[Actions] System actions MVP #166267

cnasikas · 2023-09-12T14:09:51Z

Summary

A system action is an action that triggers Kibana workflows—for example, creating a case, running an OsQuery, running an ML job, or logging. In this PR:

Enable rule routes to accept system actions. The schema of the action is not changed. The framework deducts which action is a system action automatically. System actions do not accept properties like the notifyWhen or group.
Enable rule client methods to accept system actions. The methods accept a new property called systemActions. The methods merge the actions with the system actions before persisting the rule to ES. The methods split the actions from the system actions and return two arrays, actions and systemActions.
Introduce connector adapters: a way to transform the action params to the corresponding connector params.
Allow the execution of system actions. Only alert summaries are supported. Users cannot control the execution of system actions.
Register an example system action.
Change the UI to handle system action. All configuration regarding execution like "Run when" is hidden for system actions. Users cannot select the same system action twice.

Closes #160367

This PR merges the system actions framework, a culmination of several issues merged to the system_actions_mvp feature branch over the past several months.

Testing

A system action with ID system-connector-.system-log-example will be available to be used by the APIs and the UI if you start Kibana with --run-examples. Please ensure the following:

You can create and update rules with actions and system actions.
A rule with actions and system actions is executed as expected.
Entries about the system action execution are added to the event log as expected.
Existing rules with actions work without issues (BWC).
You can perform bulk actions in the rules table to rules with actions and system actions.
License restrictions are respected.
Permission restrictions are respected.
Disabled system actions cannot be used.
Users cannot specify how the system action will run in the UI and the API.

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)

Co-authored-by: Kibana Machine <[email protected]>

…ystem_actions_mvp

In this PR: - Creation of types for the system actions - Creation of a helper function to detect if it is a system action or not - Use the `isSystemAction` in the executor to determine if an action is a system action - Pass the `isSystemConnector` utility function from the actions plugin to the rules factory - Create test utils to help test system actions and connector adapters ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

…#167884) ## Summary This PR enables system actions only to the Create Rule API. Other PRs will follow on a subsequent PR. Depends on: #167871 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Julia <[email protected]>

…ystem_actions_mvp

…API (#168226) Summarize your PR. If it involves visual changes include a screenshot or gif. Depends on: #167871, #167884 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Julia Guskova <[email protected]>

…ystem_actions_mvp

Fix: #170097 Meta: #160367 ## Summary This PR enables system actions for the Bulk Disable Rule API. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

Fix: #170097 Meta: #160367 ## Summary This PR enables system actions for the Bulk Enable Rule API. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <[email protected]>

…ystem_actions_mvp

cnasikas · 2024-04-01T08:29:06Z

@elasticmachine merge upstream

ymao1

LGTM! Great job! Left some minor comments in the functional tests.

x-pack/test/alerting_api_integration/common/lib/alert_utils.ts

x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find.ts

x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/get.ts

x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/actions/get_all_system.ts

x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_delete.ts

x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_disable.ts

x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_enable.ts

x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/clone.ts

x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/resolve.ts

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/create.ts

...lugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx

...ers_actions_ui/public/application/sections/action_connector_form/system_action_type_form.tsx

XavierM

LGTM! it looks like you did it!!!

kibana-ci · 2024-04-02T08:14:42Z

💚 Build Succeeded

Buildkite Build
Commit: bcc2397

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`triggersActionsUi`	690	691	+1

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`actions`	283	285	+2
`alerting`	807	822	+15
`triggersActionsUi`	572	566	-6
total			+11

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`triggersActionsUi`	1.6MB	1.6MB	+6.8KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`alerting`	53	54	+1
`triggersActionsUi`	58	59	+1
total			+2

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`triggersActionsUi`	108.7KB	109.2KB	+444.0B

Unknown metric groups

API count

id	before	after	diff
`actions`	289	291	+2
`alerting`	838	854	+16
`triggersActionsUi`	598	592	-6
total			+12

ESLint disabled line counts

id	before	after	diff
`actions`	22	24	+2
`alerting`	90	92	+2
`triggersActionsUi`	127	128	+1
total			+5

References to deprecated APIs

id	before	after	diff
`triggersActionsUi`	54	53	-1

Total ESLint disabled count

id	before	after	diff
`actions`	24	26	+2
`alerting`	92	94	+2
`triggersActionsUi`	133	134	+1
total			+5

History

💚 Build #200340 succeeded 763e05f
💚 Build #200283 succeeded eb96022
💚 Build #200242 succeeded c5c06e9
💚 Build #200132 succeeded e59c542
💔 Build #200130 failed d1ba533
💔 Build #200109 failed 57559e6

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @cnasikas

## Summary Now that the system actions PR is merged (#166267) we can use the connector adapters to transform the case action params. This PR: - Registers a connector adapter for the case action. - Uses flattened objects in the description and the tags. - Change the integration tests to use an internal router to execute system actions. PR #166267 disabled execution of system actions through the public execute API. - Skip execution of the case action if the grouping did not produce any alerts. - Add references to the cases oracle saved objects. - Remove the owner from the UI and deduct the owner from the rule's consumer in the connector adapter. ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

## Summary Depends on: #166267, #170326, #169484, #173740, #173763, #178068, #178307, #178600, #180437 PRs: - #168370 - #169229 - #171754 - #172709 - #173012 - #175107 - #175452 - #175505 - #177033 - #178277 - #177139 - #179796 Fixes: #153837 ## Testing Run Kibana with `--run-examples` if you want to use the "Always firing" rule. Create a rule with a case action in observability and the stack. The security solution is not supported. You should not be able to assign a case action in a security solution rule. 1. Test the "Reopen closed cases" configuration. 2. Test the "Grouping by" configuration. Only one field is allowed. Not all fields are persisted in alerts. If you select a field not part of the alert the case action will create a case where the grouping value is set to `unknow`. 3. Test the "Time window" feature. You can comment out the validation to test for shorter times. 4. Verify that the case action is experimental. 5. Verify that based on the rule type the case is created in the correct solution. 6. Verify that you cannot create a rule with the case action on the basic license. 7. Verify that the execution of the case action fails if you do not have permission for cases. Pending work on the system actions framework level to not allow users to create rules with system actions where they do not have permission. 8. Stress test the case action by creating multiple rules. ### Checklist Delete any items that are not applicable to this PR. - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) ## Release notes Automatically create cases when an alert is triggered. --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: adcoelho <[email protected]> Co-authored-by: Janki Salvi <[email protected]>

[Actions] Connector Adapters MVP (#166101)

29973e2

cnasikas self-assigned this Sep 12, 2023

cnasikas mentioned this pull request Sep 12, 2023

[Actions] System actions #160367

Closed

15 tasks

cnasikas and others added 15 commits September 13, 2023 19:28

Merge branch 'main' into system_actions_mvp

10e2a56

Merge branch 'main' into system_actions_mvp

1bb0eb5

Merge branch 'main' into system_actions_mvp

dac21c2

[Actions] Expose getAllSystemActions from the actions client (#167783)

d5f1791

Co-authored-by: Kibana Machine <[email protected]>

Merge branch 'main' into system_actions_mvp

d465407

Merge branch 'system_actions_mvp' of github.com:elastic/kibana into s…

a6d9da4

…ystem_actions_mvp

Merge branch 'main' into system_actions_mvp

b064eba

Merge branch 'main' into system_actions_mvp

a291f7a

Merge branch 'main' into system_actions_mvp

861697c

Merge branch 'system_actions_mvp' of github.com:elastic/kibana into s…

645e45c

…ystem_actions_mvp

Merge branch 'main' into system_actions_mvp

bb0ad08

Merge branch 'system_actions_mvp' of github.com:elastic/kibana into s…

f7ecb3b

…ystem_actions_mvp

cnasikas mentioned this pull request Nov 1, 2023

[Cases] Case action #168369

Merged

3 tasks

guskovaue and others added 5 commits November 6, 2023 09:56

Merge branch 'main' into system_actions_mvp

c0b2feb

Merge branch 'main' into system_actions_mvp

825bcc6

Merge branch 'system_actions_mvp' of github.com:elastic/kibana into s…

6105ee6

…ystem_actions_mvp

cnasikas mentioned this pull request Nov 14, 2023

[Cases] Case action: Phase 2 #169229

Merged

2 tasks

cnasikas added 7 commits March 28, 2024 18:28

Merge branch 'system_actions_mvp' of github.com:elastic/kibana into s…

eea2743

…ystem_actions_mvp

Throw an error if a system action is used twice

6c1317b

Remove rules after the end of tests

57559e6

Fix integration tests

91eb80c

Merge branch 'main' into system_actions_mvp

d1ba533

Disable system action type if already selected

c38cebc

Fix type errors in integration tests

e59c542

cnasikas mentioned this pull request Mar 29, 2024

[Cases] Case action UI implementation #179409

Merged

3 tasks

cnasikas added v8.14.0 and removed v8.13.0 labels Mar 29, 2024

Type connector adapter params

c5c06e9

Merge branch 'main' into system_actions_mvp

eb96022

ymao1 approved these changes Apr 1, 2024

View reviewed changes

PR feedback

763e05f

XavierM reviewed Apr 1, 2024

View reviewed changes

...lugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx Show resolved Hide resolved

XavierM reviewed Apr 1, 2024

View reviewed changes

...lugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx Show resolved Hide resolved

XavierM reviewed Apr 1, 2024

View reviewed changes

...lugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx Outdated Show resolved Hide resolved

XavierM reviewed Apr 1, 2024

View reviewed changes

...ers_actions_ui/public/application/sections/action_connector_form/system_action_type_form.tsx Show resolved Hide resolved

XavierM approved these changes Apr 1, 2024

View reviewed changes

cnasikas added 2 commits April 2, 2024 09:40

Merge branch 'main' into system_actions_mvp

2cf8246

PR feedback 2

bcc2397

cnasikas enabled auto-merge (squash) April 2, 2024 07:07

cnasikas merged commit 26d8222 into main Apr 2, 2024
37 checks passed

cnasikas deleted the system_actions_mvp branch April 2, 2024 08:14

kibanamachine added the backport:skip This commit does not require backporting label Apr 2, 2024

cnasikas mentioned this pull request Apr 2, 2024

[Cases] Register connector adapter #179796

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Actions] System actions MVP #166267

[Actions] System actions MVP #166267

cnasikas commented Sep 12, 2023 •

edited

Loading

cnasikas commented Apr 1, 2024

ymao1 left a comment

XavierM left a comment

kibana-ci commented Apr 2, 2024

API count

ESLint disabled line counts

References to deprecated APIs

Total ESLint disabled count

[Actions] System actions MVP #166267

[Actions] System actions MVP #166267

Conversation

cnasikas commented Sep 12, 2023 • edited Loading

Summary

Testing

Checklist

cnasikas commented Apr 1, 2024

ymao1 left a comment

Choose a reason for hiding this comment

XavierM left a comment

Choose a reason for hiding this comment

kibana-ci commented Apr 2, 2024

💚 Build Succeeded

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Public APIs missing exports

Page load bundle

API count

ESLint disabled line counts

References to deprecated APIs

Total ESLint disabled count

History

cnasikas commented Sep 12, 2023 •

edited

Loading