Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[RAM] System actions update rule api #171099

Merged
merged 16 commits into from
Nov 28, 2023

Conversation

guskovaue
Copy link
Contributor

@guskovaue guskovaue commented Nov 13, 2023

Fix: #170831
Meta: #160367

Summary

This PR enables system actions for the Bulk Delete Rule API.

@guskovaue guskovaue changed the base branch from main to system_actions_mvp November 13, 2023 14:17
@guskovaue guskovaue changed the title [RAM] Sa update rule api [RAM] System actions update rule api Nov 14, 2023
@@ -84,7 +92,10 @@ const rewriteBodyRes: RewriteResponseCase<PartialRule<RuleTypeParams>> = ({
lastRun,
nextRun,
...rest
}) => ({
}: PartialRule<RuleTypeParams>): Omit<
AsApiContract<PartialRule<RuleTypeParams> & { actions?: RuleResponseV1['actions'] }>,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change to the latest and now versioning for now

Suggested change
AsApiContract<PartialRule<RuleTypeParams> & { actions?: RuleResponseV1['actions'] }>,
AsApiContract<PartialRule<RuleTypeParams> & { actions?: RuleResponse['actions'] }>,

@@ -54,18 +54,26 @@ const bodySchema = schema.object({
),
});

const rewriteBodyReq: RewriteRequestCase<UpdateOptions<RuleTypeParams>> = (result) => {
const rewriteBodyReq = (
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just a little bit cleaner

type RuleBody = TypeOf<typeof bodySchema>;
interface RuleUpdateOptionsResult extends Omit<UpdateOptions<RuleTypeParams>, 'data'> {
  data: RuleBody;
}
const rewriteBodyReq = (
  result: RuleUpdateOptionsResult,
  isSystemAction: (connectorId: string) => boolean
): UpdateOptions<RuleTypeParams> => {
  const { notify_when: notifyWhen, actions, ...rest } = result.data;
  return {
    ...result,
    data: {
      ...rest,
      notifyWhen,
      actions: rewriteActionsReqWithSystemActions(actions, isSystemAction),
    },
  };
};

Copy link
Contributor

@XavierM XavierM left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Talked to @JiaweiWu about it since it is a work around since we did not migrate this route to versioning. We should add a note in the route file to let know the FUTURE ENGINEER why we did that and that we should change all the type to an update specific type.

@guskovaue guskovaue added Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) release_note:skip Skip the PR/issue when compiling release notes Feature:Alerting/RulesFramework Issues related to the Alerting Rules Framework labels Nov 28, 2023
@kibana-ci
Copy link
Collaborator

kibana-ci commented Nov 28, 2023

💔 Build Failed

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #18 / Actions and Triggers app Rule Details Header renders the rule details
  • [job] [logs] FTR Configs #18 / Actions and Triggers app Rule Details Header renders the rule details
  • [job] [logs] FTR Configs #33 / Actions API @serverless @ess add_actions adding actions creates rule with a new webhook action
  • [job] [logs] FTR Configs #43 / Actions API @serverless @ess add_actions adding actions creates rule with a new webhook action
  • [job] [logs] FTR Configs #43 / Actions API @serverless @ess add_actions adding actions creates rule with a new webhook action
  • [job] [logs] FTR Configs #33 / Actions API @serverless @ess add_actions adding actions creates rule with a new webhook action
  • [job] [logs] FTR Configs #48 / Alerting alerts should schedule task, run alert and schedule actions
  • [job] [logs] FTR Configs #48 / Alerting alerts should schedule task, run alert and schedule actions
  • [job] [logs] FTR Configs #33 / alerting api integration security and spaces enabled - Group 2 Alerts alerts alerts superuser at space1 should schedule task, run alert and schedule actions when appropriate
  • [job] [logs] FTR Configs #54 / alerting api integration security and spaces enabled - Group 2 Alerts alerts alerts superuser at space1 should schedule task, run alert and schedule actions when appropriate
  • [job] [logs] FTR Configs #33 / alerting api integration security and spaces enabled - Group 2 Alerts alerts alerts superuser at space1 should schedule task, run alert and schedule actions when appropriate
  • [job] [logs] FTR Configs #54 / alerting api integration security and spaces enabled - Group 2 Alerts alerts alerts superuser at space1 should schedule task, run alert and schedule actions when appropriate
  • [job] [logs] FTR Configs #37 / alerting api integration security and spaces enabled - Group 3 Alerts - Group 3 alerts bulkEnableRules superuser at space1 should handle bulk enable of one rule appropriately based on id
  • [job] [logs] FTR Configs #37 / alerting api integration security and spaces enabled - Group 3 Alerts - Group 3 alerts bulkEnableRules superuser at space1 should handle bulk enable of one rule appropriately based on id
  • [job] [logs] FTR Configs #30 / Alerting APIs Summary actions should schedule actions for summary of alerts per rule run
  • [job] [logs] FTR Configs #51 / Alerting APIs Summary actions should schedule actions for summary of alerts per rule run
  • [job] [logs] FTR Configs #59 / Alerting APIs Summary actions should schedule actions for summary of alerts per rule run
  • [job] [logs] FTR Configs #51 / Alerting APIs Summary actions should schedule actions for summary of alerts per rule run
  • [job] [logs] FTR Configs #59 / Alerting APIs Summary actions should schedule actions for summary of alerts per rule run
  • [job] [logs] FTR Configs #30 / Alerting APIs Summary actions should schedule actions for summary of alerts per rule run
  • [job] [logs] FTR Configs #16 / Alerting create legacy should handle create alert request appropriately
  • [job] [logs] FTR Configs #16 / Alerting create legacy should handle create alert request appropriately
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with a data view only Add index patterns to custom rules with configured data view when data view checkbox is checked: rules are updated Add index patterns to custom rules with configured data view when data view checkbox is checked: rules are updated
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with a data view only Add index patterns to custom rules with configured data view when data view checkbox is checked: rules are updated Add index patterns to custom rules with configured data view when data view checkbox is checked: rules are updated
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with a data view only Add index patterns to custom rules with configured data view: all rules are skipped Add index patterns to custom rules with configured data view: all rules are skipped
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with a data view only Add index patterns to custom rules with configured data view: all rules are skipped Add index patterns to custom rules with configured data view: all rules are skipped
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with a data view only Delete index patterns in custom rules with configured data view: rules are skipped Delete index patterns in custom rules with configured data view: rules are skipped
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with a data view only Delete index patterns in custom rules with configured data view: rules are skipped Delete index patterns in custom rules with configured data view: rules are skipped
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with a data view only Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is checked: rules are updated Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is checked: rules are updated
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with a data view only Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is checked: rules are updated Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is checked: rules are updated
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with a data view only Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is NOT checked:: rules are skipped Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is NOT checked:: rules are skipped
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with a data view only Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is NOT checked:: rules are skipped Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is NOT checked:: rules are skipped
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with index patterns and rules with a data view Add index patterns to custom rules when overwrite data view checkbox is checked: all rules are updated Add index patterns to custom rules when overwrite data view checkbox is checked: all rules are updated
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with index patterns and rules with a data view Add index patterns to custom rules when overwrite data view checkbox is checked: all rules are updated Add index patterns to custom rules when overwrite data view checkbox is checked: all rules are updated
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with index patterns and rules with a data view Add index patterns to custom rules: one rule is updated, one rule is skipped Add index patterns to custom rules: one rule is updated, one rule is skipped
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Bulk editing index patterns of rules with index patterns and rules with a data view Add index patterns to custom rules: one rule is updated, one rule is skipped Add index patterns to custom rules: one rule is updated, one rule is skipped
  • [job] [logs] Serverless Security Cypress Tests #4 / Custom query rules Allows a rule to be edited Allows a rule to be edited
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Custom query rules Allows a rule to be edited Allows a rule to be edited
  • [job] [logs] Serverless Security Cypress Tests #4 / Custom query rules Allows a rule to be edited Allows a rule to be edited
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Custom query rules Allows a rule to be edited Allows a rule to be edited
  • [job] [logs] FTR Configs #24 / detection engine api security and spaces enabled - Group 1 create_rules_bulk creating rules in bulk per-action frequencies actions without frequencies it sets each action's frequency attribute to default value when 'throttle' is undefined
  • [job] [logs] FTR Configs #24 / detection engine api security and spaces enabled - Group 1 create_rules_bulk creating rules in bulk per-action frequencies actions without frequencies it sets each action's frequency attribute to default value when 'throttle' is undefined
  • [job] [logs] FTR Configs #43 / detection engine api security and spaces enabled - Group 10 import_rules importing rules with an index should migrate legacy actions in existing rule if overwrite is set to true
  • [job] [logs] FTR Configs #43 / detection engine api security and spaces enabled - Group 10 import_rules importing rules with an index should migrate legacy actions in existing rule if overwrite is set to true
  • [job] [logs] FTR Configs #7 / detection engine api security and spaces enabled - Group 4 Detection rule type telemetry Detection rule telemetry "kql" rule type should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active"
  • [job] [logs] FTR Configs #7 / detection engine api security and spaces enabled - Group 4 Detection rule type telemetry Detection rule telemetry "kql" rule type should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active"
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Add index patterns to custom rules Add index patterns to custom rules
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Add index patterns to custom rules Add index patterns to custom rules
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Delete all index patterns from custom rules Delete all index patterns from custom rules
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Delete all index patterns from custom rules Delete all index patterns from custom rules
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Delete index patterns from custom rules Delete index patterns from custom rules
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Delete index patterns from custom rules Delete index patterns from custom rules
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Display success toast after editing the index pattern Display success toast after editing the index pattern
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Display success toast after editing the index pattern Display success toast after editing the index pattern
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Index pattern action applied to custom rules, including machine learning: user proceeds with edit of custom non machine learning rule Index pattern action applied to custom rules, including machine learning: user proceeds with edit of custom non machine learning rule
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Index pattern action applied to custom rules, including machine learning: user proceeds with edit of custom non machine learning rule Index pattern action applied to custom rules, including machine learning: user proceeds with edit of custom non machine learning rule
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Overwrite index patterns in custom rules Overwrite index patterns in custom rules
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Index patterns Overwrite index patterns in custom rules Overwrite index patterns in custom rules
  • [job] [logs] Security Solution Cypress Tests #3 / Detection rules, bulk edit of rule actions All actions privileges "before each" hook for "Add a rule action to rules (existing connector)" "before each" hook for "Add a rule action to rules (existing connector)"
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #3 / Detection rules, bulk edit of rule actions All actions privileges "before each" hook for "Add a rule action to rules (existing connector)" "before each" hook for "Add a rule action to rules (existing connector)"
  • [job] [logs] Security Solution Cypress Tests #3 / Detection rules, bulk edit of rule actions All actions privileges "before each" hook for "Add a rule action to rules (existing connector)" "before each" hook for "Add a rule action to rules (existing connector)"
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #3 / Detection rules, bulk edit of rule actions All actions privileges "before each" hook for "Add a rule action to rules (existing connector)" "before each" hook for "Add a rule action to rules (existing connector)"
  • [job] [logs] Security Solution Cypress Tests #3 / Detection rules, bulk edit of rule actions Restricted action privileges User with no privileges can't add rule actions User with no privileges can't add rule actions
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #3 / Detection rules, bulk edit of rule actions Restricted action privileges User with no privileges can't add rule actions User with no privileges can't add rule actions
  • [job] [logs] Security Solution Cypress Tests #3 / Detection rules, bulk edit of rule actions Restricted action privileges User with no privileges can't add rule actions User with no privileges can't add rule actions
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #3 / Detection rules, bulk edit of rule actions Restricted action privileges User with no privileges can't add rule actions User with no privileges can't add rule actions
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Timeline templates Apply timeline template to custom rules Apply timeline template to custom rules
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Timeline templates Apply timeline template to custom rules Apply timeline template to custom rules
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Timeline templates Reset timeline template to None for custom rules Reset timeline template to None for custom rules
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #2 / Detection rules, bulk edit Timeline templates Reset timeline template to None for custom rules Reset timeline template to None for custom rules
  • [job] [logs] FTR Configs #51 / Discover alerting Search source Alert should navigate to alert results via view in app link
  • [job] [logs] FTR Configs #51 / Discover alerting Search source Alert should navigate to alert results via view in app link
  • [job] [logs] Jest Tests #20 / find() auditLogger logs audit event when searching rules
  • [job] [logs] Jest Tests #20 / find() authorization ensures user is query filter types down to those the user is authorized to find
  • [job] [logs] Jest Tests #20 / find() calls mapSortField
  • [job] [logs] Jest Tests #20 / find() calls saved objects client with given params
  • [job] [logs] Jest Tests #20 / find() finds rules with actions using preconfigured connectors
  • [job] [logs] Jest Tests #20 / find() finds rules with actions using system connectors
  • [job] [logs] Jest Tests #20 / find() should call useSavedObjectReferences.injectReferences if defined for rule type
  • [job] [logs] Jest Tests #20 / find() should translate filter/sort/search on params to mapped_params
  • [job] [logs] Jest Tests #20 / find() throws an error if useSavedObjectReferences.injectReferences throws an error
  • [job] [logs] Jest Tests #20 / get() authorization ensures user is authorised to get this type of alert under the consumer
  • [job] [logs] Jest Tests #20 / get() calls saved objects client with given params
  • [job] [logs] Jest Tests #20 / get() gets rule with actions using preconfigured connectors
  • [job] [logs] Jest Tests #20 / get() gets rule with actions using system connectors
  • [job] [logs] Jest Tests #20 / get() legacy actions migration for SIEM should call formatLegacyActions if consumer is SIEM
  • [job] [logs] Jest Tests #20 / get() legacy actions migration for SIEM should not call formatLegacyActions if consumer is not SIEM
  • [job] [logs] Jest Tests #20 / get() should call useSavedObjectReferences.injectReferences if defined for rule type
  • [job] [logs] Jest Tests #20 / get() throws an error if useSavedObjectReferences.injectReferences throws an error
  • [job] [logs] FTR Configs #48 / Monitoring app Cluster listing Alerts should show a toast when alerts are created successfully
  • [job] [logs] FTR Configs #48 / Monitoring app Cluster listing Alerts should show a toast when alerts are created successfully
  • [job] [logs] FTR Configs #80 / Observability Rules Synthetics SyntheticsRules creates rule when settings are configured
  • [job] [logs] FTR Configs #80 / Observability Rules Synthetics SyntheticsRules creates rule when settings are configured
  • [job] [logs] Jest Tests #20 / resolve() calls saved objects client with given params
  • [job] [logs] Jest Tests #20 / resolve() calls saved objects client with id and includeSnoozeData params
  • [job] [logs] Jest Tests #20 / resolve() should call useSavedObjectReferences.injectReferences if defined for rule type
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Rule actions during detection rule creation Indexes a new document after the index action is triggered Indexes a new document after the index action is triggered
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / Rule actions during detection rule creation Indexes a new document after the index action is triggered Indexes a new document after the index action is triggered
  • [job] [logs] FTR Configs #47 / Rule creation API @serverless @ess create_rules @brokenInServerless per-action frequencies actions without frequencies sets each action's frequency attribute to default value when 'throttle' is undefined
  • [job] [logs] FTR Configs #47 / Rule creation API @serverless @ess create_rules @brokenInServerless per-action frequencies actions without frequencies sets each action's frequency attribute to default value when 'throttle' is undefined
  • [job] [logs] Serverless Security Cypress Tests #1 / rule snoozing Rules management table snoozes a rule with actions for 2 days snoozes a rule with actions for 2 days
  • [job] [logs] Security Solution Cypress Tests #8 / rule snoozing Rules management table snoozes a rule with actions for 2 days snoozes a rule with actions for 2 days
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / rule snoozing Rules management table snoozes a rule with actions for 2 days snoozes a rule with actions for 2 days
  • [job] [logs] Security Solution Cypress Tests #8 / rule snoozing Rules management table snoozes a rule with actions for 2 days snoozes a rule with actions for 2 days
  • [job] [logs] Serverless Security Cypress Tests #1 / rule snoozing Rules management table snoozes a rule with actions for 2 days snoozes a rule with actions for 2 days
  • [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution #4 / rule snoozing Rules management table snoozes a rule with actions for 2 days snoozes a rule with actions for 2 days
  • [job] [logs] FTR Configs #78 / serverless search UI Rule details Edit rule with deleted connector should show and update deleted connectors when there are existing connectors of the same type
  • [job] [logs] FTR Configs #78 / serverless search UI Rule details Edit rule with deleted connector should show and update deleted connectors when there are existing connectors of the same type
  • [job] [logs] Serverless Security Cypress Tests #4 / Use Value list in exception entry Should use value list in exception entry, and validate deleting value list prompt Should use value list in exception entry, and validate deleting value list prompt

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [d8a7569]

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@guskovaue guskovaue marked this pull request as ready for review November 28, 2023 11:57
@guskovaue guskovaue requested a review from a team as a code owner November 28, 2023 11:57
@elasticmachine
Copy link
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

@guskovaue guskovaue merged commit f2f6f7d into elastic:system_actions_mvp Nov 28, 2023
16 of 34 checks passed
@cnasikas cnasikas mentioned this pull request Jan 7, 2024
15 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Alerting/RulesFramework Issues related to the Alerting Rules Framework release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
No open projects
Development

Successfully merging this pull request may close these issues.

5 participants