[Security Solution] Threshold rules incorrectly populate kibana.alert.original_time when the rule groups by @timestamp, effecting Timeline investigations

[andrew-goldstein]

Threshold rules incorrectly populate kibana.alert.original_time when the rule groups by @timestamp. As a result, the to part of the date range is invalid when a user investigates a Threshold rule in timeline. @marshallmain provided the following detailed explanation:

The kibana.alert.original_time value of alert document is wrong because we don't handle it correctly when the threshold rule groups by @timestamp. On these two lines we set the @timestamp value of a synthetic source doc to the maximum value of the timestamp override field across all docs in the bucket. The second line there adds the field-value pairs that the docs were grouped by - in this case, also @timestamp, so it overwrites the @timestamp set by the first line with a different (in this case smaller) value.

The end result of the above is that kibana.alert.original_time gets created incorrectly and we use it as the to time for the timeline, resulting in an invalid range of dates.

Kibana/Elasticsearch Stack version:

8.5.0

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[andrew-goldstein]

Related issue: #144473