[ResponseOps][Rules] Unauthorized to find alerts for rules with the discover consumer

[adcoelho]

Connected to this SDH elastic/sdh-kibana#4705.

Summary:

Superusers get an Unauthorized to find alerts for any rule types error message when viewing alerts for rules with the discover (legacy) consumer.

Kibana version:

The bug appears to have been introduced in 8.13.

How to reproduce:

Use the /api/alerting/rule API to create a rule with the discover consumer.

{
  "params": {
    "searchConfiguration": {
      "query": { "query": "", "language": "kuery" },
      "index": "b9172672-a9ee-467e-af0c-cdb845989072"
    },
    "timeField": "cases.created_at",
    "searchType": "searchSource",
    "timeWindowSize": 5,
    "timeWindowUnit": "m",
    "threshold": [1000],
    "thresholdComparator": ">",
    "size": 100,
    "aggType": "count",
    "groupBy": "all",
    "termSize": 5,
    "excludeHitsFromPreviousRun": false,
    "sourceFields": []
  },
  "consumer": "discover",
  "schedule": { "interval": "1m" },
  "tags": [],
  "name": "My discover rule",
  "rule_type_id": ".es-query",
  "actions": []
}

Go to the rule detail page in Kibana and confirm that the pop-up with the message Unauthorized to find alerts for any rule types appears.

Screenshots:

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[cnasikas]

Related #175206

[pmuellr]

Here's another way to create an EQ rule with consumer: "discover", in DevTools. This one runs off of the event log, so should always have an active alert, no other setup required.

POST kbn:/api/alerting/rule
{
  "params": {
    "timeField": "@timestamp",
    "index": [
      ".kibana-event-log*"
    ],
    "esQuery": "{\n    \"query\":{\n      \"match_all\" : {}\n    }\n  }",
    "size": 100,
    "thresholdComparator": ">",
    "timeWindowSize": 10,
    "timeWindowUnit": "m",
    "threshold": [
      0
    ],
    "aggType": "count",
    "groupBy": "all",
    "termSize": 5,
    "searchType": "esQuery",
    "excludeHitsFromPreviousRun": false,
    "sourceFields": []
  },
  "consumer": "discover",
  "schedule": {
    "interval": "10s"
  },
  "tags": [],
  "name": "EQ rule with consumer: discover",
  "rule_type_id": ".es-query",
  "actions": []
}