Prepare alerts and actions for feature controls

x-pack/legacy/plugins/alerting/mappings.json

@@ -13,6 +13,9 @@
       "alertTypeId": {
         "type": "keyword"
       },
+      "consumer": {
+        "type": "keyword"
+      },
       "interval": {
         "type": "keyword"
       },

x-pack/legacy/plugins/alerting/server/alerts_client.test.ts

@@ -47,6 +47,7 @@ function getMockData(overwrites: Record<string, any> = {}) {
     name: 'abc',
     tags: ['foo'],
     alertTypeId: '123',
+    consumer: 'bar',
     interval: '10s',
     throttle: null,
     params: {
@@ -182,6 +183,7 @@ describe('create()', () => {
         "alertTypeId": "123",
         "apiKey": undefined,
         "apiKeyOwner": undefined,
+        "consumer": "bar",
         "createdBy": "elastic",
         "enabled": true,
         "interval": "10s",
@@ -787,6 +789,7 @@ describe('create()', () => {
           },
         ],
         alertTypeId: '123',
+        consumer: 'bar',
         name: 'abc',
         params: { bar: true },
         apiKey: Buffer.from('123:abc').toString('base64'),

x-pack/legacy/plugins/alerting/server/routes/create.test.ts

@@ -12,6 +12,7 @@ server.route(createAlertRoute);
 
 const mockedAlert = {
   alertTypeId: '1',
+  consumer: 'bar',
   name: 'abc',
   interval: '10s',
   tags: ['foo'],
@@ -64,6 +65,7 @@ test('creates an alert with proper parameters', async () => {
         },
       ],
       "alertTypeId": "1",
+      "consumer": "bar",
       "id": "123",
       "interval": "10s",
       "name": "abc",
@@ -90,6 +92,7 @@ test('creates an alert with proper parameters', async () => {
             },
           ],
           "alertTypeId": "1",
+          "consumer": "bar",
           "enabled": true,
           "interval": "10s",
           "name": "abc",

x-pack/legacy/plugins/alerting/server/routes/create.ts

@@ -14,6 +14,7 @@ interface ScheduleRequest extends Hapi.Request {
     name: string;
     tags: string[];
     alertTypeId: string;
+    consumer: string;
     interval: string;
     actions: Array<{
       group: string;
@@ -42,6 +43,7 @@ export const createAlertRoute = {
             .items(Joi.string())
             .default([]),
           alertTypeId: Joi.string().required(),
+          consumer: Joi.string().required(),
           throttle: getDurationSchema().default(null),
           interval: getDurationSchema().required(),
           params: Joi.object().required(),

x-pack/legacy/plugins/alerting/server/types.ts

@@ -65,6 +65,7 @@ export interface Alert {
   name: string;
   tags: string[];
   alertTypeId: string;
+  consumer: string;
   interval: string;
   actions: AlertAction[];
   params: Record<string, any>;
@@ -83,6 +84,7 @@ export interface RawAlert extends SavedObjectAttributes {
   name: string;
   tags: string[];
   alertTypeId: string;
+  consumer: string;
   interval: string;
   actions: RawAlertAction[];
   params: SavedObjectAttributes;

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts

@@ -174,6 +174,7 @@ export const getResult = (): RuleAlertType => ({
   name: 'Detect Root/Admin Users',
   tags: [`${INTERNAL_RULE_ID_KEY}:rule-1`],
   alertTypeId: 'siem.signals',
+  consumer: 'siem',
   params: {
     description: 'Detecting root and admin users',
     ruleId: 'rule-1',

x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts

@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SIGNALS_ID } from '../../../../common/constants';
+import { APP_ID, SIGNALS_ID } from '../../../../common/constants';
 import { RuleParams } from './types';
 import { addRuleIdToTags } from './add_rule_id_to_tags';
 
@@ -40,6 +40,7 @@ export const createRules = async ({
       name,
       tags: addRuleIdToTags(tags, ruleId),
       alertTypeId: SIGNALS_ID,
+      consumer: APP_ID,
       params: {
         description,
         ruleId,

x-pack/test/alerting_api_integration/common/lib/alert_utils.ts

@@ -183,6 +183,7 @@ export class AlertUtils {
       throttle: '1m',
       tags: [],
       alertTypeId: 'test.always-firing',
+      consumer: 'bar',
       params: {
         index: ES_TEST_INDEX_NAME,
         reference,

x-pack/test/alerting_api_integration/common/lib/get_test_alert_data.ts

@@ -10,6 +10,7 @@ export function getTestAlertData(overwrites = {}) {
     name: 'abc',
     tags: ['foo'],
     alertTypeId: 'test.noop',
+    consumer: 'bar',
     interval: '1m',
     throttle: '1m',
     actions: [],

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts

@@ -467,6 +467,7 @@ export default function alertTests({ getService }: FtrProviderContext) {
               break;
             case 'space_1_all at space1':
             case 'superuser at space1':
+              expect(response.statusCode).to.eql(200);
               // Wait until alerts scheduled actions 3 times before disabling the alert and waiting for tasks to finish
               await esTestIndexTool.waitForDocs('alert:test.always-firing', reference, 3);
               await alertUtils.disable(response.body.id);
@@ -582,6 +583,7 @@ export default function alertTests({ getService }: FtrProviderContext) {
               break;
             case 'space_1_all at space1':
             case 'superuser at space1':
+              expect(response.statusCode).to.eql(200);
               // Actions should execute twice before widning things down
               await esTestIndexTool.waitForDocs('action:test.index-record', reference, 2);
               await alertUtils.disable(response.body.id);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts

@@ -87,6 +87,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
                 ],
                 enabled: true,
                 alertTypeId: 'test.noop',
+                consumer: 'bar',
                 params: {},
                 createdBy: user.username,
                 interval: '1m',
@@ -201,10 +202,10 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
                 statusCode: 400,
                 error: 'Bad Request',
                 message:
-                  'child "name" fails because ["name" is required]. child "alertTypeId" fails because ["alertTypeId" is required]. child "interval" fails because ["interval" is required]. child "params" fails because ["params" is required]. child "actions" fails because ["actions" is required]',
+                  'child "name" fails because ["name" is required]. child "alertTypeId" fails because ["alertTypeId" is required]. child "consumer" fails because ["consumer" is required]. child "interval" fails because ["interval" is required]. child "params" fails because ["params" is required]. child "actions" fails because ["actions" is required]',
                 validation: {
                   source: 'payload',
-                  keys: ['name', 'alertTypeId', 'interval', 'params', 'actions'],
+                  keys: ['name', 'alertTypeId', 'consumer', 'interval', 'params', 'actions'],
                 },
               });
               break;

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts

@@ -59,6 +59,7 @@ export default function createFindTests({ getService }: FtrProviderContext) {
                 name: 'abc',
                 tags: ['foo'],
                 alertTypeId: 'test.noop',
+                consumer: 'bar',
                 interval: '1m',
                 enabled: true,
                 actions: [],
@@ -138,6 +139,7 @@ export default function createFindTests({ getService }: FtrProviderContext) {
                 name: 'abc',
                 tags: ['foo'],
                 alertTypeId: 'test.noop',
+                consumer: 'bar',
                 interval: '1m',
                 enabled: false,
                 actions: [

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get.ts

@@ -53,6 +53,7 @@ export default function createGetTests({ getService }: FtrProviderContext) {
                 name: 'abc',
                 tags: ['foo'],
                 alertTypeId: 'test.noop',
+                consumer: 'bar',
                 interval: '1m',
                 enabled: true,
                 actions: [],

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts

@@ -64,6 +64,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
                 ...updatedData,
                 id: createdAlert.id,
                 alertTypeId: 'test.noop',
+                consumer: 'bar',
                 createdBy: 'elastic',
                 enabled: true,
                 updatedBy: user.username,
@@ -274,7 +275,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
             .put(`${getUrlPrefix(space.id)}/api/alert/1`)
             .set('kbn-xsrf', 'foo')
             .auth(user.username, user.password)
-            .send(getTestAlertData({ interval: '10x', enabled: undefined }));
+            .send(getTestAlertData({ interval: '10x', enabled: undefined, consumer: undefined }));
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/create.ts

@@ -69,6 +69,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
         ],
         enabled: true,
         alertTypeId: 'test.noop',
+        consumer: 'bar',
         params: {},
         createdBy: null,
         interval: '1m',

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/find.ts

@@ -42,6 +42,7 @@ export default function createFindTests({ getService }: FtrProviderContext) {
         name: 'abc',
         tags: ['foo'],
         alertTypeId: 'test.noop',
+        consumer: 'bar',
         interval: '1m',
         enabled: true,
         actions: [],

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get.ts

@@ -36,6 +36,7 @@ export default function createGetTests({ getService }: FtrProviderContext) {
         name: 'abc',
         tags: ['foo'],
         alertTypeId: 'test.noop',
+        consumer: 'bar',
         interval: '1m',
         enabled: true,
         actions: [],

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update.ts

@@ -44,6 +44,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
           id: createdAlert.id,
           tags: ['bar'],
           alertTypeId: 'test.noop',
+          consumer: 'bar',
           createdBy: null,
           enabled: true,
           updatedBy: null,