[POC] Enable per-alert actions #154977
Closed
[POC] Enable per-alert actions #154977
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ity solution rule page elastic#151916
…maries commit 7265666 Merge: db3fbee e80abe8 Author: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Date: Thu Apr 13 09:17:32 2023 -0400 Merge branch 'main' into security_rule_context_alias commit db3fbee Author: Ying <ying.mao@elastic.co> Date: Wed Apr 12 16:41:31 2023 -0400 Using given intervals for time range, not deriving from alert data commit ca9b149 Author: Ying <ying.mao@elastic.co> Date: Wed Apr 12 14:59:33 2023 -0400 Aliasing context and state variables for detection rules in alert summaries
e40pud
added
release_note:enhancement
ci:cloud-deploy
|
@elasticmachine merge upstream |
1 similar comment
|
@elasticmachine merge upstream |
ymao1
reviewed
Apr 19, 2023
| createdAlerts.forEach((alert) => | ||
| options.services.alertFactory | ||
| .create(alert._id) | ||
| .scheduleActions(type.defaultActionGroupId) |
There was a problem hiding this comment.
should include the context object in scheduleActions call so per alert actions have context variables.
ymao1
reviewed
Apr 19, 2023
| }; | ||
| }) | ||
| .filter((_, idx) => response.body.items[idx].create?.status === 201), | ||
| createdAlerts, | ||
| errors: errorAggregator(response.body, [409]), | ||
| alertsWereTruncated, | ||
| }; |
There was a problem hiding this comment.
there is an alertWithSuppression function here that should also be updated to call the alertFactory.create
ymao1
added a commit
that referenced
this pull request
Apr 19, 2023
…ection rules in alert summary mode (#154864) Toward enabling per-action-alerts for detection rules #154977 ## Summary This PR provides the necessary changes for detection rules to fully onboard onto alerting framework alert summaries. * Aliases detection rule context and state variables for summary action variables. This provides backwards compatibility with the `context.alerts`, `context.results_link` and `state.signals_count` action variables that are currently used by detection rules. * Calculates time bounds for summary alerts that can be passed back to the view in app URL generator. This allows rule types to generate view in app URLs limited to the timeframe that will match the summary alerts time range * For throttled summary alerts, the time range is generated as `now - throttle duration` * For per execution summary alerts, we use the `previousStartedAt` time from the task state if available and the schedule duration if not available. This is because some rules write out alerts with `@timestamp: task.startedAt` so just using `now - schedule duration` may not capture those alerts due to task manager schedule delays. --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
|
@elasticmachine merge upstream |
|
@elasticmachine merge upstream |
💔 Build FailedFailed CI StepsTest Failures
Metrics [docs]Module Count
Public APIs missing comments
Async chunks
Page load bundle
Unknown metric groupsAPI count
ESLint disabled line counts
Total ESLint disabled count
History
To update your PR or re-run it, just comment with: cc @e40pud |
e40pud
deleted the
security/feature/actions-integration-with-per-alert-actions
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Summarize your PR. If it involves visual changes include a screenshot or gif.