[Cases] Bulk add alerts to a case

[cnasikas]

Summary

At the moment of writing, users can attach one alert to a case per time. This limits users and can be a usability hurdle when users want to attach multiple alerts at once.

Architecture

Each attachment is saved as a saved object record on the cases-comments saved object. Each attachment has a type. The type alert is for alert attachments. The schema of the attachment is:

alertId: string[] | string;
index: string[] | string;
rule: { id: string, name: string }

Cases provide two hooks for attaching attachments to a case. Both of them accept an array of attachments. With the current schema, alert attachments are grouped by rule so the consumer of the hooks should group the alerts by rule and create one attachment for each group. For example:

const attachments = groupByRule(selectedAlerts);
cases.hooks.getUseCasesAddToExistingCaseModal({
    attachments,
  });

An internal bulk creates API will be created so one call will be made to create the attachments.

UI

A single event in the comment list (user action) will be created for each bulk action. The user can click on the <number> alerts text and view the alerts on the alert's table.

Reference: https://github.com/elastic/stack-design-team/issues/90#issuecomment-953167079

Limits

Circuit breakers should be put in place to ensure performance. Specifically, one for how many alerts can a user attach with a single action and one for how many alerts a user can attach to a case in total. The first limit is to ensure that not many alert ids and indexes will be saved on the same saved object. The second limit is to ensure that the list of the activity in the single case page view will not grow a lot. Having a load more button on the activity timeline could allow for this limit to be relaxed.

We decided with @kobelb to limit users to 1K alerts per case and per action and relaxed it if needed in the future.

Current user flow

alerts.mp4

Tasks

• Create an internal endpoint to bulk create attachments ([Cases] Support bulk cases POST comment  #124814)
• Add limits to the number of alerts a case can have ([Cases] Limit the number of alerts that can be attached to a case #129988)
• Use the new internal endpoint on the UI ([Cases] Use the bulk create attachment endpoint on the UI #130124)
• Different view for user action when the length of the alert table is greater than one ([Cases] Multiple alerts user action on the UI #130265)
• Add the bulk menu item to the alerts table in security solution #131122

Related issues

• [Cases][Security Solution] Bulk add alerts to cases #113853
• [Security Solution][Case] Attach multiple alerts to case #91292
• https://github.com/elastic/enhancements/issues/13795
• [Cases] Add view to see list of alerts on Case detail page. #116501

[elasticmachine]

Pinging @elastic/response-ops-cases (Feature:Cases)

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)