[Security Solution] Allow users to edit max_signals field for custom rules

test/plugin_functional/test_suites/core_plugins/rendering.ts

@@ -328,6 +328,7 @@ export default function ({ getService }: PluginFunctionalProviderContext) {
         'xpack.stack_connectors.enableExperimental (array)',
         'xpack.trigger_actions_ui.enableExperimental (array)',
         'xpack.trigger_actions_ui.enableGeoTrackingThresholdAlert (boolean)',
+        'xpack.alerting.rules.run.alerts.max (number)',
         'xpack.upgrade_assistant.featureSet.migrateSystemIndices (boolean)',
         'xpack.upgrade_assistant.featureSet.mlSnapshots (boolean)',
         'xpack.upgrade_assistant.featureSet.reindexCorrectiveActions (boolean)',

x-pack/plugins/alerting/public/mocks.ts

@@ -17,6 +17,7 @@ const createSetupContract = (): Setup => ({
 
 const createStartContract = (): Start => ({
   getNavigation: jest.fn(),
+  getMaxAlertsPerRun: jest.fn(),
 });
 
 export const alertingPluginMock = {

x-pack/plugins/alerting/public/plugin.test.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { AlertingPublicPlugin } from './plugin';
+import { AlertingPublicPlugin, AlertingUIConfig } from './plugin';
 import { coreMock } from '@kbn/core/public/mocks';
 import {
   createManagementSectionMock,
@@ -17,7 +17,17 @@ jest.mock('./services/rule_api', () => ({
   loadRuleType: jest.fn(),
 }));
 
-const mockInitializerContext = coreMock.createPluginInitializerContext();
+const mockAlertingUIConfig: AlertingUIConfig = {
+  rules: {
+    run: {
+      alerts: {
+        max: 1000,
+      },
+    },
+  },
+};
+
+const mockInitializerContext = coreMock.createPluginInitializerContext(mockAlertingUIConfig);
 const management = managementPluginMock.createSetupContract();
 const mockSection = createManagementSectionMock();
 

x-pack/plugins/alerting/public/plugin.ts

@@ -57,6 +57,7 @@ export interface PluginSetupContract {
 }
 export interface PluginStartContract {
   getNavigation: (ruleId: Rule['id']) => Promise<string | undefined>;
+  getMaxAlertsPerRun: () => number | undefined;
 }
 export interface AlertingPluginSetup {
   management: ManagementSetup;
@@ -69,13 +70,28 @@ export interface AlertingPluginStart {
   data: DataPublicPluginStart;
 }
 
+export interface AlertingUIConfig {
+  rules: {
+    run: {
+      alerts: {
+        max: number;
+      };
+    };
+  };
+}
+
 export class AlertingPublicPlugin
   implements
     Plugin<PluginSetupContract, PluginStartContract, AlertingPluginSetup, AlertingPluginStart>
 {
   private alertNavigationRegistry?: AlertNavigationRegistry;
+  private config: AlertingUIConfig;
+  readonly maxAlertsPerRun?: number;
 
-  constructor(private readonly initContext: PluginInitializerContext) {}
+  constructor(private readonly initContext: PluginInitializerContext) {
+    this.config = this.initContext.config.get<AlertingUIConfig>();
+    this.maxAlertsPerRun = this.config.rules.run.alerts.max;
+  }
 
   public setup(core: CoreSetup, plugins: AlertingPluginSetup) {
     this.alertNavigationRegistry = new AlertNavigationRegistry();
@@ -150,6 +166,9 @@ export class AlertingPublicPlugin
           return rule.viewInAppRelativeUrl;
         }
       },
+      getMaxAlertsPerRun: () => {
+        return this.maxAlertsPerRun;
+      },
     };
   }
 }

x-pack/plugins/alerting/server/application/rule/methods/aggregate/aggregate_rules.test.ts

@@ -29,6 +29,7 @@ import { DefaultRuleAggregationResult } from '../../../../routes/rule/apis/aggre
 import { defaultRuleAggregationFactory } from '.';
 import { ConnectorAdapterRegistry } from '../../../../connector_adapters/connector_adapter_registry';
 import { RULE_SAVED_OBJECT_TYPE } from '../../../../saved_objects';
+import { DEFAULT_MAX_ALERTS } from '../../../../config';
 
 const taskManager = taskManagerMock.createStart();
 const ruleTypeRegistry = ruleTypeRegistryMock.create();
@@ -66,6 +67,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   internalSavedObjectsRepository,
   uiSettings: uiSettingsServiceMock.createStartContract(),
   isSystemAction: jest.fn(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 beforeEach(() => {

x-pack/plugins/alerting/server/application/rule/methods/bulk_delete/bulk_delete_rules.test.ts

@@ -41,6 +41,7 @@ import {
 import { migrateLegacyActions } from '../../../../rules_client/lib';
 import { ConnectorAdapterRegistry } from '../../../../connector_adapters/connector_adapter_registry';
 import { RULE_SAVED_OBJECT_TYPE } from '../../../../saved_objects';
+import { DEFAULT_MAX_ALERTS } from '../../../../config';
 
 jest.mock('../../../../rules_client/lib/siem_legacy_actions/migrate_legacy_actions', () => {
   return {
@@ -95,6 +96,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   getAlertIndicesAlias: jest.fn(),
   alertsService: null,
   uiSettings: uiSettingsServiceMock.createStartContract(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 const getBulkOperationStatusErrorResponse = (statusCode: number) => ({

x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.test.ts

@@ -46,6 +46,7 @@ import { migrateLegacyActions } from '../../../../rules_client/lib';
 import { ConnectorAdapterRegistry } from '../../../../connector_adapters/connector_adapter_registry';
 import { ActionsClient } from '@kbn/actions-plugin/server';
 import { RULE_SAVED_OBJECT_TYPE } from '../../../../saved_objects';
+import { DEFAULT_MAX_ALERTS } from '../../../../config';
 
 jest.mock('../../../../rules_client/lib/siem_legacy_actions/migrate_legacy_actions', () => {
   return {
@@ -107,6 +108,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   getAlertIndicesAlias: jest.fn(),
   alertsService: null,
   uiSettings: uiSettingsServiceMock.createStartContract(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 beforeEach(() => {

x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.test.ts

@@ -41,6 +41,7 @@ import { RuleAttributes } from '../../../../data/rule/types';
 import { SavedObject } from '@kbn/core/server';
 import { bulkEditOperationsSchema } from './schemas';
 import { RULE_SAVED_OBJECT_TYPE } from '../../../../saved_objects';
+import { DEFAULT_MAX_ALERTS } from '../../../../config';
 
 jest.mock('../../../../rules_client/lib/siem_legacy_actions/migrate_legacy_actions', () => {
   return {
@@ -113,6 +114,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   getAlertIndicesAlias: jest.fn(),
   alertsService: null,
   uiSettings: uiSettingsServiceMock.createStartContract(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 const paramsModifier = jest.fn();
 

x-pack/plugins/alerting/server/application/rule/methods/bulk_untrack/bulk_untrack_alerts.test.ts

@@ -23,6 +23,7 @@ import { alertsServiceMock } from '../../../../alerts_service/alerts_service.moc
 import { ALERT_RULE_UUID, ALERT_UUID } from '@kbn/rule-data-utils';
 import { ConcreteTaskInstance, TaskStatus } from '@kbn/task-manager-plugin/server';
 import { ConnectorAdapterRegistry } from '../../../../connector_adapters/connector_adapter_registry';
+import { DEFAULT_MAX_ALERTS } from '../../../../config';
 
 const taskManager = taskManagerMock.createStart();
 const ruleTypeRegistry = ruleTypeRegistryMock.create();
@@ -64,6 +65,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   uiSettings: uiSettingsServiceMock.createStartContract(),
   isSystemAction: jest.fn(),
   connectorAdapterRegistry: new ConnectorAdapterRegistry(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 describe('bulkUntrackAlerts()', () => {

x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.test.ts

@@ -33,6 +33,7 @@ import { ConnectorAdapter } from '../../../../connector_adapters/types';
 import { RuleDomain } from '../../types';
 import { RuleSystemAction } from '../../../../types';
 import { RULE_SAVED_OBJECT_TYPE } from '../../../../saved_objects';
+import { DEFAULT_MAX_ALERTS } from '../../../../config';
 
 jest.mock('../../../../invalidate_pending_api_keys/bulk_mark_api_keys_for_invalidation', () => ({
   bulkMarkApiKeysForInvalidation: jest.fn(),
@@ -94,6 +95,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   connectorAdapterRegistry,
   isSystemAction: jest.fn(),
   uiSettings: uiSettingsServiceMock.createStartContract(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 beforeEach(() => {

x-pack/plugins/alerting/server/application/rule/methods/get_schedule_frequency/get_schedule_frequency.test.ts

@@ -22,6 +22,7 @@ import { AlertingAuthorization } from '../../../../authorization/alerting_author
 import { ActionsAuthorization } from '@kbn/actions-plugin/server';
 import { auditLoggerMock } from '@kbn/security-plugin/server/audit/mocks';
 import { ConnectorAdapterRegistry } from '../../../../connector_adapters/connector_adapter_registry';
+import { DEFAULT_MAX_ALERTS } from '../../../../config';
 
 const taskManager = taskManagerMock.createStart();
 const ruleTypeRegistry = ruleTypeRegistryMock.create();
@@ -60,6 +61,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   alertsService: null,
   uiSettings: uiSettingsServiceMock.createStartContract(),
   isSystemAction: jest.fn(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 const getMockAggregationResult = (

x-pack/plugins/alerting/server/application/rule/methods/resolve/resolve.test.ts

@@ -23,6 +23,7 @@ import { auditLoggerMock } from '@kbn/security-plugin/server/audit/mocks';
 import { ConnectorAdapterRegistry } from '../../../../connector_adapters/connector_adapter_registry';
 import { RULE_SAVED_OBJECT_TYPE } from '../../../../saved_objects';
 import { getBeforeSetup } from '../../../../rules_client/tests/lib';
+import { DEFAULT_MAX_ALERTS } from '../../../../config';
 
 describe('resolve', () => {
   const taskManager = taskManagerMock.createStart();
@@ -65,6 +66,7 @@ describe('resolve', () => {
     getAlertIndicesAlias: jest.fn(),
     alertsService: null,
     uiSettings: uiSettingsServiceMock.createStartContract(),
+    maxAlertsPerRun: DEFAULT_MAX_ALERTS,
   };
 
   let rulesClient: RulesClient;

x-pack/plugins/alerting/server/application/rule/methods/tags/get_rule_tags.test.ts

@@ -25,6 +25,7 @@ import { RecoveredActionGroup } from '../../../../../common';
 import { RegistryRuleType } from '../../../../rule_type_registry';
 import { ConnectorAdapterRegistry } from '../../../../connector_adapters/connector_adapter_registry';
 import { RULE_SAVED_OBJECT_TYPE } from '../../../../saved_objects';
+import { DEFAULT_MAX_ALERTS } from '../../../../config';
 
 const taskManager = taskManagerMock.createStart();
 const ruleTypeRegistry = ruleTypeRegistryMock.create();
@@ -62,6 +63,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   alertsService: null,
   uiSettings: uiSettingsServiceMock.createStartContract(),
   isSystemAction: jest.fn(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 const listedTypes = new Set<RegistryRuleType>([

x-pack/plugins/alerting/server/index.ts

@@ -7,8 +7,7 @@
 import type { PublicMethodsOf } from '@kbn/utility-types';
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { RulesClient as RulesClientClass } from './rules_client';
-import { configSchema } from './config';
-import { AlertsConfigType } from './types';
+import { AlertingConfig, configSchema } from './config';
 
 export type RulesClient = PublicMethodsOf<RulesClientClass>;
 
@@ -79,8 +78,11 @@ export const plugin = async (initContext: PluginInitializerContext) => {
   return new AlertingPlugin(initContext);
 };
 
-export const config: PluginConfigDescriptor<AlertsConfigType> = {
+export const config: PluginConfigDescriptor<AlertingConfig> = {
   schema: configSchema,
+  exposeToBrowser: {
+    rules: { run: { alerts: { max: true } } },
+  },
   deprecations: ({ renameFromRoot, deprecate }) => [
     renameFromRoot('xpack.alerts.healthCheck', 'xpack.alerting.healthCheck', { level: 'warning' }),
     renameFromRoot(

x-pack/plugins/alerting/server/plugin.ts

@@ -526,6 +526,7 @@ export class AlertingPlugin {
       alertsService: this.alertsService,
       connectorAdapterRegistry: this.connectorAdapterRegistry,
       uiSettings: core.uiSettings,
+      maxAlertsPerRun: this.config.rules.run.alerts.max,
     });
 
     rulesSettingsClientFactory.initialize({

x-pack/plugins/alerting/server/rules_client.mock.ts

@@ -54,6 +54,7 @@ const createRulesClientMock = () => {
     getAlertFromRaw: jest.fn(),
     getScheduleFrequency: jest.fn(),
     bulkUntrackAlerts: jest.fn(),
+    getMaxAlertsPerRun: jest.fn(),
   };
   return mocked;
 };

x-pack/plugins/alerting/server/rules_client/lib/add_generated_action_values.test.ts

@@ -22,6 +22,7 @@ import { alertingAuthorizationMock } from '../../authorization/alerting_authoriz
 import { ruleTypeRegistryMock } from '../../rule_type_registry.mock';
 import { ConstructorOptions } from '../rules_client';
 import { ConnectorAdapterRegistry } from '../../connector_adapters/connector_adapter_registry';
+import { DEFAULT_MAX_ALERTS } from '../../config';
 
 jest.mock('uuid', () => ({
   v4: () => '111-222',
@@ -65,6 +66,7 @@ describe('addGeneratedActionValues()', () => {
     uiSettings: uiSettingsServiceMock.createStartContract(),
     connectorAdapterRegistry: new ConnectorAdapterRegistry(),
     isSystemAction: jest.fn(),
+    maxAlertsPerRun: DEFAULT_MAX_ALERTS,
   };
 
   const mockAction: RuleAction = {

x-pack/plugins/alerting/server/rules_client/lib/create_new_api_key_set.test.ts

@@ -23,6 +23,7 @@ import { getBeforeSetup, mockedDateString } from '../tests/lib';
 import { createNewAPIKeySet } from './create_new_api_key_set';
 import { RulesClientContext } from '../types';
 import { ConnectorAdapterRegistry } from '../../connector_adapters/connector_adapter_registry';
+import { DEFAULT_MAX_ALERTS } from '../../config';
 
 const taskManager = taskManagerMock.createStart();
 const ruleTypeRegistry = ruleTypeRegistryMock.create();
@@ -59,6 +60,7 @@ const rulesClientParams: jest.Mocked<RulesClientContext> = {
   alertsService: null,
   uiSettings: uiSettingsServiceMock.createStartContract(),
   isSystemAction: jest.fn(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 const username = 'test';

x-pack/plugins/alerting/server/rules_client/rules_client.ts

@@ -194,6 +194,10 @@ export class RulesClient {
     return this.context.auditLogger;
   }
 
+  public getMaxAlertsPerRun() {
+    return this.context.maxAlertsPerRun;
+  }
+
   public getTags = (params: RuleTagsParams) => getRuleTags(this.context, params);
 
   public getScheduleFrequency = () => getScheduleFrequency(this.context);

x-pack/plugins/alerting/server/rules_client/tests/bulk_enable.test.ts

@@ -46,6 +46,7 @@ import { TaskStatus } from '@kbn/task-manager-plugin/server';
 import { migrateLegacyActions } from '../lib';
 import { ConnectorAdapterRegistry } from '../../connector_adapters/connector_adapter_registry';
 import { RULE_SAVED_OBJECT_TYPE } from '../../saved_objects';
+import { DEFAULT_MAX_ALERTS } from '../../config';
 
 jest.mock('../lib/siem_legacy_actions/migrate_legacy_actions', () => {
   return {
@@ -99,6 +100,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   getAlertIndicesAlias: jest.fn(),
   alertsService: null,
   uiSettings: uiSettingsServiceMock.createStartContract(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 beforeEach(() => {

x-pack/plugins/alerting/server/rules_client/tests/clear_expired_snoozes.test.ts

@@ -28,6 +28,7 @@ import { TaskStatus } from '@kbn/task-manager-plugin/server';
 import { RuleSnooze } from '../../types';
 import { ConnectorAdapterRegistry } from '../../connector_adapters/connector_adapter_registry';
 import { RULE_SAVED_OBJECT_TYPE } from '../../saved_objects';
+import { DEFAULT_MAX_ALERTS } from '../../config';
 
 jest.mock('../../invalidate_pending_api_keys/bulk_mark_api_keys_for_invalidation', () => ({
   bulkMarkApiKeysForInvalidation: jest.fn(),
@@ -77,6 +78,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   alertsService: null,
   uiSettings: uiSettingsServiceMock.createStartContract(),
   isSystemAction: jest.fn(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 describe('clearExpiredSnoozes()', () => {

x-pack/plugins/alerting/server/rules_client/tests/clone.test.ts

@@ -24,6 +24,7 @@ import { RULE_SAVED_OBJECT_TYPE } from '../../saved_objects';
 import { getBeforeSetup } from './lib';
 import { RuleDomain } from '../../application/rule/types';
 import { ConstructorOptions, RulesClient } from '../rules_client';
+import { DEFAULT_MAX_ALERTS } from '../../config';
 
 describe('clone', () => {
   const taskManager = taskManagerMock.createStart();
@@ -66,6 +67,7 @@ describe('clone', () => {
     getAlertIndicesAlias: jest.fn(),
     alertsService: null,
     uiSettings: uiSettingsServiceMock.createStartContract(),
+    maxAlertsPerRun: DEFAULT_MAX_ALERTS,
   };
 
   let rulesClient: RulesClient;

x-pack/plugins/alerting/server/rules_client/tests/delete.test.ts

@@ -27,6 +27,7 @@ import { bulkMarkApiKeysForInvalidation } from '../../invalidate_pending_api_key
 import { migrateLegacyActions } from '../lib';
 import { ConnectorAdapterRegistry } from '../../connector_adapters/connector_adapter_registry';
 import { RULE_SAVED_OBJECT_TYPE } from '../../saved_objects';
+import { DEFAULT_MAX_ALERTS } from '../../config';
 
 jest.mock('../lib/siem_legacy_actions/migrate_legacy_actions', () => {
   return {
@@ -79,6 +80,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   alertsService: null,
   uiSettings: uiSettingsServiceMock.createStartContract(),
   isSystemAction: jest.fn(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 beforeEach(() => {

x-pack/plugins/alerting/server/rules_client/tests/disable.test.ts

@@ -28,6 +28,7 @@ import { migrateLegacyActions } from '../lib';
 import { migrateLegacyActionsMock } from '../lib/siem_legacy_actions/retrieve_migrated_legacy_actions.mock';
 import { ConnectorAdapterRegistry } from '../../connector_adapters/connector_adapter_registry';
 import { RULE_SAVED_OBJECT_TYPE } from '../../saved_objects';
+import { DEFAULT_MAX_ALERTS } from '../../config';
 
 jest.mock('../lib/siem_legacy_actions/migrate_legacy_actions', () => {
   return {
@@ -81,6 +82,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   alertsService: null,
   uiSettings: uiSettingsServiceMock.createStartContract(),
   isSystemAction: jest.fn(),
+  maxAlertsPerRun: DEFAULT_MAX_ALERTS,
 };
 
 beforeEach(() => {