[Security Solution][Alerts] Alert suppression time window

packages/kbn-rule-data-utils/src/technical_field_names.ts

@@ -48,6 +48,7 @@ const ALERT_BUILDING_BLOCK_TYPE = `${ALERT_NAMESPACE}.building_block_type` as co
 const ALERT_EVALUATION_THRESHOLD = `${ALERT_NAMESPACE}.evaluation.threshold` as const;
 const ALERT_EVALUATION_VALUE = `${ALERT_NAMESPACE}.evaluation.value` as const;
 const ALERT_INSTANCE_ID = `${ALERT_NAMESPACE}.instance.id` as const;
+const ALERT_LAST_DETECTED = `${ALERT_NAMESPACE}.last_detected_at` as const;
 const ALERT_RISK_SCORE = `${ALERT_NAMESPACE}.risk_score` as const;
 const ALERT_SEVERITY = `${ALERT_NAMESPACE}.severity` as const;
 const ALERT_SYSTEM_STATUS = `${ALERT_NAMESPACE}.system_status` as const;
@@ -122,6 +123,7 @@ const fields = {
   ALERT_EVALUATION_VALUE,
   ALERT_FLAPPING,
   ALERT_INSTANCE_ID,
+  ALERT_LAST_DETECTED,
   ALERT_RULE_CONSUMER,
   ALERT_RULE_PRODUCER,
   ALERT_REASON,
@@ -187,6 +189,7 @@ export {
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
   ALERT_INSTANCE_ID,
+  ALERT_LAST_DETECTED,
   ALERT_RISK_SCORE,
   ALERT_WORKFLOW_REASON,
   ALERT_WORKFLOW_USER,

x-pack/plugins/rule_registry/common/schemas/8.6.0/index.ts

@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  ALERT_SUPPRESSION_TERMS,
+  ALERT_SUPPRESSION_START,
+  ALERT_SUPPRESSION_END,
+  ALERT_SUPPRESSION_DOCS_COUNT,
+} from '@kbn/rule-data-utils';
+import { AlertWithCommonFields800 } from '../8.0.0';
+
+/* DO NOT MODIFY THIS SCHEMA TO ADD NEW FIELDS. These types represent the alerts that shipped in 8.0.0.
+Any changes to these types should be bug fixes so the types more accurately represent the alerts from 8.0.0.
+
+If you are adding new fields for a new release of Kibana, create a new sibling folder to this one
+for the version to be released and add the field(s) to the schema in that folder.
+
+Then, update `../index.ts` to import from the new folder that has the latest schemas, add the
+new schemas to the union of all alert schemas, and re-export the new schemas as the `*Latest` schemas.
+*/
+
+export interface SuppressionFields860 {
+  [ALERT_SUPPRESSION_TERMS]: Array<{ field: string; value: string | number | null }>;
+  [ALERT_SUPPRESSION_START]: Date;
+  [ALERT_SUPPRESSION_END]: Date;
+  [ALERT_SUPPRESSION_DOCS_COUNT]: number;
+}
+
+export type AlertWithSuppressionFields860<T> = AlertWithCommonFields800<T> & SuppressionFields860;

x-pack/plugins/rule_registry/common/schemas/8.7.0/index.ts

@@ -21,6 +21,9 @@ import {
   TIMESTAMP,
   ALERT_RULE_PARAMETERS,
 } from '@kbn/rule-data-utils';
+import { AlertWithCommonFields800 } from '../8.0.0';
+
+import { SuppressionFields860 } from '../8.6.0';
 
 /* DO NOT MODIFY THIS SCHEMA TO ADD NEW FIELDS. These types represent the alerts that shipped in 8.7.0.
 Any changes to these types should be bug fixes so the types more accurately represent the alerts from 8.7.0.
@@ -32,6 +35,11 @@ Then, update `../index.ts` to import from the new folder that has the latest sch
 new schemas to the union of all alert schemas, and re-export the new schemas as the `*Latest` schemas.
 */
 
+export interface SuppressionFields870 extends SuppressionFields860 {
+  [ALERT_INSTANCE_ID]: string;
+}
+
+export type AlertWithSuppressionFields870<T> = AlertWithCommonFields800<T> & SuppressionFields870;
 const commonAlertIdFieldNames = [ALERT_INSTANCE_ID, ALERT_UUID];
 export type CommonAlertIdFieldName870 = Values<typeof commonAlertIdFieldNames>;
 

x-pack/plugins/rule_registry/common/schemas/index.ts

@@ -12,7 +12,11 @@ import type {
   AlertWithCommonFields870,
 } from './8.7.0';
 
+import type { AlertWithSuppressionFields870, SuppressionFields870 } from './8.7.0';
+
 export type {
+  AlertWithSuppressionFields870 as AlertWithSuppressionFieldsLatest,
+  SuppressionFields870 as SuppressionFieldsLatest,
   CommonAlertFieldName870 as CommonAlertFieldNameLatest,
   CommonAlertIdFieldName870 as CommonAlertIdFieldNameLatest,
   CommonAlertFields870 as CommonAlertFieldsLatest,

x-pack/plugins/rule_registry/server/rule_data_client/rule_data_client.ts

@@ -106,20 +106,18 @@ export class RuleDataClient implements IRuleDataClient {
     };
 
     return {
-      search: async <TSearchRequest extends ESSearchRequest>(
+      search: async <
+        TSearchRequest extends ESSearchRequest,
+        TAlertDoc = Partial<ParsedTechnicalFields & ParsedExperimentalFields>
+      >(
         request: TSearchRequest
-      ): Promise<
-        ESSearchResponse<Partial<ParsedTechnicalFields & ParsedExperimentalFields>, TSearchRequest>
-      > => {
+      ): Promise<ESSearchResponse<TAlertDoc, TSearchRequest>> => {
         try {
           const clusterClient = await waitUntilReady();
           return (await clusterClient.search({
             ...request,
             index: indexPattern,
-          })) as unknown as ESSearchResponse<
-            Partial<ParsedTechnicalFields & ParsedExperimentalFields>,
-            TSearchRequest
-          >;
+          })) as unknown as ESSearchResponse<TAlertDoc, TSearchRequest>;
         } catch (err) {
           this.options.logger.error(`Error performing search in RuleDataClient - ${err.message}`);
           throw err;

x-pack/plugins/rule_registry/server/rule_data_client/types.ts

@@ -23,11 +23,12 @@ export interface IRuleDataClient {
 }
 
 export interface IRuleDataReader {
-  search<TSearchRequest extends ESSearchRequest>(
+  search<
+    TSearchRequest extends ESSearchRequest,
+    TAlertDoc = Partial<ParsedTechnicalFields & ParsedExperimentalFields>
+  >(
     request: TSearchRequest
-  ): Promise<
-    ESSearchResponse<Partial<ParsedTechnicalFields & ParsedExperimentalFields>, TSearchRequest>
-  >;
+  ): Promise<ESSearchResponse<TAlertDoc, TSearchRequest>>;
 
   getDynamicIndexPattern(target?: string): Promise<{
     title: string;

x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_wrapper.mock.ts

@@ -11,6 +11,7 @@ import { PersistenceServices } from './persistence_types';
 export const createPersistenceServicesMock = (): jest.Mocked<PersistenceServices> => {
   return {
     alertWithPersistence: jest.fn(),
+    alertWithSuppression: jest.fn(),
   };
 };