Merge branch '7.15' into backport/7.15/pr-110548

.buildkite/scripts/lifecycle/build_status.js

@@ -7,11 +7,11 @@ const { BuildkiteClient } = require('kibana-buildkite-library');
     console.log(status.success ? 'true' : 'false');
     process.exit(0);
   } catch (ex) {
+    console.error('Buildkite API Error', ex.message);
     if (ex.response) {
-      console.error('HTTP Error Response Body', ex.response.data);
       console.error('HTTP Error Response Status', ex.response.status);
+      console.error('HTTP Error Response Body', ex.response.data);
     }
-    console.error(ex);
     process.exit(1);
   }
 })();

.buildkite/scripts/lifecycle/ci_stats_complete.js

@@ -4,7 +4,11 @@ const { CiStats } = require('kibana-buildkite-library');
   try {
     await CiStats.onComplete();
   } catch (ex) {
-    console.error(ex);
+    console.error('CI Stats Error', ex.message);
+    if (ex.response) {
+      console.error('HTTP Error Response Status', ex.response.status);
+      console.error('HTTP Error Response Body', ex.response.data);
+    }
     process.exit(1);
   }
 })();

.buildkite/scripts/lifecycle/ci_stats_start.js

@@ -4,7 +4,11 @@ const { CiStats } = require('kibana-buildkite-library');
   try {
     await CiStats.onStart();
   } catch (ex) {
-    console.error(ex);
+    console.error('CI Stats Error', ex.message);
+    if (ex.response) {
+      console.error('HTTP Error Response Status', ex.response.status);
+      console.error('HTTP Error Response Body', ex.response.data);
+    }
     process.exit(1);
   }
 })();

docs/apm/correlations.asciidoc

@@ -12,34 +12,33 @@ piece of hardware, like a host or pod. Or, perhaps a set of users, based on IP
 address or region, is facing increased latency due to local data center issues.
 
 To find correlations, select a service on the *Services* page in the {apm-app}
-and click **View correlations**.
+then select a transaction group from the *Transactions* tab.
 
 NOTE: Queries within the {apm-app} are also applied to the correlations.
 
 [discrete]
 [[correlations-latency]]
 ==== Find high transaction latency correlations
 
-The correlations on the *Latency* tab help you discover which attributes are
-contributing to increased transaction latency. 
+The correlations on the *Latency correlations* tab help you discover which
+attributes are contributing to increased transaction latency. 
 
 [role="screenshot"]
 image::apm/images/correlations-hover.png[Latency correlations]
 
 The progress bar indicates the status of the asynchronous analysis, which
 performs statistical searches across a large number of attributes. For large
-time ranges and services with high transaction throughput this might take some
-time. To improve performance, reduce the time range on the service overview
-page.
+time ranges and services with high transaction throughput, this might take some
+time. To improve performance, reduce the time range.
 
 The latency distribution chart visualizes the overall latency of the
-transactions in the service. If there are attributes that have a statistically
-significant correlation with slow response times, they are listed in a table
-below the chart. The table is sorted by correlation coefficients that range from
-0 to 1. Attributes with higher correlation values are more likely to contribute
-to high latency transactions. By default, the attribute with the highest
-correlation value is added to the chart. To see the latency distribution for
-other attributes, hover over their row in the table.
+transactions in the transaction group. If there are attributes that have a
+statistically significant correlation with slow response times, they are listed
+in a table below the chart. The table is sorted by correlation coefficients that
+range from 0 to 1. Attributes with higher correlation values are more likely to
+contribute to high latency transactions. By default, the attribute with the
+highest correlation value is added to the chart. To see the latency distribution
+for other attributes, hover over their row in the table.
 
 If a correlated attribute seems noteworthy, use the **Filter** quick links:
 

docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md

@@ -128,6 +128,7 @@ readonly links: {
         readonly rollupJobs: string;
         readonly elasticsearch: Record<string, string>;
         readonly siem: {
+            readonly privileges: string;
             readonly guide: string;
             readonly gettingStarted: string;
             readonly ml: string;

docs/settings/reporting-settings.asciidoc

@@ -283,7 +283,7 @@ With Security enabled, Reporting has two forms of access control: each user can
 
 [NOTE]
 ============================================================================
-The `xpack.reporting.roles` settings are for a deprecated system of access control in Reporting. It does not allow API Keys to generate reports, and it doesn't allow {kib} application privileges. We recommend you explicitly turn off reporting's deprecated access control feature by adding `xpack.reporting.roles.enabled: false` in kibana.yml. This will enable application privileges for reporting, as described in <<grant-user-access, granting users access to reporting>>.
+The `xpack.reporting.roles` settings are for a deprecated system of access control in Reporting. It does not allow API Keys to generate reports, and it doesn't allow {kib} application privileges. We recommend you explicitly turn off reporting's deprecated access control feature by adding `xpack.reporting.roles.enabled: false` in kibana.yml. This will enable you to create custom roles that provide application privileges for reporting, as described in <<grant-user-access, granting users access to reporting>>.
 ============================================================================
 
 [[xpack-reporting-roles-enabled]] `xpack.reporting.roles.enabled`::

packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts

@@ -221,11 +221,12 @@ export class CiStatsReporter {
           ? `${error.response.status} response`
           : 'no response';
 
+        const seconds = attempt * 10;
         this.log.warning(
-          `failed to reach ci-stats service [reason=${reason}], retrying in ${attempt} seconds`
+          `failed to reach ci-stats service, retrying in ${seconds} seconds, [reason=${reason}], [error=${error.message}]`
         );
 
-        await new Promise((resolve) => setTimeout(resolve, attempt * 1000));
+        await new Promise((resolve) => setTimeout(resolve, seconds * 1000));
       }
     }
   }

packages/kbn-pm/dist/index.js

@@ -59522,8 +59522,9 @@ class CiStatsReporter {
 
 
         const reason = error !== null && error !== void 0 && (_error$response = error.response) !== null && _error$response !== void 0 && _error$response.status ? `${error.response.status} response` : 'no response';
-        this.log.warning(`failed to reach ci-stats service [reason=${reason}], retrying in ${attempt} seconds`);
-        await new Promise(resolve => setTimeout(resolve, attempt * 1000));
+        const seconds = attempt * 10;
+        this.log.warning(`failed to reach ci-stats service, retrying in ${seconds} seconds, [reason=${reason}], [error=${error.message}]`);
+        await new Promise(resolve => setTimeout(resolve, seconds * 1000));
       }
     }
   }

src/core/public/doc_links/doc_links_service.ts

@@ -205,6 +205,7 @@ export class DocLinksService {
         siem: {
           guide: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/index.html`,
           gettingStarted: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/index.html`,
+          privileges: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/sec-requirements.html`,
           ml: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/machine-learning.html`,
           ruleChangeLog: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/prebuilt-rules-changelog.html`,
           detectionsReq: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/detections-permissions-section.html`,
@@ -570,6 +571,7 @@ export interface DocLinksStart {
     readonly rollupJobs: string;
     readonly elasticsearch: Record<string, string>;
     readonly siem: {
+      readonly privileges: string;
       readonly guide: string;
       readonly gettingStarted: string;
       readonly ml: string;

src/core/public/public.api.md

@@ -607,6 +607,7 @@ export interface DocLinksStart {
         readonly rollupJobs: string;
         readonly elasticsearch: Record<string, string>;
         readonly siem: {
+            readonly privileges: string;
             readonly guide: string;
             readonly gettingStarted: string;
             readonly ml: string;

x-pack/plugins/alerting/server/health/get_state.test.ts

@@ -216,8 +216,8 @@ describe('getHealthServiceStatusWithRetryAndErrorHandling', () => {
       })
     ).toPromise();
 
-    expect(status.level).toEqual(ServiceStatusLevels.unavailable);
-    expect(status.summary).toEqual('Alerting framework is unavailable');
+    expect(status.level).toEqual(ServiceStatusLevels.degraded);
+    expect(status.summary).toEqual('Alerting framework is degraded');
     expect(status.meta).toBeUndefined();
   });
 
@@ -275,8 +275,8 @@ describe('getHealthServiceStatusWithRetryAndErrorHandling', () => {
       }),
       retryDelay
     ).subscribe((status) => {
-      expect(status.level).toEqual(ServiceStatusLevels.unavailable);
-      expect(status.summary).toEqual('Alerting framework is unavailable');
+      expect(status.level).toEqual(ServiceStatusLevels.degraded);
+      expect(status.summary).toEqual('Alerting framework is degraded');
       expect(status.meta).toEqual({ error: err });
     });
 

x-pack/plugins/alerting/server/health/get_state.ts

@@ -73,9 +73,7 @@ const getHealthServiceStatus = async (
   const level =
     doc.state?.health_status === HealthStatus.OK
       ? ServiceStatusLevels.available
-      : doc.state?.health_status === HealthStatus.Warning
-      ? ServiceStatusLevels.degraded
-      : ServiceStatusLevels.unavailable;
+      : ServiceStatusLevels.degraded;
   return {
     level,
     summary: LEVEL_SUMMARY[level.toString()],
@@ -102,10 +100,10 @@ export const getHealthServiceStatusWithRetryAndErrorHandling = (
       );
     }),
     catchError((error) => {
-      logger.warn(`Alerting framework is unavailable due to the error: ${error}`);
+      logger.warn(`Alerting framework is degraded due to the error: ${error}`);
       return of({
-        level: ServiceStatusLevels.unavailable,
-        summary: LEVEL_SUMMARY[ServiceStatusLevels.unavailable.toString()],
+        level: ServiceStatusLevels.degraded,
+        summary: LEVEL_SUMMARY[ServiceStatusLevels.degraded.toString()],
         meta: { error },
       });
     })

x-pack/plugins/alerting/server/plugin.ts

@@ -239,7 +239,7 @@ export class AlertingPlugin {
     );
 
     const serviceStatus$ = new BehaviorSubject<ServiceStatus>({
-      level: ServiceStatusLevels.unavailable,
+      level: ServiceStatusLevels.degraded,
       summary: 'Alerting is initializing',
     });
     core.status.set(serviceStatus$);

x-pack/plugins/apm/public/components/app/correlations/latency_correlations_help_popover.tsx

@@ -39,7 +39,7 @@ export function LatencyCorrelationsHelpPopover() {
       <p>
         <FormattedMessage
           id="xpack.apm.correlations.latencyPopoverChartExplanation"
-          defaultMessage="The latency distribution chart visualizes the overall latency of the transactions in the service. When you hover over attributes in the table, their latency distribution is added to the chart."
+          defaultMessage="The latency distribution chart visualizes the overall latency of the transactions in the transaction group. When you hover over attributes in the table, their latency distribution is added to the chart."
         />
       </p>
       <p>

x-pack/plugins/apm/public/components/app/transaction_details/index.tsx

@@ -11,6 +11,8 @@ import { useBreadcrumb } from '../../../context/breadcrumbs/use_breadcrumb';
 import { ChartPointerEventContextProvider } from '../../../context/chart_pointer_event/chart_pointer_event_context';
 import { useApmParams } from '../../../hooks/use_apm_params';
 import { useApmRouter } from '../../../hooks/use_apm_router';
+import { useFallbackToTransactionsFetcher } from '../../../hooks/use_fallback_to_transactions_fetcher';
+import { AggregatedTransactionsBadge } from '../../shared/aggregated_transactions_badge';
 import { TransactionCharts } from '../../shared/charts/transaction_charts';
 
 import { TransactionDetailsTabs } from './transaction_details_tabs';
@@ -31,8 +33,14 @@ export function TransactionDetails() {
     }),
   });
 
+  const { kuery } = query;
+  const { fallbackToTransactions } = useFallbackToTransactionsFetcher({
+    kuery,
+  });
+
   return (
     <>
+      {fallbackToTransactions && <AggregatedTransactionsBadge />}
       <EuiSpacer size="s" />
 
       <EuiTitle>

x-pack/plugins/cases/kibana.json

@@ -10,7 +10,6 @@
   "id":"cases",
   "kibanaVersion":"kibana",
   "optionalPlugins":[
-    "ruleRegistry",
      "security",
      "spaces"
   ],

x-pack/plugins/cases/public/components/create/form.test.tsx

@@ -7,7 +7,7 @@
 
 import React from 'react';
 import { mount } from 'enzyme';
-import { act, waitFor } from '@testing-library/react';
+import { act, render, waitFor } from '@testing-library/react';
 
 import { useForm, Form, FormHook } from '../../common/shared_imports';
 import { useGetTags } from '../../containers/use_get_tags';
@@ -119,4 +119,14 @@ describe('CreateCaseForm', () => {
       });
     });
   });
+
+  it('hides the sync alerts toggle', () => {
+    const { queryByText } = render(
+      <MockHookWrapperComponent>
+        <CreateCaseForm disableAlerts />
+      </MockHookWrapperComponent>
+    );
+
+    expect(queryByText('Sync alert')).not.toBeInTheDocument();
+  });
 });

x-pack/plugins/cases/public/components/create/form.tsx

@@ -53,7 +53,6 @@ export const CreateCaseForm: React.FC<Props> = React.memo(
     withSteps = true,
   }) => {
     const { isSubmitting } = useFormContext();
-
     const firstStep = useMemo(
       () => ({
         title: i18n.STEP_ONE_TITLE,

x-pack/plugins/cases/server/client/alerts/get.ts

@@ -12,11 +12,19 @@ export const get = async (
   { alertsInfo }: AlertGet,
   clientArgs: CasesClientArgs
 ): Promise<CasesClientGetAlertsResponse> => {
-  const { alertsService, logger } = clientArgs;
+  const { alertsService, scopedClusterClient, logger } = clientArgs;
   if (alertsInfo.length === 0) {
     return [];
   }
 
-  const alerts = await alertsService.getAlerts({ alertsInfo, logger });
-  return alerts ?? [];
+  const alerts = await alertsService.getAlerts({ alertsInfo, scopedClusterClient, logger });
+  if (!alerts) {
+    return [];
+  }
+
+  return alerts.docs.map((alert) => ({
+    id: alert._id,
+    index: alert._index,
+    ...alert._source,
+  }));
 };

x-pack/plugins/cases/server/client/alerts/types.ts

@@ -7,7 +7,17 @@
 
 import { CaseStatuses } from '../../../common/api';
 import { AlertInfo } from '../../common';
-import { Alert } from '../../services/alerts/types';
+
+interface Alert {
+  id: string;
+  index: string;
+  destination?: {
+    ip: string;
+  };
+  source?: {
+    ip: string;
+  };
+}
 
 export type CasesClientGetAlertsResponse = Alert[];
 

x-pack/plugins/cases/server/client/alerts/update_status.ts

@@ -16,6 +16,6 @@ export const updateStatus = async (
   { alerts }: UpdateAlertsStatusArgs,
   clientArgs: CasesClientArgs
 ): Promise<void> => {
-  const { alertsService, logger } = clientArgs;
-  await alertsService.updateAlertsStatus({ alerts, logger });
+  const { alertsService, scopedClusterClient, logger } = clientArgs;
+  await alertsService.updateAlertsStatus({ alerts, scopedClusterClient, logger });
 };

x-pack/plugins/cases/server/client/attachments/add.ts

@@ -40,7 +40,12 @@ import {
 } from '../../services/user_actions/helpers';
 
 import { AttachmentService, CasesService, CaseUserActionService } from '../../services';
-import { createCaseError, CommentableCase, isCommentRequestTypeGenAlert } from '../../common';
+import {
+  createCaseError,
+  CommentableCase,
+  createAlertUpdateRequest,
+  isCommentRequestTypeGenAlert,
+} from '../../common';
 import { CasesClientArgs, CasesClientInternal } from '..';
 
 import { decodeCommentRequest } from '../utils';
@@ -190,9 +195,22 @@ const addGeneratedAlerts = async (
       user: userDetails,
       commentReq: query,
       id: savedObjectID,
-      casesClientInternal,
     });
 
+    if (
+      (newComment.attributes.type === CommentType.alert ||
+        newComment.attributes.type === CommentType.generatedAlert) &&
+      caseInfo.attributes.settings.syncAlerts
+    ) {
+      const alertsToUpdate = createAlertUpdateRequest({
+        comment: query,
+        status: subCase.attributes.status,
+      });
+      await casesClientInternal.alerts.updateStatus({
+        alerts: alertsToUpdate,
+      });
+    }
+
     await userActionService.bulkCreate({
       unsecuredSavedObjectsClient,
       actions: [
@@ -368,9 +386,19 @@ export const addComment = async (
       user: userInfo,
       commentReq: query,
       id: savedObjectID,
-      casesClientInternal,
     });
 
+    if (newComment.attributes.type === CommentType.alert && updatedCase.settings.syncAlerts) {
+      const alertsToUpdate = createAlertUpdateRequest({
+        comment: query,
+        status: updatedCase.status,
+      });
+
+      await casesClientInternal.alerts.updateStatus({
+        alerts: alertsToUpdate,
+      });
+    }
+
     await userActionService.bulkCreate({
       unsecuredSavedObjectsClient,
       actions: [