From cb5c510ad954866357509f03bcf72aa3f0ab1336 Mon Sep 17 00:00:00 2001
From: Ryland Herrick <ryalnd@gmail.com>
Date: Fri, 3 Apr 2020 15:22:38 -0500
Subject: [PATCH] Mark rule run as failure if there was an error (#62383)

While we still let the rule execute in the case of gap errors and
stopped ML jobs, we now mark that execution as a failure instead of a
success.
---
 .../signals/signal_rule_alert_type.ts         | 31 +++++++++++--------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 27074be1b5cf4..246701e94c99a 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -55,6 +55,7 @@ export const signalRulesAlertType = ({
         index,
         filters,
         language,
+        maxSignals,
         meta,
         machineLearningJobId,
         outputIndex,
@@ -63,6 +64,14 @@ export const signalRulesAlertType = ({
         to,
         type,
       } = params;
+      const searchAfterSize = Math.min(maxSignals, DEFAULT_SEARCH_AFTER_PAGE_SIZE);
+      let hasError: boolean = false;
+      let result: SearchAfterAndBulkCreateReturnType = {
+        success: false,
+        bulkCreateTimes: [],
+        searchAfterTimes: [],
+        lastLookBackDate: null,
+      };
       const ruleStatusClient = ruleStatusSavedObjectsClientFactory(services.savedObjectsClient);
       const ruleStatusService = await ruleStatusServiceFactory({
         alertId,
@@ -104,17 +113,10 @@ export const signalRulesAlertType = ({
         );
         logger.warn(gapMessage);
 
+        hasError = true;
         await ruleStatusService.error(gapMessage, { gap: gapString });
       }
 
-      const searchAfterSize = Math.min(params.maxSignals, DEFAULT_SEARCH_AFTER_PAGE_SIZE);
-      let result: SearchAfterAndBulkCreateReturnType = {
-        success: false,
-        bulkCreateTimes: [],
-        searchAfterTimes: [],
-        lastLookBackDate: null,
-      };
-
       try {
         if (isMlRule(type)) {
           if (ml == null) {
@@ -143,6 +145,7 @@ export const signalRulesAlertType = ({
               `datafeed status: "${jobSummary?.datafeedState}"`
             );
             logger.warn(errorMessage);
+            hasError = true;
             await ruleStatusService.error(errorMessage);
           }
 
@@ -270,11 +273,13 @@ export const signalRulesAlertType = ({
           }
 
           logger.debug(buildRuleMessage('[+] Signal Rule execution completed.'));
-          await ruleStatusService.success('succeeded', {
-            bulkCreateTimeDurations: result.bulkCreateTimes,
-            searchAfterTimeDurations: result.searchAfterTimes,
-            lastLookBackDate: result.lastLookBackDate?.toISOString(),
-          });
+          if (!hasError) {
+            await ruleStatusService.success('succeeded', {
+              bulkCreateTimeDurations: result.bulkCreateTimes,
+              searchAfterTimeDurations: result.searchAfterTimes,
+              lastLookBackDate: result.lastLookBackDate?.toISOString(),
+            });
+          }
         } else {
           const errorMessage = buildRuleMessage(
             'Bulk Indexing of signals failed. Check logs for further details.'