[ML] Package @kbn/ml-anomaly-utils

.github/CODEOWNERS

@@ -459,6 +459,7 @@ x-pack/examples/third_party_maps_source_example @elastic/kibana-gis
 src/plugins/maps_ems @elastic/kibana-gis
 x-pack/plugins/maps @elastic/kibana-gis
 x-pack/packages/ml/agg_utils @elastic/ml-ui
+x-pack/packages/ml/anomaly_utils @elastic/ml-ui
 x-pack/packages/ml/date_picker @elastic/ml-ui
 x-pack/packages/ml/error_utils @elastic/ml-ui
 x-pack/packages/ml/is_defined @elastic/ml-ui

package.json

@@ -474,6 +474,7 @@
     "@kbn/maps-ems-plugin": "link:src/plugins/maps_ems",
     "@kbn/maps-plugin": "link:x-pack/plugins/maps",
     "@kbn/ml-agg-utils": "link:x-pack/packages/ml/agg_utils",
+    "@kbn/ml-anomaly-utils": "link:x-pack/packages/ml/anomaly_utils",
     "@kbn/ml-date-picker": "link:x-pack/packages/ml/date_picker",
     "@kbn/ml-error-utils": "link:x-pack/packages/ml/error_utils",
     "@kbn/ml-is-defined": "link:x-pack/packages/ml/is_defined",

tsconfig.base.json

@@ -912,6 +912,8 @@
       "@kbn/maps-plugin/*": ["x-pack/plugins/maps/*"],
       "@kbn/ml-agg-utils": ["x-pack/packages/ml/agg_utils"],
       "@kbn/ml-agg-utils/*": ["x-pack/packages/ml/agg_utils/*"],
+      "@kbn/ml-anomaly-utils": ["x-pack/packages/ml/anomaly_utils"],
+      "@kbn/ml-anomaly-utils/*": ["x-pack/packages/ml/anomaly_utils/*"],
       "@kbn/ml-date-picker": ["x-pack/packages/ml/date_picker"],
       "@kbn/ml-date-picker/*": ["x-pack/packages/ml/date_picker/*"],
       "@kbn/ml-error-utils": ["x-pack/packages/ml/error_utils"],

x-pack/.i18nrc.json

@@ -2,6 +2,7 @@
   "prefix": "xpack",
   "paths": {
     "xpack.actions": "plugins/actions",
+    "xpack.aiops": ["packages/ml/aiops_components", "plugins/aiops"],
     "xpack.alerting": "plugins/alerting",
     "xpack.eventLog": "plugins/event_log",
     "xpack.stackAlerts": "plugins/stack_alerts",
@@ -45,8 +46,12 @@
     "xpack.logstash": ["plugins/logstash"],
     "xpack.main": "legacy/plugins/xpack_main",
     "xpack.maps": ["plugins/maps"],
-    "xpack.aiops": ["packages/ml/aiops_components", "plugins/aiops"],
-    "xpack.ml": ["packages/ml/date_picker", "packages/ml/trained_models_utils", "plugins/ml"],
+    "xpack.ml": [
+      "packages/ml/anomaly_utils",
+      "packages/ml/date_picker",
+      "packages/ml/trained_models_utils",
+      "plugins/ml"
+    ],
     "xpack.monitoring": ["plugins/monitoring"],
     "xpack.observability": "plugins/observability",
     "xpack.observabilityShared": "plugins/observability_shared",

x-pack/packages/ml/anomaly_utils/README.md

@@ -0,0 +1,3 @@
+# @kbn/ml-anomaly-utils
+
+Utility functions, constants and types for Machine Learning's Anomaly Detection.

x-pack/packages/ml/anomaly_utils/anomaly_severity.ts

@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/**
+ * Labels displayed in the ML UI to indicate the severity of the anomaly according
+ * to the normalized anomaly score.
+ */
+export enum ML_ANOMALY_SEVERITY {
+  /**
+   * Anomalies are displayed as critical severity when the score is greater than or equal to 75.
+   */
+  CRITICAL = 'critical',
+
+  /**
+   * Anomalies are displayed as major severity when the score is greater than or equal to 50 and less than 75.
+   */
+  MAJOR = 'major',
+
+  /**
+   * Anomalies are displayed as minor severity when the score is greater than or equal to 25 and less than 50.
+   */
+  MINOR = 'minor',
+
+  /**
+   * Anomalies are displayed as warning severity when the score is greater than or equal to 3 and less than 25.
+   * Note in some parts of the UI, warning severity is used when the score is greater than or equal to 0.
+   */
+  WARNING = 'warning',
+
+  /**
+   * Anomalies are displayed as low severity in some parts of the ML UI when the score is greater than or equal to 0 and less than 3.
+   */
+  LOW = 'low',
+
+  /**
+   * Anomalies are displayed as unknown severity if the anomaly score is not known.
+   */
+  UNKNOWN = 'unknown',
+}
+
+/**
+ * Interface for severity types to be used in ML_ANOMALY_SEVERITY_TYPES.
+ *
+ * @export
+ * @interface MlSeverityType
+ * @typedef {MlSeverityType}
+ */
+export interface MlSeverityType {
+  /**
+   * One of ML_ANOMALY_SEVERITY
+   * @type {ML_ANOMALY_SEVERITY}
+   */
+  id: ML_ANOMALY_SEVERITY;
+  /**
+   * Translated ML_ANOMALY_SEVERITY
+   * @type {string}
+   */
+  label: string;
+}

x-pack/packages/ml/anomaly_utils/anomaly_severity_types.ts

@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { type MlSeverityType, ML_ANOMALY_SEVERITY } from './anomaly_severity';
+
+export const ML_ANOMALY_SEVERITY_TYPES: Record<ML_ANOMALY_SEVERITY, MlSeverityType> = {
+  critical: {
+    id: ML_ANOMALY_SEVERITY.CRITICAL,
+    label: i18n.translate('xpack.ml.anomalyUtils.severity.criticalLabel', {
+      defaultMessage: 'critical',
+    }),
+  },
+  major: {
+    id: ML_ANOMALY_SEVERITY.MAJOR,
+    label: i18n.translate('xpack.ml.anomalyUtils.severity.majorLabel', {
+      defaultMessage: 'major',
+    }),
+  },
+  minor: {
+    id: ML_ANOMALY_SEVERITY.MINOR,
+    label: i18n.translate('xpack.ml.anomalyUtils.severity.minorLabel', {
+      defaultMessage: 'minor',
+    }),
+  },
+  warning: {
+    id: ML_ANOMALY_SEVERITY.WARNING,
+    label: i18n.translate('xpack.ml.anomalyUtils.severity.warningLabel', {
+      defaultMessage: 'warning',
+    }),
+  },
+  unknown: {
+    id: ML_ANOMALY_SEVERITY.UNKNOWN,
+    label: i18n.translate('xpack.ml.anomalyUtils.severity.unknownLabel', {
+      defaultMessage: 'unknown',
+    }),
+  },
+  low: {
+    id: ML_ANOMALY_SEVERITY.LOW,
+    label: i18n.translate('xpack.ml.anomalyUtils.severityWithLow.lowLabel', {
+      defaultMessage: 'low',
+    }),
+  },
+};

x-pack/packages/ml/anomaly_utils/anomaly_threshold.ts

@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/**
+ * Anomaly score numeric thresholds to indicate the severity of the anomaly.
+ */
+export enum ML_ANOMALY_THRESHOLD {
+  /**
+   * Threshold at which anomalies are labelled in the UI as critical.
+   */
+  CRITICAL = 75,
+
+  /**
+   * Threshold at which anomalies are labelled in the UI as major.
+   */
+  MAJOR = 50,
+
+  /**
+   * Threshold at which anomalies are labelled in the UI as minor.
+   */
+  MINOR = 25,
+
+  /**
+   * Threshold at which anomalies are labelled in the UI as warning.
+   */
+  WARNING = 3,
+
+  /**
+   * Threshold at which anomalies are labelled in the UI as low.
+   */
+  LOW = 0,
+}

x-pack/plugins/ml/common/util/anomaly_utils.test.ts → x-pack/packages/ml/anomaly_utils/anomaly_utils.test.ts

@@ -5,24 +5,22 @@
  * 2.0.
  */
 
-import { AnomalyRecordDoc } from '../types/anomalies';
+import type { MlAnomalyRecordDoc } from './types';
 
 import {
   aggregationTypeTransform,
   getEntityFieldList,
   getEntityFieldName,
   getEntityFieldValue,
-  getSeverity,
   getSeverityWithLow,
-  getSeverityColor,
   isRuleSupported,
   showActualForFunction,
   showTypicalForFunction,
   isMultiBucketAnomaly,
 } from './anomaly_utils';
 
 describe('ML - anomaly utils', () => {
-  const partitionEntityRecord: AnomalyRecordDoc = {
+  const partitionEntityRecord: MlAnomalyRecordDoc = {
     job_id: 'farequote',
     result_type: 'record',
     probability: 0.012818,
@@ -39,7 +37,7 @@ describe('ML - anomaly utils', () => {
     field_name: 'responsetime',
   };
 
-  const byEntityRecord: AnomalyRecordDoc = {
+  const byEntityRecord: MlAnomalyRecordDoc = {
     job_id: 'farequote',
     result_type: 'record',
     probability: 0.012818,
@@ -56,7 +54,7 @@ describe('ML - anomaly utils', () => {
     field_name: 'responsetime',
   };
 
-  const overEntityRecord: AnomalyRecordDoc = {
+  const overEntityRecord: MlAnomalyRecordDoc = {
     job_id: 'gallery',
     result_type: 'record',
     probability: 2.81806e-9,
@@ -74,7 +72,7 @@ describe('ML - anomaly utils', () => {
     over_field_value: '37.157.32.164',
   };
 
-  const noEntityRecord: AnomalyRecordDoc = {
+  const noEntityRecord: MlAnomalyRecordDoc = {
     job_id: 'farequote_no_by',
     result_type: 'record',
     probability: 0.0191711,
@@ -89,7 +87,7 @@ describe('ML - anomaly utils', () => {
     field_name: 'responsetime',
   };
 
-  const metricNoEntityRecord: AnomalyRecordDoc = {
+  const metricNoEntityRecord: MlAnomalyRecordDoc = {
     job_id: 'farequote_metric',
     result_type: 'record',
     probability: 0.030133495093182184,
@@ -113,7 +111,7 @@ describe('ML - anomaly utils', () => {
     airline: ['NKS'],
   };
 
-  const rareEntityRecord: AnomalyRecordDoc = {
+  const rareEntityRecord: MlAnomalyRecordDoc = {
     job_id: 'gallery',
     result_type: 'record',
     probability: 0.02277014211908481,
@@ -166,34 +164,6 @@ describe('ML - anomaly utils', () => {
     status: ['206'],
   };
 
-  describe('getSeverity', () => {
-    test('returns warning for 0 <= score < 25', () => {
-      expect(getSeverity(0).id).toBe('warning');
-      expect(getSeverity(0.001).id).toBe('warning');
-      expect(getSeverity(24.99).id).toBe('warning');
-    });
-
-    test('returns minor for 25 <= score < 50', () => {
-      expect(getSeverity(25).id).toBe('minor');
-      expect(getSeverity(49.99).id).toBe('minor');
-    });
-
-    test('returns minor for 50 <= score < 75', () => {
-      expect(getSeverity(50).id).toBe('major');
-      expect(getSeverity(74.99).id).toBe('major');
-    });
-
-    test('returns critical for score >= 75', () => {
-      expect(getSeverity(75).id).toBe('critical');
-      expect(getSeverity(100).id).toBe('critical');
-      expect(getSeverity(1000).id).toBe('critical');
-    });
-
-    test('returns unknown for scores less than 0', () => {
-      expect(getSeverity(-10).id).toBe('unknown');
-    });
-  });
-
   describe('getSeverityWithLow', () => {
     test('returns low for 0 <= score < 3', () => {
       expect(getSeverityWithLow(0).id).toBe('low');
@@ -227,41 +197,8 @@ describe('ML - anomaly utils', () => {
     });
   });
 
-  describe('getSeverityColor', () => {
-    test('returns correct hex code for low for 0 <= score < 3', () => {
-      expect(getSeverityColor(0)).toBe('#d2e9f7');
-      expect(getSeverityColor(0.001)).toBe('#d2e9f7');
-      expect(getSeverityColor(2.99)).toBe('#d2e9f7');
-    });
-
-    test('returns correct hex code for warning for 3 <= score < 25', () => {
-      expect(getSeverityColor(3)).toBe('#8bc8fb');
-      expect(getSeverityColor(24.99)).toBe('#8bc8fb');
-    });
-
-    test('returns correct hex code for minor for 25 <= score < 50', () => {
-      expect(getSeverityColor(25)).toBe('#fdec25');
-      expect(getSeverityColor(49.99)).toBe('#fdec25');
-    });
-
-    test('returns correct hex code for major for 50 <= score < 75', () => {
-      expect(getSeverityColor(50)).toBe('#fba740');
-      expect(getSeverityColor(74.99)).toBe('#fba740');
-    });
-
-    test('returns correct hex code for critical for score >= 75', () => {
-      expect(getSeverityColor(75)).toBe('#fe5050');
-      expect(getSeverityColor(100)).toBe('#fe5050');
-      expect(getSeverityColor(1000)).toBe('#fe5050');
-    });
-
-    test('returns correct hex code for unknown for scores less than 0', () => {
-      expect(getSeverityColor(-10)).toBe('#ffffff');
-    });
-  });
-
   describe('isMultiBucketAnomaly', () => {
-    const singleBucketAnomaly: AnomalyRecordDoc = {
+    const singleBucketAnomaly: MlAnomalyRecordDoc = {
       job_id: 'farequote_sb',
       result_type: 'record',
       probability: 0.0191711,
@@ -283,7 +220,7 @@ describe('ML - anomaly utils', () => {
       },
     };
 
-    const multiBucketAnomaly: AnomalyRecordDoc = {
+    const multiBucketAnomaly: MlAnomalyRecordDoc = {
       job_id: 'farequote_mb',
       result_type: 'record',
       probability: 0.0191711,
@@ -305,7 +242,7 @@ describe('ML - anomaly utils', () => {
       },
     };
 
-    const multiBucketAnomaly2: AnomalyRecordDoc = {
+    const multiBucketAnomaly2: MlAnomalyRecordDoc = {
       job_id: 'farequote_mb2',
       result_type: 'record',
       probability: 0.0191711,
@@ -326,7 +263,7 @@ describe('ML - anomaly utils', () => {
       },
     };
 
-    const noASEAnomaly: AnomalyRecordDoc = {
+    const noASEAnomaly: MlAnomalyRecordDoc = {
       job_id: 'farequote_ase',
       result_type: 'record',
       probability: 0.0191711,
@@ -341,7 +278,7 @@ describe('ML - anomaly utils', () => {
       field_name: 'responsetime',
     };
 
-    const noMBIAnomaly: AnomalyRecordDoc = {
+    const noMBIAnomaly: MlAnomalyRecordDoc = {
       job_id: 'farequote_sbi',
       result_type: 'record',
       probability: 0.0191711,
@@ -362,7 +299,7 @@ describe('ML - anomaly utils', () => {
       },
     };
 
-    const singleBucketAnomaly2: AnomalyRecordDoc = {
+    const singleBucketAnomaly2: MlAnomalyRecordDoc = {
       job_id: 'farequote_sb2',
       result_type: 'record',
       probability: 0.0191711,