From c403354f46187ba78843c679f0cbbb6108f30ba0 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Wed, 3 May 2023 17:18:52 -0400
Subject: [PATCH] [8.8] Don't trigger summary actions when there are no alerts
 to report (#156421) (#156617)

# Backport

This will backport the following commits from `main` to `8.8`:
- [Don't trigger summary actions when there are no alerts to report
(#156421)](https://github.com/elastic/kibana/pull/156421)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Ersin
Erdal","email":"92688503+ersin-erdal@users.noreply.github.com"},"sourceCommit":{"committedDate":"2023-05-03T19:15:01Z","message":"Don't
trigger summary actions when there are no alerts to report
(#156421)\n\nResolves: #155708\r\n\r\nCurrently we always trigger
summary actions on custom interval even if\r\nthere are no alerts to
report.\r\nThis PR changes this behaviour to skip summary actions when
there are no\r\nalerts.\r\n\r\n## To verify\r\nCreate a Security Rule
with a summary action that is on custom interval\r\n(`Summary of alerts`
-> `Custom Frequency`)\r\nAdd an alerts filter to filter out all the
alerts (e.g. by using host\r\nname that doesn't exist)\r\nExpect the
summary action not to be
triggered.","sha":"506806fee7f374205d98995a2754a0d296fbebb0","branchLabelMapping":{"^v8.9.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:ResponseOps","v8.8.0","v8.9.0"],"number":156421,"url":"https://github.com/elastic/kibana/pull/156421","mergeCommit":{"message":"Don't
trigger summary actions when there are no alerts to report
(#156421)\n\nResolves: #155708\r\n\r\nCurrently we always trigger
summary actions on custom interval even if\r\nthere are no alerts to
report.\r\nThis PR changes this behaviour to skip summary actions when
there are no\r\nalerts.\r\n\r\n## To verify\r\nCreate a Security Rule
with a summary action that is on custom interval\r\n(`Summary of alerts`
-> `Custom Frequency`)\r\nAdd an alerts filter to filter out all the
alerts (e.g. by using host\r\nname that doesn't exist)\r\nExpect the
summary action not to be
triggered.","sha":"506806fee7f374205d98995a2754a0d296fbebb0"}},"sourceBranch":"main","suggestedTargetBranches":["8.8"],"targetPullRequestStates":[{"branch":"8.8","label":"v8.8.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.9.0","labelRegex":"^v8.9.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/156421","number":156421,"mergeCommit":{"message":"Don't
trigger summary actions when there are no alerts to report
(#156421)\n\nResolves: #155708\r\n\r\nCurrently we always trigger
summary actions on custom interval even if\r\nthere are no alerts to
report.\r\nThis PR changes this behaviour to skip summary actions when
there are no\r\nalerts.\r\n\r\n## To verify\r\nCreate a Security Rule
with a summary action that is on custom interval\r\n(`Summary of alerts`
-> `Custom Frequency`)\r\nAdd an alerts filter to filter out all the
alerts (e.g. by using host\r\nname that doesn't exist)\r\nExpect the
summary action not to be
triggered.","sha":"506806fee7f374205d98995a2754a0d296fbebb0"}}]}]
BACKPORT-->

Co-authored-by: Ersin Erdal <92688503+ersin-erdal@users.noreply.github.com>
---
 .../task_runner/execution_handler.test.ts     | 62 ++++++++++++++++++-
 .../server/task_runner/execution_handler.ts   |  6 +-
 .../server/task_runner/rule_action_helper.ts  |  7 ---
 3 files changed, 62 insertions(+), 13 deletions(-)

diff --git a/x-pack/plugins/alerting/server/task_runner/execution_handler.test.ts b/x-pack/plugins/alerting/server/task_runner/execution_handler.test.ts
index bf5aad5f63386..6e22818fd19a3 100644
--- a/x-pack/plugins/alerting/server/task_runner/execution_handler.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/execution_handler.test.ts
@@ -1299,7 +1299,7 @@ describe('Execution Handler', () => {
       `);
   });
 
-  test('does not schedule actions for the summarized alerts that are filtered out', async () => {
+  test('does not schedule actions for the summarized alerts that are filtered out (for each alert)', async () => {
     getSummarizedAlertsMock.mockResolvedValue({
       new: {
         count: 0,
@@ -1362,6 +1362,66 @@ describe('Execution Handler', () => {
     );
   });
 
+  test('does not schedule actions for the summarized alerts that are filtered out (summary of alerts onThrottleInterval)', async () => {
+    getSummarizedAlertsMock.mockResolvedValue({
+      new: {
+        count: 0,
+        data: [],
+      },
+      ongoing: {
+        count: 0,
+        data: [],
+      },
+      recovered: { count: 0, data: [] },
+    });
+    const executionHandler = new ExecutionHandler(
+      generateExecutionParams({
+        rule: {
+          ...defaultExecutionParams.rule,
+          mutedInstanceIds: ['foo'],
+          actions: [
+            {
+              id: '1',
+              uuid: '111',
+              group: null,
+              actionTypeId: 'testActionTypeId',
+              frequency: {
+                summary: true,
+                notifyWhen: 'onThrottleInterval',
+                throttle: '1h',
+              },
+              params: {
+                message:
+                  'New: {{alerts.new.count}} Ongoing: {{alerts.ongoing.count}} Recovered: {{alerts.recovered.count}}',
+              },
+              alertsFilter: {
+                query: { kql: 'kibana.alert.rule.name:foo', dsl: '{}', filters: [] },
+              },
+            },
+          ],
+        },
+      })
+    );
+
+    await executionHandler.run({
+      ...generateAlert({ id: 1 }),
+      ...generateAlert({ id: 2 }),
+    });
+
+    expect(getSummarizedAlertsMock).toHaveBeenCalledWith({
+      ruleId: '1',
+      spaceId: 'test1',
+      end: new Date('1970-01-01T00:01:30.000Z'),
+      start: new Date('1969-12-31T23:01:30.000Z'),
+      excludedAlertInstanceIds: ['foo'],
+      alertsFilter: {
+        query: { kql: 'kibana.alert.rule.name:foo', dsl: '{}', filters: [] },
+      },
+    });
+    expect(actionsClient.bulkEnqueueExecution).not.toHaveBeenCalled();
+    expect(alertingEventLogger.logAction).not.toHaveBeenCalled();
+  });
+
   test('does not schedule actions for the for-each type alerts that are filtered out', async () => {
     getSummarizedAlertsMock.mockResolvedValue({
       new: {
diff --git a/x-pack/plugins/alerting/server/task_runner/execution_handler.ts b/x-pack/plugins/alerting/server/task_runner/execution_handler.ts
index 083225de1f371..af6b135311c00 100644
--- a/x-pack/plugins/alerting/server/task_runner/execution_handler.ts
+++ b/x-pack/plugins/alerting/server/task_runner/execution_handler.ts
@@ -44,7 +44,6 @@ import {
   isActionOnInterval,
   isSummaryAction,
   isSummaryActionOnInterval,
-  isSummaryActionPerRuleRun,
   isSummaryActionThrottled,
 } from './rule_action_helper';
 
@@ -511,10 +510,7 @@ export class ExecutionHandler<
       }
 
       if (isSummaryAction(action)) {
-        if (summarizedAlerts) {
-          if (isSummaryActionPerRuleRun(action) && summarizedAlerts.all.count === 0) {
-            continue;
-          }
+        if (summarizedAlerts && summarizedAlerts.all.count !== 0) {
           executables.push({ action, summarizedAlerts });
         }
         continue;
diff --git a/x-pack/plugins/alerting/server/task_runner/rule_action_helper.ts b/x-pack/plugins/alerting/server/task_runner/rule_action_helper.ts
index 5150170a52bcd..5eb9794dce606 100644
--- a/x-pack/plugins/alerting/server/task_runner/rule_action_helper.ts
+++ b/x-pack/plugins/alerting/server/task_runner/rule_action_helper.ts
@@ -28,13 +28,6 @@ export const isActionOnInterval = (action?: RuleAction) => {
   );
 };
 
-export const isSummaryActionPerRuleRun = (action: RuleAction) => {
-  if (!action.frequency) {
-    return false;
-  }
-  return action.frequency.notifyWhen === RuleNotifyWhenTypeValues[1] && action.frequency.summary;
-};
-
 export const isSummaryActionOnInterval = (action: RuleAction) => {
   return isActionOnInterval(action) && action.frequency?.summary;
 };