Investigate requirements for rules-in-packages

[miltonhultgren]

While working on Platform Observability related work about recreating Stack Monitoring views as Kibana Dashboards, I realized that Stack Monitoring also includes alerts.

While we might re-create those Rules with existing Observability rules or refactor the existing rules to work with Alerts-As-Data, we still need to consider how package authors will make use of those rules in their packages (both for our own stack component but also 3rd party integrations).

This is on the ReponseOps teams radar as outline in this issue.

In this issue I would like to explore what we think the requirements are for this to work for us, both in the shape of changing current rules but also how/what to put into the packages and how those are then exposed in the UI for users to create instances of.

Open questions

• Are the existing rules (Observability and Stack Monitoring) re-useable enough for our stack component needs and other package authors?
• Should rules in packages be in the shape of pre-filled values for existing rule executors or is there a need for a generic rule executor that can be "scripted" to allow for more complex/odd use cases without writing code in Kibana?
• How are these rules exposed in the UI, under the existing name but pre-filled based on page context or added as "named rules" (where multiple named rules share the same executor but pre-fill different values)?

AC

• There exists a document that outlines the requirements we currently have and a formulation of the problems we need help solving that we can present to the ResponseOps folks (not solutions)

[elasticmachine]

Pinging @elastic/infra-monitoring-ui (Team:Infra Monitoring UI)

[miltonhultgren]

I'll copy a quote from @jasonrhodes here because I liked how it was worded:

The main problem statement is probably something along the lines of “integrations are the best place to capture domain knowledge about an external system. If that's where the data ingest rules and logic are being defined, that should also be where default rule definitions for that domain should be defined as well, so that the rules are installed only if the data is being collected.”

[smith]

This is probably still valid but we'll take care of it through another issue when needed.