[Security Solution] Sync rule statuses of Detection Engine and Alerting Framework

[banderror]

Summary

Alerting Framework uses the following rule execution statuses: Succeeded, Failed, Running, and Not started.

Additionally, in Security Solution we have custom execution statuses that are displayed in the Rule Management table and Rule Details page:

• succeeded,
• failed
• going to run (actually this one means “running”)
• warning (previously known as partial failure )

The difference from the Alerting framework statuses is:

• we don’t show and don’t have a “not started” / “idle” status; instead, we always show the most recent previous status of execution (like, result, outcome)
• we can transition from status A to status B (e.g. from going to run to warning ) asap in the middle of the rule execution (not waiting till the end of execution), and we can do it multiple times (e.g. going to run -> warning -> failed )

The way it's implemented today you could have a rule that's succeeded at framework level but failed at Security level.

This can happen because of the way error handling is implemented in Security rule type executor. Most of the logic is under try-catch, so if an exception happens within this try block, our status will become “failed”, but on the framework level the rule will be “succeeded”. Some of the errors are handled not via exceptions, in this case the result can be the same. Finally, some parts of the executor are not inside this try-catch, so if any exception happens there, the rule will become failed at the framework levels, but we won’t write our own status. I believe that this case is handled in our routes where we merge own statuses with the framework statuses to get the final, correct status of each rule.

kibana/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts

Line 110 in 3f40328

async executor({

This seems to be fixable from the Security Solution side. We could throw/re-throw exceptions from the executor whenever we decide to make the rule failed. This would sync Security Solution's custom statuses with the Framework statuses.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[banderror]

cc @gmmorris @mikecote @kobelb