[SIEM] Add support for actions and throttle in Rules

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts

@@ -50,6 +50,7 @@ export const mockPrepackagedRule = (): PrepackagedRules => ({
       technique: [{ id: 'techniqueId', name: 'techniqueName', reference: 'techniqueRef' }],
     },
   ],
+  throttle: null,
   enabled: true,
   filters: [],
   immutable: false,

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/utils.ts

@@ -82,6 +82,7 @@ export const getOutputRuleAlertForRest = (): Omit<
   OutputRuleAlertRest,
   'machine_learning_job_id' | 'anomaly_threshold'
 > => ({
+  actions: [],
   created_by: 'elastic',
   created_at: '2019-12-13T16:40:33.400Z',
   updated_at: '2019-12-13T16:40:33.400Z',

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts

@@ -56,6 +56,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
           .filter(rule => rule.rule_id == null || !dupes.includes(rule.rule_id))
           .map(async payloadRule => {
             const {
+              actions,
               anomaly_threshold: anomalyThreshold,
               description,
               enabled,
@@ -77,6 +78,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
               severity,
               tags,
               threat,
+              throttle,
               to,
               type,
               references,
@@ -110,6 +112,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
               const createdRule = await createRules({
                 alertsClient,
                 actionsClient,
+                actions,
                 anomalyThreshold,
                 description,
                 enabled,
@@ -133,6 +136,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
                 name,
                 severity,
                 tags,
+                throttle,
                 to,
                 type,
                 threat,

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts

@@ -31,6 +31,7 @@ export const createRulesRoute = (router: IRouter): void => {
     },
     async (context, request, response) => {
       const {
+        actions,
         anomaly_threshold: anomalyThreshold,
         description,
         enabled,
@@ -54,6 +55,7 @@ export const createRulesRoute = (router: IRouter): void => {
         severity,
         tags,
         threat,
+        throttle,
         to,
         type,
         references,
@@ -96,6 +98,7 @@ export const createRulesRoute = (router: IRouter): void => {
         const createdRule = await createRules({
           alertsClient,
           actionsClient,
+          actions,
           anomalyThreshold,
           description,
           enabled,
@@ -119,6 +122,7 @@ export const createRulesRoute = (router: IRouter): void => {
           name,
           severity,
           tags,
+          throttle,
           to,
           type,
           threat,

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts

@@ -111,6 +111,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                     return null;
                   }
                   const {
+                    actions,
                     anomaly_threshold: anomalyThreshold,
                     description,
                     enabled,
@@ -133,6 +134,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                     severity,
                     tags,
                     threat,
+                    throttle,
                     to,
                     type,
                     references,
@@ -163,6 +165,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                       await createRules({
                         alertsClient,
                         actionsClient,
+                        actions,
                         anomalyThreshold,
                         description,
                         enabled,
@@ -189,6 +192,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                         to,
                         type,
                         threat,
+                        throttle,
                         references,
                         note,
                         version,
@@ -199,6 +203,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                       await patchRules({
                         alertsClient,
                         actionsClient,
+                        actions,
                         savedObjectsClient,
                         description,
                         enabled,
@@ -225,6 +230,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                         to,
                         type,
                         threat,
+                        throttle,
                         references,
                         note,
                         version,

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts

@@ -46,6 +46,7 @@ export const patchRulesBulkRoute = (router: IRouter) => {
       const rules = await Promise.all(
         request.body.map(async payloadRule => {
           const {
+            actions,
             description,
             enabled,
             false_positives: falsePositives,
@@ -70,6 +71,7 @@ export const patchRulesBulkRoute = (router: IRouter) => {
             to,
             type,
             threat,
+            throttle,
             references,
             note,
             version,
@@ -79,6 +81,7 @@ export const patchRulesBulkRoute = (router: IRouter) => {
             const rule = await patchRules({
               alertsClient,
               actionsClient,
+              actions,
               description,
               enabled,
               falsePositives,
@@ -104,6 +107,7 @@ export const patchRulesBulkRoute = (router: IRouter) => {
               to,
               type,
               threat,
+              throttle,
               references,
               note,
               version,

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_route.ts

@@ -30,6 +30,7 @@ export const patchRulesRoute = (router: IRouter) => {
     },
     async (context, request, response) => {
       const {
+        actions,
         description,
         enabled,
         false_positives: falsePositives,
@@ -54,6 +55,7 @@ export const patchRulesRoute = (router: IRouter) => {
         to,
         type,
         threat,
+        throttle,
         references,
         note,
         version,
@@ -76,6 +78,7 @@ export const patchRulesRoute = (router: IRouter) => {
         const rule = await patchRules({
           actionsClient,
           alertsClient,
+          actions,
           description,
           enabled,
           falsePositives,
@@ -101,6 +104,7 @@ export const patchRulesRoute = (router: IRouter) => {
           to,
           type,
           threat,
+          throttle,
           references,
           note,
           version,

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts

@@ -47,6 +47,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
       const rules = await Promise.all(
         request.body.map(async payloadRule => {
           const {
+            actions,
             anomaly_threshold: anomalyThreshold,
             description,
             enabled,
@@ -73,6 +74,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
             to,
             type,
             threat,
+            throttle,
             references,
             note,
             version,
@@ -84,6 +86,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
             const rule = await updateRules({
               alertsClient,
               actionsClient,
+              actions,
               anomalyThreshold,
               description,
               enabled,
@@ -112,6 +115,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
               to,
               type,
               threat,
+              throttle,
               references,
               note,
               version,

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts

@@ -30,6 +30,7 @@ export const updateRulesRoute = (router: IRouter) => {
     },
     async (context, request, response) => {
       const {
+        actions,
         anomaly_threshold: anomalyThreshold,
         description,
         enabled,
@@ -56,6 +57,7 @@ export const updateRulesRoute = (router: IRouter) => {
         to,
         type,
         threat,
+        throttle,
         references,
         note,
         version,
@@ -80,6 +82,7 @@ export const updateRulesRoute = (router: IRouter) => {
         const rule = await updateRules({
           alertsClient,
           actionsClient,
+          actions,
           anomalyThreshold,
           description,
           enabled,
@@ -108,6 +111,7 @@ export const updateRulesRoute = (router: IRouter) => {
           to,
           type,
           threat,
+          throttle,
           references,
           note,
           version,

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts

@@ -29,6 +29,7 @@ import {
   OutputError,
 } from '../utils';
 import { hasListsFeature } from '../../feature_flags';
+import { transformAlertToRuleAction } from '../../rules/transform_actions';
 
 type PromiseFromStreams = ImportRuleAlertRest | Error;
 
@@ -102,6 +103,7 @@ export const transformAlertToRule = (
   ruleStatus?: SavedObject<IRuleSavedAttributesSavedObjectAttributes>
 ): Partial<OutputRuleAlertRest> => {
   return pickBy<OutputRuleAlertRest>((value: unknown) => value != null, {
+    actions: alert.actions.map(transformAlertToRuleAction),
     created_at: alert.createdAt.toISOString(),
     updated_at: alert.updatedAt.toISOString(),
     created_by: alert.createdBy,
@@ -134,6 +136,7 @@ export const transformAlertToRule = (
     to: alert.params.to,
     type: alert.params.type,
     threat: alert.params.threat,
+    throttle: alert.throttle,
     note: alert.params.note,
     version: alert.params.version,
     status: ruleStatus?.attributes.status,

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/validate.test.ts

@@ -19,6 +19,7 @@ import { BulkError } from '../utils';
 import { setFeatureFlagsForTestsOnly, unSetFeatureFlagsForTestsOnly } from '../../feature_flags';
 
 export const ruleOutput: RulesSchema = {
+  actions: [],
   created_at: '2019-12-13T16:40:33.400Z',
   updated_at: '2019-12-13T16:40:33.400Z',
   created_by: 'elastic',