[RAC] 7.15 Observability Checklist

[jasonrhodes]

META TICKET to describe remaining work planned for 7.15 re: Observability Rules, Alerts, and Cases.

Known Bugs

We are tracking all known bugs in the 7.15 Critical Bugs column

Data model stability and other deal-breakers

• Index + RBAC finalization - @Kerry350 / @jasonrhodes
  • RBAC 7.15 should filter by producer and consumer (fixed: [Alerting] Alerting authorization should always exempt alerts consumer #108220)
    • Note: in parallel, we should continue to look at how to improve this for rule sharing in the future, but not for 7.15
  • Legacy multi-tenancy is confirmed to work
  • Because legacy multi-tenancy is not likely to be possible without significant risk, we've pivoted to disabling alerts as data for customers who have kibana.index turned on, with some "unsafe"-labelled config option to bypass that if the user wants to take their own life into their hands
• [RAC] Populate common alert fields from alerting framework data #108161 @weltenwort @mgiota
• [RAC] Preserve lifecycle alert document changes for active alerts #108670 @mgiota in progress
• [RAC][Rule Registry] Implement versioning and backing indices #109276 under review
• [RAC] Replace usages of kibana.alert.status: open with active #109033
• [Security Solution] Fix another reference to ALERT_STATUS #110376
• [RAC] [Observability] Temporarily enable RAC feature flags #109113 @weltenwort
• [RAC] Get o11y alerts in alerts table #109346 @weltenwort
• [RAC] [Observability] Use simpler alert severity level mapping #109068 @mgiota
• [RAC][Rule Registry] Improve RuleDataService API and index bootstrapping implementation #108115
• [RAC] Populate workflow status fields for new lifecycle alerts #107650 @afgomez

UX high-priority 7.15 requirements

@mgiota will take the lead with @katrin-freihofner to make sure our UX is ready for 7.15

• [RAC] [Observability] Enable the observability alerts, cases and ruleRegistry feature flags by default #105237 including on-by-default feature flag Moved to 7.16 checklist
• [RAC] Confirm empty state for the alerts table (might be fixed by EUIDataGrid) #104923 @afgomez under review
• [RAC][Observability][Security Solution] Popover icon is broken #109957 verify if fix from security team solved the issue on Observability @mgiota
• [RAC][Observability]Display Alerts table with proper height #110077 verify if fix from security team solved the issue on Observability @mgiota
• [RAC]Observability alerts table should show 50 rows per default, no vertical scrolling within the panel #108188 @Kerry350
• [RAC][Observability active status jumps on hover  #109084 @Kerry350
• [RAC] Workflow status is not updated on alerts #109379 @afgomez
• [RAC] Observability Alerts table should be responsive #108148 @afgomez
• [Observability RAC] Implement workflow status filters UX for observability alerts table #107629 @afgomez
• [Observability RAC] Severity column #108162 @mgiota removed column
• [RAC] Filter active/recovered status #108119 @mgiota
• [RAC] [Observability] Update alert status in alerts table #108041 @Kerry350
• [RAC][Observability] Alerts table: fullscreen feature does not work as expected #108174 @mgiota
• [Observability RAC] Remove cell actions from all columns #108150 @mgiota
• [RAC] Verify sorting, filtering, adding/removing fields all work #108121 @mgiota
• [Observability RAC] Header updates #107628 @mgiota
• [RAC] update "view in app" icon in alerts table #108377
• [RAC] Remove observability plugin alerts endpoint(s) #104927
• [RAC] Change @timestamp value to be last updated #107636 - @mgiota
  • Related: [RAC] [Observability] Alerts table change relative time for timestamp #108035
• [Observability RAC]: Search a term in the reason field doesn't seem to work #108177 - @mgiota
• [Observability RAC] Actions Header selection looks broken #108153 - fixed by security

RAC documentation

• RAC documentation observability-docs#960 in progress by @EamonnTP Moved to 7.16 checklist

Features coming from the @elastic/security-threat-hunting team

We need to keep an eye on these, possibly help review them, and then test that they work as expected once they merge.

• Overflow icon appears for each row - coming from threat hunt team
• "Add to case"
  • appears as an option within overflow actions, is confirmed to work with Cases page - PR: [RAC][Security Solution] Add to case actions in detail flyout #108057 part 2 PR: [RAC][Security Solution][Observability] Add the add to new case and add to existing case actions to observability alerts table #108502
  • [Cases][Observability] Disabling sync alerts for observability #109929
• "workflow status"
  • Options to update appear in overflow actions, confirmed to work - PR: [TGrid] Alerts status update use RBAC api #108092
  • [RAC][Observability] Add status update actions in row menu #108698
  • [Security Solution][Detection Alerts] Changes in-progress status to acknowledged #107972
  • [RAC] integrating rbac search strategy with alert flyout #108748
  • [RAC][Observability] Overflow options "mark as acknowledged" and "closed selected" don't appear in all rows #109619 @XavierM @mgiota under review
  • [RAC][Observability] Update Cases UI "In progress" to "Acknowledged" #109641
• [RAC] [o11y] add permission in alerts table from kibana privilege/consumer #109759
• Alert Table loading state for change and switching pagination #108432 @afgomez open PR under review and possible duplicate with security [RAC] EuiDataGrid pagination #109269

Stretch goals

Unlikely that we will get to anything in this list for 7.15

• [RAC] [Metrics UI] Link inventory alert to the specific inventory item  #106958 Moved to 7.16 checklist
• Feature controls for alerting within Logs, Metrics, and Uptime (similar to how this works in APM) Moved to 7.16 checklist

[elasticmachine]

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

[paulb-elastic]

Moved the incomplete items from here into the 7.16 checklist