apm.anomaly/observability/rule/runSoon", - "alerting:apm.anomaly/observability/rule/scheduleBackfill", - "alerting:apm.anomaly/observability/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", @@ -6469,25 +7853,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/create", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/delete", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/update", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/updateApiKey", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/enable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/disable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAll", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAll", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAlert", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAlert", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/snooze", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEdit", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDelete", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/get", "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", @@ -6497,82 +7871,1791 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/create", - "alerting:xpack.synthetics.alerts.tls/observability/rule/delete", - "alerting:xpack.synthetics.alerts.tls/observability/rule/update", - "alerting:xpack.synthetics.alerts.tls/observability/rule/updateApiKey", - "alerting:xpack.synthetics.alerts.tls/observability/rule/enable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/disable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAll", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAll", - "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAlert", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAlert", - "alerting:xpack.synthetics.alerts.tls/observability/rule/snooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:slo.rules.burnRate/observability/alert/update", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/update", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", - "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", - "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", - "alerting:apm.anomaly/observability/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/observability/alert/get", "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + ], + "store_search_session": Array [ + "login:", + "api:store_search_session", + "ui:management/kibana/search_sessions", + "saved_object:search-session/bulk_get", + "saved_object:search-session/get", + "saved_object:search-session/find", + "saved_object:search-session/open_point_in_time", + "saved_object:search-session/close_point_in_time", + "saved_object:search-session/create", + "saved_object:search-session/bulk_create", + "saved_object:search-session/update", + "saved_object:search-session/bulk_update", + "saved_object:search-session/delete", + "saved_object:search-session/bulk_delete", + "saved_object:search-session/share_to_space", + "ui:discover/storeSearchSession", + ], + "url_create": Array [ + "login:", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "saved_object:url/create", + "saved_object:url/bulk_create", + "saved_object:url/update", + "saved_object:url/bulk_update", + "saved_object:url/delete", + "saved_object:url/bulk_delete", + "saved_object:url/share_to_space", + "ui:discover/createShortUrl", + ], + }, + "fleetv2": Object { + "all": Array [ + "login:", + "api:fleet-read", + "api:fleet-all", + "app:fleet", + "ui:catalogue/fleet", + "ui:navLinks/fleet", + "saved_object:ingest-outputs/bulk_get", + "saved_object:ingest-outputs/get", + "saved_object:ingest-outputs/find", + "saved_object:ingest-outputs/open_point_in_time", + "saved_object:ingest-outputs/close_point_in_time", + "saved_object:ingest-outputs/create", + "saved_object:ingest-outputs/bulk_create", + "saved_object:ingest-outputs/update", + "saved_object:ingest-outputs/bulk_update", + "saved_object:ingest-outputs/delete", + "saved_object:ingest-outputs/bulk_delete", + "saved_object:ingest-outputs/share_to_space", + "saved_object:ingest-agent-policies/bulk_get", + "saved_object:ingest-agent-policies/get", + "saved_object:ingest-agent-policies/find", + "saved_object:ingest-agent-policies/open_point_in_time", + "saved_object:ingest-agent-policies/close_point_in_time", + "saved_object:ingest-agent-policies/create", + "saved_object:ingest-agent-policies/bulk_create", + "saved_object:ingest-agent-policies/update", + "saved_object:ingest-agent-policies/bulk_update", + "saved_object:ingest-agent-policies/delete", + "saved_object:ingest-agent-policies/bulk_delete", + "saved_object:ingest-agent-policies/share_to_space", + "saved_object:fleet-agent-policies/bulk_get", + "saved_object:fleet-agent-policies/get", + "saved_object:fleet-agent-policies/find", + "saved_object:fleet-agent-policies/open_point_in_time", + "saved_object:fleet-agent-policies/close_point_in_time", + "saved_object:fleet-agent-policies/create", + "saved_object:fleet-agent-policies/bulk_create", + "saved_object:fleet-agent-policies/update", + "saved_object:fleet-agent-policies/bulk_update", + "saved_object:fleet-agent-policies/delete", + "saved_object:fleet-agent-policies/bulk_delete", + "saved_object:fleet-agent-policies/share_to_space", + "saved_object:ingest-package-policies/bulk_get", + "saved_object:ingest-package-policies/get", + "saved_object:ingest-package-policies/find", + "saved_object:ingest-package-policies/open_point_in_time", + "saved_object:ingest-package-policies/close_point_in_time", + "saved_object:ingest-package-policies/create", + "saved_object:ingest-package-policies/bulk_create", + "saved_object:ingest-package-policies/update", + "saved_object:ingest-package-policies/bulk_update", + "saved_object:ingest-package-policies/delete", + "saved_object:ingest-package-policies/bulk_delete", + "saved_object:ingest-package-policies/share_to_space", + "saved_object:fleet-package-policies/bulk_get", + "saved_object:fleet-package-policies/get", + "saved_object:fleet-package-policies/find", + "saved_object:fleet-package-policies/open_point_in_time", + "saved_object:fleet-package-policies/close_point_in_time", + "saved_object:fleet-package-policies/create", + "saved_object:fleet-package-policies/bulk_create", + "saved_object:fleet-package-policies/update", + "saved_object:fleet-package-policies/bulk_update", + "saved_object:fleet-package-policies/delete", + "saved_object:fleet-package-policies/bulk_delete", + "saved_object:fleet-package-policies/share_to_space", + "saved_object:epm-packages/bulk_get", + "saved_object:epm-packages/get", + "saved_object:epm-packages/find", + "saved_object:epm-packages/open_point_in_time", + "saved_object:epm-packages/close_point_in_time", + "saved_object:epm-packages/create", + "saved_object:epm-packages/bulk_create", + "saved_object:epm-packages/update", + "saved_object:epm-packages/bulk_update", + "saved_object:epm-packages/delete", + "saved_object:epm-packages/bulk_delete", + "saved_object:epm-packages/share_to_space", + "saved_object:epm-packages-assets/bulk_get", + "saved_object:epm-packages-assets/get", + "saved_object:epm-packages-assets/find", + "saved_object:epm-packages-assets/open_point_in_time", + "saved_object:epm-packages-assets/close_point_in_time", + "saved_object:epm-packages-assets/create", + "saved_object:epm-packages-assets/bulk_create", + "saved_object:epm-packages-assets/update", + "saved_object:epm-packages-assets/bulk_update", + "saved_object:epm-packages-assets/delete", + "saved_object:epm-packages-assets/bulk_delete", + "saved_object:epm-packages-assets/share_to_space", + "saved_object:fleet-preconfiguration-deletion-record/bulk_get", + "saved_object:fleet-preconfiguration-deletion-record/get", + "saved_object:fleet-preconfiguration-deletion-record/find", + "saved_object:fleet-preconfiguration-deletion-record/open_point_in_time", + "saved_object:fleet-preconfiguration-deletion-record/close_point_in_time", + "saved_object:fleet-preconfiguration-deletion-record/create", + "saved_object:fleet-preconfiguration-deletion-record/bulk_create", + "saved_object:fleet-preconfiguration-deletion-record/update", + "saved_object:fleet-preconfiguration-deletion-record/bulk_update", + "saved_object:fleet-preconfiguration-deletion-record/delete", + "saved_object:fleet-preconfiguration-deletion-record/bulk_delete", + "saved_object:fleet-preconfiguration-deletion-record/share_to_space", + "saved_object:ingest-download-sources/bulk_get", + "saved_object:ingest-download-sources/get", + "saved_object:ingest-download-sources/find", + "saved_object:ingest-download-sources/open_point_in_time", + "saved_object:ingest-download-sources/close_point_in_time", + "saved_object:ingest-download-sources/create", + "saved_object:ingest-download-sources/bulk_create", + "saved_object:ingest-download-sources/update", + "saved_object:ingest-download-sources/bulk_update", + "saved_object:ingest-download-sources/delete", + "saved_object:ingest-download-sources/bulk_delete", + "saved_object:ingest-download-sources/share_to_space", + "saved_object:fleet-fleet-server-host/bulk_get", + "saved_object:fleet-fleet-server-host/get", + "saved_object:fleet-fleet-server-host/find", + "saved_object:fleet-fleet-server-host/open_point_in_time", + "saved_object:fleet-fleet-server-host/close_point_in_time", + "saved_object:fleet-fleet-server-host/create", + "saved_object:fleet-fleet-server-host/bulk_create", + "saved_object:fleet-fleet-server-host/update", + "saved_object:fleet-fleet-server-host/bulk_update", + "saved_object:fleet-fleet-server-host/delete", + "saved_object:fleet-fleet-server-host/bulk_delete", + "saved_object:fleet-fleet-server-host/share_to_space", + "saved_object:fleet-proxy/bulk_get", + "saved_object:fleet-proxy/get", + "saved_object:fleet-proxy/find", + "saved_object:fleet-proxy/open_point_in_time", + "saved_object:fleet-proxy/close_point_in_time", + "saved_object:fleet-proxy/create", + "saved_object:fleet-proxy/bulk_create", + "saved_object:fleet-proxy/update", + "saved_object:fleet-proxy/bulk_update", + "saved_object:fleet-proxy/delete", + "saved_object:fleet-proxy/bulk_delete", + "saved_object:fleet-proxy/share_to_space", + "saved_object:fleet-space-settings/bulk_get", + "saved_object:fleet-space-settings/get", + "saved_object:fleet-space-settings/find", + "saved_object:fleet-space-settings/open_point_in_time", + "saved_object:fleet-space-settings/close_point_in_time", + "saved_object:fleet-space-settings/create", + "saved_object:fleet-space-settings/bulk_create", + "saved_object:fleet-space-settings/update", + "saved_object:fleet-space-settings/bulk_update", + "saved_object:fleet-space-settings/delete", + "saved_object:fleet-space-settings/bulk_delete", + "saved_object:fleet-space-settings/share_to_space", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:fleetv2/read", + "ui:fleetv2/all", + "api:infra", + "api:rac", + "app:infra", + "app:logs", + "app:kibana", + "app:observability-logs-explorer", + "ui:catalogue/infralogging", + "ui:catalogue/logs", + "ui:management/insightsAndAlerting/triggersActions", + "ui:navLinks/infra", + "ui:navLinks/logs", + "ui:navLinks/kibana", + "ui:navLinks/observability-logs-explorer", + "saved_object:infrastructure-ui-source/bulk_get", + "saved_object:infrastructure-ui-source/get", + "saved_object:infrastructure-ui-source/find", + "saved_object:infrastructure-ui-source/open_point_in_time", + "saved_object:infrastructure-ui-source/close_point_in_time", + "saved_object:infrastructure-ui-source/create", + "saved_object:infrastructure-ui-source/bulk_create", + "saved_object:infrastructure-ui-source/update", + "saved_object:infrastructure-ui-source/bulk_update", + "saved_object:infrastructure-ui-source/delete", + "saved_object:infrastructure-ui-source/bulk_delete", + "saved_object:infrastructure-ui-source/share_to_space", + "saved_object:infrastructure-monitoring-log-view/bulk_get", + "saved_object:infrastructure-monitoring-log-view/get", + "saved_object:infrastructure-monitoring-log-view/find", + "saved_object:infrastructure-monitoring-log-view/open_point_in_time", + "saved_object:infrastructure-monitoring-log-view/close_point_in_time", + "saved_object:infrastructure-monitoring-log-view/create", + "saved_object:infrastructure-monitoring-log-view/bulk_create", + "saved_object:infrastructure-monitoring-log-view/update", + "saved_object:infrastructure-monitoring-log-view/bulk_update", + "saved_object:infrastructure-monitoring-log-view/delete", + "saved_object:infrastructure-monitoring-log-view/bulk_delete", + "saved_object:infrastructure-monitoring-log-view/share_to_space", + "ui:logs/show", + "ui:logs/configureSource", + "ui:logs/save", + "alerting:logs.alert.document.count/logs/rule/get", + "alerting:logs.alert.document.count/logs/rule/getRuleState", + "alerting:logs.alert.document.count/logs/rule/getAlertSummary", + "alerting:logs.alert.document.count/logs/rule/getExecutionLog", + "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", + "alerting:logs.alert.document.count/logs/rule/find", + "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/logs/rule/getBackfill", + "alerting:logs.alert.document.count/logs/rule/findBackfill", + "alerting:logs.alert.document.count/logs/rule/create", + "alerting:logs.alert.document.count/logs/rule/delete", + "alerting:logs.alert.document.count/logs/rule/update", + "alerting:logs.alert.document.count/logs/rule/updateApiKey", + "alerting:logs.alert.document.count/logs/rule/enable", + "alerting:logs.alert.document.count/logs/rule/disable", + "alerting:logs.alert.document.count/logs/rule/muteAll", + "alerting:logs.alert.document.count/logs/rule/unmuteAll", + "alerting:logs.alert.document.count/logs/rule/muteAlert", + "alerting:logs.alert.document.count/logs/rule/unmuteAlert", + "alerting:logs.alert.document.count/logs/rule/snooze", + "alerting:logs.alert.document.count/logs/rule/bulkEdit", + "alerting:logs.alert.document.count/logs/rule/bulkDelete", + "alerting:logs.alert.document.count/logs/rule/bulkEnable", + "alerting:logs.alert.document.count/logs/rule/bulkDisable", + "alerting:logs.alert.document.count/logs/rule/unsnooze", + "alerting:logs.alert.document.count/logs/rule/runSoon", + "alerting:logs.alert.document.count/logs/rule/scheduleBackfill", + "alerting:logs.alert.document.count/logs/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", + "alerting:.es-query/logs/rule/get", + "alerting:.es-query/logs/rule/getRuleState", + "alerting:.es-query/logs/rule/getAlertSummary", + "alerting:.es-query/logs/rule/getExecutionLog", + "alerting:.es-query/logs/rule/getActionErrorLog", + "alerting:.es-query/logs/rule/find", + "alerting:.es-query/logs/rule/getRuleExecutionKPI", + "alerting:.es-query/logs/rule/getBackfill", + "alerting:.es-query/logs/rule/findBackfill", + "alerting:.es-query/logs/rule/create", + "alerting:.es-query/logs/rule/delete", + "alerting:.es-query/logs/rule/update", + "alerting:.es-query/logs/rule/updateApiKey", + "alerting:.es-query/logs/rule/enable", + "alerting:.es-query/logs/rule/disable", + "alerting:.es-query/logs/rule/muteAll", + "alerting:.es-query/logs/rule/unmuteAll", + "alerting:.es-query/logs/rule/muteAlert", + "alerting:.es-query/logs/rule/unmuteAlert", + "alerting:.es-query/logs/rule/snooze", + "alerting:.es-query/logs/rule/bulkEdit", + "alerting:.es-query/logs/rule/bulkDelete", + "alerting:.es-query/logs/rule/bulkEnable", + "alerting:.es-query/logs/rule/bulkDisable", + "alerting:.es-query/logs/rule/unsnooze", + "alerting:.es-query/logs/rule/runSoon", + "alerting:.es-query/logs/rule/scheduleBackfill", + "alerting:.es-query/logs/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/get", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", + "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/logs/rule/find", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/create", + "alerting:observability.rules.custom_threshold/logs/rule/delete", + "alerting:observability.rules.custom_threshold/logs/rule/update", + "alerting:observability.rules.custom_threshold/logs/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/logs/rule/enable", + "alerting:observability.rules.custom_threshold/logs/rule/disable", + "alerting:observability.rules.custom_threshold/logs/rule/muteAll", + "alerting:observability.rules.custom_threshold/logs/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/logs/rule/muteAlert", + "alerting:observability.rules.custom_threshold/logs/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/logs/rule/snooze", + "alerting:observability.rules.custom_threshold/logs/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/logs/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/logs/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/logs/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/logs/rule/unsnooze", + "alerting:observability.rules.custom_threshold/logs/rule/runSoon", + "alerting:observability.rules.custom_threshold/logs/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", + "alerting:logs.alert.document.count/logs/alert/get", + "alerting:logs.alert.document.count/logs/alert/find", + "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/logs/alert/getAlertSummary", + "alerting:logs.alert.document.count/logs/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", + "alerting:.es-query/logs/alert/get", + "alerting:.es-query/logs/alert/find", + "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/logs/alert/getAlertSummary", + "alerting:.es-query/logs/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", + "alerting:observability.rules.custom_threshold/logs/alert/get", + "alerting:observability.rules.custom_threshold/logs/alert/find", + "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", + ], + "minimal_all": Array [ + "login:", + "api:fleet-read", + "api:fleet-all", + "app:fleet", + "ui:catalogue/fleet", + "ui:navLinks/fleet", + "saved_object:ingest-outputs/bulk_get", + "saved_object:ingest-outputs/get", + "saved_object:ingest-outputs/find", + "saved_object:ingest-outputs/open_point_in_time", + "saved_object:ingest-outputs/close_point_in_time", + "saved_object:ingest-outputs/create", + "saved_object:ingest-outputs/bulk_create", + "saved_object:ingest-outputs/update", + "saved_object:ingest-outputs/bulk_update", + "saved_object:ingest-outputs/delete", + "saved_object:ingest-outputs/bulk_delete", + "saved_object:ingest-outputs/share_to_space", + "saved_object:ingest-agent-policies/bulk_get", + "saved_object:ingest-agent-policies/get", + "saved_object:ingest-agent-policies/find", + "saved_object:ingest-agent-policies/open_point_in_time", + "saved_object:ingest-agent-policies/close_point_in_time", + "saved_object:ingest-agent-policies/create", + "saved_object:ingest-agent-policies/bulk_create", + "saved_object:ingest-agent-policies/update", + "saved_object:ingest-agent-policies/bulk_update", + "saved_object:ingest-agent-policies/delete", + "saved_object:ingest-agent-policies/bulk_delete", + "saved_object:ingest-agent-policies/share_to_space", + "saved_object:fleet-agent-policies/bulk_get", + "saved_object:fleet-agent-policies/get", + "saved_object:fleet-agent-policies/find", + "saved_object:fleet-agent-policies/open_point_in_time", + "saved_object:fleet-agent-policies/close_point_in_time", + "saved_object:fleet-agent-policies/create", + "saved_object:fleet-agent-policies/bulk_create", + "saved_object:fleet-agent-policies/update", + "saved_object:fleet-agent-policies/bulk_update", + "saved_object:fleet-agent-policies/delete", + "saved_object:fleet-agent-policies/bulk_delete", + "saved_object:fleet-agent-policies/share_to_space", + "saved_object:ingest-package-policies/bulk_get", + "saved_object:ingest-package-policies/get", + "saved_object:ingest-package-policies/find", + "saved_object:ingest-package-policies/open_point_in_time", + "saved_object:ingest-package-policies/close_point_in_time", + "saved_object:ingest-package-policies/create", + "saved_object:ingest-package-policies/bulk_create", + "saved_object:ingest-package-policies/update", + "saved_object:ingest-package-policies/bulk_update", + "saved_object:ingest-package-policies/delete", + "saved_object:ingest-package-policies/bulk_delete", + "saved_object:ingest-package-policies/share_to_space", + "saved_object:fleet-package-policies/bulk_get", + "saved_object:fleet-package-policies/get", + "saved_object:fleet-package-policies/find", + "saved_object:fleet-package-policies/open_point_in_time", + "saved_object:fleet-package-policies/close_point_in_time", + "saved_object:fleet-package-policies/create", + "saved_object:fleet-package-policies/bulk_create", + "saved_object:fleet-package-policies/update", + "saved_object:fleet-package-policies/bulk_update", + "saved_object:fleet-package-policies/delete", + "saved_object:fleet-package-policies/bulk_delete", + "saved_object:fleet-package-policies/share_to_space", + "saved_object:epm-packages/bulk_get", + "saved_object:epm-packages/get", + "saved_object:epm-packages/find", + "saved_object:epm-packages/open_point_in_time", + "saved_object:epm-packages/close_point_in_time", + "saved_object:epm-packages/create", + "saved_object:epm-packages/bulk_create", + "saved_object:epm-packages/update", + "saved_object:epm-packages/bulk_update", + "saved_object:epm-packages/delete", + "saved_object:epm-packages/bulk_delete", + "saved_object:epm-packages/share_to_space", + "saved_object:epm-packages-assets/bulk_get", + "saved_object:epm-packages-assets/get", + "saved_object:epm-packages-assets/find", + "saved_object:epm-packages-assets/open_point_in_time", + "saved_object:epm-packages-assets/close_point_in_time", + "saved_object:epm-packages-assets/create", + "saved_object:epm-packages-assets/bulk_create", + "saved_object:epm-packages-assets/update", + "saved_object:epm-packages-assets/bulk_update", + "saved_object:epm-packages-assets/delete", + "saved_object:epm-packages-assets/bulk_delete", + "saved_object:epm-packages-assets/share_to_space", + "saved_object:fleet-preconfiguration-deletion-record/bulk_get", + "saved_object:fleet-preconfiguration-deletion-record/get", + "saved_object:fleet-preconfiguration-deletion-record/find", + "saved_object:fleet-preconfiguration-deletion-record/open_point_in_time", + "saved_object:fleet-preconfiguration-deletion-record/close_point_in_time", + "saved_object:fleet-preconfiguration-deletion-record/create", + "saved_object:fleet-preconfiguration-deletion-record/bulk_create", + "saved_object:fleet-preconfiguration-deletion-record/update", + "saved_object:fleet-preconfiguration-deletion-record/bulk_update", + "saved_object:fleet-preconfiguration-deletion-record/delete", + "saved_object:fleet-preconfiguration-deletion-record/bulk_delete", + "saved_object:fleet-preconfiguration-deletion-record/share_to_space", + "saved_object:ingest-download-sources/bulk_get", + "saved_object:ingest-download-sources/get", + "saved_object:ingest-download-sources/find", + "saved_object:ingest-download-sources/open_point_in_time", + "saved_object:ingest-download-sources/close_point_in_time", + "saved_object:ingest-download-sources/create", + "saved_object:ingest-download-sources/bulk_create", + "saved_object:ingest-download-sources/update", + "saved_object:ingest-download-sources/bulk_update", + "saved_object:ingest-download-sources/delete", + "saved_object:ingest-download-sources/bulk_delete", + "saved_object:ingest-download-sources/share_to_space", + "saved_object:fleet-fleet-server-host/bulk_get", + "saved_object:fleet-fleet-server-host/get", + "saved_object:fleet-fleet-server-host/find", + "saved_object:fleet-fleet-server-host/open_point_in_time", + "saved_object:fleet-fleet-server-host/close_point_in_time", + "saved_object:fleet-fleet-server-host/create", + "saved_object:fleet-fleet-server-host/bulk_create", + "saved_object:fleet-fleet-server-host/update", + "saved_object:fleet-fleet-server-host/bulk_update", + "saved_object:fleet-fleet-server-host/delete", + "saved_object:fleet-fleet-server-host/bulk_delete", + "saved_object:fleet-fleet-server-host/share_to_space", + "saved_object:fleet-proxy/bulk_get", + "saved_object:fleet-proxy/get", + "saved_object:fleet-proxy/find", + "saved_object:fleet-proxy/open_point_in_time", + "saved_object:fleet-proxy/close_point_in_time", + "saved_object:fleet-proxy/create", + "saved_object:fleet-proxy/bulk_create", + "saved_object:fleet-proxy/update", + "saved_object:fleet-proxy/bulk_update", + "saved_object:fleet-proxy/delete", + "saved_object:fleet-proxy/bulk_delete", + "saved_object:fleet-proxy/share_to_space", + "saved_object:fleet-space-settings/bulk_get", + "saved_object:fleet-space-settings/get", + "saved_object:fleet-space-settings/find", + "saved_object:fleet-space-settings/open_point_in_time", + "saved_object:fleet-space-settings/close_point_in_time", + "saved_object:fleet-space-settings/create", + "saved_object:fleet-space-settings/bulk_create", + "saved_object:fleet-space-settings/update", + "saved_object:fleet-space-settings/bulk_update", + "saved_object:fleet-space-settings/delete", + "saved_object:fleet-space-settings/bulk_delete", + "saved_object:fleet-space-settings/share_to_space", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:fleetv2/read", + "ui:fleetv2/all", + "api:infra", + "api:rac", + "app:infra", + "app:logs", + "app:kibana", + "app:observability-logs-explorer", + "ui:catalogue/infralogging", + "ui:catalogue/logs", + "ui:management/insightsAndAlerting/triggersActions", + "ui:navLinks/infra", + "ui:navLinks/logs", + "ui:navLinks/kibana", + "ui:navLinks/observability-logs-explorer", + "saved_object:infrastructure-ui-source/bulk_get", + "saved_object:infrastructure-ui-source/get", + "saved_object:infrastructure-ui-source/find", + "saved_object:infrastructure-ui-source/open_point_in_time", + "saved_object:infrastructure-ui-source/close_point_in_time", + "saved_object:infrastructure-ui-source/create", + "saved_object:infrastructure-ui-source/bulk_create", + "saved_object:infrastructure-ui-source/update", + "saved_object:infrastructure-ui-source/bulk_update", + "saved_object:infrastructure-ui-source/delete", + "saved_object:infrastructure-ui-source/bulk_delete", + "saved_object:infrastructure-ui-source/share_to_space", + "saved_object:infrastructure-monitoring-log-view/bulk_get", + "saved_object:infrastructure-monitoring-log-view/get", + "saved_object:infrastructure-monitoring-log-view/find", + "saved_object:infrastructure-monitoring-log-view/open_point_in_time", + "saved_object:infrastructure-monitoring-log-view/close_point_in_time", + "saved_object:infrastructure-monitoring-log-view/create", + "saved_object:infrastructure-monitoring-log-view/bulk_create", + "saved_object:infrastructure-monitoring-log-view/update", + "saved_object:infrastructure-monitoring-log-view/bulk_update", + "saved_object:infrastructure-monitoring-log-view/delete", + "saved_object:infrastructure-monitoring-log-view/bulk_delete", + "saved_object:infrastructure-monitoring-log-view/share_to_space", + "ui:logs/show", + "ui:logs/configureSource", + "ui:logs/save", + "alerting:logs.alert.document.count/logs/rule/get", + "alerting:logs.alert.document.count/logs/rule/getRuleState", + "alerting:logs.alert.document.count/logs/rule/getAlertSummary", + "alerting:logs.alert.document.count/logs/rule/getExecutionLog", + "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", + "alerting:logs.alert.document.count/logs/rule/find", + "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/logs/rule/getBackfill", + "alerting:logs.alert.document.count/logs/rule/findBackfill", + "alerting:logs.alert.document.count/logs/rule/create", + "alerting:logs.alert.document.count/logs/rule/delete", + "alerting:logs.alert.document.count/logs/rule/update", + "alerting:logs.alert.document.count/logs/rule/updateApiKey", + "alerting:logs.alert.document.count/logs/rule/enable", + "alerting:logs.alert.document.count/logs/rule/disable", + "alerting:logs.alert.document.count/logs/rule/muteAll", + "alerting:logs.alert.document.count/logs/rule/unmuteAll", + "alerting:logs.alert.document.count/logs/rule/muteAlert", + "alerting:logs.alert.document.count/logs/rule/unmuteAlert", + "alerting:logs.alert.document.count/logs/rule/snooze", + "alerting:logs.alert.document.count/logs/rule/bulkEdit", + "alerting:logs.alert.document.count/logs/rule/bulkDelete", + "alerting:logs.alert.document.count/logs/rule/bulkEnable", + "alerting:logs.alert.document.count/logs/rule/bulkDisable", + "alerting:logs.alert.document.count/logs/rule/unsnooze", + "alerting:logs.alert.document.count/logs/rule/runSoon", + "alerting:logs.alert.document.count/logs/rule/scheduleBackfill", + "alerting:logs.alert.document.count/logs/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", + "alerting:.es-query/logs/rule/get", + "alerting:.es-query/logs/rule/getRuleState", + "alerting:.es-query/logs/rule/getAlertSummary", + "alerting:.es-query/logs/rule/getExecutionLog", + "alerting:.es-query/logs/rule/getActionErrorLog", + "alerting:.es-query/logs/rule/find", + "alerting:.es-query/logs/rule/getRuleExecutionKPI", + "alerting:.es-query/logs/rule/getBackfill", + "alerting:.es-query/logs/rule/findBackfill", + "alerting:.es-query/logs/rule/create", + "alerting:.es-query/logs/rule/delete", + "alerting:.es-query/logs/rule/update", + "alerting:.es-query/logs/rule/updateApiKey", + "alerting:.es-query/logs/rule/enable", + "alerting:.es-query/logs/rule/disable", + "alerting:.es-query/logs/rule/muteAll", + "alerting:.es-query/logs/rule/unmuteAll", + "alerting:.es-query/logs/rule/muteAlert", + "alerting:.es-query/logs/rule/unmuteAlert", + "alerting:.es-query/logs/rule/snooze", + "alerting:.es-query/logs/rule/bulkEdit", + "alerting:.es-query/logs/rule/bulkDelete", + "alerting:.es-query/logs/rule/bulkEnable", + "alerting:.es-query/logs/rule/bulkDisable", + "alerting:.es-query/logs/rule/unsnooze", + "alerting:.es-query/logs/rule/runSoon", + "alerting:.es-query/logs/rule/scheduleBackfill", + "alerting:.es-query/logs/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/get", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", + "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/logs/rule/find", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/create", + "alerting:observability.rules.custom_threshold/logs/rule/delete", + "alerting:observability.rules.custom_threshold/logs/rule/update", + "alerting:observability.rules.custom_threshold/logs/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/logs/rule/enable", + "alerting:observability.rules.custom_threshold/logs/rule/disable", + "alerting:observability.rules.custom_threshold/logs/rule/muteAll", + "alerting:observability.rules.custom_threshold/logs/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/logs/rule/muteAlert", + "alerting:observability.rules.custom_threshold/logs/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/logs/rule/snooze", + "alerting:observability.rules.custom_threshold/logs/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/logs/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/logs/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/logs/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/logs/rule/unsnooze", + "alerting:observability.rules.custom_threshold/logs/rule/runSoon", + "alerting:observability.rules.custom_threshold/logs/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", + "alerting:logs.alert.document.count/logs/alert/get", + "alerting:logs.alert.document.count/logs/alert/find", + "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/logs/alert/getAlertSummary", + "alerting:logs.alert.document.count/logs/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", + "alerting:.es-query/logs/alert/get", + "alerting:.es-query/logs/alert/find", + "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/logs/alert/getAlertSummary", + "alerting:.es-query/logs/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", + "alerting:observability.rules.custom_threshold/logs/alert/get", + "alerting:observability.rules.custom_threshold/logs/alert/find", + "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", + ], + "minimal_read": Array [ + "login:", + "api:fleet-read", + "app:fleet", + "ui:catalogue/fleet", + "ui:navLinks/fleet", + "saved_object:ingest-outputs/bulk_get", + "saved_object:ingest-outputs/get", + "saved_object:ingest-outputs/find", + "saved_object:ingest-outputs/open_point_in_time", + "saved_object:ingest-outputs/close_point_in_time", + "saved_object:ingest-agent-policies/bulk_get", + "saved_object:ingest-agent-policies/get", + "saved_object:ingest-agent-policies/find", + "saved_object:ingest-agent-policies/open_point_in_time", + "saved_object:ingest-agent-policies/close_point_in_time", + "saved_object:fleet-agent-policies/bulk_get", + "saved_object:fleet-agent-policies/get", + "saved_object:fleet-agent-policies/find", + "saved_object:fleet-agent-policies/open_point_in_time", + "saved_object:fleet-agent-policies/close_point_in_time", + "saved_object:ingest-package-policies/bulk_get", + "saved_object:ingest-package-policies/get", + "saved_object:ingest-package-policies/find", + "saved_object:ingest-package-policies/open_point_in_time", + "saved_object:ingest-package-policies/close_point_in_time", + "saved_object:fleet-package-policies/bulk_get", + "saved_object:fleet-package-policies/get", + "saved_object:fleet-package-policies/find", + "saved_object:fleet-package-policies/open_point_in_time", + "saved_object:fleet-package-policies/close_point_in_time", + "saved_object:epm-packages/bulk_get", + "saved_object:epm-packages/get", + "saved_object:epm-packages/find", + "saved_object:epm-packages/open_point_in_time", + "saved_object:epm-packages/close_point_in_time", + "saved_object:epm-packages-assets/bulk_get", + "saved_object:epm-packages-assets/get", + "saved_object:epm-packages-assets/find", + "saved_object:epm-packages-assets/open_point_in_time", + "saved_object:epm-packages-assets/close_point_in_time", + "saved_object:fleet-preconfiguration-deletion-record/bulk_get", + "saved_object:fleet-preconfiguration-deletion-record/get", + "saved_object:fleet-preconfiguration-deletion-record/find", + "saved_object:fleet-preconfiguration-deletion-record/open_point_in_time", + "saved_object:fleet-preconfiguration-deletion-record/close_point_in_time", + "saved_object:ingest-download-sources/bulk_get", + "saved_object:ingest-download-sources/get", + "saved_object:ingest-download-sources/find", + "saved_object:ingest-download-sources/open_point_in_time", + "saved_object:ingest-download-sources/close_point_in_time", + "saved_object:fleet-fleet-server-host/bulk_get", + "saved_object:fleet-fleet-server-host/get", + "saved_object:fleet-fleet-server-host/find", + "saved_object:fleet-fleet-server-host/open_point_in_time", + "saved_object:fleet-fleet-server-host/close_point_in_time", + "saved_object:fleet-proxy/bulk_get", + "saved_object:fleet-proxy/get", + "saved_object:fleet-proxy/find", + "saved_object:fleet-proxy/open_point_in_time", + "saved_object:fleet-proxy/close_point_in_time", + "saved_object:fleet-space-settings/bulk_get", + "saved_object:fleet-space-settings/get", + "saved_object:fleet-space-settings/find", + "saved_object:fleet-space-settings/open_point_in_time", + "saved_object:fleet-space-settings/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:fleetv2/read", + "api:infra", + "api:rac", + "app:infra", + "app:logs", + "app:kibana", + "app:observability-logs-explorer", + "ui:catalogue/infralogging", + "ui:catalogue/logs", + "ui:management/insightsAndAlerting/triggersActions", + "ui:navLinks/infra", + "ui:navLinks/logs", + "ui:navLinks/kibana", + "ui:navLinks/observability-logs-explorer", + "saved_object:infrastructure-ui-source/bulk_get", + "saved_object:infrastructure-ui-source/get", + "saved_object:infrastructure-ui-source/find", + "saved_object:infrastructure-ui-source/open_point_in_time", + "saved_object:infrastructure-ui-source/close_point_in_time", + "saved_object:infrastructure-monitoring-log-view/bulk_get", + "saved_object:infrastructure-monitoring-log-view/get", + "saved_object:infrastructure-monitoring-log-view/find", + "saved_object:infrastructure-monitoring-log-view/open_point_in_time", + "saved_object:infrastructure-monitoring-log-view/close_point_in_time", + "ui:logs/show", + "alerting:logs.alert.document.count/logs/rule/get", + "alerting:logs.alert.document.count/logs/rule/getRuleState", + "alerting:logs.alert.document.count/logs/rule/getAlertSummary", + "alerting:logs.alert.document.count/logs/rule/getExecutionLog", + "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", + "alerting:logs.alert.document.count/logs/rule/find", + "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/logs/rule/getBackfill", + "alerting:logs.alert.document.count/logs/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:.es-query/logs/rule/get", + "alerting:.es-query/logs/rule/getRuleState", + "alerting:.es-query/logs/rule/getAlertSummary", + "alerting:.es-query/logs/rule/getExecutionLog", + "alerting:.es-query/logs/rule/getActionErrorLog", + "alerting:.es-query/logs/rule/find", + "alerting:.es-query/logs/rule/getRuleExecutionKPI", + "alerting:.es-query/logs/rule/getBackfill", + "alerting:.es-query/logs/rule/findBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/get", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", + "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/logs/rule/find", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/logs/alert/get", + "alerting:logs.alert.document.count/logs/alert/find", + "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/logs/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:.es-query/logs/alert/get", + "alerting:.es-query/logs/alert/find", + "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/logs/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/alert/get", + "alerting:observability.rules.custom_threshold/logs/alert/find", + "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", ], - "minimal_read": Array [ + "read": Array [ + "login:", + "api:fleet-read", + "app:fleet", + "ui:catalogue/fleet", + "ui:navLinks/fleet", + "saved_object:ingest-outputs/bulk_get", + "saved_object:ingest-outputs/get", + "saved_object:ingest-outputs/find", + "saved_object:ingest-outputs/open_point_in_time", + "saved_object:ingest-outputs/close_point_in_time", + "saved_object:ingest-agent-policies/bulk_get", + "saved_object:ingest-agent-policies/get", + "saved_object:ingest-agent-policies/find", + "saved_object:ingest-agent-policies/open_point_in_time", + "saved_object:ingest-agent-policies/close_point_in_time", + "saved_object:fleet-agent-policies/bulk_get", + "saved_object:fleet-agent-policies/get", + "saved_object:fleet-agent-policies/find", + "saved_object:fleet-agent-policies/open_point_in_time", + "saved_object:fleet-agent-policies/close_point_in_time", + "saved_object:ingest-package-policies/bulk_get", + "saved_object:ingest-package-policies/get", + "saved_object:ingest-package-policies/find", + "saved_object:ingest-package-policies/open_point_in_time", + "saved_object:ingest-package-policies/close_point_in_time", + "saved_object:fleet-package-policies/bulk_get", + "saved_object:fleet-package-policies/get", + "saved_object:fleet-package-policies/find", + "saved_object:fleet-package-policies/open_point_in_time", + "saved_object:fleet-package-policies/close_point_in_time", + "saved_object:epm-packages/bulk_get", + "saved_object:epm-packages/get", + "saved_object:epm-packages/find", + "saved_object:epm-packages/open_point_in_time", + "saved_object:epm-packages/close_point_in_time", + "saved_object:epm-packages-assets/bulk_get", + "saved_object:epm-packages-assets/get", + "saved_object:epm-packages-assets/find", + "saved_object:epm-packages-assets/open_point_in_time", + "saved_object:epm-packages-assets/close_point_in_time", + "saved_object:fleet-preconfiguration-deletion-record/bulk_get", + "saved_object:fleet-preconfiguration-deletion-record/get", + "saved_object:fleet-preconfiguration-deletion-record/find", + "saved_object:fleet-preconfiguration-deletion-record/open_point_in_time", + "saved_object:fleet-preconfiguration-deletion-record/close_point_in_time", + "saved_object:ingest-download-sources/bulk_get", + "saved_object:ingest-download-sources/get", + "saved_object:ingest-download-sources/find", + "saved_object:ingest-download-sources/open_point_in_time", + "saved_object:ingest-download-sources/close_point_in_time", + "saved_object:fleet-fleet-server-host/bulk_get", + "saved_object:fleet-fleet-server-host/get", + "saved_object:fleet-fleet-server-host/find", + "saved_object:fleet-fleet-server-host/open_point_in_time", + "saved_object:fleet-fleet-server-host/close_point_in_time", + "saved_object:fleet-proxy/bulk_get", + "saved_object:fleet-proxy/get", + "saved_object:fleet-proxy/find", + "saved_object:fleet-proxy/open_point_in_time", + "saved_object:fleet-proxy/close_point_in_time", + "saved_object:fleet-space-settings/bulk_get", + "saved_object:fleet-space-settings/get", + "saved_object:fleet-space-settings/find", + "saved_object:fleet-space-settings/open_point_in_time", + "saved_object:fleet-space-settings/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:fleetv2/read", + "api:infra", + "api:rac", + "app:infra", + "app:logs", + "app:kibana", + "app:observability-logs-explorer", + "ui:catalogue/infralogging", + "ui:catalogue/logs", + "ui:management/insightsAndAlerting/triggersActions", + "ui:navLinks/infra", + "ui:navLinks/logs", + "ui:navLinks/kibana", + "ui:navLinks/observability-logs-explorer", + "saved_object:infrastructure-ui-source/bulk_get", + "saved_object:infrastructure-ui-source/get", + "saved_object:infrastructure-ui-source/find", + "saved_object:infrastructure-ui-source/open_point_in_time", + "saved_object:infrastructure-ui-source/close_point_in_time", + "saved_object:infrastructure-monitoring-log-view/bulk_get", + "saved_object:infrastructure-monitoring-log-view/get", + "saved_object:infrastructure-monitoring-log-view/find", + "saved_object:infrastructure-monitoring-log-view/open_point_in_time", + "saved_object:infrastructure-monitoring-log-view/close_point_in_time", + "ui:logs/show", + "alerting:logs.alert.document.count/logs/rule/get", + "alerting:logs.alert.document.count/logs/rule/getRuleState", + "alerting:logs.alert.document.count/logs/rule/getAlertSummary", + "alerting:logs.alert.document.count/logs/rule/getExecutionLog", + "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", + "alerting:logs.alert.document.count/logs/rule/find", + "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/logs/rule/getBackfill", + "alerting:logs.alert.document.count/logs/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:.es-query/logs/rule/get", + "alerting:.es-query/logs/rule/getRuleState", + "alerting:.es-query/logs/rule/getAlertSummary", + "alerting:.es-query/logs/rule/getExecutionLog", + "alerting:.es-query/logs/rule/getActionErrorLog", + "alerting:.es-query/logs/rule/find", + "alerting:.es-query/logs/rule/getRuleExecutionKPI", + "alerting:.es-query/logs/rule/getBackfill", + "alerting:.es-query/logs/rule/findBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/get", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", + "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/logs/rule/find", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/logs/alert/get", + "alerting:logs.alert.document.count/logs/alert/find", + "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/logs/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:.es-query/logs/alert/get", + "alerting:.es-query/logs/alert/find", + "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/logs/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/alert/get", + "alerting:observability.rules.custom_threshold/logs/alert/find", + "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + ], + }, + "infrastructure": Object { + "all": Array [ "login:", "api:infra", "api:rac", @@ -6590,16 +9673,42 @@ export default function ({ getService }: FtrProviderContext) { "saved_object:infrastructure-ui-source/find", "saved_object:infrastructure-ui-source/open_point_in_time", "saved_object:infrastructure-ui-source/close_point_in_time", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", + "saved_object:infrastructure-ui-source/create", + "saved_object:infrastructure-ui-source/bulk_create", + "saved_object:infrastructure-ui-source/update", + "saved_object:infrastructure-ui-source/bulk_update", + "saved_object:infrastructure-ui-source/delete", + "saved_object:infrastructure-ui-source/bulk_delete", + "saved_object:infrastructure-ui-source/share_to_space", "saved_object:metrics-data-source/bulk_get", "saved_object:metrics-data-source/get", "saved_object:metrics-data-source/find", "saved_object:metrics-data-source/open_point_in_time", "saved_object:metrics-data-source/close_point_in_time", + "saved_object:metrics-data-source/create", + "saved_object:metrics-data-source/bulk_create", + "saved_object:metrics-data-source/update", + "saved_object:metrics-data-source/bulk_update", + "saved_object:metrics-data-source/delete", + "saved_object:metrics-data-source/bulk_delete", + "saved_object:metrics-data-source/share_to_space", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", "saved_object:config/bulk_get", "saved_object:config/get", "saved_object:config/find", @@ -6610,17 +9719,14 @@ export default function ({ getService }: FtrProviderContext) { "saved_object:config-global/find", "saved_object:config-global/open_point_in_time", "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", "saved_object:url/bulk_get", "saved_object:url/get", "saved_object:url/find", "saved_object:url/open_point_in_time", "saved_object:url/close_point_in_time", "ui:infrastructure/show", + "ui:infrastructure/configureSource", + "ui:infrastructure/save", "alerting:metrics.alert.threshold/infrastructure/rule/get", "alerting:metrics.alert.threshold/infrastructure/rule/getRuleState", "alerting:metrics.alert.threshold/infrastructure/rule/getAlertSummary", @@ -6630,6 +9736,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:metrics.alert.threshold/infrastructure/rule/getRuleExecutionKPI", "alerting:metrics.alert.threshold/infrastructure/rule/getBackfill", "alerting:metrics.alert.threshold/infrastructure/rule/findBackfill", + "alerting:metrics.alert.threshold/infrastructure/rule/create", + "alerting:metrics.alert.threshold/infrastructure/rule/delete", + "alerting:metrics.alert.threshold/infrastructure/rule/update", + "alerting:metrics.alert.threshold/infrastructure/rule/updateApiKey", + "alerting:metrics.alert.threshold/infrastructure/rule/enable", + "alerting:metrics.alert.threshold/infrastructure/rule/disable", + "alerting:metrics.alert.threshold/infrastructure/rule/muteAll", + "alerting:metrics.alert.threshold/infrastructure/rule/unmuteAll", + "alerting:metrics.alert.threshold/infrastructure/rule/muteAlert", + "alerting:metrics.alert.threshold/infrastructure/rule/unmuteAlert", + "alerting:metrics.alert.threshold/infrastructure/rule/snooze", + "alerting:metrics.alert.threshold/infrastructure/rule/bulkEdit", + "alerting:metrics.alert.threshold/infrastructure/rule/bulkDelete", + "alerting:metrics.alert.threshold/infrastructure/rule/bulkEnable", + "alerting:metrics.alert.threshold/infrastructure/rule/bulkDisable", + "alerting:metrics.alert.threshold/infrastructure/rule/unsnooze", + "alerting:metrics.alert.threshold/infrastructure/rule/runSoon", + "alerting:metrics.alert.threshold/infrastructure/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/infrastructure/rule/deleteBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/create", + "alerting:metrics.alert.threshold/alerts/rule/delete", + "alerting:metrics.alert.threshold/alerts/rule/update", + "alerting:metrics.alert.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.threshold/alerts/rule/enable", + "alerting:metrics.alert.threshold/alerts/rule/disable", + "alerting:metrics.alert.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.threshold/alerts/rule/snooze", + "alerting:metrics.alert.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/alerts/rule/deleteBackfill", "alerting:metrics.alert.inventory.threshold/infrastructure/rule/get", "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleState", "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getAlertSummary", @@ -6639,6 +9792,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleExecutionKPI", "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getBackfill", "alerting:metrics.alert.inventory.threshold/infrastructure/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/create", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/delete", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/update", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/enable", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/disable", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/snooze", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/create", + "alerting:metrics.alert.inventory.threshold/alerts/rule/delete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/update", + "alerting:metrics.alert.inventory.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/alerts/rule/enable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/disable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/snooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/deleteBackfill", "alerting:.es-query/infrastructure/rule/get", "alerting:.es-query/infrastructure/rule/getRuleState", "alerting:.es-query/infrastructure/rule/getAlertSummary", @@ -6648,6 +9848,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/infrastructure/rule/getRuleExecutionKPI", "alerting:.es-query/infrastructure/rule/getBackfill", "alerting:.es-query/infrastructure/rule/findBackfill", + "alerting:.es-query/infrastructure/rule/create", + "alerting:.es-query/infrastructure/rule/delete", + "alerting:.es-query/infrastructure/rule/update", + "alerting:.es-query/infrastructure/rule/updateApiKey", + "alerting:.es-query/infrastructure/rule/enable", + "alerting:.es-query/infrastructure/rule/disable", + "alerting:.es-query/infrastructure/rule/muteAll", + "alerting:.es-query/infrastructure/rule/unmuteAll", + "alerting:.es-query/infrastructure/rule/muteAlert", + "alerting:.es-query/infrastructure/rule/unmuteAlert", + "alerting:.es-query/infrastructure/rule/snooze", + "alerting:.es-query/infrastructure/rule/bulkEdit", + "alerting:.es-query/infrastructure/rule/bulkDelete", + "alerting:.es-query/infrastructure/rule/bulkEnable", + "alerting:.es-query/infrastructure/rule/bulkDisable", + "alerting:.es-query/infrastructure/rule/unsnooze", + "alerting:.es-query/infrastructure/rule/runSoon", + "alerting:.es-query/infrastructure/rule/scheduleBackfill", + "alerting:.es-query/infrastructure/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", "alerting:observability.rules.custom_threshold/infrastructure/rule/get", "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleState", "alerting:observability.rules.custom_threshold/infrastructure/rule/getAlertSummary", @@ -6657,6 +9904,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleExecutionKPI", "alerting:observability.rules.custom_threshold/infrastructure/rule/getBackfill", "alerting:observability.rules.custom_threshold/infrastructure/rule/findBackfill", + "alerting:observability.rules.custom_threshold/infrastructure/rule/create", + "alerting:observability.rules.custom_threshold/infrastructure/rule/delete", + "alerting:observability.rules.custom_threshold/infrastructure/rule/update", + "alerting:observability.rules.custom_threshold/infrastructure/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/infrastructure/rule/enable", + "alerting:observability.rules.custom_threshold/infrastructure/rule/disable", + "alerting:observability.rules.custom_threshold/infrastructure/rule/muteAll", + "alerting:observability.rules.custom_threshold/infrastructure/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/infrastructure/rule/muteAlert", + "alerting:observability.rules.custom_threshold/infrastructure/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/infrastructure/rule/snooze", + "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/infrastructure/rule/unsnooze", + "alerting:observability.rules.custom_threshold/infrastructure/rule/runSoon", + "alerting:observability.rules.custom_threshold/infrastructure/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/infrastructure/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/get", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getAlertSummary", @@ -6666,26 +9960,103 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleExecutionKPI", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getBackfill", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", "alerting:metrics.alert.threshold/infrastructure/alert/get", "alerting:metrics.alert.threshold/infrastructure/alert/find", "alerting:metrics.alert.threshold/infrastructure/alert/getAuthorizedAlertsIndices", "alerting:metrics.alert.threshold/infrastructure/alert/getAlertSummary", + "alerting:metrics.alert.threshold/infrastructure/alert/update", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/update", "alerting:metrics.alert.inventory.threshold/infrastructure/alert/get", "alerting:metrics.alert.inventory.threshold/infrastructure/alert/find", "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAuthorizedAlertsIndices", "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/infrastructure/alert/update", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/update", "alerting:.es-query/infrastructure/alert/get", "alerting:.es-query/infrastructure/alert/find", "alerting:.es-query/infrastructure/alert/getAuthorizedAlertsIndices", "alerting:.es-query/infrastructure/alert/getAlertSummary", + "alerting:.es-query/infrastructure/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", "alerting:observability.rules.custom_threshold/infrastructure/alert/get", "alerting:observability.rules.custom_threshold/infrastructure/alert/find", "alerting:observability.rules.custom_threshold/infrastructure/alert/getAuthorizedAlertsIndices", "alerting:observability.rules.custom_threshold/infrastructure/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/infrastructure/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/get", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/find", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAuthorizedAlertsIndices", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", "app:logs", "app:observability-logs-explorer", "ui:catalogue/infralogging", @@ -6697,7 +10068,16 @@ export default function ({ getService }: FtrProviderContext) { "saved_object:infrastructure-monitoring-log-view/find", "saved_object:infrastructure-monitoring-log-view/open_point_in_time", "saved_object:infrastructure-monitoring-log-view/close_point_in_time", + "saved_object:infrastructure-monitoring-log-view/create", + "saved_object:infrastructure-monitoring-log-view/bulk_create", + "saved_object:infrastructure-monitoring-log-view/update", + "saved_object:infrastructure-monitoring-log-view/bulk_update", + "saved_object:infrastructure-monitoring-log-view/delete", + "saved_object:infrastructure-monitoring-log-view/bulk_delete", + "saved_object:infrastructure-monitoring-log-view/share_to_space", "ui:logs/show", + "ui:logs/configureSource", + "ui:logs/save", "alerting:logs.alert.document.count/logs/rule/get", "alerting:logs.alert.document.count/logs/rule/getRuleState", "alerting:logs.alert.document.count/logs/rule/getAlertSummary", @@ -6707,6 +10087,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", "alerting:logs.alert.document.count/logs/rule/getBackfill", "alerting:logs.alert.document.count/logs/rule/findBackfill", + "alerting:logs.alert.document.count/logs/rule/create", + "alerting:logs.alert.document.count/logs/rule/delete", + "alerting:logs.alert.document.count/logs/rule/update", + "alerting:logs.alert.document.count/logs/rule/updateApiKey", + "alerting:logs.alert.document.count/logs/rule/enable", + "alerting:logs.alert.document.count/logs/rule/disable", + "alerting:logs.alert.document.count/logs/rule/muteAll", + "alerting:logs.alert.document.count/logs/rule/unmuteAll", + "alerting:logs.alert.document.count/logs/rule/muteAlert", + "alerting:logs.alert.document.count/logs/rule/unmuteAlert", + "alerting:logs.alert.document.count/logs/rule/snooze", + "alerting:logs.alert.document.count/logs/rule/bulkEdit", + "alerting:logs.alert.document.count/logs/rule/bulkDelete", + "alerting:logs.alert.document.count/logs/rule/bulkEnable", + "alerting:logs.alert.document.count/logs/rule/bulkDisable", + "alerting:logs.alert.document.count/logs/rule/unsnooze", + "alerting:logs.alert.document.count/logs/rule/runSoon", + "alerting:logs.alert.document.count/logs/rule/scheduleBackfill", + "alerting:logs.alert.document.count/logs/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", "alerting:.es-query/logs/rule/get", "alerting:.es-query/logs/rule/getRuleState", "alerting:.es-query/logs/rule/getAlertSummary", @@ -6716,6 +10143,25 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/logs/rule/getRuleExecutionKPI", "alerting:.es-query/logs/rule/getBackfill", "alerting:.es-query/logs/rule/findBackfill", + "alerting:.es-query/logs/rule/create", + "alerting:.es-query/logs/rule/delete", + "alerting:.es-query/logs/rule/update", + "alerting:.es-query/logs/rule/updateApiKey", + "alerting:.es-query/logs/rule/enable", + "alerting:.es-query/logs/rule/disable", + "alerting:.es-query/logs/rule/muteAll", + "alerting:.es-query/logs/rule/unmuteAll", + "alerting:.es-query/logs/rule/muteAlert", + "alerting:.es-query/logs/rule/unmuteAlert", + "alerting:.es-query/logs/rule/snooze", + "alerting:.es-query/logs/rule/bulkEdit", + "alerting:.es-query/logs/rule/bulkDelete", + "alerting:.es-query/logs/rule/bulkEnable", + "alerting:.es-query/logs/rule/bulkDisable", + "alerting:.es-query/logs/rule/unsnooze", + "alerting:.es-query/logs/rule/runSoon", + "alerting:.es-query/logs/rule/scheduleBackfill", + "alerting:.es-query/logs/rule/deleteBackfill", "alerting:observability.rules.custom_threshold/logs/rule/get", "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", @@ -6725,6 +10171,25 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/create", + "alerting:observability.rules.custom_threshold/logs/rule/delete", + "alerting:observability.rules.custom_threshold/logs/rule/update", + "alerting:observability.rules.custom_threshold/logs/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/logs/rule/enable", + "alerting:observability.rules.custom_threshold/logs/rule/disable", + "alerting:observability.rules.custom_threshold/logs/rule/muteAll", + "alerting:observability.rules.custom_threshold/logs/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/logs/rule/muteAlert", + "alerting:observability.rules.custom_threshold/logs/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/logs/rule/snooze", + "alerting:observability.rules.custom_threshold/logs/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/logs/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/logs/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/logs/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/logs/rule/unsnooze", + "alerting:observability.rules.custom_threshold/logs/rule/runSoon", + "alerting:observability.rules.custom_threshold/logs/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/deleteBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", @@ -6734,71 +10199,55 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/deleteBackfill", "alerting:logs.alert.document.count/logs/alert/get", "alerting:logs.alert.document.count/logs/alert/find", "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", "alerting:logs.alert.document.count/logs/alert/getAlertSummary", + "alerting:logs.alert.document.count/logs/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", "alerting:.es-query/logs/alert/get", "alerting:.es-query/logs/alert/find", "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", "alerting:.es-query/logs/alert/getAlertSummary", + "alerting:.es-query/logs/alert/update", "alerting:observability.rules.custom_threshold/logs/alert/get", "alerting:observability.rules.custom_threshold/logs/alert/find", "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/alert/update", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/update", "app:observability", "ui:catalogue/observability", "ui:navLinks/observability", "ui:observability/read", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "ui:observability/write", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -6808,6 +10257,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.error_rate/observability/rule/getBackfill", "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/observability/rule/create", + "alerting:apm.error_rate/observability/rule/delete", + "alerting:apm.error_rate/observability/rule/update", + "alerting:apm.error_rate/observability/rule/updateApiKey", + "alerting:apm.error_rate/observability/rule/enable", + "alerting:apm.error_rate/observability/rule/disable", + "alerting:apm.error_rate/observability/rule/muteAll", + "alerting:apm.error_rate/observability/rule/unmuteAll", + "alerting:apm.error_rate/observability/rule/muteAlert", + "alerting:apm.error_rate/observability/rule/unmuteAlert", + "alerting:apm.error_rate/observability/rule/snooze", + "alerting:apm.error_rate/observability/rule/bulkEdit", + "alerting:apm.error_rate/observability/rule/bulkDelete", + "alerting:apm.error_rate/observability/rule/bulkEnable", + "alerting:apm.error_rate/observability/rule/bulkDisable", + "alerting:apm.error_rate/observability/rule/unsnooze", + "alerting:apm.error_rate/observability/rule/runSoon", + "alerting:apm.error_rate/observability/rule/scheduleBackfill", + "alerting:apm.error_rate/observability/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/create", + "alerting:apm.error_rate/alerts/rule/delete", + "alerting:apm.error_rate/alerts/rule/update", + "alerting:apm.error_rate/alerts/rule/updateApiKey", + "alerting:apm.error_rate/alerts/rule/enable", + "alerting:apm.error_rate/alerts/rule/disable", + "alerting:apm.error_rate/alerts/rule/muteAll", + "alerting:apm.error_rate/alerts/rule/unmuteAll", + "alerting:apm.error_rate/alerts/rule/muteAlert", + "alerting:apm.error_rate/alerts/rule/unmuteAlert", + "alerting:apm.error_rate/alerts/rule/snooze", + "alerting:apm.error_rate/alerts/rule/bulkEdit", + "alerting:apm.error_rate/alerts/rule/bulkDelete", + "alerting:apm.error_rate/alerts/rule/bulkEnable", + "alerting:apm.error_rate/alerts/rule/bulkDisable", + "alerting:apm.error_rate/alerts/rule/unsnooze", + "alerting:apm.error_rate/alerts/rule/runSoon", + "alerting:apm.error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", "alerting:apm.transaction_error_rate/observability/rule/getRuleState", "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", @@ -6817,6 +10313,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_error_rate/observability/rule/getBackfill", "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/observability/rule/create", + "alerting:apm.transaction_error_rate/observability/rule/delete", + "alerting:apm.transaction_error_rate/observability/rule/update", + "alerting:apm.transaction_error_rate/observability/rule/updateApiKey", + "alerting:apm.transaction_error_rate/observability/rule/enable", + "alerting:apm.transaction_error_rate/observability/rule/disable", + "alerting:apm.transaction_error_rate/observability/rule/muteAll", + "alerting:apm.transaction_error_rate/observability/rule/unmuteAll", + "alerting:apm.transaction_error_rate/observability/rule/muteAlert", + "alerting:apm.transaction_error_rate/observability/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/observability/rule/snooze", + "alerting:apm.transaction_error_rate/observability/rule/bulkEdit", + "alerting:apm.transaction_error_rate/observability/rule/bulkDelete", + "alerting:apm.transaction_error_rate/observability/rule/bulkEnable", + "alerting:apm.transaction_error_rate/observability/rule/bulkDisable", + "alerting:apm.transaction_error_rate/observability/rule/unsnooze", + "alerting:apm.transaction_error_rate/observability/rule/runSoon", + "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/create", + "alerting:apm.transaction_error_rate/alerts/rule/delete", + "alerting:apm.transaction_error_rate/alerts/rule/update", + "alerting:apm.transaction_error_rate/alerts/rule/updateApiKey", + "alerting:apm.transaction_error_rate/alerts/rule/enable", + "alerting:apm.transaction_error_rate/alerts/rule/disable", + "alerting:apm.transaction_error_rate/alerts/rule/muteAll", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAll", + "alerting:apm.transaction_error_rate/alerts/rule/muteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/snooze", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEdit", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDelete", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEnable", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDisable", + "alerting:apm.transaction_error_rate/alerts/rule/unsnooze", + "alerting:apm.transaction_error_rate/alerts/rule/runSoon", + "alerting:apm.transaction_error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_duration/observability/rule/get", "alerting:apm.transaction_duration/observability/rule/getRuleState", "alerting:apm.transaction_duration/observability/rule/getAlertSummary", @@ -6826,6 +10369,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_duration/observability/rule/getBackfill", "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/observability/rule/create", + "alerting:apm.transaction_duration/observability/rule/delete", + "alerting:apm.transaction_duration/observability/rule/update", + "alerting:apm.transaction_duration/observability/rule/updateApiKey", + "alerting:apm.transaction_duration/observability/rule/enable", + "alerting:apm.transaction_duration/observability/rule/disable", + "alerting:apm.transaction_duration/observability/rule/muteAll", + "alerting:apm.transaction_duration/observability/rule/unmuteAll", + "alerting:apm.transaction_duration/observability/rule/muteAlert", + "alerting:apm.transaction_duration/observability/rule/unmuteAlert", + "alerting:apm.transaction_duration/observability/rule/snooze", + "alerting:apm.transaction_duration/observability/rule/bulkEdit", + "alerting:apm.transaction_duration/observability/rule/bulkDelete", + "alerting:apm.transaction_duration/observability/rule/bulkEnable", + "alerting:apm.transaction_duration/observability/rule/bulkDisable", + "alerting:apm.transaction_duration/observability/rule/unsnooze", + "alerting:apm.transaction_duration/observability/rule/runSoon", + "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", + "alerting:apm.transaction_duration/observability/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/create", + "alerting:apm.transaction_duration/alerts/rule/delete", + "alerting:apm.transaction_duration/alerts/rule/update", + "alerting:apm.transaction_duration/alerts/rule/updateApiKey", + "alerting:apm.transaction_duration/alerts/rule/enable", + "alerting:apm.transaction_duration/alerts/rule/disable", + "alerting:apm.transaction_duration/alerts/rule/muteAll", + "alerting:apm.transaction_duration/alerts/rule/unmuteAll", + "alerting:apm.transaction_duration/alerts/rule/muteAlert", + "alerting:apm.transaction_duration/alerts/rule/unmuteAlert", + "alerting:apm.transaction_duration/alerts/rule/snooze", + "alerting:apm.transaction_duration/alerts/rule/bulkEdit", + "alerting:apm.transaction_duration/alerts/rule/bulkDelete", + "alerting:apm.transaction_duration/alerts/rule/bulkEnable", + "alerting:apm.transaction_duration/alerts/rule/bulkDisable", + "alerting:apm.transaction_duration/alerts/rule/unsnooze", + "alerting:apm.transaction_duration/alerts/rule/runSoon", + "alerting:apm.transaction_duration/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_duration/alerts/rule/deleteBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -6835,6 +10425,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", "alerting:apm.anomaly/observability/rule/getBackfill", "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/observability/rule/create", + "alerting:apm.anomaly/observability/rule/delete", + "alerting:apm.anomaly/observability/rule/update", + "alerting:apm.anomaly/observability/rule/updateApiKey", + "alerting:apm.anomaly/observability/rule/enable", + "alerting:apm.anomaly/observability/rule/disable", + "alerting:apm.anomaly/observability/rule/muteAll", + "alerting:apm.anomaly/observability/rule/unmuteAll", + "alerting:apm.anomaly/observability/rule/muteAlert", + "alerting:apm.anomaly/observability/rule/unmuteAlert", + "alerting:apm.anomaly/observability/rule/snooze", + "alerting:apm.anomaly/observability/rule/bulkEdit", + "alerting:apm.anomaly/observability/rule/bulkDelete", + "alerting:apm.anomaly/observability/rule/bulkEnable", + "alerting:apm.anomaly/observability/rule/bulkDisable", + "alerting:apm.anomaly/observability/rule/unsnooze", + "alerting:apm.anomaly/observability/rule/runSoon", + "alerting:apm.anomaly/observability/rule/scheduleBackfill", + "alerting:apm.anomaly/observability/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/create", + "alerting:apm.anomaly/alerts/rule/delete", + "alerting:apm.anomaly/alerts/rule/update", + "alerting:apm.anomaly/alerts/rule/updateApiKey", + "alerting:apm.anomaly/alerts/rule/enable", + "alerting:apm.anomaly/alerts/rule/disable", + "alerting:apm.anomaly/alerts/rule/muteAll", + "alerting:apm.anomaly/alerts/rule/unmuteAll", + "alerting:apm.anomaly/alerts/rule/muteAlert", + "alerting:apm.anomaly/alerts/rule/unmuteAlert", + "alerting:apm.anomaly/alerts/rule/snooze", + "alerting:apm.anomaly/alerts/rule/bulkEdit", + "alerting:apm.anomaly/alerts/rule/bulkDelete", + "alerting:apm.anomaly/alerts/rule/bulkEnable", + "alerting:apm.anomaly/alerts/rule/bulkDisable", + "alerting:apm.anomaly/alerts/rule/unsnooze", + "alerting:apm.anomaly/alerts/rule/runSoon", + "alerting:apm.anomaly/alerts/rule/scheduleBackfill", + "alerting:apm.anomaly/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", @@ -6844,6 +10481,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/get", "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", @@ -6853,52 +10537,643 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/rule/create", + "alerting:xpack.synthetics.alerts.tls/observability/rule/delete", + "alerting:xpack.synthetics.alerts.tls/observability/rule/update", + "alerting:xpack.synthetics.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/observability/rule/enable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/disable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/observability/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/deleteBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/create", + "alerting:metrics.alert.threshold/observability/rule/delete", + "alerting:metrics.alert.threshold/observability/rule/update", + "alerting:metrics.alert.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.threshold/observability/rule/enable", + "alerting:metrics.alert.threshold/observability/rule/disable", + "alerting:metrics.alert.threshold/observability/rule/muteAll", + "alerting:metrics.alert.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.threshold/observability/rule/snooze", + "alerting:metrics.alert.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.threshold/observability/rule/runSoon", + "alerting:metrics.alert.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/create", + "alerting:metrics.alert.inventory.threshold/observability/rule/delete", + "alerting:metrics.alert.inventory.threshold/observability/rule/update", + "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/observability/rule/enable", + "alerting:metrics.alert.inventory.threshold/observability/rule/disable", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/create", + "alerting:xpack.uptime.alerts.tls/observability/rule/delete", + "alerting:xpack.uptime.alerts.tls/observability/rule/update", + "alerting:xpack.uptime.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/observability/rule/enable", + "alerting:xpack.uptime.alerts.tls/observability/rule/disable", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/create", + "alerting:xpack.uptime.alerts.tls/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/update", + "alerting:xpack.uptime.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/deleteBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/create", + "alerting:logs.alert.document.count/observability/rule/delete", + "alerting:logs.alert.document.count/observability/rule/update", + "alerting:logs.alert.document.count/observability/rule/updateApiKey", + "alerting:logs.alert.document.count/observability/rule/enable", + "alerting:logs.alert.document.count/observability/rule/disable", + "alerting:logs.alert.document.count/observability/rule/muteAll", + "alerting:logs.alert.document.count/observability/rule/unmuteAll", + "alerting:logs.alert.document.count/observability/rule/muteAlert", + "alerting:logs.alert.document.count/observability/rule/unmuteAlert", + "alerting:logs.alert.document.count/observability/rule/snooze", + "alerting:logs.alert.document.count/observability/rule/bulkEdit", + "alerting:logs.alert.document.count/observability/rule/bulkDelete", + "alerting:logs.alert.document.count/observability/rule/bulkEnable", + "alerting:logs.alert.document.count/observability/rule/bulkDisable", + "alerting:logs.alert.document.count/observability/rule/unsnooze", + "alerting:logs.alert.document.count/observability/rule/runSoon", + "alerting:logs.alert.document.count/observability/rule/scheduleBackfill", + "alerting:logs.alert.document.count/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/create", + "alerting:slo.rules.burnRate/observability/rule/delete", + "alerting:slo.rules.burnRate/observability/rule/update", + "alerting:slo.rules.burnRate/observability/rule/updateApiKey", + "alerting:slo.rules.burnRate/observability/rule/enable", + "alerting:slo.rules.burnRate/observability/rule/disable", + "alerting:slo.rules.burnRate/observability/rule/muteAll", + "alerting:slo.rules.burnRate/observability/rule/unmuteAll", + "alerting:slo.rules.burnRate/observability/rule/muteAlert", + "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", + "alerting:slo.rules.burnRate/observability/rule/snooze", + "alerting:slo.rules.burnRate/observability/rule/bulkEdit", + "alerting:slo.rules.burnRate/observability/rule/bulkDelete", + "alerting:slo.rules.burnRate/observability/rule/bulkEnable", + "alerting:slo.rules.burnRate/observability/rule/bulkDisable", + "alerting:slo.rules.burnRate/observability/rule/unsnooze", + "alerting:slo.rules.burnRate/observability/rule/runSoon", + "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/create", + "alerting:slo.rules.burnRate/alerts/rule/delete", + "alerting:slo.rules.burnRate/alerts/rule/update", + "alerting:slo.rules.burnRate/alerts/rule/updateApiKey", + "alerting:slo.rules.burnRate/alerts/rule/enable", + "alerting:slo.rules.burnRate/alerts/rule/disable", + "alerting:slo.rules.burnRate/alerts/rule/muteAll", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAll", + "alerting:slo.rules.burnRate/alerts/rule/muteAlert", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAlert", + "alerting:slo.rules.burnRate/alerts/rule/snooze", + "alerting:slo.rules.burnRate/alerts/rule/bulkEdit", + "alerting:slo.rules.burnRate/alerts/rule/bulkDelete", + "alerting:slo.rules.burnRate/alerts/rule/bulkEnable", + "alerting:slo.rules.burnRate/alerts/rule/bulkDisable", + "alerting:slo.rules.burnRate/alerts/rule/unsnooze", + "alerting:slo.rules.burnRate/alerts/rule/runSoon", + "alerting:slo.rules.burnRate/alerts/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/alerts/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/create", + "alerting:observability.rules.custom_threshold/observability/rule/delete", + "alerting:observability.rules.custom_threshold/observability/rule/update", + "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/observability/rule/enable", + "alerting:observability.rules.custom_threshold/observability/rule/disable", + "alerting:observability.rules.custom_threshold/observability/rule/muteAll", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/snooze", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", + "alerting:observability.rules.custom_threshold/observability/rule/runSoon", + "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/create", + "alerting:.es-query/observability/rule/delete", + "alerting:.es-query/observability/rule/update", + "alerting:.es-query/observability/rule/updateApiKey", + "alerting:.es-query/observability/rule/enable", + "alerting:.es-query/observability/rule/disable", + "alerting:.es-query/observability/rule/muteAll", + "alerting:.es-query/observability/rule/unmuteAll", + "alerting:.es-query/observability/rule/muteAlert", + "alerting:.es-query/observability/rule/unmuteAlert", + "alerting:.es-query/observability/rule/snooze", + "alerting:.es-query/observability/rule/bulkEdit", + "alerting:.es-query/observability/rule/bulkDelete", + "alerting:.es-query/observability/rule/bulkEnable", + "alerting:.es-query/observability/rule/bulkDisable", + "alerting:.es-query/observability/rule/unsnooze", + "alerting:.es-query/observability/rule/runSoon", + "alerting:.es-query/observability/rule/scheduleBackfill", + "alerting:.es-query/observability/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/update", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/update", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/update", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/observability/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/update", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/update", "alerting:xpack.synthetics.alerts.tls/observability/alert/get", "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/update", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/update", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/update", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/update", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/update", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/update", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/update", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/update", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", ], - "read": Array [ + "minimal_all": Array [ "login:", "api:infra", "api:rac", @@ -6916,16 +11191,42 @@ export default function ({ getService }: FtrProviderContext) { "saved_object:infrastructure-ui-source/find", "saved_object:infrastructure-ui-source/open_point_in_time", "saved_object:infrastructure-ui-source/close_point_in_time", - "saved_object:index-pattern/bulk_get", - "saved_object:index-pattern/get", - "saved_object:index-pattern/find", - "saved_object:index-pattern/open_point_in_time", - "saved_object:index-pattern/close_point_in_time", + "saved_object:infrastructure-ui-source/create", + "saved_object:infrastructure-ui-source/bulk_create", + "saved_object:infrastructure-ui-source/update", + "saved_object:infrastructure-ui-source/bulk_update", + "saved_object:infrastructure-ui-source/delete", + "saved_object:infrastructure-ui-source/bulk_delete", + "saved_object:infrastructure-ui-source/share_to_space", "saved_object:metrics-data-source/bulk_get", "saved_object:metrics-data-source/get", "saved_object:metrics-data-source/find", "saved_object:metrics-data-source/open_point_in_time", "saved_object:metrics-data-source/close_point_in_time", + "saved_object:metrics-data-source/create", + "saved_object:metrics-data-source/bulk_create", + "saved_object:metrics-data-source/update", + "saved_object:metrics-data-source/bulk_update", + "saved_object:metrics-data-source/delete", + "saved_object:metrics-data-source/bulk_delete", + "saved_object:metrics-data-source/share_to_space", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", "saved_object:config/bulk_get", "saved_object:config/get", "saved_object:config/find", @@ -6936,17 +11237,14 @@ export default function ({ getService }: FtrProviderContext) { "saved_object:config-global/find", "saved_object:config-global/open_point_in_time", "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", "saved_object:url/bulk_get", "saved_object:url/get", "saved_object:url/find", "saved_object:url/open_point_in_time", "saved_object:url/close_point_in_time", "ui:infrastructure/show", + "ui:infrastructure/configureSource", + "ui:infrastructure/save", "alerting:metrics.alert.threshold/infrastructure/rule/get", "alerting:metrics.alert.threshold/infrastructure/rule/getRuleState", "alerting:metrics.alert.threshold/infrastructure/rule/getAlertSummary", @@ -6956,6 +11254,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:metrics.alert.threshold/infrastructure/rule/getRuleExecutionKPI", "alerting:metrics.alert.threshold/infrastructure/rule/getBackfill", "alerting:metrics.alert.threshold/infrastructure/rule/findBackfill", + "alerting:metrics.alert.threshold/infrastructure/rule/create", + "alerting:metrics.alert.threshold/infrastructure/rule/delete", + "alerting:metrics.alert.threshold/infrastructure/rule/update", + "alerting:metrics.alert.threshold/infrastructure/rule/updateApiKey", + "alerting:metrics.alert.threshold/infrastructure/rule/enable", + "alerting:metrics.alert.threshold/infrastructure/rule/disable", + "alerting:metrics.alert.threshold/infrastructure/rule/muteAll", + "alerting:metrics.alert.threshold/infrastructure/rule/unmuteAll", + "alerting:metrics.alert.threshold/infrastructure/rule/muteAlert", + "alerting:metrics.alert.threshold/infrastructure/rule/unmuteAlert", + "alerting:metrics.alert.threshold/infrastructure/rule/snooze", + "alerting:metrics.alert.threshold/infrastructure/rule/bulkEdit", + "alerting:metrics.alert.threshold/infrastructure/rule/bulkDelete", + "alerting:metrics.alert.threshold/infrastructure/rule/bulkEnable", + "alerting:metrics.alert.threshold/infrastructure/rule/bulkDisable", + "alerting:metrics.alert.threshold/infrastructure/rule/unsnooze", + "alerting:metrics.alert.threshold/infrastructure/rule/runSoon", + "alerting:metrics.alert.threshold/infrastructure/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/infrastructure/rule/deleteBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/create", + "alerting:metrics.alert.threshold/alerts/rule/delete", + "alerting:metrics.alert.threshold/alerts/rule/update", + "alerting:metrics.alert.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.threshold/alerts/rule/enable", + "alerting:metrics.alert.threshold/alerts/rule/disable", + "alerting:metrics.alert.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.threshold/alerts/rule/snooze", + "alerting:metrics.alert.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/alerts/rule/deleteBackfill", "alerting:metrics.alert.inventory.threshold/infrastructure/rule/get", "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleState", "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getAlertSummary", @@ -6965,6 +11310,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleExecutionKPI", "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getBackfill", "alerting:metrics.alert.inventory.threshold/infrastructure/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/create", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/delete", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/update", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/enable", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/disable", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/snooze", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/create", + "alerting:metrics.alert.inventory.threshold/alerts/rule/delete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/update", + "alerting:metrics.alert.inventory.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/alerts/rule/enable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/disable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/snooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/deleteBackfill", "alerting:.es-query/infrastructure/rule/get", "alerting:.es-query/infrastructure/rule/getRuleState", "alerting:.es-query/infrastructure/rule/getAlertSummary", @@ -6974,6 +11366,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/infrastructure/rule/getRuleExecutionKPI", "alerting:.es-query/infrastructure/rule/getBackfill", "alerting:.es-query/infrastructure/rule/findBackfill", + "alerting:.es-query/infrastructure/rule/create", + "alerting:.es-query/infrastructure/rule/delete", + "alerting:.es-query/infrastructure/rule/update", + "alerting:.es-query/infrastructure/rule/updateApiKey", + "alerting:.es-query/infrastructure/rule/enable", + "alerting:.es-query/infrastructure/rule/disable", + "alerting:.es-query/infrastructure/rule/muteAll", + "alerting:.es-query/infrastructure/rule/unmuteAll", + "alerting:.es-query/infrastructure/rule/muteAlert", + "alerting:.es-query/infrastructure/rule/unmuteAlert", + "alerting:.es-query/infrastructure/rule/snooze", + "alerting:.es-query/infrastructure/rule/bulkEdit", + "alerting:.es-query/infrastructure/rule/bulkDelete", + "alerting:.es-query/infrastructure/rule/bulkEnable", + "alerting:.es-query/infrastructure/rule/bulkDisable", + "alerting:.es-query/infrastructure/rule/unsnooze", + "alerting:.es-query/infrastructure/rule/runSoon", + "alerting:.es-query/infrastructure/rule/scheduleBackfill", + "alerting:.es-query/infrastructure/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", "alerting:observability.rules.custom_threshold/infrastructure/rule/get", "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleState", "alerting:observability.rules.custom_threshold/infrastructure/rule/getAlertSummary", @@ -6983,6 +11422,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleExecutionKPI", "alerting:observability.rules.custom_threshold/infrastructure/rule/getBackfill", "alerting:observability.rules.custom_threshold/infrastructure/rule/findBackfill", + "alerting:observability.rules.custom_threshold/infrastructure/rule/create", + "alerting:observability.rules.custom_threshold/infrastructure/rule/delete", + "alerting:observability.rules.custom_threshold/infrastructure/rule/update", + "alerting:observability.rules.custom_threshold/infrastructure/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/infrastructure/rule/enable", + "alerting:observability.rules.custom_threshold/infrastructure/rule/disable", + "alerting:observability.rules.custom_threshold/infrastructure/rule/muteAll", + "alerting:observability.rules.custom_threshold/infrastructure/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/infrastructure/rule/muteAlert", + "alerting:observability.rules.custom_threshold/infrastructure/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/infrastructure/rule/snooze", + "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/infrastructure/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/infrastructure/rule/unsnooze", + "alerting:observability.rules.custom_threshold/infrastructure/rule/runSoon", + "alerting:observability.rules.custom_threshold/infrastructure/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/infrastructure/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/get", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getAlertSummary", @@ -6992,26 +11478,103 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleExecutionKPI", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getBackfill", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", "alerting:metrics.alert.threshold/infrastructure/alert/get", "alerting:metrics.alert.threshold/infrastructure/alert/find", "alerting:metrics.alert.threshold/infrastructure/alert/getAuthorizedAlertsIndices", "alerting:metrics.alert.threshold/infrastructure/alert/getAlertSummary", + "alerting:metrics.alert.threshold/infrastructure/alert/update", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/update", "alerting:metrics.alert.inventory.threshold/infrastructure/alert/get", "alerting:metrics.alert.inventory.threshold/infrastructure/alert/find", "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAuthorizedAlertsIndices", "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/infrastructure/alert/update", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/update", "alerting:.es-query/infrastructure/alert/get", "alerting:.es-query/infrastructure/alert/find", "alerting:.es-query/infrastructure/alert/getAuthorizedAlertsIndices", "alerting:.es-query/infrastructure/alert/getAlertSummary", + "alerting:.es-query/infrastructure/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", "alerting:observability.rules.custom_threshold/infrastructure/alert/get", "alerting:observability.rules.custom_threshold/infrastructure/alert/find", "alerting:observability.rules.custom_threshold/infrastructure/alert/getAuthorizedAlertsIndices", "alerting:observability.rules.custom_threshold/infrastructure/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/infrastructure/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/get", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/find", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAuthorizedAlertsIndices", "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", "app:logs", "app:observability-logs-explorer", "ui:catalogue/infralogging", @@ -7023,7 +11586,16 @@ export default function ({ getService }: FtrProviderContext) { "saved_object:infrastructure-monitoring-log-view/find", "saved_object:infrastructure-monitoring-log-view/open_point_in_time", "saved_object:infrastructure-monitoring-log-view/close_point_in_time", + "saved_object:infrastructure-monitoring-log-view/create", + "saved_object:infrastructure-monitoring-log-view/bulk_create", + "saved_object:infrastructure-monitoring-log-view/update", + "saved_object:infrastructure-monitoring-log-view/bulk_update", + "saved_object:infrastructure-monitoring-log-view/delete", + "saved_object:infrastructure-monitoring-log-view/bulk_delete", + "saved_object:infrastructure-monitoring-log-view/share_to_space", "ui:logs/show", + "ui:logs/configureSource", + "ui:logs/save", "alerting:logs.alert.document.count/logs/rule/get", "alerting:logs.alert.document.count/logs/rule/getRuleState", "alerting:logs.alert.document.count/logs/rule/getAlertSummary", @@ -7033,6 +11605,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", "alerting:logs.alert.document.count/logs/rule/getBackfill", "alerting:logs.alert.document.count/logs/rule/findBackfill", + "alerting:logs.alert.document.count/logs/rule/create", + "alerting:logs.alert.document.count/logs/rule/delete", + "alerting:logs.alert.document.count/logs/rule/update", + "alerting:logs.alert.document.count/logs/rule/updateApiKey", + "alerting:logs.alert.document.count/logs/rule/enable", + "alerting:logs.alert.document.count/logs/rule/disable", + "alerting:logs.alert.document.count/logs/rule/muteAll", + "alerting:logs.alert.document.count/logs/rule/unmuteAll", + "alerting:logs.alert.document.count/logs/rule/muteAlert", + "alerting:logs.alert.document.count/logs/rule/unmuteAlert", + "alerting:logs.alert.document.count/logs/rule/snooze", + "alerting:logs.alert.document.count/logs/rule/bulkEdit", + "alerting:logs.alert.document.count/logs/rule/bulkDelete", + "alerting:logs.alert.document.count/logs/rule/bulkEnable", + "alerting:logs.alert.document.count/logs/rule/bulkDisable", + "alerting:logs.alert.document.count/logs/rule/unsnooze", + "alerting:logs.alert.document.count/logs/rule/runSoon", + "alerting:logs.alert.document.count/logs/rule/scheduleBackfill", + "alerting:logs.alert.document.count/logs/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", "alerting:.es-query/logs/rule/get", "alerting:.es-query/logs/rule/getRuleState", "alerting:.es-query/logs/rule/getAlertSummary", @@ -7042,6 +11661,25 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/logs/rule/getRuleExecutionKPI", "alerting:.es-query/logs/rule/getBackfill", "alerting:.es-query/logs/rule/findBackfill", + "alerting:.es-query/logs/rule/create", + "alerting:.es-query/logs/rule/delete", + "alerting:.es-query/logs/rule/update", + "alerting:.es-query/logs/rule/updateApiKey", + "alerting:.es-query/logs/rule/enable", + "alerting:.es-query/logs/rule/disable", + "alerting:.es-query/logs/rule/muteAll", + "alerting:.es-query/logs/rule/unmuteAll", + "alerting:.es-query/logs/rule/muteAlert", + "alerting:.es-query/logs/rule/unmuteAlert", + "alerting:.es-query/logs/rule/snooze", + "alerting:.es-query/logs/rule/bulkEdit", + "alerting:.es-query/logs/rule/bulkDelete", + "alerting:.es-query/logs/rule/bulkEnable", + "alerting:.es-query/logs/rule/bulkDisable", + "alerting:.es-query/logs/rule/unsnooze", + "alerting:.es-query/logs/rule/runSoon", + "alerting:.es-query/logs/rule/scheduleBackfill", + "alerting:.es-query/logs/rule/deleteBackfill", "alerting:observability.rules.custom_threshold/logs/rule/get", "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", @@ -7051,6 +11689,25 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/create", + "alerting:observability.rules.custom_threshold/logs/rule/delete", + "alerting:observability.rules.custom_threshold/logs/rule/update", + "alerting:observability.rules.custom_threshold/logs/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/logs/rule/enable", + "alerting:observability.rules.custom_threshold/logs/rule/disable", + "alerting:observability.rules.custom_threshold/logs/rule/muteAll", + "alerting:observability.rules.custom_threshold/logs/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/logs/rule/muteAlert", + "alerting:observability.rules.custom_threshold/logs/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/logs/rule/snooze", + "alerting:observability.rules.custom_threshold/logs/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/logs/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/logs/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/logs/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/logs/rule/unsnooze", + "alerting:observability.rules.custom_threshold/logs/rule/runSoon", + "alerting:observability.rules.custom_threshold/logs/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/deleteBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", @@ -7060,71 +11717,55 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/deleteBackfill", "alerting:logs.alert.document.count/logs/alert/get", "alerting:logs.alert.document.count/logs/alert/find", "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", "alerting:logs.alert.document.count/logs/alert/getAlertSummary", + "alerting:logs.alert.document.count/logs/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", "alerting:.es-query/logs/alert/get", "alerting:.es-query/logs/alert/find", "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", "alerting:.es-query/logs/alert/getAlertSummary", + "alerting:.es-query/logs/alert/update", "alerting:observability.rules.custom_threshold/logs/alert/get", "alerting:observability.rules.custom_threshold/logs/alert/find", "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/alert/update", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/update", "app:observability", "ui:catalogue/observability", "ui:navLinks/observability", "ui:observability/read", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "ui:observability/write", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -7134,6 +11775,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.error_rate/observability/rule/getBackfill", "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/observability/rule/create", + "alerting:apm.error_rate/observability/rule/delete", + "alerting:apm.error_rate/observability/rule/update", + "alerting:apm.error_rate/observability/rule/updateApiKey", + "alerting:apm.error_rate/observability/rule/enable", + "alerting:apm.error_rate/observability/rule/disable", + "alerting:apm.error_rate/observability/rule/muteAll", + "alerting:apm.error_rate/observability/rule/unmuteAll", + "alerting:apm.error_rate/observability/rule/muteAlert", + "alerting:apm.error_rate/observability/rule/unmuteAlert", + "alerting:apm.error_rate/observability/rule/snooze", + "alerting:apm.error_rate/observability/rule/bulkEdit", + "alerting:apm.error_rate/observability/rule/bulkDelete", + "alerting:apm.error_rate/observability/rule/bulkEnable", + "alerting:apm.error_rate/observability/rule/bulkDisable", + "alerting:apm.error_rate/observability/rule/unsnooze", + "alerting:apm.error_rate/observability/rule/runSoon", + "alerting:apm.error_rate/observability/rule/scheduleBackfill", + "alerting:apm.error_rate/observability/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/create", + "alerting:apm.error_rate/alerts/rule/delete", + "alerting:apm.error_rate/alerts/rule/update", + "alerting:apm.error_rate/alerts/rule/updateApiKey", + "alerting:apm.error_rate/alerts/rule/enable", + "alerting:apm.error_rate/alerts/rule/disable", + "alerting:apm.error_rate/alerts/rule/muteAll", + "alerting:apm.error_rate/alerts/rule/unmuteAll", + "alerting:apm.error_rate/alerts/rule/muteAlert", + "alerting:apm.error_rate/alerts/rule/unmuteAlert", + "alerting:apm.error_rate/alerts/rule/snooze", + "alerting:apm.error_rate/alerts/rule/bulkEdit", + "alerting:apm.error_rate/alerts/rule/bulkDelete", + "alerting:apm.error_rate/alerts/rule/bulkEnable", + "alerting:apm.error_rate/alerts/rule/bulkDisable", + "alerting:apm.error_rate/alerts/rule/unsnooze", + "alerting:apm.error_rate/alerts/rule/runSoon", + "alerting:apm.error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", "alerting:apm.transaction_error_rate/observability/rule/getRuleState", "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", @@ -7143,6 +11831,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_error_rate/observability/rule/getBackfill", "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/observability/rule/create", + "alerting:apm.transaction_error_rate/observability/rule/delete", + "alerting:apm.transaction_error_rate/observability/rule/update", + "alerting:apm.transaction_error_rate/observability/rule/updateApiKey", + "alerting:apm.transaction_error_rate/observability/rule/enable", + "alerting:apm.transaction_error_rate/observability/rule/disable", + "alerting:apm.transaction_error_rate/observability/rule/muteAll", + "alerting:apm.transaction_error_rate/observability/rule/unmuteAll", + "alerting:apm.transaction_error_rate/observability/rule/muteAlert", + "alerting:apm.transaction_error_rate/observability/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/observability/rule/snooze", + "alerting:apm.transaction_error_rate/observability/rule/bulkEdit", + "alerting:apm.transaction_error_rate/observability/rule/bulkDelete", + "alerting:apm.transaction_error_rate/observability/rule/bulkEnable", + "alerting:apm.transaction_error_rate/observability/rule/bulkDisable", + "alerting:apm.transaction_error_rate/observability/rule/unsnooze", + "alerting:apm.transaction_error_rate/observability/rule/runSoon", + "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/create", + "alerting:apm.transaction_error_rate/alerts/rule/delete", + "alerting:apm.transaction_error_rate/alerts/rule/update", + "alerting:apm.transaction_error_rate/alerts/rule/updateApiKey", + "alerting:apm.transaction_error_rate/alerts/rule/enable", + "alerting:apm.transaction_error_rate/alerts/rule/disable", + "alerting:apm.transaction_error_rate/alerts/rule/muteAll", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAll", + "alerting:apm.transaction_error_rate/alerts/rule/muteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/snooze", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEdit", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDelete", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEnable", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDisable", + "alerting:apm.transaction_error_rate/alerts/rule/unsnooze", + "alerting:apm.transaction_error_rate/alerts/rule/runSoon", + "alerting:apm.transaction_error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_duration/observability/rule/get", "alerting:apm.transaction_duration/observability/rule/getRuleState", "alerting:apm.transaction_duration/observability/rule/getAlertSummary", @@ -7152,6 +11887,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_duration/observability/rule/getBackfill", "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/observability/rule/create", + "alerting:apm.transaction_duration/observability/rule/delete", + "alerting:apm.transaction_duration/observability/rule/update", + "alerting:apm.transaction_duration/observability/rule/updateApiKey", + "alerting:apm.transaction_duration/observability/rule/enable", + "alerting:apm.transaction_duration/observability/rule/disable", + "alerting:apm.transaction_duration/observability/rule/muteAll", + "alerting:apm.transaction_duration/observability/rule/unmuteAll", + "alerting:apm.transaction_duration/observability/rule/muteAlert", + "alerting:apm.transaction_duration/observability/rule/unmuteAlert", + "alerting:apm.transaction_duration/observability/rule/snooze", + "alerting:apm.transaction_duration/observability/rule/bulkEdit", + "alerting:apm.transaction_duration/observability/rule/bulkDelete", + "alerting:apm.transaction_duration/observability/rule/bulkEnable", + "alerting:apm.transaction_duration/observability/rule/bulkDisable", + "alerting:apm.transaction_duration/observability/rule/unsnooze", + "alerting:apm.transaction_duration/observability/rule/runSoon", + "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", + "alerting:apm.transaction_duration/observability/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/create", + "alerting:apm.transaction_duration/alerts/rule/delete", + "alerting:apm.transaction_duration/alerts/rule/update", + "alerting:apm.transaction_duration/alerts/rule/updateApiKey", + "alerting:apm.transaction_duration/alerts/rule/enable", + "alerting:apm.transaction_duration/alerts/rule/disable", + "alerting:apm.transaction_duration/alerts/rule/muteAll", + "alerting:apm.transaction_duration/alerts/rule/unmuteAll", + "alerting:apm.transaction_duration/alerts/rule/muteAlert", + "alerting:apm.transaction_duration/alerts/rule/unmuteAlert", + "alerting:apm.transaction_duration/alerts/rule/snooze", + "alerting:apm.transaction_duration/alerts/rule/bulkEdit", + "alerting:apm.transaction_duration/alerts/rule/bulkDelete", + "alerting:apm.transaction_duration/alerts/rule/bulkEnable", + "alerting:apm.transaction_duration/alerts/rule/bulkDisable", + "alerting:apm.transaction_duration/alerts/rule/unsnooze", + "alerting:apm.transaction_duration/alerts/rule/runSoon", + "alerting:apm.transaction_duration/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_duration/alerts/rule/deleteBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -7161,6 +11943,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", "alerting:apm.anomaly/observability/rule/getBackfill", "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/observability/rule/create", + "alerting:apm.anomaly/observability/rule/delete", + "alerting:apm.anomaly/observability/rule/update", + "alerting:apm.anomaly/observability/rule/updateApiKey", + "alerting:apm.anomaly/observability/rule/enable", + "alerting:apm.anomaly/observability/rule/disable", + "alerting:apm.anomaly/observability/rule/muteAll", + "alerting:apm.anomaly/observability/rule/unmuteAll", + "alerting:apm.anomaly/observability/rule/muteAlert", + "alerting:apm.anomaly/observability/rule/unmuteAlert", + "alerting:apm.anomaly/observability/rule/snooze", + "alerting:apm.anomaly/observability/rule/bulkEdit", + "alerting:apm.anomaly/observability/rule/bulkDelete", + "alerting:apm.anomaly/observability/rule/bulkEnable", + "alerting:apm.anomaly/observability/rule/bulkDisable", + "alerting:apm.anomaly/observability/rule/unsnooze", + "alerting:apm.anomaly/observability/rule/runSoon", + "alerting:apm.anomaly/observability/rule/scheduleBackfill", + "alerting:apm.anomaly/observability/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/create", + "alerting:apm.anomaly/alerts/rule/delete", + "alerting:apm.anomaly/alerts/rule/update", + "alerting:apm.anomaly/alerts/rule/updateApiKey", + "alerting:apm.anomaly/alerts/rule/enable", + "alerting:apm.anomaly/alerts/rule/disable", + "alerting:apm.anomaly/alerts/rule/muteAll", + "alerting:apm.anomaly/alerts/rule/unmuteAll", + "alerting:apm.anomaly/alerts/rule/muteAlert", + "alerting:apm.anomaly/alerts/rule/unmuteAlert", + "alerting:apm.anomaly/alerts/rule/snooze", + "alerting:apm.anomaly/alerts/rule/bulkEdit", + "alerting:apm.anomaly/alerts/rule/bulkDelete", + "alerting:apm.anomaly/alerts/rule/bulkEnable", + "alerting:apm.anomaly/alerts/rule/bulkDisable", + "alerting:apm.anomaly/alerts/rule/unsnooze", + "alerting:apm.anomaly/alerts/rule/runSoon", + "alerting:apm.anomaly/alerts/rule/scheduleBackfill", + "alerting:apm.anomaly/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", @@ -7170,6 +11999,53 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/get", "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", @@ -7179,218 +12055,670 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/rule/create", + "alerting:xpack.synthetics.alerts.tls/observability/rule/delete", + "alerting:xpack.synthetics.alerts.tls/observability/rule/update", + "alerting:xpack.synthetics.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/observability/rule/enable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/disable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/observability/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/deleteBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/create", + "alerting:metrics.alert.threshold/observability/rule/delete", + "alerting:metrics.alert.threshold/observability/rule/update", + "alerting:metrics.alert.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.threshold/observability/rule/enable", + "alerting:metrics.alert.threshold/observability/rule/disable", + "alerting:metrics.alert.threshold/observability/rule/muteAll", + "alerting:metrics.alert.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.threshold/observability/rule/snooze", + "alerting:metrics.alert.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.threshold/observability/rule/runSoon", + "alerting:metrics.alert.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/create", + "alerting:metrics.alert.inventory.threshold/observability/rule/delete", + "alerting:metrics.alert.inventory.threshold/observability/rule/update", + "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/observability/rule/enable", + "alerting:metrics.alert.inventory.threshold/observability/rule/disable", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/create", + "alerting:xpack.uptime.alerts.tls/observability/rule/delete", + "alerting:xpack.uptime.alerts.tls/observability/rule/update", + "alerting:xpack.uptime.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/observability/rule/enable", + "alerting:xpack.uptime.alerts.tls/observability/rule/disable", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/create", + "alerting:xpack.uptime.alerts.tls/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/update", + "alerting:xpack.uptime.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/deleteBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/create", + "alerting:logs.alert.document.count/observability/rule/delete", + "alerting:logs.alert.document.count/observability/rule/update", + "alerting:logs.alert.document.count/observability/rule/updateApiKey", + "alerting:logs.alert.document.count/observability/rule/enable", + "alerting:logs.alert.document.count/observability/rule/disable", + "alerting:logs.alert.document.count/observability/rule/muteAll", + "alerting:logs.alert.document.count/observability/rule/unmuteAll", + "alerting:logs.alert.document.count/observability/rule/muteAlert", + "alerting:logs.alert.document.count/observability/rule/unmuteAlert", + "alerting:logs.alert.document.count/observability/rule/snooze", + "alerting:logs.alert.document.count/observability/rule/bulkEdit", + "alerting:logs.alert.document.count/observability/rule/bulkDelete", + "alerting:logs.alert.document.count/observability/rule/bulkEnable", + "alerting:logs.alert.document.count/observability/rule/bulkDisable", + "alerting:logs.alert.document.count/observability/rule/unsnooze", + "alerting:logs.alert.document.count/observability/rule/runSoon", + "alerting:logs.alert.document.count/observability/rule/scheduleBackfill", + "alerting:logs.alert.document.count/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/create", + "alerting:slo.rules.burnRate/observability/rule/delete", + "alerting:slo.rules.burnRate/observability/rule/update", + "alerting:slo.rules.burnRate/observability/rule/updateApiKey", + "alerting:slo.rules.burnRate/observability/rule/enable", + "alerting:slo.rules.burnRate/observability/rule/disable", + "alerting:slo.rules.burnRate/observability/rule/muteAll", + "alerting:slo.rules.burnRate/observability/rule/unmuteAll", + "alerting:slo.rules.burnRate/observability/rule/muteAlert", + "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", + "alerting:slo.rules.burnRate/observability/rule/snooze", + "alerting:slo.rules.burnRate/observability/rule/bulkEdit", + "alerting:slo.rules.burnRate/observability/rule/bulkDelete", + "alerting:slo.rules.burnRate/observability/rule/bulkEnable", + "alerting:slo.rules.burnRate/observability/rule/bulkDisable", + "alerting:slo.rules.burnRate/observability/rule/unsnooze", + "alerting:slo.rules.burnRate/observability/rule/runSoon", + "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/create", + "alerting:slo.rules.burnRate/alerts/rule/delete", + "alerting:slo.rules.burnRate/alerts/rule/update", + "alerting:slo.rules.burnRate/alerts/rule/updateApiKey", + "alerting:slo.rules.burnRate/alerts/rule/enable", + "alerting:slo.rules.burnRate/alerts/rule/disable", + "alerting:slo.rules.burnRate/alerts/rule/muteAll", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAll", + "alerting:slo.rules.burnRate/alerts/rule/muteAlert", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAlert", + "alerting:slo.rules.burnRate/alerts/rule/snooze", + "alerting:slo.rules.burnRate/alerts/rule/bulkEdit", + "alerting:slo.rules.burnRate/alerts/rule/bulkDelete", + "alerting:slo.rules.burnRate/alerts/rule/bulkEnable", + "alerting:slo.rules.burnRate/alerts/rule/bulkDisable", + "alerting:slo.rules.burnRate/alerts/rule/unsnooze", + "alerting:slo.rules.burnRate/alerts/rule/runSoon", + "alerting:slo.rules.burnRate/alerts/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/alerts/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/create", + "alerting:observability.rules.custom_threshold/observability/rule/delete", + "alerting:observability.rules.custom_threshold/observability/rule/update", + "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/observability/rule/enable", + "alerting:observability.rules.custom_threshold/observability/rule/disable", + "alerting:observability.rules.custom_threshold/observability/rule/muteAll", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/snooze", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", + "alerting:observability.rules.custom_threshold/observability/rule/runSoon", + "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/create", + "alerting:.es-query/observability/rule/delete", + "alerting:.es-query/observability/rule/update", + "alerting:.es-query/observability/rule/updateApiKey", + "alerting:.es-query/observability/rule/enable", + "alerting:.es-query/observability/rule/disable", + "alerting:.es-query/observability/rule/muteAll", + "alerting:.es-query/observability/rule/unmuteAll", + "alerting:.es-query/observability/rule/muteAlert", + "alerting:.es-query/observability/rule/unmuteAlert", + "alerting:.es-query/observability/rule/snooze", + "alerting:.es-query/observability/rule/bulkEdit", + "alerting:.es-query/observability/rule/bulkDelete", + "alerting:.es-query/observability/rule/bulkEnable", + "alerting:.es-query/observability/rule/bulkDisable", + "alerting:.es-query/observability/rule/unsnooze", + "alerting:.es-query/observability/rule/runSoon", + "alerting:.es-query/observability/rule/scheduleBackfill", + "alerting:.es-query/observability/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/update", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/update", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/update", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/observability/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/update", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/update", "alerting:xpack.synthetics.alerts.tls/observability/alert/get", "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", - ], - }, - "reporting": Object { - "all": Array [ - "login:", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "api:downloadCsv", - "ui:management/insightsAndAlerting/reporting", - "ui:dashboard/downloadCsv", - "api:generateReport", - "ui:discover/generateCsv", - ], - "minimal_all": Array [ - "login:", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - "api:downloadCsv", - "ui:management/insightsAndAlerting/reporting", - "ui:dashboard/downloadCsv", - "api:generateReport", - "ui:discover/generateCsv", - ], - "minimal_read": Array [ - "login:", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - ], - "read": Array [ - "login:", - "saved_object:config/bulk_get", - "saved_object:config/get", - "saved_object:config/find", - "saved_object:config/open_point_in_time", - "saved_object:config/close_point_in_time", - "saved_object:config-global/bulk_get", - "saved_object:config-global/get", - "saved_object:config-global/find", - "saved_object:config-global/open_point_in_time", - "saved_object:config-global/close_point_in_time", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:url/bulk_get", - "saved_object:url/get", - "saved_object:url/find", - "saved_object:url/open_point_in_time", - "saved_object:url/close_point_in_time", - ], - }, - "slo": Object { - "all": Array [ - "login:", - "api:slo_write", - "api:slo_read", - "api:rac", - "app:slo", - "app:kibana", - "ui:catalogue/slo", - "ui:catalogue/observability", - "ui:navLinks/slo", - "ui:navLinks/kibana", - "saved_object:slo/bulk_get", - "saved_object:slo/get", - "saved_object:slo/find", - "saved_object:slo/open_point_in_time", - "saved_object:slo/close_point_in_time", - "saved_object:slo/create", - "saved_object:slo/bulk_create", - "saved_object:slo/update", - "saved_object:slo/bulk_update", - "saved_object:slo/delete", - "saved_object:slo/bulk_delete", - "saved_object:slo/share_to_space", - "saved_object:slo-settings/bulk_get", - "saved_object:slo-settings/get", - "saved_object:slo-settings/find", - "saved_object:slo-settings/open_point_in_time", - "saved_object:slo-settings/close_point_in_time", - "saved_object:slo-settings/create", - "saved_object:slo-settings/bulk_create", - "saved_object:slo-settings/update", - "saved_object:slo-settings/bulk_update", - "saved_object:slo-settings/delete", - "saved_object:slo-settings/bulk_delete", - "saved_object:slo-settings/share_to_space", - "saved_object:telemetry/bulk_get", - "saved_object:telemetry/get", - "saved_object:telemetry/find", - "saved_object:telemetry/open_point_in_time", - "saved_object:telemetry/close_point_in_time", - "saved_object:telemetry/create", - "saved_object:telemetry/bulk_create", - "saved_object:telemetry/update", - "saved_object:telemetry/bulk_update", - "saved_object:telemetry/delete", - "saved_object:telemetry/bulk_delete", - "saved_object:telemetry/share_to_space", + "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/update", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/update", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/update", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/update", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/update", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/update", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/update", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/update", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", + ], + "minimal_read": Array [ + "login:", + "api:infra", + "api:rac", + "app:infra", + "app:metrics", + "app:kibana", + "ui:catalogue/infraops", + "ui:catalogue/metrics", + "ui:management/insightsAndAlerting/triggersActions", + "ui:navLinks/infra", + "ui:navLinks/metrics", + "ui:navLinks/kibana", + "saved_object:infrastructure-ui-source/bulk_get", + "saved_object:infrastructure-ui-source/get", + "saved_object:infrastructure-ui-source/find", + "saved_object:infrastructure-ui-source/open_point_in_time", + "saved_object:infrastructure-ui-source/close_point_in_time", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", + "saved_object:metrics-data-source/bulk_get", + "saved_object:metrics-data-source/get", + "saved_object:metrics-data-source/find", + "saved_object:metrics-data-source/open_point_in_time", + "saved_object:metrics-data-source/close_point_in_time", "saved_object:config/bulk_get", "saved_object:config/get", "saved_object:config/find", @@ -7401,50 +12729,435 @@ export default function ({ getService }: FtrProviderContext) { "saved_object:config-global/find", "saved_object:config-global/open_point_in_time", "saved_object:config-global/close_point_in_time", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", "saved_object:url/bulk_get", "saved_object:url/get", "saved_object:url/find", "saved_object:url/open_point_in_time", "saved_object:url/close_point_in_time", - "ui:slo/read", - "ui:slo/write", - "alerting:slo.rules.burnRate/slo/rule/get", - "alerting:slo.rules.burnRate/slo/rule/getRuleState", - "alerting:slo.rules.burnRate/slo/rule/getAlertSummary", - "alerting:slo.rules.burnRate/slo/rule/getExecutionLog", - "alerting:slo.rules.burnRate/slo/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/slo/rule/find", - "alerting:slo.rules.burnRate/slo/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/slo/rule/getBackfill", - "alerting:slo.rules.burnRate/slo/rule/findBackfill", - "alerting:slo.rules.burnRate/slo/rule/create", - "alerting:slo.rules.burnRate/slo/rule/delete", - "alerting:slo.rules.burnRate/slo/rule/update", - "alerting:slo.rules.burnRate/slo/rule/updateApiKey", - "alerting:slo.rules.burnRate/slo/rule/enable", - "alerting:slo.rules.burnRate/slo/rule/disable", - "alerting:slo.rules.burnRate/slo/rule/muteAll", - "alerting:slo.rules.burnRate/slo/rule/unmuteAll", - "alerting:slo.rules.burnRate/slo/rule/muteAlert", - "alerting:slo.rules.burnRate/slo/rule/unmuteAlert", - "alerting:slo.rules.burnRate/slo/rule/snooze", - "alerting:slo.rules.burnRate/slo/rule/bulkEdit", - "alerting:slo.rules.burnRate/slo/rule/bulkDelete", - "alerting:slo.rules.burnRate/slo/rule/bulkEnable", - "alerting:slo.rules.burnRate/slo/rule/bulkDisable", - "alerting:slo.rules.burnRate/slo/rule/unsnooze", - "alerting:slo.rules.burnRate/slo/rule/runSoon", - "alerting:slo.rules.burnRate/slo/rule/scheduleBackfill", - "alerting:slo.rules.burnRate/slo/rule/deleteBackfill", - "alerting:slo.rules.burnRate/slo/alert/get", - "alerting:slo.rules.burnRate/slo/alert/find", - "alerting:slo.rules.burnRate/slo/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/slo/alert/getAlertSummary", - "alerting:slo.rules.burnRate/slo/alert/update", + "ui:infrastructure/show", + "alerting:metrics.alert.threshold/infrastructure/rule/get", + "alerting:metrics.alert.threshold/infrastructure/rule/getRuleState", + "alerting:metrics.alert.threshold/infrastructure/rule/getAlertSummary", + "alerting:metrics.alert.threshold/infrastructure/rule/getExecutionLog", + "alerting:metrics.alert.threshold/infrastructure/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/infrastructure/rule/find", + "alerting:metrics.alert.threshold/infrastructure/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/infrastructure/rule/getBackfill", + "alerting:metrics.alert.threshold/infrastructure/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/get", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/find", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:.es-query/infrastructure/rule/get", + "alerting:.es-query/infrastructure/rule/getRuleState", + "alerting:.es-query/infrastructure/rule/getAlertSummary", + "alerting:.es-query/infrastructure/rule/getExecutionLog", + "alerting:.es-query/infrastructure/rule/getActionErrorLog", + "alerting:.es-query/infrastructure/rule/find", + "alerting:.es-query/infrastructure/rule/getRuleExecutionKPI", + "alerting:.es-query/infrastructure/rule/getBackfill", + "alerting:.es-query/infrastructure/rule/findBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/infrastructure/rule/get", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleState", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/infrastructure/rule/find", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getBackfill", + "alerting:observability.rules.custom_threshold/infrastructure/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/infrastructure/alert/get", + "alerting:metrics.alert.threshold/infrastructure/alert/find", + "alerting:metrics.alert.threshold/infrastructure/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/infrastructure/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/infrastructure/alert/get", + "alerting:metrics.alert.inventory.threshold/infrastructure/alert/find", + "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:.es-query/infrastructure/alert/get", + "alerting:.es-query/infrastructure/alert/find", + "alerting:.es-query/infrastructure/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/infrastructure/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/infrastructure/alert/get", + "alerting:observability.rules.custom_threshold/infrastructure/alert/find", + "alerting:observability.rules.custom_threshold/infrastructure/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/infrastructure/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "app:logs", + "app:observability-logs-explorer", + "ui:catalogue/infralogging", + "ui:catalogue/logs", + "ui:navLinks/logs", + "ui:navLinks/observability-logs-explorer", + "saved_object:infrastructure-monitoring-log-view/bulk_get", + "saved_object:infrastructure-monitoring-log-view/get", + "saved_object:infrastructure-monitoring-log-view/find", + "saved_object:infrastructure-monitoring-log-view/open_point_in_time", + "saved_object:infrastructure-monitoring-log-view/close_point_in_time", + "ui:logs/show", + "alerting:logs.alert.document.count/logs/rule/get", + "alerting:logs.alert.document.count/logs/rule/getRuleState", + "alerting:logs.alert.document.count/logs/rule/getAlertSummary", + "alerting:logs.alert.document.count/logs/rule/getExecutionLog", + "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", + "alerting:logs.alert.document.count/logs/rule/find", + "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/logs/rule/getBackfill", + "alerting:logs.alert.document.count/logs/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:.es-query/logs/rule/get", + "alerting:.es-query/logs/rule/getRuleState", + "alerting:.es-query/logs/rule/getAlertSummary", + "alerting:.es-query/logs/rule/getExecutionLog", + "alerting:.es-query/logs/rule/getActionErrorLog", + "alerting:.es-query/logs/rule/find", + "alerting:.es-query/logs/rule/getRuleExecutionKPI", + "alerting:.es-query/logs/rule/getBackfill", + "alerting:.es-query/logs/rule/findBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/get", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", + "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/logs/rule/find", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", + "alerting:logs.alert.document.count/logs/alert/get", + "alerting:logs.alert.document.count/logs/alert/find", + "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/logs/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:.es-query/logs/alert/get", + "alerting:.es-query/logs/alert/find", + "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/logs/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/alert/get", + "alerting:observability.rules.custom_threshold/logs/alert/find", + "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", "app:observability", + "ui:catalogue/observability", "ui:navLinks/observability", "ui:observability/read", - "ui:observability/write", + "alerting:apm.error_rate/observability/rule/get", + "alerting:apm.error_rate/observability/rule/getRuleState", + "alerting:apm.error_rate/observability/rule/getAlertSummary", + "alerting:apm.error_rate/observability/rule/getExecutionLog", + "alerting:apm.error_rate/observability/rule/getActionErrorLog", + "alerting:apm.error_rate/observability/rule/find", + "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/observability/rule/getBackfill", + "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/observability/rule/get", + "alerting:apm.transaction_error_rate/observability/rule/getRuleState", + "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/observability/rule/find", + "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/observability/rule/getBackfill", + "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/observability/rule/get", + "alerting:apm.transaction_duration/observability/rule/getRuleState", + "alerting:apm.transaction_duration/observability/rule/getAlertSummary", + "alerting:apm.transaction_duration/observability/rule/getExecutionLog", + "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", + "alerting:apm.transaction_duration/observability/rule/find", + "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/observability/rule/getBackfill", + "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.anomaly/observability/rule/get", + "alerting:apm.anomaly/observability/rule/getRuleState", + "alerting:apm.anomaly/observability/rule/getAlertSummary", + "alerting:apm.anomaly/observability/rule/getExecutionLog", + "alerting:apm.anomaly/observability/rule/getActionErrorLog", + "alerting:apm.anomaly/observability/rule/find", + "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/observability/rule/getBackfill", + "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/get", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/find", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", "alerting:slo.rules.burnRate/observability/rule/get", "alerting:slo.rules.burnRate/observability/rule/getRuleState", "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", @@ -7454,25 +13167,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", "alerting:slo.rules.burnRate/observability/rule/getBackfill", "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/rule/create", - "alerting:slo.rules.burnRate/observability/rule/delete", - "alerting:slo.rules.burnRate/observability/rule/update", - "alerting:slo.rules.burnRate/observability/rule/updateApiKey", - "alerting:slo.rules.burnRate/observability/rule/enable", - "alerting:slo.rules.burnRate/observability/rule/disable", - "alerting:slo.rules.burnRate/observability/rule/muteAll", - "alerting:slo.rules.burnRate/observability/rule/unmuteAll", - "alerting:slo.rules.burnRate/observability/rule/muteAlert", - "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", - "alerting:slo.rules.burnRate/observability/rule/snooze", - "alerting:slo.rules.burnRate/observability/rule/bulkEdit", - "alerting:slo.rules.burnRate/observability/rule/bulkDelete", - "alerting:slo.rules.burnRate/observability/rule/bulkEnable", - "alerting:slo.rules.burnRate/observability/rule/bulkDisable", - "alerting:slo.rules.burnRate/observability/rule/unsnooze", - "alerting:slo.rules.burnRate/observability/rule/runSoon", - "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", - "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", "alerting:observability.rules.custom_threshold/observability/rule/get", "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", @@ -7482,25 +13185,6 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/create", - "alerting:observability.rules.custom_threshold/observability/rule/delete", - "alerting:observability.rules.custom_threshold/observability/rule/update", - "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/observability/rule/enable", - "alerting:observability.rules.custom_threshold/observability/rule/disable", - "alerting:observability.rules.custom_threshold/observability/rule/muteAll", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/snooze", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", - "alerting:observability.rules.custom_threshold/observability/rule/runSoon", - "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", "alerting:.es-query/observability/rule/get", "alerting:.es-query/observability/rule/getRuleState", "alerting:.es-query/observability/rule/getAlertSummary", @@ -7510,25 +13194,6 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/observability/rule/getRuleExecutionKPI", "alerting:.es-query/observability/rule/getBackfill", "alerting:.es-query/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/create", - "alerting:.es-query/observability/rule/delete", - "alerting:.es-query/observability/rule/update", - "alerting:.es-query/observability/rule/updateApiKey", - "alerting:.es-query/observability/rule/enable", - "alerting:.es-query/observability/rule/disable", - "alerting:.es-query/observability/rule/muteAll", - "alerting:.es-query/observability/rule/unmuteAll", - "alerting:.es-query/observability/rule/muteAlert", - "alerting:.es-query/observability/rule/unmuteAlert", - "alerting:.es-query/observability/rule/snooze", - "alerting:.es-query/observability/rule/bulkEdit", - "alerting:.es-query/observability/rule/bulkDelete", - "alerting:.es-query/observability/rule/bulkEnable", - "alerting:.es-query/observability/rule/bulkDisable", - "alerting:.es-query/observability/rule/unsnooze", - "alerting:.es-query/observability/rule/runSoon", - "alerting:.es-query/observability/rule/scheduleBackfill", - "alerting:.es-query/observability/rule/deleteBackfill", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", @@ -7538,53 +13203,379 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/create", - "alerting:metrics.alert.inventory.threshold/observability/rule/delete", - "alerting:metrics.alert.inventory.threshold/observability/rule/update", - "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/observability/rule/enable", - "alerting:metrics.alert.inventory.threshold/observability/rule/disable", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:apm.error_rate/observability/alert/get", + "alerting:apm.error_rate/observability/alert/find", + "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/alert/get", + "alerting:apm.transaction_error_rate/observability/alert/find", + "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/observability/alert/get", + "alerting:apm.transaction_duration/observability/alert/find", + "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/observability/alert/get", + "alerting:apm.anomaly/observability/alert/find", + "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/alert/get", + "alerting:xpack.synthetics.alerts.tls/observability/alert/find", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + ], + "read": Array [ + "login:", + "api:infra", + "api:rac", + "app:infra", + "app:metrics", + "app:kibana", + "ui:catalogue/infraops", + "ui:catalogue/metrics", + "ui:management/insightsAndAlerting/triggersActions", + "ui:navLinks/infra", + "ui:navLinks/metrics", + "ui:navLinks/kibana", + "saved_object:infrastructure-ui-source/bulk_get", + "saved_object:infrastructure-ui-source/get", + "saved_object:infrastructure-ui-source/find", + "saved_object:infrastructure-ui-source/open_point_in_time", + "saved_object:infrastructure-ui-source/close_point_in_time", + "saved_object:index-pattern/bulk_get", + "saved_object:index-pattern/get", + "saved_object:index-pattern/find", + "saved_object:index-pattern/open_point_in_time", + "saved_object:index-pattern/close_point_in_time", + "saved_object:metrics-data-source/bulk_get", + "saved_object:metrics-data-source/get", + "saved_object:metrics-data-source/find", + "saved_object:metrics-data-source/open_point_in_time", + "saved_object:metrics-data-source/close_point_in_time", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:infrastructure/show", + "alerting:metrics.alert.threshold/infrastructure/rule/get", + "alerting:metrics.alert.threshold/infrastructure/rule/getRuleState", + "alerting:metrics.alert.threshold/infrastructure/rule/getAlertSummary", + "alerting:metrics.alert.threshold/infrastructure/rule/getExecutionLog", + "alerting:metrics.alert.threshold/infrastructure/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/infrastructure/rule/find", + "alerting:metrics.alert.threshold/infrastructure/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/infrastructure/rule/getBackfill", + "alerting:metrics.alert.threshold/infrastructure/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/get", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/find", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/infrastructure/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:.es-query/infrastructure/rule/get", + "alerting:.es-query/infrastructure/rule/getRuleState", + "alerting:.es-query/infrastructure/rule/getAlertSummary", + "alerting:.es-query/infrastructure/rule/getExecutionLog", + "alerting:.es-query/infrastructure/rule/getActionErrorLog", + "alerting:.es-query/infrastructure/rule/find", + "alerting:.es-query/infrastructure/rule/getRuleExecutionKPI", + "alerting:.es-query/infrastructure/rule/getBackfill", + "alerting:.es-query/infrastructure/rule/findBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/infrastructure/rule/get", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleState", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/infrastructure/rule/find", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/infrastructure/rule/getBackfill", + "alerting:observability.rules.custom_threshold/infrastructure/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/infrastructure/alert/get", + "alerting:metrics.alert.threshold/infrastructure/alert/find", + "alerting:metrics.alert.threshold/infrastructure/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/infrastructure/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/infrastructure/alert/get", + "alerting:metrics.alert.inventory.threshold/infrastructure/alert/find", + "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/infrastructure/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:.es-query/infrastructure/alert/get", + "alerting:.es-query/infrastructure/alert/find", + "alerting:.es-query/infrastructure/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/infrastructure/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/infrastructure/alert/get", + "alerting:observability.rules.custom_threshold/infrastructure/alert/find", + "alerting:observability.rules.custom_threshold/infrastructure/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/infrastructure/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/infrastructure/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "app:logs", + "app:observability-logs-explorer", + "ui:catalogue/infralogging", + "ui:catalogue/logs", + "ui:navLinks/logs", + "ui:navLinks/observability-logs-explorer", + "saved_object:infrastructure-monitoring-log-view/bulk_get", + "saved_object:infrastructure-monitoring-log-view/get", + "saved_object:infrastructure-monitoring-log-view/find", + "saved_object:infrastructure-monitoring-log-view/open_point_in_time", + "saved_object:infrastructure-monitoring-log-view/close_point_in_time", + "ui:logs/show", + "alerting:logs.alert.document.count/logs/rule/get", + "alerting:logs.alert.document.count/logs/rule/getRuleState", + "alerting:logs.alert.document.count/logs/rule/getAlertSummary", + "alerting:logs.alert.document.count/logs/rule/getExecutionLog", + "alerting:logs.alert.document.count/logs/rule/getActionErrorLog", + "alerting:logs.alert.document.count/logs/rule/find", + "alerting:logs.alert.document.count/logs/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/logs/rule/getBackfill", + "alerting:logs.alert.document.count/logs/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:.es-query/logs/rule/get", + "alerting:.es-query/logs/rule/getRuleState", + "alerting:.es-query/logs/rule/getAlertSummary", + "alerting:.es-query/logs/rule/getExecutionLog", + "alerting:.es-query/logs/rule/getActionErrorLog", + "alerting:.es-query/logs/rule/find", + "alerting:.es-query/logs/rule/getRuleExecutionKPI", + "alerting:.es-query/logs/rule/getBackfill", + "alerting:.es-query/logs/rule/findBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/get", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleState", + "alerting:observability.rules.custom_threshold/logs/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/logs/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/logs/rule/find", + "alerting:observability.rules.custom_threshold/logs/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/logs/rule/getBackfill", + "alerting:observability.rules.custom_threshold/logs/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/logs/rule/findBackfill", + "alerting:logs.alert.document.count/logs/alert/get", + "alerting:logs.alert.document.count/logs/alert/find", + "alerting:logs.alert.document.count/logs/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/logs/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:.es-query/logs/alert/get", + "alerting:.es-query/logs/alert/find", + "alerting:.es-query/logs/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/logs/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/logs/alert/get", + "alerting:observability.rules.custom_threshold/logs/alert/find", + "alerting:observability.rules.custom_threshold/logs/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/logs/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/logs/alert/getAlertSummary", + "app:observability", + "ui:catalogue/observability", + "ui:navLinks/observability", + "ui:observability/read", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -7594,25 +13585,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.error_rate/observability/rule/getBackfill", "alerting:apm.error_rate/observability/rule/findBackfill", - "alerting:apm.error_rate/observability/rule/create", - "alerting:apm.error_rate/observability/rule/delete", - "alerting:apm.error_rate/observability/rule/update", - "alerting:apm.error_rate/observability/rule/updateApiKey", - "alerting:apm.error_rate/observability/rule/enable", - "alerting:apm.error_rate/observability/rule/disable", - "alerting:apm.error_rate/observability/rule/muteAll", - "alerting:apm.error_rate/observability/rule/unmuteAll", - "alerting:apm.error_rate/observability/rule/muteAlert", - "alerting:apm.error_rate/observability/rule/unmuteAlert", - "alerting:apm.error_rate/observability/rule/snooze", - "alerting:apm.error_rate/observability/rule/bulkEdit", - "alerting:apm.error_rate/observability/rule/bulkDelete", - "alerting:apm.error_rate/observability/rule/bulkEnable", - "alerting:apm.error_rate/observability/rule/bulkDisable", - "alerting:apm.error_rate/observability/rule/unsnooze", - "alerting:apm.error_rate/observability/rule/runSoon", - "alerting:apm.error_rate/observability/rule/scheduleBackfill", - "alerting:apm.error_rate/observability/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", "alerting:apm.transaction_error_rate/observability/rule/getRuleState", "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", @@ -7622,25 +13603,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_error_rate/observability/rule/getBackfill", "alerting:apm.transaction_error_rate/observability/rule/findBackfill", - "alerting:apm.transaction_error_rate/observability/rule/create", - "alerting:apm.transaction_error_rate/observability/rule/delete", - "alerting:apm.transaction_error_rate/observability/rule/update", - "alerting:apm.transaction_error_rate/observability/rule/updateApiKey", - "alerting:apm.transaction_error_rate/observability/rule/enable", - "alerting:apm.transaction_error_rate/observability/rule/disable", - "alerting:apm.transaction_error_rate/observability/rule/muteAll", - "alerting:apm.transaction_error_rate/observability/rule/unmuteAll", - "alerting:apm.transaction_error_rate/observability/rule/muteAlert", - "alerting:apm.transaction_error_rate/observability/rule/unmuteAlert", - "alerting:apm.transaction_error_rate/observability/rule/snooze", - "alerting:apm.transaction_error_rate/observability/rule/bulkEdit", - "alerting:apm.transaction_error_rate/observability/rule/bulkDelete", - "alerting:apm.transaction_error_rate/observability/rule/bulkEnable", - "alerting:apm.transaction_error_rate/observability/rule/bulkDisable", - "alerting:apm.transaction_error_rate/observability/rule/unsnooze", - "alerting:apm.transaction_error_rate/observability/rule/runSoon", - "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", - "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_duration/observability/rule/get", "alerting:apm.transaction_duration/observability/rule/getRuleState", "alerting:apm.transaction_duration/observability/rule/getAlertSummary", @@ -7650,25 +13621,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_duration/observability/rule/getBackfill", "alerting:apm.transaction_duration/observability/rule/findBackfill", - "alerting:apm.transaction_duration/observability/rule/create", - "alerting:apm.transaction_duration/observability/rule/delete", - "alerting:apm.transaction_duration/observability/rule/update", - "alerting:apm.transaction_duration/observability/rule/updateApiKey", - "alerting:apm.transaction_duration/observability/rule/enable", - "alerting:apm.transaction_duration/observability/rule/disable", - "alerting:apm.transaction_duration/observability/rule/muteAll", - "alerting:apm.transaction_duration/observability/rule/unmuteAll", - "alerting:apm.transaction_duration/observability/rule/muteAlert", - "alerting:apm.transaction_duration/observability/rule/unmuteAlert", - "alerting:apm.transaction_duration/observability/rule/snooze", - "alerting:apm.transaction_duration/observability/rule/bulkEdit", - "alerting:apm.transaction_duration/observability/rule/bulkDelete", - "alerting:apm.transaction_duration/observability/rule/bulkEnable", - "alerting:apm.transaction_duration/observability/rule/bulkDisable", - "alerting:apm.transaction_duration/observability/rule/unsnooze", - "alerting:apm.transaction_duration/observability/rule/runSoon", - "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", - "alerting:apm.transaction_duration/observability/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -7678,138 +13639,429 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", "alerting:apm.anomaly/observability/rule/getBackfill", "alerting:apm.anomaly/observability/rule/findBackfill", - "alerting:apm.anomaly/observability/rule/create", - "alerting:apm.anomaly/observability/rule/delete", - "alerting:apm.anomaly/observability/rule/update", - "alerting:apm.anomaly/observability/rule/updateApiKey", - "alerting:apm.anomaly/observability/rule/enable", - "alerting:apm.anomaly/observability/rule/disable", - "alerting:apm.anomaly/observability/rule/muteAll", - "alerting:apm.anomaly/observability/rule/unmuteAll", - "alerting:apm.anomaly/observability/rule/muteAlert", - "alerting:apm.anomaly/observability/rule/unmuteAlert", - "alerting:apm.anomaly/observability/rule/snooze", - "alerting:apm.anomaly/observability/rule/bulkEdit", - "alerting:apm.anomaly/observability/rule/bulkDelete", - "alerting:apm.anomaly/observability/rule/bulkEnable", - "alerting:apm.anomaly/observability/rule/bulkDisable", - "alerting:apm.anomaly/observability/rule/unsnooze", - "alerting:apm.anomaly/observability/rule/runSoon", - "alerting:apm.anomaly/observability/rule/scheduleBackfill", - "alerting:apm.anomaly/observability/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/create", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/delete", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/update", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/updateApiKey", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/enable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/disable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAll", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAll", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAlert", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAlert", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/snooze", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEdit", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDelete", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/get", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.tls/observability/rule/find", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/create", - "alerting:xpack.synthetics.alerts.tls/observability/rule/delete", - "alerting:xpack.synthetics.alerts.tls/observability/rule/update", - "alerting:xpack.synthetics.alerts.tls/observability/rule/updateApiKey", - "alerting:xpack.synthetics.alerts.tls/observability/rule/enable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/disable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAll", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAll", - "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAlert", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAlert", - "alerting:xpack.synthetics.alerts.tls/observability/rule/snooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:slo.rules.burnRate/observability/alert/update", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/update", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/get", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/find", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", - "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", - "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", - "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", - "alerting:apm.anomaly/observability/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/observability/alert/get", "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + ], + }, + "reporting": Object { + "all": Array [ + "login:", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "api:downloadCsv", + "ui:management/insightsAndAlerting/reporting", + "ui:dashboard/downloadCsv", + "api:generateReport", + "ui:discover/generateCsv", ], "minimal_all": Array [ + "login:", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "api:downloadCsv", + "ui:management/insightsAndAlerting/reporting", + "ui:dashboard/downloadCsv", + "api:generateReport", + "ui:discover/generateCsv", + ], + "minimal_read": Array [ + "login:", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + ], + "read": Array [ + "login:", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + ], + }, + "slo": Object { + "all": Array [ "login:", "api:slo_write", "api:slo_read", @@ -7901,15 +14153,776 @@ export default function ({ getService }: FtrProviderContext) { "alerting:slo.rules.burnRate/slo/rule/runSoon", "alerting:slo.rules.burnRate/slo/rule/scheduleBackfill", "alerting:slo.rules.burnRate/slo/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/create", + "alerting:slo.rules.burnRate/alerts/rule/delete", + "alerting:slo.rules.burnRate/alerts/rule/update", + "alerting:slo.rules.burnRate/alerts/rule/updateApiKey", + "alerting:slo.rules.burnRate/alerts/rule/enable", + "alerting:slo.rules.burnRate/alerts/rule/disable", + "alerting:slo.rules.burnRate/alerts/rule/muteAll", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAll", + "alerting:slo.rules.burnRate/alerts/rule/muteAlert", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAlert", + "alerting:slo.rules.burnRate/alerts/rule/snooze", + "alerting:slo.rules.burnRate/alerts/rule/bulkEdit", + "alerting:slo.rules.burnRate/alerts/rule/bulkDelete", + "alerting:slo.rules.burnRate/alerts/rule/bulkEnable", + "alerting:slo.rules.burnRate/alerts/rule/bulkDisable", + "alerting:slo.rules.burnRate/alerts/rule/unsnooze", + "alerting:slo.rules.burnRate/alerts/rule/runSoon", + "alerting:slo.rules.burnRate/alerts/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/alerts/rule/deleteBackfill", "alerting:slo.rules.burnRate/slo/alert/get", "alerting:slo.rules.burnRate/slo/alert/find", "alerting:slo.rules.burnRate/slo/alert/getAuthorizedAlertsIndices", "alerting:slo.rules.burnRate/slo/alert/getAlertSummary", "alerting:slo.rules.burnRate/slo/alert/update", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/update", "app:observability", "ui:navLinks/observability", "ui:observability/read", "ui:observability/write", + "alerting:apm.error_rate/observability/rule/get", + "alerting:apm.error_rate/observability/rule/getRuleState", + "alerting:apm.error_rate/observability/rule/getAlertSummary", + "alerting:apm.error_rate/observability/rule/getExecutionLog", + "alerting:apm.error_rate/observability/rule/getActionErrorLog", + "alerting:apm.error_rate/observability/rule/find", + "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/observability/rule/getBackfill", + "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/observability/rule/create", + "alerting:apm.error_rate/observability/rule/delete", + "alerting:apm.error_rate/observability/rule/update", + "alerting:apm.error_rate/observability/rule/updateApiKey", + "alerting:apm.error_rate/observability/rule/enable", + "alerting:apm.error_rate/observability/rule/disable", + "alerting:apm.error_rate/observability/rule/muteAll", + "alerting:apm.error_rate/observability/rule/unmuteAll", + "alerting:apm.error_rate/observability/rule/muteAlert", + "alerting:apm.error_rate/observability/rule/unmuteAlert", + "alerting:apm.error_rate/observability/rule/snooze", + "alerting:apm.error_rate/observability/rule/bulkEdit", + "alerting:apm.error_rate/observability/rule/bulkDelete", + "alerting:apm.error_rate/observability/rule/bulkEnable", + "alerting:apm.error_rate/observability/rule/bulkDisable", + "alerting:apm.error_rate/observability/rule/unsnooze", + "alerting:apm.error_rate/observability/rule/runSoon", + "alerting:apm.error_rate/observability/rule/scheduleBackfill", + "alerting:apm.error_rate/observability/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/create", + "alerting:apm.error_rate/alerts/rule/delete", + "alerting:apm.error_rate/alerts/rule/update", + "alerting:apm.error_rate/alerts/rule/updateApiKey", + "alerting:apm.error_rate/alerts/rule/enable", + "alerting:apm.error_rate/alerts/rule/disable", + "alerting:apm.error_rate/alerts/rule/muteAll", + "alerting:apm.error_rate/alerts/rule/unmuteAll", + "alerting:apm.error_rate/alerts/rule/muteAlert", + "alerting:apm.error_rate/alerts/rule/unmuteAlert", + "alerting:apm.error_rate/alerts/rule/snooze", + "alerting:apm.error_rate/alerts/rule/bulkEdit", + "alerting:apm.error_rate/alerts/rule/bulkDelete", + "alerting:apm.error_rate/alerts/rule/bulkEnable", + "alerting:apm.error_rate/alerts/rule/bulkDisable", + "alerting:apm.error_rate/alerts/rule/unsnooze", + "alerting:apm.error_rate/alerts/rule/runSoon", + "alerting:apm.error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.error_rate/alerts/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/observability/rule/get", + "alerting:apm.transaction_error_rate/observability/rule/getRuleState", + "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/observability/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/observability/rule/find", + "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/observability/rule/getBackfill", + "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/observability/rule/create", + "alerting:apm.transaction_error_rate/observability/rule/delete", + "alerting:apm.transaction_error_rate/observability/rule/update", + "alerting:apm.transaction_error_rate/observability/rule/updateApiKey", + "alerting:apm.transaction_error_rate/observability/rule/enable", + "alerting:apm.transaction_error_rate/observability/rule/disable", + "alerting:apm.transaction_error_rate/observability/rule/muteAll", + "alerting:apm.transaction_error_rate/observability/rule/unmuteAll", + "alerting:apm.transaction_error_rate/observability/rule/muteAlert", + "alerting:apm.transaction_error_rate/observability/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/observability/rule/snooze", + "alerting:apm.transaction_error_rate/observability/rule/bulkEdit", + "alerting:apm.transaction_error_rate/observability/rule/bulkDelete", + "alerting:apm.transaction_error_rate/observability/rule/bulkEnable", + "alerting:apm.transaction_error_rate/observability/rule/bulkDisable", + "alerting:apm.transaction_error_rate/observability/rule/unsnooze", + "alerting:apm.transaction_error_rate/observability/rule/runSoon", + "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/create", + "alerting:apm.transaction_error_rate/alerts/rule/delete", + "alerting:apm.transaction_error_rate/alerts/rule/update", + "alerting:apm.transaction_error_rate/alerts/rule/updateApiKey", + "alerting:apm.transaction_error_rate/alerts/rule/enable", + "alerting:apm.transaction_error_rate/alerts/rule/disable", + "alerting:apm.transaction_error_rate/alerts/rule/muteAll", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAll", + "alerting:apm.transaction_error_rate/alerts/rule/muteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/snooze", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEdit", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDelete", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEnable", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDisable", + "alerting:apm.transaction_error_rate/alerts/rule/unsnooze", + "alerting:apm.transaction_error_rate/alerts/rule/runSoon", + "alerting:apm.transaction_error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/deleteBackfill", + "alerting:apm.transaction_duration/observability/rule/get", + "alerting:apm.transaction_duration/observability/rule/getRuleState", + "alerting:apm.transaction_duration/observability/rule/getAlertSummary", + "alerting:apm.transaction_duration/observability/rule/getExecutionLog", + "alerting:apm.transaction_duration/observability/rule/getActionErrorLog", + "alerting:apm.transaction_duration/observability/rule/find", + "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/observability/rule/getBackfill", + "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/observability/rule/create", + "alerting:apm.transaction_duration/observability/rule/delete", + "alerting:apm.transaction_duration/observability/rule/update", + "alerting:apm.transaction_duration/observability/rule/updateApiKey", + "alerting:apm.transaction_duration/observability/rule/enable", + "alerting:apm.transaction_duration/observability/rule/disable", + "alerting:apm.transaction_duration/observability/rule/muteAll", + "alerting:apm.transaction_duration/observability/rule/unmuteAll", + "alerting:apm.transaction_duration/observability/rule/muteAlert", + "alerting:apm.transaction_duration/observability/rule/unmuteAlert", + "alerting:apm.transaction_duration/observability/rule/snooze", + "alerting:apm.transaction_duration/observability/rule/bulkEdit", + "alerting:apm.transaction_duration/observability/rule/bulkDelete", + "alerting:apm.transaction_duration/observability/rule/bulkEnable", + "alerting:apm.transaction_duration/observability/rule/bulkDisable", + "alerting:apm.transaction_duration/observability/rule/unsnooze", + "alerting:apm.transaction_duration/observability/rule/runSoon", + "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", + "alerting:apm.transaction_duration/observability/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/create", + "alerting:apm.transaction_duration/alerts/rule/delete", + "alerting:apm.transaction_duration/alerts/rule/update", + "alerting:apm.transaction_duration/alerts/rule/updateApiKey", + "alerting:apm.transaction_duration/alerts/rule/enable", + "alerting:apm.transaction_duration/alerts/rule/disable", + "alerting:apm.transaction_duration/alerts/rule/muteAll", + "alerting:apm.transaction_duration/alerts/rule/unmuteAll", + "alerting:apm.transaction_duration/alerts/rule/muteAlert", + "alerting:apm.transaction_duration/alerts/rule/unmuteAlert", + "alerting:apm.transaction_duration/alerts/rule/snooze", + "alerting:apm.transaction_duration/alerts/rule/bulkEdit", + "alerting:apm.transaction_duration/alerts/rule/bulkDelete", + "alerting:apm.transaction_duration/alerts/rule/bulkEnable", + "alerting:apm.transaction_duration/alerts/rule/bulkDisable", + "alerting:apm.transaction_duration/alerts/rule/unsnooze", + "alerting:apm.transaction_duration/alerts/rule/runSoon", + "alerting:apm.transaction_duration/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_duration/alerts/rule/deleteBackfill", + "alerting:apm.anomaly/observability/rule/get", + "alerting:apm.anomaly/observability/rule/getRuleState", + "alerting:apm.anomaly/observability/rule/getAlertSummary", + "alerting:apm.anomaly/observability/rule/getExecutionLog", + "alerting:apm.anomaly/observability/rule/getActionErrorLog", + "alerting:apm.anomaly/observability/rule/find", + "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/observability/rule/getBackfill", + "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/observability/rule/create", + "alerting:apm.anomaly/observability/rule/delete", + "alerting:apm.anomaly/observability/rule/update", + "alerting:apm.anomaly/observability/rule/updateApiKey", + "alerting:apm.anomaly/observability/rule/enable", + "alerting:apm.anomaly/observability/rule/disable", + "alerting:apm.anomaly/observability/rule/muteAll", + "alerting:apm.anomaly/observability/rule/unmuteAll", + "alerting:apm.anomaly/observability/rule/muteAlert", + "alerting:apm.anomaly/observability/rule/unmuteAlert", + "alerting:apm.anomaly/observability/rule/snooze", + "alerting:apm.anomaly/observability/rule/bulkEdit", + "alerting:apm.anomaly/observability/rule/bulkDelete", + "alerting:apm.anomaly/observability/rule/bulkEnable", + "alerting:apm.anomaly/observability/rule/bulkDisable", + "alerting:apm.anomaly/observability/rule/unsnooze", + "alerting:apm.anomaly/observability/rule/runSoon", + "alerting:apm.anomaly/observability/rule/scheduleBackfill", + "alerting:apm.anomaly/observability/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/create", + "alerting:apm.anomaly/alerts/rule/delete", + "alerting:apm.anomaly/alerts/rule/update", + "alerting:apm.anomaly/alerts/rule/updateApiKey", + "alerting:apm.anomaly/alerts/rule/enable", + "alerting:apm.anomaly/alerts/rule/disable", + "alerting:apm.anomaly/alerts/rule/muteAll", + "alerting:apm.anomaly/alerts/rule/unmuteAll", + "alerting:apm.anomaly/alerts/rule/muteAlert", + "alerting:apm.anomaly/alerts/rule/unmuteAlert", + "alerting:apm.anomaly/alerts/rule/snooze", + "alerting:apm.anomaly/alerts/rule/bulkEdit", + "alerting:apm.anomaly/alerts/rule/bulkDelete", + "alerting:apm.anomaly/alerts/rule/bulkEnable", + "alerting:apm.anomaly/alerts/rule/bulkDisable", + "alerting:apm.anomaly/alerts/rule/unsnooze", + "alerting:apm.anomaly/alerts/rule/runSoon", + "alerting:apm.anomaly/alerts/rule/scheduleBackfill", + "alerting:apm.anomaly/alerts/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/get", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/observability/rule/find", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/create", + "alerting:xpack.synthetics.alerts.tls/observability/rule/delete", + "alerting:xpack.synthetics.alerts.tls/observability/rule/update", + "alerting:xpack.synthetics.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/observability/rule/enable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/disable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/observability/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/deleteBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/create", + "alerting:metrics.alert.threshold/observability/rule/delete", + "alerting:metrics.alert.threshold/observability/rule/update", + "alerting:metrics.alert.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.threshold/observability/rule/enable", + "alerting:metrics.alert.threshold/observability/rule/disable", + "alerting:metrics.alert.threshold/observability/rule/muteAll", + "alerting:metrics.alert.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.threshold/observability/rule/snooze", + "alerting:metrics.alert.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.threshold/observability/rule/runSoon", + "alerting:metrics.alert.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/create", + "alerting:metrics.alert.threshold/alerts/rule/delete", + "alerting:metrics.alert.threshold/alerts/rule/update", + "alerting:metrics.alert.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.threshold/alerts/rule/enable", + "alerting:metrics.alert.threshold/alerts/rule/disable", + "alerting:metrics.alert.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.threshold/alerts/rule/snooze", + "alerting:metrics.alert.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/alerts/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/create", + "alerting:metrics.alert.inventory.threshold/observability/rule/delete", + "alerting:metrics.alert.inventory.threshold/observability/rule/update", + "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/observability/rule/enable", + "alerting:metrics.alert.inventory.threshold/observability/rule/disable", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/create", + "alerting:metrics.alert.inventory.threshold/alerts/rule/delete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/update", + "alerting:metrics.alert.inventory.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/alerts/rule/enable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/disable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/snooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/create", + "alerting:xpack.uptime.alerts.tls/observability/rule/delete", + "alerting:xpack.uptime.alerts.tls/observability/rule/update", + "alerting:xpack.uptime.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/observability/rule/enable", + "alerting:xpack.uptime.alerts.tls/observability/rule/disable", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/create", + "alerting:xpack.uptime.alerts.tls/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/update", + "alerting:xpack.uptime.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/deleteBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/create", + "alerting:logs.alert.document.count/observability/rule/delete", + "alerting:logs.alert.document.count/observability/rule/update", + "alerting:logs.alert.document.count/observability/rule/updateApiKey", + "alerting:logs.alert.document.count/observability/rule/enable", + "alerting:logs.alert.document.count/observability/rule/disable", + "alerting:logs.alert.document.count/observability/rule/muteAll", + "alerting:logs.alert.document.count/observability/rule/unmuteAll", + "alerting:logs.alert.document.count/observability/rule/muteAlert", + "alerting:logs.alert.document.count/observability/rule/unmuteAlert", + "alerting:logs.alert.document.count/observability/rule/snooze", + "alerting:logs.alert.document.count/observability/rule/bulkEdit", + "alerting:logs.alert.document.count/observability/rule/bulkDelete", + "alerting:logs.alert.document.count/observability/rule/bulkEnable", + "alerting:logs.alert.document.count/observability/rule/bulkDisable", + "alerting:logs.alert.document.count/observability/rule/unsnooze", + "alerting:logs.alert.document.count/observability/rule/runSoon", + "alerting:logs.alert.document.count/observability/rule/scheduleBackfill", + "alerting:logs.alert.document.count/observability/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", "alerting:slo.rules.burnRate/observability/rule/get", "alerting:slo.rules.burnRate/observability/rule/getRuleState", "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", @@ -7966,6 +14979,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:observability.rules.custom_threshold/observability/rule/runSoon", "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", "alerting:.es-query/observability/rule/get", "alerting:.es-query/observability/rule/getRuleState", "alerting:.es-query/observability/rule/getAlertSummary", @@ -7994,6 +15035,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:.es-query/observability/rule/runSoon", "alerting:.es-query/observability/rule/scheduleBackfill", "alerting:.es-query/observability/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", @@ -8022,34 +15091,334 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/create", - "alerting:metrics.alert.inventory.threshold/observability/rule/delete", - "alerting:metrics.alert.inventory.threshold/observability/rule/update", - "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/observability/rule/enable", - "alerting:metrics.alert.inventory.threshold/observability/rule/disable", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", + "alerting:apm.error_rate/observability/alert/get", + "alerting:apm.error_rate/observability/alert/find", + "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/update", + "alerting:apm.transaction_error_rate/observability/alert/get", + "alerting:apm.transaction_error_rate/observability/alert/find", + "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/update", + "alerting:apm.transaction_duration/observability/alert/get", + "alerting:apm.transaction_duration/observability/alert/find", + "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/update", + "alerting:apm.anomaly/observability/alert/get", + "alerting:apm.anomaly/observability/alert/find", + "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/observability/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.synthetics.alerts.tls/observability/alert/get", + "alerting:xpack.synthetics.alerts.tls/observability/alert/find", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/update", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/update", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/update", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/update", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/update", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/update", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/update", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", + ], + "minimal_all": Array [ + "login:", + "api:slo_write", + "api:slo_read", + "api:rac", + "app:slo", + "app:kibana", + "ui:catalogue/slo", + "ui:catalogue/observability", + "ui:navLinks/slo", + "ui:navLinks/kibana", + "saved_object:slo/bulk_get", + "saved_object:slo/get", + "saved_object:slo/find", + "saved_object:slo/open_point_in_time", + "saved_object:slo/close_point_in_time", + "saved_object:slo/create", + "saved_object:slo/bulk_create", + "saved_object:slo/update", + "saved_object:slo/bulk_update", + "saved_object:slo/delete", + "saved_object:slo/bulk_delete", + "saved_object:slo/share_to_space", + "saved_object:slo-settings/bulk_get", + "saved_object:slo-settings/get", + "saved_object:slo-settings/find", + "saved_object:slo-settings/open_point_in_time", + "saved_object:slo-settings/close_point_in_time", + "saved_object:slo-settings/create", + "saved_object:slo-settings/bulk_create", + "saved_object:slo-settings/update", + "saved_object:slo-settings/bulk_update", + "saved_object:slo-settings/delete", + "saved_object:slo-settings/bulk_delete", + "saved_object:slo-settings/share_to_space", + "saved_object:telemetry/bulk_get", + "saved_object:telemetry/get", + "saved_object:telemetry/find", + "saved_object:telemetry/open_point_in_time", + "saved_object:telemetry/close_point_in_time", + "saved_object:telemetry/create", + "saved_object:telemetry/bulk_create", + "saved_object:telemetry/update", + "saved_object:telemetry/bulk_update", + "saved_object:telemetry/delete", + "saved_object:telemetry/bulk_delete", + "saved_object:telemetry/share_to_space", + "saved_object:config/bulk_get", + "saved_object:config/get", + "saved_object:config/find", + "saved_object:config/open_point_in_time", + "saved_object:config/close_point_in_time", + "saved_object:config-global/bulk_get", + "saved_object:config-global/get", + "saved_object:config-global/find", + "saved_object:config-global/open_point_in_time", + "saved_object:config-global/close_point_in_time", + "saved_object:url/bulk_get", + "saved_object:url/get", + "saved_object:url/find", + "saved_object:url/open_point_in_time", + "saved_object:url/close_point_in_time", + "ui:slo/read", + "ui:slo/write", + "alerting:slo.rules.burnRate/slo/rule/get", + "alerting:slo.rules.burnRate/slo/rule/getRuleState", + "alerting:slo.rules.burnRate/slo/rule/getAlertSummary", + "alerting:slo.rules.burnRate/slo/rule/getExecutionLog", + "alerting:slo.rules.burnRate/slo/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/slo/rule/find", + "alerting:slo.rules.burnRate/slo/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/slo/rule/getBackfill", + "alerting:slo.rules.burnRate/slo/rule/findBackfill", + "alerting:slo.rules.burnRate/slo/rule/create", + "alerting:slo.rules.burnRate/slo/rule/delete", + "alerting:slo.rules.burnRate/slo/rule/update", + "alerting:slo.rules.burnRate/slo/rule/updateApiKey", + "alerting:slo.rules.burnRate/slo/rule/enable", + "alerting:slo.rules.burnRate/slo/rule/disable", + "alerting:slo.rules.burnRate/slo/rule/muteAll", + "alerting:slo.rules.burnRate/slo/rule/unmuteAll", + "alerting:slo.rules.burnRate/slo/rule/muteAlert", + "alerting:slo.rules.burnRate/slo/rule/unmuteAlert", + "alerting:slo.rules.burnRate/slo/rule/snooze", + "alerting:slo.rules.burnRate/slo/rule/bulkEdit", + "alerting:slo.rules.burnRate/slo/rule/bulkDelete", + "alerting:slo.rules.burnRate/slo/rule/bulkEnable", + "alerting:slo.rules.burnRate/slo/rule/bulkDisable", + "alerting:slo.rules.burnRate/slo/rule/unsnooze", + "alerting:slo.rules.burnRate/slo/rule/runSoon", + "alerting:slo.rules.burnRate/slo/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/slo/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/create", + "alerting:slo.rules.burnRate/alerts/rule/delete", + "alerting:slo.rules.burnRate/alerts/rule/update", + "alerting:slo.rules.burnRate/alerts/rule/updateApiKey", + "alerting:slo.rules.burnRate/alerts/rule/enable", + "alerting:slo.rules.burnRate/alerts/rule/disable", + "alerting:slo.rules.burnRate/alerts/rule/muteAll", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAll", + "alerting:slo.rules.burnRate/alerts/rule/muteAlert", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAlert", + "alerting:slo.rules.burnRate/alerts/rule/snooze", + "alerting:slo.rules.burnRate/alerts/rule/bulkEdit", + "alerting:slo.rules.burnRate/alerts/rule/bulkDelete", + "alerting:slo.rules.burnRate/alerts/rule/bulkEnable", + "alerting:slo.rules.burnRate/alerts/rule/bulkDisable", + "alerting:slo.rules.burnRate/alerts/rule/unsnooze", + "alerting:slo.rules.burnRate/alerts/rule/runSoon", + "alerting:slo.rules.burnRate/alerts/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/alerts/rule/deleteBackfill", + "alerting:slo.rules.burnRate/slo/alert/get", + "alerting:slo.rules.burnRate/slo/alert/find", + "alerting:slo.rules.burnRate/slo/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/slo/alert/getAlertSummary", + "alerting:slo.rules.burnRate/slo/alert/update", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/update", + "app:observability", + "ui:navLinks/observability", + "ui:observability/read", + "ui:observability/write", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -8078,6 +15447,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/runSoon", "alerting:apm.error_rate/observability/rule/scheduleBackfill", "alerting:apm.error_rate/observability/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/create", + "alerting:apm.error_rate/alerts/rule/delete", + "alerting:apm.error_rate/alerts/rule/update", + "alerting:apm.error_rate/alerts/rule/updateApiKey", + "alerting:apm.error_rate/alerts/rule/enable", + "alerting:apm.error_rate/alerts/rule/disable", + "alerting:apm.error_rate/alerts/rule/muteAll", + "alerting:apm.error_rate/alerts/rule/unmuteAll", + "alerting:apm.error_rate/alerts/rule/muteAlert", + "alerting:apm.error_rate/alerts/rule/unmuteAlert", + "alerting:apm.error_rate/alerts/rule/snooze", + "alerting:apm.error_rate/alerts/rule/bulkEdit", + "alerting:apm.error_rate/alerts/rule/bulkDelete", + "alerting:apm.error_rate/alerts/rule/bulkEnable", + "alerting:apm.error_rate/alerts/rule/bulkDisable", + "alerting:apm.error_rate/alerts/rule/unsnooze", + "alerting:apm.error_rate/alerts/rule/runSoon", + "alerting:apm.error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", "alerting:apm.transaction_error_rate/observability/rule/getRuleState", "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", @@ -8106,6 +15503,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/observability/rule/runSoon", "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/create", + "alerting:apm.transaction_error_rate/alerts/rule/delete", + "alerting:apm.transaction_error_rate/alerts/rule/update", + "alerting:apm.transaction_error_rate/alerts/rule/updateApiKey", + "alerting:apm.transaction_error_rate/alerts/rule/enable", + "alerting:apm.transaction_error_rate/alerts/rule/disable", + "alerting:apm.transaction_error_rate/alerts/rule/muteAll", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAll", + "alerting:apm.transaction_error_rate/alerts/rule/muteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/snooze", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEdit", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDelete", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEnable", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDisable", + "alerting:apm.transaction_error_rate/alerts/rule/unsnooze", + "alerting:apm.transaction_error_rate/alerts/rule/runSoon", + "alerting:apm.transaction_error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_duration/observability/rule/get", "alerting:apm.transaction_duration/observability/rule/getRuleState", "alerting:apm.transaction_duration/observability/rule/getAlertSummary", @@ -8134,6 +15559,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/observability/rule/runSoon", "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", "alerting:apm.transaction_duration/observability/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/create", + "alerting:apm.transaction_duration/alerts/rule/delete", + "alerting:apm.transaction_duration/alerts/rule/update", + "alerting:apm.transaction_duration/alerts/rule/updateApiKey", + "alerting:apm.transaction_duration/alerts/rule/enable", + "alerting:apm.transaction_duration/alerts/rule/disable", + "alerting:apm.transaction_duration/alerts/rule/muteAll", + "alerting:apm.transaction_duration/alerts/rule/unmuteAll", + "alerting:apm.transaction_duration/alerts/rule/muteAlert", + "alerting:apm.transaction_duration/alerts/rule/unmuteAlert", + "alerting:apm.transaction_duration/alerts/rule/snooze", + "alerting:apm.transaction_duration/alerts/rule/bulkEdit", + "alerting:apm.transaction_duration/alerts/rule/bulkDelete", + "alerting:apm.transaction_duration/alerts/rule/bulkEnable", + "alerting:apm.transaction_duration/alerts/rule/bulkDisable", + "alerting:apm.transaction_duration/alerts/rule/unsnooze", + "alerting:apm.transaction_duration/alerts/rule/runSoon", + "alerting:apm.transaction_duration/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_duration/alerts/rule/deleteBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -8162,6 +15615,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/runSoon", "alerting:apm.anomaly/observability/rule/scheduleBackfill", "alerting:apm.anomaly/observability/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/create", + "alerting:apm.anomaly/alerts/rule/delete", + "alerting:apm.anomaly/alerts/rule/update", + "alerting:apm.anomaly/alerts/rule/updateApiKey", + "alerting:apm.anomaly/alerts/rule/enable", + "alerting:apm.anomaly/alerts/rule/disable", + "alerting:apm.anomaly/alerts/rule/muteAll", + "alerting:apm.anomaly/alerts/rule/unmuteAll", + "alerting:apm.anomaly/alerts/rule/muteAlert", + "alerting:apm.anomaly/alerts/rule/unmuteAlert", + "alerting:apm.anomaly/alerts/rule/snooze", + "alerting:apm.anomaly/alerts/rule/bulkEdit", + "alerting:apm.anomaly/alerts/rule/bulkDelete", + "alerting:apm.anomaly/alerts/rule/bulkEnable", + "alerting:apm.anomaly/alerts/rule/bulkDisable", + "alerting:apm.anomaly/alerts/rule/unsnooze", + "alerting:apm.anomaly/alerts/rule/runSoon", + "alerting:apm.anomaly/alerts/rule/scheduleBackfill", + "alerting:apm.anomaly/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", @@ -8190,6 +15671,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/runSoon", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/get", "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", @@ -8218,61 +15727,787 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:slo.rules.burnRate/observability/alert/update", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/update", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/deleteBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/create", + "alerting:metrics.alert.threshold/observability/rule/delete", + "alerting:metrics.alert.threshold/observability/rule/update", + "alerting:metrics.alert.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.threshold/observability/rule/enable", + "alerting:metrics.alert.threshold/observability/rule/disable", + "alerting:metrics.alert.threshold/observability/rule/muteAll", + "alerting:metrics.alert.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.threshold/observability/rule/snooze", + "alerting:metrics.alert.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.threshold/observability/rule/runSoon", + "alerting:metrics.alert.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/create", + "alerting:metrics.alert.threshold/alerts/rule/delete", + "alerting:metrics.alert.threshold/alerts/rule/update", + "alerting:metrics.alert.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.threshold/alerts/rule/enable", + "alerting:metrics.alert.threshold/alerts/rule/disable", + "alerting:metrics.alert.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.threshold/alerts/rule/snooze", + "alerting:metrics.alert.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/alerts/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/create", + "alerting:metrics.alert.inventory.threshold/observability/rule/delete", + "alerting:metrics.alert.inventory.threshold/observability/rule/update", + "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/observability/rule/enable", + "alerting:metrics.alert.inventory.threshold/observability/rule/disable", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/create", + "alerting:metrics.alert.inventory.threshold/alerts/rule/delete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/update", + "alerting:metrics.alert.inventory.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/alerts/rule/enable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/disable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/snooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/create", + "alerting:xpack.uptime.alerts.tls/observability/rule/delete", + "alerting:xpack.uptime.alerts.tls/observability/rule/update", + "alerting:xpack.uptime.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/observability/rule/enable", + "alerting:xpack.uptime.alerts.tls/observability/rule/disable", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/create", + "alerting:xpack.uptime.alerts.tls/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/update", + "alerting:xpack.uptime.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/deleteBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/create", + "alerting:logs.alert.document.count/observability/rule/delete", + "alerting:logs.alert.document.count/observability/rule/update", + "alerting:logs.alert.document.count/observability/rule/updateApiKey", + "alerting:logs.alert.document.count/observability/rule/enable", + "alerting:logs.alert.document.count/observability/rule/disable", + "alerting:logs.alert.document.count/observability/rule/muteAll", + "alerting:logs.alert.document.count/observability/rule/unmuteAll", + "alerting:logs.alert.document.count/observability/rule/muteAlert", + "alerting:logs.alert.document.count/observability/rule/unmuteAlert", + "alerting:logs.alert.document.count/observability/rule/snooze", + "alerting:logs.alert.document.count/observability/rule/bulkEdit", + "alerting:logs.alert.document.count/observability/rule/bulkDelete", + "alerting:logs.alert.document.count/observability/rule/bulkEnable", + "alerting:logs.alert.document.count/observability/rule/bulkDisable", + "alerting:logs.alert.document.count/observability/rule/unsnooze", + "alerting:logs.alert.document.count/observability/rule/runSoon", + "alerting:logs.alert.document.count/observability/rule/scheduleBackfill", + "alerting:logs.alert.document.count/observability/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/create", + "alerting:slo.rules.burnRate/observability/rule/delete", + "alerting:slo.rules.burnRate/observability/rule/update", + "alerting:slo.rules.burnRate/observability/rule/updateApiKey", + "alerting:slo.rules.burnRate/observability/rule/enable", + "alerting:slo.rules.burnRate/observability/rule/disable", + "alerting:slo.rules.burnRate/observability/rule/muteAll", + "alerting:slo.rules.burnRate/observability/rule/unmuteAll", + "alerting:slo.rules.burnRate/observability/rule/muteAlert", + "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", + "alerting:slo.rules.burnRate/observability/rule/snooze", + "alerting:slo.rules.burnRate/observability/rule/bulkEdit", + "alerting:slo.rules.burnRate/observability/rule/bulkDelete", + "alerting:slo.rules.burnRate/observability/rule/bulkEnable", + "alerting:slo.rules.burnRate/observability/rule/bulkDisable", + "alerting:slo.rules.burnRate/observability/rule/unsnooze", + "alerting:slo.rules.burnRate/observability/rule/runSoon", + "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/create", + "alerting:observability.rules.custom_threshold/observability/rule/delete", + "alerting:observability.rules.custom_threshold/observability/rule/update", + "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/observability/rule/enable", + "alerting:observability.rules.custom_threshold/observability/rule/disable", + "alerting:observability.rules.custom_threshold/observability/rule/muteAll", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/snooze", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", + "alerting:observability.rules.custom_threshold/observability/rule/runSoon", + "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/create", + "alerting:.es-query/observability/rule/delete", + "alerting:.es-query/observability/rule/update", + "alerting:.es-query/observability/rule/updateApiKey", + "alerting:.es-query/observability/rule/enable", + "alerting:.es-query/observability/rule/disable", + "alerting:.es-query/observability/rule/muteAll", + "alerting:.es-query/observability/rule/unmuteAll", + "alerting:.es-query/observability/rule/muteAlert", + "alerting:.es-query/observability/rule/unmuteAlert", + "alerting:.es-query/observability/rule/snooze", + "alerting:.es-query/observability/rule/bulkEdit", + "alerting:.es-query/observability/rule/bulkDelete", + "alerting:.es-query/observability/rule/bulkEnable", + "alerting:.es-query/observability/rule/bulkDisable", + "alerting:.es-query/observability/rule/unsnooze", + "alerting:.es-query/observability/rule/runSoon", + "alerting:.es-query/observability/rule/scheduleBackfill", + "alerting:.es-query/observability/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/update", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/update", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/update", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", "alerting:apm.anomaly/observability/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/update", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/update", "alerting:xpack.synthetics.alerts.tls/observability/alert/get", "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/update", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/update", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/update", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/update", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/update", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/update", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/update", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", ], "minimal_read": Array [ "login:", @@ -8324,58 +16559,26 @@ export default function ({ getService }: FtrProviderContext) { "alerting:slo.rules.burnRate/slo/rule/getRuleExecutionKPI", "alerting:slo.rules.burnRate/slo/rule/getBackfill", "alerting:slo.rules.burnRate/slo/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", "alerting:slo.rules.burnRate/slo/alert/get", "alerting:slo.rules.burnRate/slo/alert/find", "alerting:slo.rules.burnRate/slo/alert/getAuthorizedAlertsIndices", "alerting:slo.rules.burnRate/slo/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", "app:observability", "ui:navLinks/observability", "ui:observability/read", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -8385,6 +16588,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.error_rate/observability/rule/getBackfill", "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", "alerting:apm.transaction_error_rate/observability/rule/getRuleState", "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", @@ -8394,6 +16606,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_error_rate/observability/rule/getBackfill", "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_duration/observability/rule/get", "alerting:apm.transaction_duration/observability/rule/getRuleState", "alerting:apm.transaction_duration/observability/rule/getAlertSummary", @@ -8403,6 +16624,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_duration/observability/rule/getBackfill", "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -8412,6 +16642,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", "alerting:apm.anomaly/observability/rule/getBackfill", "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", @@ -8421,6 +16660,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/get", "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", @@ -8430,50 +16678,336 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/observability/alert/get", "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", ], "read": Array [ "login:", @@ -8525,58 +17059,26 @@ export default function ({ getService }: FtrProviderContext) { "alerting:slo.rules.burnRate/slo/rule/getRuleExecutionKPI", "alerting:slo.rules.burnRate/slo/rule/getBackfill", "alerting:slo.rules.burnRate/slo/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", "alerting:slo.rules.burnRate/slo/alert/get", "alerting:slo.rules.burnRate/slo/alert/find", "alerting:slo.rules.burnRate/slo/alert/getAuthorizedAlertsIndices", "alerting:slo.rules.burnRate/slo/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", "app:observability", "ui:navLinks/observability", "ui:observability/read", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -8586,6 +17088,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.error_rate/observability/rule/getBackfill", "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", "alerting:apm.transaction_error_rate/observability/rule/getRuleState", "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", @@ -8595,6 +17106,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_error_rate/observability/rule/getBackfill", "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_duration/observability/rule/get", "alerting:apm.transaction_duration/observability/rule/getRuleState", "alerting:apm.transaction_duration/observability/rule/getAlertSummary", @@ -8604,6 +17124,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_duration/observability/rule/getBackfill", "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -8613,6 +17142,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", "alerting:apm.anomaly/observability/rule/getBackfill", "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", @@ -8622,6 +17160,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/get", "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/observability/rule/getAlertSummary", @@ -8631,50 +17178,336 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/observability/alert/get", "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", ], }, "uptime": Object { @@ -8838,6 +17671,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.tls/uptime/rule/runSoon", "alerting:xpack.uptime.alerts.tls/uptime/rule/scheduleBackfill", "alerting:xpack.uptime.alerts.tls/uptime/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/create", + "alerting:xpack.uptime.alerts.tls/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/update", + "alerting:xpack.uptime.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/deleteBackfill", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/get", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getAlertSummary", @@ -8866,6 +17727,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/runSoon", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/scheduleBackfill", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/deleteBackfill", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/get", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getAlertSummary", @@ -8894,6 +17783,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/runSoon", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/scheduleBackfill", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/deleteBackfill", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/get", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getAlertSummary", @@ -8922,6 +17839,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/runSoon", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/scheduleBackfill", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getAlertSummary", @@ -8950,6 +17895,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/runSoon", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.tls/uptime/rule/get", "alerting:xpack.synthetics.alerts.tls/uptime/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/uptime/rule/getAlertSummary", @@ -8978,181 +17951,99 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/uptime/rule/runSoon", "alerting:xpack.synthetics.alerts.tls/uptime/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.tls/uptime/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/deleteBackfill", "alerting:xpack.uptime.alerts.tls/uptime/alert/get", "alerting:xpack.uptime.alerts.tls/uptime/alert/find", "alerting:xpack.uptime.alerts.tls/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.tls/uptime/alert/getAlertSummary", "alerting:xpack.uptime.alerts.tls/uptime/alert/update", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/update", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/get", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/find", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/getAlertSummary", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/update", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/get", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/find", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/getAlertSummary", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/update", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/get", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/find", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/getAlertSummary", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/update", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/update", "alerting:xpack.synthetics.alerts.tls/uptime/alert/get", "alerting:xpack.synthetics.alerts.tls/uptime/alert/find", "alerting:xpack.synthetics.alerts.tls/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/uptime/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/uptime/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/update", "app:observability", "ui:catalogue/observability", "ui:navLinks/observability", "ui:observability/read", "ui:observability/write", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/rule/create", - "alerting:slo.rules.burnRate/observability/rule/delete", - "alerting:slo.rules.burnRate/observability/rule/update", - "alerting:slo.rules.burnRate/observability/rule/updateApiKey", - "alerting:slo.rules.burnRate/observability/rule/enable", - "alerting:slo.rules.burnRate/observability/rule/disable", - "alerting:slo.rules.burnRate/observability/rule/muteAll", - "alerting:slo.rules.burnRate/observability/rule/unmuteAll", - "alerting:slo.rules.burnRate/observability/rule/muteAlert", - "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", - "alerting:slo.rules.burnRate/observability/rule/snooze", - "alerting:slo.rules.burnRate/observability/rule/bulkEdit", - "alerting:slo.rules.burnRate/observability/rule/bulkDelete", - "alerting:slo.rules.burnRate/observability/rule/bulkEnable", - "alerting:slo.rules.burnRate/observability/rule/bulkDisable", - "alerting:slo.rules.burnRate/observability/rule/unsnooze", - "alerting:slo.rules.burnRate/observability/rule/runSoon", - "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", - "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/create", - "alerting:observability.rules.custom_threshold/observability/rule/delete", - "alerting:observability.rules.custom_threshold/observability/rule/update", - "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/observability/rule/enable", - "alerting:observability.rules.custom_threshold/observability/rule/disable", - "alerting:observability.rules.custom_threshold/observability/rule/muteAll", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/snooze", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", - "alerting:observability.rules.custom_threshold/observability/rule/runSoon", - "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/create", - "alerting:.es-query/observability/rule/delete", - "alerting:.es-query/observability/rule/update", - "alerting:.es-query/observability/rule/updateApiKey", - "alerting:.es-query/observability/rule/enable", - "alerting:.es-query/observability/rule/disable", - "alerting:.es-query/observability/rule/muteAll", - "alerting:.es-query/observability/rule/unmuteAll", - "alerting:.es-query/observability/rule/muteAlert", - "alerting:.es-query/observability/rule/unmuteAlert", - "alerting:.es-query/observability/rule/snooze", - "alerting:.es-query/observability/rule/bulkEdit", - "alerting:.es-query/observability/rule/bulkDelete", - "alerting:.es-query/observability/rule/bulkEnable", - "alerting:.es-query/observability/rule/bulkDisable", - "alerting:.es-query/observability/rule/unsnooze", - "alerting:.es-query/observability/rule/runSoon", - "alerting:.es-query/observability/rule/scheduleBackfill", - "alerting:.es-query/observability/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/create", - "alerting:metrics.alert.inventory.threshold/observability/rule/delete", - "alerting:metrics.alert.inventory.threshold/observability/rule/update", - "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/observability/rule/enable", - "alerting:metrics.alert.inventory.threshold/observability/rule/disable", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -9181,6 +18072,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/runSoon", "alerting:apm.error_rate/observability/rule/scheduleBackfill", "alerting:apm.error_rate/observability/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/create", + "alerting:apm.error_rate/alerts/rule/delete", + "alerting:apm.error_rate/alerts/rule/update", + "alerting:apm.error_rate/alerts/rule/updateApiKey", + "alerting:apm.error_rate/alerts/rule/enable", + "alerting:apm.error_rate/alerts/rule/disable", + "alerting:apm.error_rate/alerts/rule/muteAll", + "alerting:apm.error_rate/alerts/rule/unmuteAll", + "alerting:apm.error_rate/alerts/rule/muteAlert", + "alerting:apm.error_rate/alerts/rule/unmuteAlert", + "alerting:apm.error_rate/alerts/rule/snooze", + "alerting:apm.error_rate/alerts/rule/bulkEdit", + "alerting:apm.error_rate/alerts/rule/bulkDelete", + "alerting:apm.error_rate/alerts/rule/bulkEnable", + "alerting:apm.error_rate/alerts/rule/bulkDisable", + "alerting:apm.error_rate/alerts/rule/unsnooze", + "alerting:apm.error_rate/alerts/rule/runSoon", + "alerting:apm.error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", "alerting:apm.transaction_error_rate/observability/rule/getRuleState", "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", @@ -9209,6 +18128,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/observability/rule/runSoon", "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/create", + "alerting:apm.transaction_error_rate/alerts/rule/delete", + "alerting:apm.transaction_error_rate/alerts/rule/update", + "alerting:apm.transaction_error_rate/alerts/rule/updateApiKey", + "alerting:apm.transaction_error_rate/alerts/rule/enable", + "alerting:apm.transaction_error_rate/alerts/rule/disable", + "alerting:apm.transaction_error_rate/alerts/rule/muteAll", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAll", + "alerting:apm.transaction_error_rate/alerts/rule/muteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/snooze", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEdit", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDelete", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEnable", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDisable", + "alerting:apm.transaction_error_rate/alerts/rule/unsnooze", + "alerting:apm.transaction_error_rate/alerts/rule/runSoon", + "alerting:apm.transaction_error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_duration/observability/rule/get", "alerting:apm.transaction_duration/observability/rule/getRuleState", "alerting:apm.transaction_duration/observability/rule/getAlertSummary", @@ -9237,6 +18184,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/observability/rule/runSoon", "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", "alerting:apm.transaction_duration/observability/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/create", + "alerting:apm.transaction_duration/alerts/rule/delete", + "alerting:apm.transaction_duration/alerts/rule/update", + "alerting:apm.transaction_duration/alerts/rule/updateApiKey", + "alerting:apm.transaction_duration/alerts/rule/enable", + "alerting:apm.transaction_duration/alerts/rule/disable", + "alerting:apm.transaction_duration/alerts/rule/muteAll", + "alerting:apm.transaction_duration/alerts/rule/unmuteAll", + "alerting:apm.transaction_duration/alerts/rule/muteAlert", + "alerting:apm.transaction_duration/alerts/rule/unmuteAlert", + "alerting:apm.transaction_duration/alerts/rule/snooze", + "alerting:apm.transaction_duration/alerts/rule/bulkEdit", + "alerting:apm.transaction_duration/alerts/rule/bulkDelete", + "alerting:apm.transaction_duration/alerts/rule/bulkEnable", + "alerting:apm.transaction_duration/alerts/rule/bulkDisable", + "alerting:apm.transaction_duration/alerts/rule/unsnooze", + "alerting:apm.transaction_duration/alerts/rule/runSoon", + "alerting:apm.transaction_duration/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_duration/alerts/rule/deleteBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -9265,6 +18240,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/runSoon", "alerting:apm.anomaly/observability/rule/scheduleBackfill", "alerting:apm.anomaly/observability/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/create", + "alerting:apm.anomaly/alerts/rule/delete", + "alerting:apm.anomaly/alerts/rule/update", + "alerting:apm.anomaly/alerts/rule/updateApiKey", + "alerting:apm.anomaly/alerts/rule/enable", + "alerting:apm.anomaly/alerts/rule/disable", + "alerting:apm.anomaly/alerts/rule/muteAll", + "alerting:apm.anomaly/alerts/rule/unmuteAll", + "alerting:apm.anomaly/alerts/rule/muteAlert", + "alerting:apm.anomaly/alerts/rule/unmuteAlert", + "alerting:apm.anomaly/alerts/rule/snooze", + "alerting:apm.anomaly/alerts/rule/bulkEdit", + "alerting:apm.anomaly/alerts/rule/bulkDelete", + "alerting:apm.anomaly/alerts/rule/bulkEnable", + "alerting:apm.anomaly/alerts/rule/bulkDisable", + "alerting:apm.anomaly/alerts/rule/unsnooze", + "alerting:apm.anomaly/alerts/rule/runSoon", + "alerting:apm.anomaly/alerts/rule/scheduleBackfill", + "alerting:apm.anomaly/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", @@ -9321,51 +18324,550 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:slo.rules.burnRate/observability/alert/update", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/update", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/create", + "alerting:metrics.alert.threshold/observability/rule/delete", + "alerting:metrics.alert.threshold/observability/rule/update", + "alerting:metrics.alert.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.threshold/observability/rule/enable", + "alerting:metrics.alert.threshold/observability/rule/disable", + "alerting:metrics.alert.threshold/observability/rule/muteAll", + "alerting:metrics.alert.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.threshold/observability/rule/snooze", + "alerting:metrics.alert.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.threshold/observability/rule/runSoon", + "alerting:metrics.alert.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/create", + "alerting:metrics.alert.threshold/alerts/rule/delete", + "alerting:metrics.alert.threshold/alerts/rule/update", + "alerting:metrics.alert.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.threshold/alerts/rule/enable", + "alerting:metrics.alert.threshold/alerts/rule/disable", + "alerting:metrics.alert.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.threshold/alerts/rule/snooze", + "alerting:metrics.alert.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/alerts/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/create", + "alerting:metrics.alert.inventory.threshold/observability/rule/delete", + "alerting:metrics.alert.inventory.threshold/observability/rule/update", + "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/observability/rule/enable", + "alerting:metrics.alert.inventory.threshold/observability/rule/disable", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/create", + "alerting:metrics.alert.inventory.threshold/alerts/rule/delete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/update", + "alerting:metrics.alert.inventory.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/alerts/rule/enable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/disable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/snooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/create", + "alerting:xpack.uptime.alerts.tls/observability/rule/delete", + "alerting:xpack.uptime.alerts.tls/observability/rule/update", + "alerting:xpack.uptime.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/observability/rule/enable", + "alerting:xpack.uptime.alerts.tls/observability/rule/disable", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/deleteBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/create", + "alerting:logs.alert.document.count/observability/rule/delete", + "alerting:logs.alert.document.count/observability/rule/update", + "alerting:logs.alert.document.count/observability/rule/updateApiKey", + "alerting:logs.alert.document.count/observability/rule/enable", + "alerting:logs.alert.document.count/observability/rule/disable", + "alerting:logs.alert.document.count/observability/rule/muteAll", + "alerting:logs.alert.document.count/observability/rule/unmuteAll", + "alerting:logs.alert.document.count/observability/rule/muteAlert", + "alerting:logs.alert.document.count/observability/rule/unmuteAlert", + "alerting:logs.alert.document.count/observability/rule/snooze", + "alerting:logs.alert.document.count/observability/rule/bulkEdit", + "alerting:logs.alert.document.count/observability/rule/bulkDelete", + "alerting:logs.alert.document.count/observability/rule/bulkEnable", + "alerting:logs.alert.document.count/observability/rule/bulkDisable", + "alerting:logs.alert.document.count/observability/rule/unsnooze", + "alerting:logs.alert.document.count/observability/rule/runSoon", + "alerting:logs.alert.document.count/observability/rule/scheduleBackfill", + "alerting:logs.alert.document.count/observability/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/create", + "alerting:slo.rules.burnRate/observability/rule/delete", + "alerting:slo.rules.burnRate/observability/rule/update", + "alerting:slo.rules.burnRate/observability/rule/updateApiKey", + "alerting:slo.rules.burnRate/observability/rule/enable", + "alerting:slo.rules.burnRate/observability/rule/disable", + "alerting:slo.rules.burnRate/observability/rule/muteAll", + "alerting:slo.rules.burnRate/observability/rule/unmuteAll", + "alerting:slo.rules.burnRate/observability/rule/muteAlert", + "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", + "alerting:slo.rules.burnRate/observability/rule/snooze", + "alerting:slo.rules.burnRate/observability/rule/bulkEdit", + "alerting:slo.rules.burnRate/observability/rule/bulkDelete", + "alerting:slo.rules.burnRate/observability/rule/bulkEnable", + "alerting:slo.rules.burnRate/observability/rule/bulkDisable", + "alerting:slo.rules.burnRate/observability/rule/unsnooze", + "alerting:slo.rules.burnRate/observability/rule/runSoon", + "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/create", + "alerting:slo.rules.burnRate/alerts/rule/delete", + "alerting:slo.rules.burnRate/alerts/rule/update", + "alerting:slo.rules.burnRate/alerts/rule/updateApiKey", + "alerting:slo.rules.burnRate/alerts/rule/enable", + "alerting:slo.rules.burnRate/alerts/rule/disable", + "alerting:slo.rules.burnRate/alerts/rule/muteAll", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAll", + "alerting:slo.rules.burnRate/alerts/rule/muteAlert", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAlert", + "alerting:slo.rules.burnRate/alerts/rule/snooze", + "alerting:slo.rules.burnRate/alerts/rule/bulkEdit", + "alerting:slo.rules.burnRate/alerts/rule/bulkDelete", + "alerting:slo.rules.burnRate/alerts/rule/bulkEnable", + "alerting:slo.rules.burnRate/alerts/rule/bulkDisable", + "alerting:slo.rules.burnRate/alerts/rule/unsnooze", + "alerting:slo.rules.burnRate/alerts/rule/runSoon", + "alerting:slo.rules.burnRate/alerts/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/alerts/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/create", + "alerting:observability.rules.custom_threshold/observability/rule/delete", + "alerting:observability.rules.custom_threshold/observability/rule/update", + "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/observability/rule/enable", + "alerting:observability.rules.custom_threshold/observability/rule/disable", + "alerting:observability.rules.custom_threshold/observability/rule/muteAll", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/snooze", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", + "alerting:observability.rules.custom_threshold/observability/rule/runSoon", + "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/create", + "alerting:.es-query/observability/rule/delete", + "alerting:.es-query/observability/rule/update", + "alerting:.es-query/observability/rule/updateApiKey", + "alerting:.es-query/observability/rule/enable", + "alerting:.es-query/observability/rule/disable", + "alerting:.es-query/observability/rule/muteAll", + "alerting:.es-query/observability/rule/unmuteAll", + "alerting:.es-query/observability/rule/muteAlert", + "alerting:.es-query/observability/rule/unmuteAlert", + "alerting:.es-query/observability/rule/snooze", + "alerting:.es-query/observability/rule/bulkEdit", + "alerting:.es-query/observability/rule/bulkDelete", + "alerting:.es-query/observability/rule/bulkEnable", + "alerting:.es-query/observability/rule/bulkDisable", + "alerting:.es-query/observability/rule/unsnooze", + "alerting:.es-query/observability/rule/runSoon", + "alerting:.es-query/observability/rule/scheduleBackfill", + "alerting:.es-query/observability/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/update", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/update", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/update", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", "alerting:apm.anomaly/observability/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/update", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", @@ -9376,6 +18878,96 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/update", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/update", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/update", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/update", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/update", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/update", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", ], "can_manage_private_locations": Array [ "login:", @@ -9553,6 +19145,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.tls/uptime/rule/runSoon", "alerting:xpack.uptime.alerts.tls/uptime/rule/scheduleBackfill", "alerting:xpack.uptime.alerts.tls/uptime/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/create", + "alerting:xpack.uptime.alerts.tls/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/update", + "alerting:xpack.uptime.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/deleteBackfill", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/get", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getAlertSummary", @@ -9581,6 +19201,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/runSoon", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/scheduleBackfill", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/deleteBackfill", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/get", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getAlertSummary", @@ -9609,6 +19257,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/runSoon", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/scheduleBackfill", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/deleteBackfill", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/get", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getAlertSummary", @@ -9637,6 +19313,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/runSoon", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/scheduleBackfill", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getAlertSummary", @@ -9665,6 +19369,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/runSoon", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/create", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.tls/uptime/rule/get", "alerting:xpack.synthetics.alerts.tls/uptime/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/uptime/rule/getAlertSummary", @@ -9693,181 +19425,99 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/uptime/rule/runSoon", "alerting:xpack.synthetics.alerts.tls/uptime/rule/scheduleBackfill", "alerting:xpack.synthetics.alerts.tls/uptime/rule/deleteBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/create", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/delete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/update", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/updateApiKey", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/enable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/disable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAll", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/muteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unmuteAlert", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/snooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEdit", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDelete", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkEnable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/deleteBackfill", "alerting:xpack.uptime.alerts.tls/uptime/alert/get", "alerting:xpack.uptime.alerts.tls/uptime/alert/find", "alerting:xpack.uptime.alerts.tls/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.tls/uptime/alert/getAlertSummary", "alerting:xpack.uptime.alerts.tls/uptime/alert/update", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/update", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/get", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/find", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/getAlertSummary", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/update", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/get", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/find", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/getAlertSummary", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/update", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/get", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/find", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/getAlertSummary", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/update", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/update", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/update", "alerting:xpack.synthetics.alerts.tls/uptime/alert/get", "alerting:xpack.synthetics.alerts.tls/uptime/alert/find", "alerting:xpack.synthetics.alerts.tls/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/uptime/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/uptime/alert/update", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/update", "app:observability", "ui:catalogue/observability", "ui:navLinks/observability", "ui:observability/read", "ui:observability/write", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/rule/create", - "alerting:slo.rules.burnRate/observability/rule/delete", - "alerting:slo.rules.burnRate/observability/rule/update", - "alerting:slo.rules.burnRate/observability/rule/updateApiKey", - "alerting:slo.rules.burnRate/observability/rule/enable", - "alerting:slo.rules.burnRate/observability/rule/disable", - "alerting:slo.rules.burnRate/observability/rule/muteAll", - "alerting:slo.rules.burnRate/observability/rule/unmuteAll", - "alerting:slo.rules.burnRate/observability/rule/muteAlert", - "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", - "alerting:slo.rules.burnRate/observability/rule/snooze", - "alerting:slo.rules.burnRate/observability/rule/bulkEdit", - "alerting:slo.rules.burnRate/observability/rule/bulkDelete", - "alerting:slo.rules.burnRate/observability/rule/bulkEnable", - "alerting:slo.rules.burnRate/observability/rule/bulkDisable", - "alerting:slo.rules.burnRate/observability/rule/unsnooze", - "alerting:slo.rules.burnRate/observability/rule/runSoon", - "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", - "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/create", - "alerting:observability.rules.custom_threshold/observability/rule/delete", - "alerting:observability.rules.custom_threshold/observability/rule/update", - "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", - "alerting:observability.rules.custom_threshold/observability/rule/enable", - "alerting:observability.rules.custom_threshold/observability/rule/disable", - "alerting:observability.rules.custom_threshold/observability/rule/muteAll", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", - "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", - "alerting:observability.rules.custom_threshold/observability/rule/snooze", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", - "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", - "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", - "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", - "alerting:observability.rules.custom_threshold/observability/rule/runSoon", - "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/create", - "alerting:.es-query/observability/rule/delete", - "alerting:.es-query/observability/rule/update", - "alerting:.es-query/observability/rule/updateApiKey", - "alerting:.es-query/observability/rule/enable", - "alerting:.es-query/observability/rule/disable", - "alerting:.es-query/observability/rule/muteAll", - "alerting:.es-query/observability/rule/unmuteAll", - "alerting:.es-query/observability/rule/muteAlert", - "alerting:.es-query/observability/rule/unmuteAlert", - "alerting:.es-query/observability/rule/snooze", - "alerting:.es-query/observability/rule/bulkEdit", - "alerting:.es-query/observability/rule/bulkDelete", - "alerting:.es-query/observability/rule/bulkEnable", - "alerting:.es-query/observability/rule/bulkDisable", - "alerting:.es-query/observability/rule/unsnooze", - "alerting:.es-query/observability/rule/runSoon", - "alerting:.es-query/observability/rule/scheduleBackfill", - "alerting:.es-query/observability/rule/deleteBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/create", - "alerting:metrics.alert.inventory.threshold/observability/rule/delete", - "alerting:metrics.alert.inventory.threshold/observability/rule/update", - "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", - "alerting:metrics.alert.inventory.threshold/observability/rule/enable", - "alerting:metrics.alert.inventory.threshold/observability/rule/disable", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", - "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", - "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", - "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", - "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", - "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", - "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -9896,6 +19546,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/runSoon", "alerting:apm.error_rate/observability/rule/scheduleBackfill", "alerting:apm.error_rate/observability/rule/deleteBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/create", + "alerting:apm.error_rate/alerts/rule/delete", + "alerting:apm.error_rate/alerts/rule/update", + "alerting:apm.error_rate/alerts/rule/updateApiKey", + "alerting:apm.error_rate/alerts/rule/enable", + "alerting:apm.error_rate/alerts/rule/disable", + "alerting:apm.error_rate/alerts/rule/muteAll", + "alerting:apm.error_rate/alerts/rule/unmuteAll", + "alerting:apm.error_rate/alerts/rule/muteAlert", + "alerting:apm.error_rate/alerts/rule/unmuteAlert", + "alerting:apm.error_rate/alerts/rule/snooze", + "alerting:apm.error_rate/alerts/rule/bulkEdit", + "alerting:apm.error_rate/alerts/rule/bulkDelete", + "alerting:apm.error_rate/alerts/rule/bulkEnable", + "alerting:apm.error_rate/alerts/rule/bulkDisable", + "alerting:apm.error_rate/alerts/rule/unsnooze", + "alerting:apm.error_rate/alerts/rule/runSoon", + "alerting:apm.error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", "alerting:apm.transaction_error_rate/observability/rule/getRuleState", "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", @@ -9924,6 +19602,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/observability/rule/runSoon", "alerting:apm.transaction_error_rate/observability/rule/scheduleBackfill", "alerting:apm.transaction_error_rate/observability/rule/deleteBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/create", + "alerting:apm.transaction_error_rate/alerts/rule/delete", + "alerting:apm.transaction_error_rate/alerts/rule/update", + "alerting:apm.transaction_error_rate/alerts/rule/updateApiKey", + "alerting:apm.transaction_error_rate/alerts/rule/enable", + "alerting:apm.transaction_error_rate/alerts/rule/disable", + "alerting:apm.transaction_error_rate/alerts/rule/muteAll", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAll", + "alerting:apm.transaction_error_rate/alerts/rule/muteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/unmuteAlert", + "alerting:apm.transaction_error_rate/alerts/rule/snooze", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEdit", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDelete", + "alerting:apm.transaction_error_rate/alerts/rule/bulkEnable", + "alerting:apm.transaction_error_rate/alerts/rule/bulkDisable", + "alerting:apm.transaction_error_rate/alerts/rule/unsnooze", + "alerting:apm.transaction_error_rate/alerts/rule/runSoon", + "alerting:apm.transaction_error_rate/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/deleteBackfill", "alerting:apm.transaction_duration/observability/rule/get", "alerting:apm.transaction_duration/observability/rule/getRuleState", "alerting:apm.transaction_duration/observability/rule/getAlertSummary", @@ -9952,6 +19658,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/observability/rule/runSoon", "alerting:apm.transaction_duration/observability/rule/scheduleBackfill", "alerting:apm.transaction_duration/observability/rule/deleteBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/create", + "alerting:apm.transaction_duration/alerts/rule/delete", + "alerting:apm.transaction_duration/alerts/rule/update", + "alerting:apm.transaction_duration/alerts/rule/updateApiKey", + "alerting:apm.transaction_duration/alerts/rule/enable", + "alerting:apm.transaction_duration/alerts/rule/disable", + "alerting:apm.transaction_duration/alerts/rule/muteAll", + "alerting:apm.transaction_duration/alerts/rule/unmuteAll", + "alerting:apm.transaction_duration/alerts/rule/muteAlert", + "alerting:apm.transaction_duration/alerts/rule/unmuteAlert", + "alerting:apm.transaction_duration/alerts/rule/snooze", + "alerting:apm.transaction_duration/alerts/rule/bulkEdit", + "alerting:apm.transaction_duration/alerts/rule/bulkDelete", + "alerting:apm.transaction_duration/alerts/rule/bulkEnable", + "alerting:apm.transaction_duration/alerts/rule/bulkDisable", + "alerting:apm.transaction_duration/alerts/rule/unsnooze", + "alerting:apm.transaction_duration/alerts/rule/runSoon", + "alerting:apm.transaction_duration/alerts/rule/scheduleBackfill", + "alerting:apm.transaction_duration/alerts/rule/deleteBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -9980,6 +19714,34 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/runSoon", "alerting:apm.anomaly/observability/rule/scheduleBackfill", "alerting:apm.anomaly/observability/rule/deleteBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/create", + "alerting:apm.anomaly/alerts/rule/delete", + "alerting:apm.anomaly/alerts/rule/update", + "alerting:apm.anomaly/alerts/rule/updateApiKey", + "alerting:apm.anomaly/alerts/rule/enable", + "alerting:apm.anomaly/alerts/rule/disable", + "alerting:apm.anomaly/alerts/rule/muteAll", + "alerting:apm.anomaly/alerts/rule/unmuteAll", + "alerting:apm.anomaly/alerts/rule/muteAlert", + "alerting:apm.anomaly/alerts/rule/unmuteAlert", + "alerting:apm.anomaly/alerts/rule/snooze", + "alerting:apm.anomaly/alerts/rule/bulkEdit", + "alerting:apm.anomaly/alerts/rule/bulkDelete", + "alerting:apm.anomaly/alerts/rule/bulkEnable", + "alerting:apm.anomaly/alerts/rule/bulkDisable", + "alerting:apm.anomaly/alerts/rule/unsnooze", + "alerting:apm.anomaly/alerts/rule/runSoon", + "alerting:apm.anomaly/alerts/rule/scheduleBackfill", + "alerting:apm.anomaly/alerts/rule/deleteBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", @@ -10031,56 +19793,555 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEdit", "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDelete", "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkEnable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", - "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", - "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", - "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", - "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:slo.rules.burnRate/observability/alert/update", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/update", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/update", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:xpack.synthetics.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.synthetics.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.synthetics.alerts.tls/observability/rule/runSoon", + "alerting:xpack.synthetics.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.synthetics.alerts.tls/observability/rule/deleteBackfill", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/observability/rule/create", + "alerting:metrics.alert.threshold/observability/rule/delete", + "alerting:metrics.alert.threshold/observability/rule/update", + "alerting:metrics.alert.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.threshold/observability/rule/enable", + "alerting:metrics.alert.threshold/observability/rule/disable", + "alerting:metrics.alert.threshold/observability/rule/muteAll", + "alerting:metrics.alert.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.threshold/observability/rule/snooze", + "alerting:metrics.alert.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.threshold/observability/rule/runSoon", + "alerting:metrics.alert.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/create", + "alerting:metrics.alert.threshold/alerts/rule/delete", + "alerting:metrics.alert.threshold/alerts/rule/update", + "alerting:metrics.alert.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.threshold/alerts/rule/enable", + "alerting:metrics.alert.threshold/alerts/rule/disable", + "alerting:metrics.alert.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.threshold/alerts/rule/snooze", + "alerting:metrics.alert.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.threshold/alerts/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/create", + "alerting:metrics.alert.inventory.threshold/observability/rule/delete", + "alerting:metrics.alert.inventory.threshold/observability/rule/update", + "alerting:metrics.alert.inventory.threshold/observability/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/observability/rule/enable", + "alerting:metrics.alert.inventory.threshold/observability/rule/disable", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/observability/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/observability/rule/snooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/observability/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/observability/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/observability/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/observability/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/deleteBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/create", + "alerting:metrics.alert.inventory.threshold/alerts/rule/delete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/update", + "alerting:metrics.alert.inventory.threshold/alerts/rule/updateApiKey", + "alerting:metrics.alert.inventory.threshold/alerts/rule/enable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/disable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAll", + "alerting:metrics.alert.inventory.threshold/alerts/rule/muteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unmuteAlert", + "alerting:metrics.alert.inventory.threshold/alerts/rule/snooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEdit", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDelete", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkEnable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/bulkDisable", + "alerting:metrics.alert.inventory.threshold/alerts/rule/unsnooze", + "alerting:metrics.alert.inventory.threshold/alerts/rule/runSoon", + "alerting:metrics.alert.inventory.threshold/alerts/rule/scheduleBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/create", + "alerting:xpack.uptime.alerts.tls/observability/rule/delete", + "alerting:xpack.uptime.alerts.tls/observability/rule/update", + "alerting:xpack.uptime.alerts.tls/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tls/observability/rule/enable", + "alerting:xpack.uptime.alerts.tls/observability/rule/disable", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tls/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tls/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tls/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tls/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tls/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tls/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/create", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/delete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/enable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/disable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/snooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/create", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/delete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/enable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/disable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/snooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/deleteBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/create", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/delete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/updateApiKey", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/enable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/disable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAll", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/muteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unmuteAlert", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/snooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEdit", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDelete", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkEnable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/bulkDisable", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/unsnooze", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/runSoon", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/scheduleBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/deleteBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/create", + "alerting:logs.alert.document.count/observability/rule/delete", + "alerting:logs.alert.document.count/observability/rule/update", + "alerting:logs.alert.document.count/observability/rule/updateApiKey", + "alerting:logs.alert.document.count/observability/rule/enable", + "alerting:logs.alert.document.count/observability/rule/disable", + "alerting:logs.alert.document.count/observability/rule/muteAll", + "alerting:logs.alert.document.count/observability/rule/unmuteAll", + "alerting:logs.alert.document.count/observability/rule/muteAlert", + "alerting:logs.alert.document.count/observability/rule/unmuteAlert", + "alerting:logs.alert.document.count/observability/rule/snooze", + "alerting:logs.alert.document.count/observability/rule/bulkEdit", + "alerting:logs.alert.document.count/observability/rule/bulkDelete", + "alerting:logs.alert.document.count/observability/rule/bulkEnable", + "alerting:logs.alert.document.count/observability/rule/bulkDisable", + "alerting:logs.alert.document.count/observability/rule/unsnooze", + "alerting:logs.alert.document.count/observability/rule/runSoon", + "alerting:logs.alert.document.count/observability/rule/scheduleBackfill", + "alerting:logs.alert.document.count/observability/rule/deleteBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/create", + "alerting:logs.alert.document.count/alerts/rule/delete", + "alerting:logs.alert.document.count/alerts/rule/update", + "alerting:logs.alert.document.count/alerts/rule/updateApiKey", + "alerting:logs.alert.document.count/alerts/rule/enable", + "alerting:logs.alert.document.count/alerts/rule/disable", + "alerting:logs.alert.document.count/alerts/rule/muteAll", + "alerting:logs.alert.document.count/alerts/rule/unmuteAll", + "alerting:logs.alert.document.count/alerts/rule/muteAlert", + "alerting:logs.alert.document.count/alerts/rule/unmuteAlert", + "alerting:logs.alert.document.count/alerts/rule/snooze", + "alerting:logs.alert.document.count/alerts/rule/bulkEdit", + "alerting:logs.alert.document.count/alerts/rule/bulkDelete", + "alerting:logs.alert.document.count/alerts/rule/bulkEnable", + "alerting:logs.alert.document.count/alerts/rule/bulkDisable", + "alerting:logs.alert.document.count/alerts/rule/unsnooze", + "alerting:logs.alert.document.count/alerts/rule/runSoon", + "alerting:logs.alert.document.count/alerts/rule/scheduleBackfill", + "alerting:logs.alert.document.count/alerts/rule/deleteBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/create", + "alerting:slo.rules.burnRate/observability/rule/delete", + "alerting:slo.rules.burnRate/observability/rule/update", + "alerting:slo.rules.burnRate/observability/rule/updateApiKey", + "alerting:slo.rules.burnRate/observability/rule/enable", + "alerting:slo.rules.burnRate/observability/rule/disable", + "alerting:slo.rules.burnRate/observability/rule/muteAll", + "alerting:slo.rules.burnRate/observability/rule/unmuteAll", + "alerting:slo.rules.burnRate/observability/rule/muteAlert", + "alerting:slo.rules.burnRate/observability/rule/unmuteAlert", + "alerting:slo.rules.burnRate/observability/rule/snooze", + "alerting:slo.rules.burnRate/observability/rule/bulkEdit", + "alerting:slo.rules.burnRate/observability/rule/bulkDelete", + "alerting:slo.rules.burnRate/observability/rule/bulkEnable", + "alerting:slo.rules.burnRate/observability/rule/bulkDisable", + "alerting:slo.rules.burnRate/observability/rule/unsnooze", + "alerting:slo.rules.burnRate/observability/rule/runSoon", + "alerting:slo.rules.burnRate/observability/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/observability/rule/deleteBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/create", + "alerting:slo.rules.burnRate/alerts/rule/delete", + "alerting:slo.rules.burnRate/alerts/rule/update", + "alerting:slo.rules.burnRate/alerts/rule/updateApiKey", + "alerting:slo.rules.burnRate/alerts/rule/enable", + "alerting:slo.rules.burnRate/alerts/rule/disable", + "alerting:slo.rules.burnRate/alerts/rule/muteAll", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAll", + "alerting:slo.rules.burnRate/alerts/rule/muteAlert", + "alerting:slo.rules.burnRate/alerts/rule/unmuteAlert", + "alerting:slo.rules.burnRate/alerts/rule/snooze", + "alerting:slo.rules.burnRate/alerts/rule/bulkEdit", + "alerting:slo.rules.burnRate/alerts/rule/bulkDelete", + "alerting:slo.rules.burnRate/alerts/rule/bulkEnable", + "alerting:slo.rules.burnRate/alerts/rule/bulkDisable", + "alerting:slo.rules.burnRate/alerts/rule/unsnooze", + "alerting:slo.rules.burnRate/alerts/rule/runSoon", + "alerting:slo.rules.burnRate/alerts/rule/scheduleBackfill", + "alerting:slo.rules.burnRate/alerts/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/create", + "alerting:observability.rules.custom_threshold/observability/rule/delete", + "alerting:observability.rules.custom_threshold/observability/rule/update", + "alerting:observability.rules.custom_threshold/observability/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/observability/rule/enable", + "alerting:observability.rules.custom_threshold/observability/rule/disable", + "alerting:observability.rules.custom_threshold/observability/rule/muteAll", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/observability/rule/muteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/observability/rule/snooze", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/observability/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/observability/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/observability/rule/unsnooze", + "alerting:observability.rules.custom_threshold/observability/rule/runSoon", + "alerting:observability.rules.custom_threshold/observability/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/deleteBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/create", + "alerting:observability.rules.custom_threshold/alerts/rule/delete", + "alerting:observability.rules.custom_threshold/alerts/rule/update", + "alerting:observability.rules.custom_threshold/alerts/rule/updateApiKey", + "alerting:observability.rules.custom_threshold/alerts/rule/enable", + "alerting:observability.rules.custom_threshold/alerts/rule/disable", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAll", + "alerting:observability.rules.custom_threshold/alerts/rule/muteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/unmuteAlert", + "alerting:observability.rules.custom_threshold/alerts/rule/snooze", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEdit", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDelete", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkEnable", + "alerting:observability.rules.custom_threshold/alerts/rule/bulkDisable", + "alerting:observability.rules.custom_threshold/alerts/rule/unsnooze", + "alerting:observability.rules.custom_threshold/alerts/rule/runSoon", + "alerting:observability.rules.custom_threshold/alerts/rule/scheduleBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/deleteBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/observability/rule/create", + "alerting:.es-query/observability/rule/delete", + "alerting:.es-query/observability/rule/update", + "alerting:.es-query/observability/rule/updateApiKey", + "alerting:.es-query/observability/rule/enable", + "alerting:.es-query/observability/rule/disable", + "alerting:.es-query/observability/rule/muteAll", + "alerting:.es-query/observability/rule/unmuteAll", + "alerting:.es-query/observability/rule/muteAlert", + "alerting:.es-query/observability/rule/unmuteAlert", + "alerting:.es-query/observability/rule/snooze", + "alerting:.es-query/observability/rule/bulkEdit", + "alerting:.es-query/observability/rule/bulkDelete", + "alerting:.es-query/observability/rule/bulkEnable", + "alerting:.es-query/observability/rule/bulkDisable", + "alerting:.es-query/observability/rule/unsnooze", + "alerting:.es-query/observability/rule/runSoon", + "alerting:.es-query/observability/rule/scheduleBackfill", + "alerting:.es-query/observability/rule/deleteBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:.es-query/alerts/rule/create", + "alerting:.es-query/alerts/rule/delete", + "alerting:.es-query/alerts/rule/update", + "alerting:.es-query/alerts/rule/updateApiKey", + "alerting:.es-query/alerts/rule/enable", + "alerting:.es-query/alerts/rule/disable", + "alerting:.es-query/alerts/rule/muteAll", + "alerting:.es-query/alerts/rule/unmuteAll", + "alerting:.es-query/alerts/rule/muteAlert", + "alerting:.es-query/alerts/rule/unmuteAlert", + "alerting:.es-query/alerts/rule/snooze", + "alerting:.es-query/alerts/rule/bulkEdit", + "alerting:.es-query/alerts/rule/bulkDelete", + "alerting:.es-query/alerts/rule/bulkEnable", + "alerting:.es-query/alerts/rule/bulkDisable", + "alerting:.es-query/alerts/rule/unsnooze", + "alerting:.es-query/alerts/rule/runSoon", + "alerting:.es-query/alerts/rule/scheduleBackfill", + "alerting:.es-query/alerts/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/deleteBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/create", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/delete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/updateApiKey", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/enable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/disable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAll", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/muteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unmuteAlert", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/snooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEdit", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDelete", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkEnable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/bulkDisable", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/unsnooze", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/runSoon", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/scheduleBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/deleteBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", "alerting:apm.error_rate/observability/alert/update", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/update", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", "alerting:apm.transaction_error_rate/observability/alert/update", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/update", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", "alerting:apm.transaction_duration/observability/alert/update", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/update", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", "alerting:apm.anomaly/observability/alert/update", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/update", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", @@ -10091,6 +20352,96 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/observability/alert/update", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/update", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/update", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/update", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/update", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/update", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/update", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/update", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/update", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/update", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/update", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/update", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/update", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/update", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/update", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/observability/alert/update", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/update", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/update", ], "minimal_read": Array [ "login:", @@ -10171,6 +20522,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.tls/uptime/rule/getRuleExecutionKPI", "alerting:xpack.uptime.alerts.tls/uptime/rule/getBackfill", "alerting:xpack.uptime.alerts.tls/uptime/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/get", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getAlertSummary", @@ -10180,6 +20540,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getRuleExecutionKPI", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getBackfill", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/get", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getAlertSummary", @@ -10189,6 +20558,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getRuleExecutionKPI", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getBackfill", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/get", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getAlertSummary", @@ -10198,97 +20576,103 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getRuleExecutionKPI", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getBackfill", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getExecutionLog", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/find", - "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getBackfill", - "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/findBackfill", - "alerting:xpack.synthetics.alerts.tls/uptime/rule/get", - "alerting:xpack.synthetics.alerts.tls/uptime/rule/getRuleState", - "alerting:xpack.synthetics.alerts.tls/uptime/rule/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/uptime/rule/getExecutionLog", - "alerting:xpack.synthetics.alerts.tls/uptime/rule/getActionErrorLog", - "alerting:xpack.synthetics.alerts.tls/uptime/rule/find", - "alerting:xpack.synthetics.alerts.tls/uptime/rule/getRuleExecutionKPI", - "alerting:xpack.synthetics.alerts.tls/uptime/rule/getBackfill", - "alerting:xpack.synthetics.alerts.tls/uptime/rule/findBackfill", - "alerting:xpack.uptime.alerts.tls/uptime/alert/get", - "alerting:xpack.uptime.alerts.tls/uptime/alert/find", - "alerting:xpack.uptime.alerts.tls/uptime/alert/getAuthorizedAlertsIndices", - "alerting:xpack.uptime.alerts.tls/uptime/alert/getAlertSummary", - "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/get", - "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/find", - "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/getAuthorizedAlertsIndices", - "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/getAlertSummary", - "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/get", - "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/find", - "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/getAuthorizedAlertsIndices", - "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/getAlertSummary", - "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/get", - "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/find", - "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/getAuthorizedAlertsIndices", - "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/get", - "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/find", - "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/getAlertSummary", - "alerting:xpack.synthetics.alerts.tls/uptime/alert/get", - "alerting:xpack.synthetics.alerts.tls/uptime/alert/find", - "alerting:xpack.synthetics.alerts.tls/uptime/alert/getAuthorizedAlertsIndices", - "alerting:xpack.synthetics.alerts.tls/uptime/alert/getAlertSummary", - "app:observability", - "ui:catalogue/observability", - "ui:navLinks/observability", - "ui:observability/read", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/uptime/rule/get", + "alerting:xpack.synthetics.alerts.tls/uptime/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/uptime/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/uptime/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/uptime/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/uptime/rule/find", + "alerting:xpack.synthetics.alerts.tls/uptime/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/uptime/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/uptime/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/uptime/alert/get", + "alerting:xpack.uptime.alerts.tls/uptime/alert/find", + "alerting:xpack.uptime.alerts.tls/uptime/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/uptime/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/uptime/alert/get", + "alerting:xpack.synthetics.alerts.tls/uptime/alert/find", + "alerting:xpack.synthetics.alerts.tls/uptime/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/uptime/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", + "app:observability", + "ui:catalogue/observability", + "ui:navLinks/observability", + "ui:observability/read", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -10298,6 +20682,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.error_rate/observability/rule/getBackfill", "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", "alerting:apm.transaction_error_rate/observability/rule/getRuleState", "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", @@ -10307,6 +20700,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_error_rate/observability/rule/getBackfill", "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_duration/observability/rule/get", "alerting:apm.transaction_duration/observability/rule/getRuleState", "alerting:apm.transaction_duration/observability/rule/getAlertSummary", @@ -10316,6 +20718,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_duration/observability/rule/getBackfill", "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -10325,6 +20736,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", "alerting:apm.anomaly/observability/rule/getBackfill", "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", @@ -10343,42 +20763,200 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", @@ -10387,6 +20965,78 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", ], "read": Array [ "login:", @@ -10467,6 +21117,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.tls/uptime/rule/getRuleExecutionKPI", "alerting:xpack.uptime.alerts.tls/uptime/rule/getBackfill", "alerting:xpack.uptime.alerts.tls/uptime/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/get", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/alerts/rule/find", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/alerts/rule/findBackfill", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/get", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getAlertSummary", @@ -10476,6 +21135,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getRuleExecutionKPI", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/getBackfill", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/rule/findBackfill", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/get", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getAlertSummary", @@ -10485,6 +21153,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getRuleExecutionKPI", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/getBackfill", "alerting:xpack.uptime.alerts.monitorStatus/uptime/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/rule/findBackfill", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/get", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getRuleState", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getAlertSummary", @@ -10494,6 +21171,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getRuleExecutionKPI", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/getBackfill", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getAlertSummary", @@ -10503,6 +21189,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/getBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/rule/findBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.tls/uptime/rule/get", "alerting:xpack.synthetics.alerts.tls/uptime/rule/getRuleState", "alerting:xpack.synthetics.alerts.tls/uptime/rule/getAlertSummary", @@ -10512,79 +21207,67 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/uptime/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.tls/uptime/rule/getBackfill", "alerting:xpack.synthetics.alerts.tls/uptime/rule/findBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/get", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleState", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getExecutionLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getActionErrorLog", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/find", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/getBackfill", + "alerting:xpack.synthetics.alerts.tls/alerts/rule/findBackfill", "alerting:xpack.uptime.alerts.tls/uptime/alert/get", "alerting:xpack.uptime.alerts.tls/uptime/alert/find", "alerting:xpack.uptime.alerts.tls/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.tls/uptime/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/alerts/alert/get", + "alerting:xpack.uptime.alerts.tls/alerts/alert/find", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/alerts/alert/getAlertSummary", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/get", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/find", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.tlsCertificate/uptime/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/alerts/alert/getAlertSummary", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/get", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/find", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.monitorStatus/uptime/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/alerts/alert/getAlertSummary", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/get", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/find", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.uptime.alerts.durationAnomaly/uptime/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.monitorStatus/uptime/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/get", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/find", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.monitorStatus/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.tls/uptime/alert/get", "alerting:xpack.synthetics.alerts.tls/uptime/alert/find", "alerting:xpack.synthetics.alerts.tls/uptime/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/uptime/alert/getAlertSummary", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/get", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/find", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.synthetics.alerts.tls/alerts/alert/getAlertSummary", "app:observability", "ui:catalogue/observability", "ui:navLinks/observability", "ui:observability/read", - "alerting:slo.rules.burnRate/observability/rule/get", - "alerting:slo.rules.burnRate/observability/rule/getRuleState", - "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", - "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", - "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", - "alerting:slo.rules.burnRate/observability/rule/find", - "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", - "alerting:slo.rules.burnRate/observability/rule/getBackfill", - "alerting:slo.rules.burnRate/observability/rule/findBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/get", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", - "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", - "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", - "alerting:observability.rules.custom_threshold/observability/rule/find", - "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", - "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", - "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", - "alerting:.es-query/observability/rule/get", - "alerting:.es-query/observability/rule/getRuleState", - "alerting:.es-query/observability/rule/getAlertSummary", - "alerting:.es-query/observability/rule/getExecutionLog", - "alerting:.es-query/observability/rule/getActionErrorLog", - "alerting:.es-query/observability/rule/find", - "alerting:.es-query/observability/rule/getRuleExecutionKPI", - "alerting:.es-query/observability/rule/getBackfill", - "alerting:.es-query/observability/rule/findBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", - "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/get", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", - "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", - "alerting:metrics.alert.inventory.threshold/observability/rule/find", - "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", - "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", - "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", "alerting:apm.error_rate/observability/rule/get", "alerting:apm.error_rate/observability/rule/getRuleState", "alerting:apm.error_rate/observability/rule/getAlertSummary", @@ -10594,6 +21277,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.error_rate/observability/rule/getBackfill", "alerting:apm.error_rate/observability/rule/findBackfill", + "alerting:apm.error_rate/alerts/rule/get", + "alerting:apm.error_rate/alerts/rule/getRuleState", + "alerting:apm.error_rate/alerts/rule/getAlertSummary", + "alerting:apm.error_rate/alerts/rule/getExecutionLog", + "alerting:apm.error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.error_rate/alerts/rule/find", + "alerting:apm.error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.error_rate/alerts/rule/getBackfill", + "alerting:apm.error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_error_rate/observability/rule/get", "alerting:apm.transaction_error_rate/observability/rule/getRuleState", "alerting:apm.transaction_error_rate/observability/rule/getAlertSummary", @@ -10603,6 +21295,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_error_rate/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_error_rate/observability/rule/getBackfill", "alerting:apm.transaction_error_rate/observability/rule/findBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/get", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleState", + "alerting:apm.transaction_error_rate/alerts/rule/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/rule/getExecutionLog", + "alerting:apm.transaction_error_rate/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_error_rate/alerts/rule/find", + "alerting:apm.transaction_error_rate/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_error_rate/alerts/rule/getBackfill", + "alerting:apm.transaction_error_rate/alerts/rule/findBackfill", "alerting:apm.transaction_duration/observability/rule/get", "alerting:apm.transaction_duration/observability/rule/getRuleState", "alerting:apm.transaction_duration/observability/rule/getAlertSummary", @@ -10612,6 +21313,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.transaction_duration/observability/rule/getRuleExecutionKPI", "alerting:apm.transaction_duration/observability/rule/getBackfill", "alerting:apm.transaction_duration/observability/rule/findBackfill", + "alerting:apm.transaction_duration/alerts/rule/get", + "alerting:apm.transaction_duration/alerts/rule/getRuleState", + "alerting:apm.transaction_duration/alerts/rule/getAlertSummary", + "alerting:apm.transaction_duration/alerts/rule/getExecutionLog", + "alerting:apm.transaction_duration/alerts/rule/getActionErrorLog", + "alerting:apm.transaction_duration/alerts/rule/find", + "alerting:apm.transaction_duration/alerts/rule/getRuleExecutionKPI", + "alerting:apm.transaction_duration/alerts/rule/getBackfill", + "alerting:apm.transaction_duration/alerts/rule/findBackfill", "alerting:apm.anomaly/observability/rule/get", "alerting:apm.anomaly/observability/rule/getRuleState", "alerting:apm.anomaly/observability/rule/getAlertSummary", @@ -10621,6 +21331,15 @@ export default function ({ getService }: FtrProviderContext) { "alerting:apm.anomaly/observability/rule/getRuleExecutionKPI", "alerting:apm.anomaly/observability/rule/getBackfill", "alerting:apm.anomaly/observability/rule/findBackfill", + "alerting:apm.anomaly/alerts/rule/get", + "alerting:apm.anomaly/alerts/rule/getRuleState", + "alerting:apm.anomaly/alerts/rule/getAlertSummary", + "alerting:apm.anomaly/alerts/rule/getExecutionLog", + "alerting:apm.anomaly/alerts/rule/getActionErrorLog", + "alerting:apm.anomaly/alerts/rule/find", + "alerting:apm.anomaly/alerts/rule/getRuleExecutionKPI", + "alerting:apm.anomaly/alerts/rule/getBackfill", + "alerting:apm.anomaly/alerts/rule/findBackfill", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getRuleState", "alerting:xpack.synthetics.alerts.monitorStatus/observability/rule/getAlertSummary", @@ -10639,42 +21358,200 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/rule/getRuleExecutionKPI", "alerting:xpack.synthetics.alerts.tls/observability/rule/getBackfill", "alerting:xpack.synthetics.alerts.tls/observability/rule/findBackfill", - "alerting:slo.rules.burnRate/observability/alert/get", - "alerting:slo.rules.burnRate/observability/alert/find", - "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", - "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", - "alerting:observability.rules.custom_threshold/observability/alert/get", - "alerting:observability.rules.custom_threshold/observability/alert/find", - "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", - "alerting:.es-query/observability/alert/get", - "alerting:.es-query/observability/alert/find", - "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", - "alerting:.es-query/observability/alert/getAlertSummary", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", - "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", - "alerting:metrics.alert.inventory.threshold/observability/alert/get", - "alerting:metrics.alert.inventory.threshold/observability/alert/find", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", - "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/get", + "alerting:metrics.alert.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/observability/rule/find", + "alerting:metrics.alert.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.threshold/alerts/rule/get", + "alerting:metrics.alert.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.threshold/alerts/rule/find", + "alerting:metrics.alert.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.threshold/alerts/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/get", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/observability/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/observability/rule/find", + "alerting:metrics.alert.inventory.threshold/observability/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/observability/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/observability/rule/findBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/get", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleState", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getExecutionLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getActionErrorLog", + "alerting:metrics.alert.inventory.threshold/alerts/rule/find", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getRuleExecutionKPI", + "alerting:metrics.alert.inventory.threshold/alerts/rule/getBackfill", + "alerting:metrics.alert.inventory.threshold/alerts/rule/findBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/get", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tls/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tls/observability/rule/find", + "alerting:xpack.uptime.alerts.tls/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tls/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tls/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.monitorStatus/observability/rule/findBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleState", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getExecutionLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getActionErrorLog", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getRuleExecutionKPI", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/getBackfill", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/rule/findBackfill", + "alerting:logs.alert.document.count/observability/rule/get", + "alerting:logs.alert.document.count/observability/rule/getRuleState", + "alerting:logs.alert.document.count/observability/rule/getAlertSummary", + "alerting:logs.alert.document.count/observability/rule/getExecutionLog", + "alerting:logs.alert.document.count/observability/rule/getActionErrorLog", + "alerting:logs.alert.document.count/observability/rule/find", + "alerting:logs.alert.document.count/observability/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/observability/rule/getBackfill", + "alerting:logs.alert.document.count/observability/rule/findBackfill", + "alerting:logs.alert.document.count/alerts/rule/get", + "alerting:logs.alert.document.count/alerts/rule/getRuleState", + "alerting:logs.alert.document.count/alerts/rule/getAlertSummary", + "alerting:logs.alert.document.count/alerts/rule/getExecutionLog", + "alerting:logs.alert.document.count/alerts/rule/getActionErrorLog", + "alerting:logs.alert.document.count/alerts/rule/find", + "alerting:logs.alert.document.count/alerts/rule/getRuleExecutionKPI", + "alerting:logs.alert.document.count/alerts/rule/getBackfill", + "alerting:logs.alert.document.count/alerts/rule/findBackfill", + "alerting:slo.rules.burnRate/observability/rule/get", + "alerting:slo.rules.burnRate/observability/rule/getRuleState", + "alerting:slo.rules.burnRate/observability/rule/getAlertSummary", + "alerting:slo.rules.burnRate/observability/rule/getExecutionLog", + "alerting:slo.rules.burnRate/observability/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/observability/rule/find", + "alerting:slo.rules.burnRate/observability/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/observability/rule/getBackfill", + "alerting:slo.rules.burnRate/observability/rule/findBackfill", + "alerting:slo.rules.burnRate/alerts/rule/get", + "alerting:slo.rules.burnRate/alerts/rule/getRuleState", + "alerting:slo.rules.burnRate/alerts/rule/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/rule/getExecutionLog", + "alerting:slo.rules.burnRate/alerts/rule/getActionErrorLog", + "alerting:slo.rules.burnRate/alerts/rule/find", + "alerting:slo.rules.burnRate/alerts/rule/getRuleExecutionKPI", + "alerting:slo.rules.burnRate/alerts/rule/getBackfill", + "alerting:slo.rules.burnRate/alerts/rule/findBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/get", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleState", + "alerting:observability.rules.custom_threshold/observability/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/observability/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/observability/rule/find", + "alerting:observability.rules.custom_threshold/observability/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/observability/rule/getBackfill", + "alerting:observability.rules.custom_threshold/observability/rule/findBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/get", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleState", + "alerting:observability.rules.custom_threshold/alerts/rule/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/rule/getExecutionLog", + "alerting:observability.rules.custom_threshold/alerts/rule/getActionErrorLog", + "alerting:observability.rules.custom_threshold/alerts/rule/find", + "alerting:observability.rules.custom_threshold/alerts/rule/getRuleExecutionKPI", + "alerting:observability.rules.custom_threshold/alerts/rule/getBackfill", + "alerting:observability.rules.custom_threshold/alerts/rule/findBackfill", + "alerting:.es-query/observability/rule/get", + "alerting:.es-query/observability/rule/getRuleState", + "alerting:.es-query/observability/rule/getAlertSummary", + "alerting:.es-query/observability/rule/getExecutionLog", + "alerting:.es-query/observability/rule/getActionErrorLog", + "alerting:.es-query/observability/rule/find", + "alerting:.es-query/observability/rule/getRuleExecutionKPI", + "alerting:.es-query/observability/rule/getBackfill", + "alerting:.es-query/observability/rule/findBackfill", + "alerting:.es-query/alerts/rule/get", + "alerting:.es-query/alerts/rule/getRuleState", + "alerting:.es-query/alerts/rule/getAlertSummary", + "alerting:.es-query/alerts/rule/getExecutionLog", + "alerting:.es-query/alerts/rule/getActionErrorLog", + "alerting:.es-query/alerts/rule/find", + "alerting:.es-query/alerts/rule/getRuleExecutionKPI", + "alerting:.es-query/alerts/rule/getBackfill", + "alerting:.es-query/alerts/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/observability/rule/findBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleState", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getExecutionLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getActionErrorLog", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getRuleExecutionKPI", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/getBackfill", + "alerting:xpack.ml.anomaly_detection_alert/alerts/rule/findBackfill", "alerting:apm.error_rate/observability/alert/get", "alerting:apm.error_rate/observability/alert/find", "alerting:apm.error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.error_rate/observability/alert/getAlertSummary", + "alerting:apm.error_rate/alerts/alert/get", + "alerting:apm.error_rate/alerts/alert/find", + "alerting:apm.error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_error_rate/observability/alert/get", "alerting:apm.transaction_error_rate/observability/alert/find", "alerting:apm.transaction_error_rate/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_error_rate/observability/alert/getAlertSummary", + "alerting:apm.transaction_error_rate/alerts/alert/get", + "alerting:apm.transaction_error_rate/alerts/alert/find", + "alerting:apm.transaction_error_rate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_error_rate/alerts/alert/getAlertSummary", "alerting:apm.transaction_duration/observability/alert/get", "alerting:apm.transaction_duration/observability/alert/find", "alerting:apm.transaction_duration/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.transaction_duration/observability/alert/getAlertSummary", + "alerting:apm.transaction_duration/alerts/alert/get", + "alerting:apm.transaction_duration/alerts/alert/find", + "alerting:apm.transaction_duration/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.transaction_duration/alerts/alert/getAlertSummary", "alerting:apm.anomaly/observability/alert/get", "alerting:apm.anomaly/observability/alert/find", "alerting:apm.anomaly/observability/alert/getAuthorizedAlertsIndices", "alerting:apm.anomaly/observability/alert/getAlertSummary", + "alerting:apm.anomaly/alerts/alert/get", + "alerting:apm.anomaly/alerts/alert/find", + "alerting:apm.anomaly/alerts/alert/getAuthorizedAlertsIndices", + "alerting:apm.anomaly/alerts/alert/getAlertSummary", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/get", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/find", "alerting:xpack.synthetics.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", @@ -10683,6 +21560,78 @@ export default function ({ getService }: FtrProviderContext) { "alerting:xpack.synthetics.alerts.tls/observability/alert/find", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAuthorizedAlertsIndices", "alerting:xpack.synthetics.alerts.tls/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/observability/alert/get", + "alerting:metrics.alert.threshold/observability/alert/find", + "alerting:metrics.alert.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.threshold/alerts/alert/get", + "alerting:metrics.alert.threshold/alerts/alert/find", + "alerting:metrics.alert.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.threshold/alerts/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/observability/alert/get", + "alerting:metrics.alert.inventory.threshold/observability/alert/find", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/observability/alert/getAlertSummary", + "alerting:metrics.alert.inventory.threshold/alerts/alert/get", + "alerting:metrics.alert.inventory.threshold/alerts/alert/find", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:metrics.alert.inventory.threshold/alerts/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tls/observability/alert/get", + "alerting:xpack.uptime.alerts.tls/observability/alert/find", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tls/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/get", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/find", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.tlsCertificate/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/get", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/find", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.monitorStatus/observability/alert/getAlertSummary", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/get", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/find", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.uptime.alerts.durationAnomaly/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/observability/alert/get", + "alerting:logs.alert.document.count/observability/alert/find", + "alerting:logs.alert.document.count/observability/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/observability/alert/getAlertSummary", + "alerting:logs.alert.document.count/alerts/alert/get", + "alerting:logs.alert.document.count/alerts/alert/find", + "alerting:logs.alert.document.count/alerts/alert/getAuthorizedAlertsIndices", + "alerting:logs.alert.document.count/alerts/alert/getAlertSummary", + "alerting:slo.rules.burnRate/observability/alert/get", + "alerting:slo.rules.burnRate/observability/alert/find", + "alerting:slo.rules.burnRate/observability/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/observability/alert/getAlertSummary", + "alerting:slo.rules.burnRate/alerts/alert/get", + "alerting:slo.rules.burnRate/alerts/alert/find", + "alerting:slo.rules.burnRate/alerts/alert/getAuthorizedAlertsIndices", + "alerting:slo.rules.burnRate/alerts/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/observability/alert/get", + "alerting:observability.rules.custom_threshold/observability/alert/find", + "alerting:observability.rules.custom_threshold/observability/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/observability/alert/getAlertSummary", + "alerting:observability.rules.custom_threshold/alerts/alert/get", + "alerting:observability.rules.custom_threshold/alerts/alert/find", + "alerting:observability.rules.custom_threshold/alerts/alert/getAuthorizedAlertsIndices", + "alerting:observability.rules.custom_threshold/alerts/alert/getAlertSummary", + "alerting:.es-query/observability/alert/get", + "alerting:.es-query/observability/alert/find", + "alerting:.es-query/observability/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/observability/alert/getAlertSummary", + "alerting:.es-query/alerts/alert/get", + "alerting:.es-query/alerts/alert/find", + "alerting:.es-query/alerts/alert/getAuthorizedAlertsIndices", + "alerting:.es-query/alerts/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/observability/alert/getAlertSummary", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/get", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/find", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAuthorizedAlertsIndices", + "alerting:xpack.ml.anomaly_detection_alert/alerts/alert/getAlertSummary", ], }, }