[RAM] Mark disabled alerts as Untracked in both Stack and o11y

packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.tsx

@@ -9,7 +9,7 @@
 import React, { memo } from 'react';
 import { i18n } from '@kbn/i18n';
 import { EuiBadge, EuiBadgeProps } from '@elastic/eui';
-import { AlertStatus, ALERT_STATUS_RECOVERED } from '@kbn/rule-data-utils';
+import { AlertStatus, ALERT_STATUS_RECOVERED, ALERT_STATUS_UNTRACKED } from '@kbn/rule-data-utils';
 
 export interface AlertLifecycleStatusBadgeProps {
   alertStatus: AlertStatus;
@@ -37,15 +37,27 @@ const FLAPPING_LABEL = i18n.translate(
   }
 );
 
+const UNTRACKED_LABEL = i18n.translate(
+  'alertsUIShared.components.alertLifecycleStatusBadge.untrackedLabel',
+  {
+    defaultMessage: 'Untracked',
+  }
+);
+
 interface BadgeProps {
   label: string;
   color: string;
+  isDisabled?: boolean;
   iconProps?: {
     iconType: EuiBadgeProps['iconType'];
   };
 }
 
 const getBadgeProps = (alertStatus: AlertStatus, flapping: boolean | undefined): BadgeProps => {
+  if (alertStatus === ALERT_STATUS_UNTRACKED) {
+    return { label: UNTRACKED_LABEL, color: 'default', isDisabled: true };
+  }
+
   // Prefer recovered over flapping
   if (alertStatus === ALERT_STATUS_RECOVERED) {
     return {
@@ -82,10 +94,15 @@ export const AlertLifecycleStatusBadge = memo((props: AlertLifecycleStatusBadgeP
 
   const castedFlapping = castFlapping(flapping);
 
-  const { label, color, iconProps } = getBadgeProps(alertStatus, castedFlapping);
+  const { label, color, iconProps, isDisabled } = getBadgeProps(alertStatus, castedFlapping);
 
   return (
-    <EuiBadge data-test-subj="alertLifecycleStatusBadge" color={color} {...iconProps}>
+    <EuiBadge
+      data-test-subj="alertLifecycleStatusBadge"
+      isDisabled={isDisabled}
+      color={color}
+      {...iconProps}
+    >
       {label}
     </EuiBadge>
   );

packages/kbn-rule-data-utils/src/alerts_as_data_status.ts

@@ -8,5 +8,9 @@
 
 export const ALERT_STATUS_ACTIVE = 'active';
 export const ALERT_STATUS_RECOVERED = 'recovered';
+export const ALERT_STATUS_UNTRACKED = 'untracked';
 
-export type AlertStatus = typeof ALERT_STATUS_ACTIVE | typeof ALERT_STATUS_RECOVERED;
+export type AlertStatus =
+  | typeof ALERT_STATUS_ACTIVE
+  | typeof ALERT_STATUS_RECOVERED
+  | typeof ALERT_STATUS_UNTRACKED;

x-pack/plugins/alerting/common/alert_summary.ts

@@ -40,4 +40,5 @@ export interface AlertStatus {
   activeStartDate?: string;
   flapping: boolean;
   maintenanceWindowIds?: string[];
+  tracked: boolean;
 }

x-pack/plugins/alerting/server/alerts_client/alerts_client.ts

@@ -6,7 +6,13 @@
  */
 
 import { ElasticsearchClient } from '@kbn/core/server';
-import { ALERT_RULE_UUID, ALERT_UUID } from '@kbn/rule-data-utils';
+import {
+  ALERT_INSTANCE_ID,
+  ALERT_RULE_UUID,
+  ALERT_STATUS,
+  ALERT_STATUS_UNTRACKED,
+  ALERT_UUID,
+} from '@kbn/rule-data-utils';
 import { chunk, flatMap, isEmpty, keys } from 'lodash';
 import { SearchRequest } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { Alert } from '@kbn/alerts-as-data-utils';
@@ -197,6 +203,30 @@ export class AlertsClient<
     return { hits, total };
   }
 
+  public async untrackAlertIdByIndices(alertId: string, indices: string[]) {
+    const esClient = await this.options.elasticsearchClientPromise;
+    for (const index of indices) {
+      try {
+        await esClient.updateByQuery({
+          index,
+          body: {
+            script: {
+              source: `ctx._source['${ALERT_STATUS}'] = '${ALERT_STATUS_UNTRACKED}'`,
+              lang: 'painless',
+            },
+            query: {
+              term: {
+                [ALERT_INSTANCE_ID]: { value: alertId },
+              },
+            },
+          },
+        });
+      } catch (err) {
+        this.options.logger.error(`Error marking ${alertId} as untracked - ${err.message}`);
+      }
+    }
+  }
+
   public report(
     alert: ReportedAlert<
       AlertData,

x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts

@@ -232,4 +232,8 @@ export class LegacyAlertsClient<
   }
 
   public async persistAlerts() {}
+
+  public async untrackAlertIdByIndices() {
+    return;
+  }
 }

x-pack/plugins/alerting/server/alerts_client/types.ts

@@ -64,6 +64,7 @@ export interface IAlertsClient<
     alertsToReturn: Record<string, RawAlertInstance>;
     recoveredAlertsToReturn: Record<string, RawAlertInstance>;
   };
+  untrackAlertIdByIndices(alertId: string, indices: string[]): Promise<void>;
   factory(): PublicAlertFactory<
     State,
     Context,

x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.test.ts

@@ -102,6 +102,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   minimumScheduleInterval: { value: '1m', enforce: false },
   isAuthenticationTypeAPIKey: isAuthenticationTypeApiKeyMock,
   getAuthenticationAPIKey: getAuthenticationApiKeyMock,
+  getAlertIndicesAlias: jest.fn(),
 };
 const paramsModifier = jest.fn();
 

x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.test.ts

@@ -82,6 +82,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   minimumScheduleInterval: { value: '1m', enforce: false },
   isAuthenticationTypeAPIKey: jest.fn(),
   getAuthenticationAPIKey: jest.fn(),
+  getAlertIndicesAlias: jest.fn(),
 };
 
 beforeEach(() => {

x-pack/plugins/alerting/server/application/rule/methods/get_schedule_frequency/get_schedule_frequency.test.ts

@@ -53,6 +53,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   minimumScheduleInterval: { value: '1m', enforce: false },
   isAuthenticationTypeAPIKey: jest.fn(),
   getAuthenticationAPIKey: jest.fn(),
+  getAlertIndicesAlias: jest.fn(),
 };
 
 const getMockAggregationResult = (

x-pack/plugins/alerting/server/lib/alert_summary_from_event_log.test.ts

@@ -127,6 +127,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": true,
             "status": "OK",
+            "tracked": true,
             "uuid": undefined,
           },
           "alert-2": Object {
@@ -135,6 +136,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": true,
             "status": "OK",
+            "tracked": true,
             "uuid": undefined,
           },
         },
@@ -241,6 +243,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": false,
             "status": "OK",
+            "tracked": true,
             "uuid": "uuid-1",
           },
         },
@@ -283,6 +286,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": false,
             "status": "OK",
+            "tracked": true,
             "uuid": "uuid-1",
           },
         },
@@ -324,6 +328,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": false,
             "status": "OK",
+            "tracked": true,
             "uuid": "uuid-1",
           },
         },
@@ -366,6 +371,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": false,
             "status": "Active",
+            "tracked": true,
             "uuid": "uuid-1",
           },
         },
@@ -408,6 +414,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": false,
             "status": "Active",
+            "tracked": true,
             "uuid": "uuid-1",
           },
         },
@@ -450,6 +457,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": false,
             "status": "Active",
+            "tracked": true,
             "uuid": "uuid-1",
           },
         },
@@ -490,6 +498,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": false,
             "status": "Active",
+            "tracked": true,
             "uuid": "uuid-1",
           },
         },
@@ -534,6 +543,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": true,
             "status": "Active",
+            "tracked": true,
             "uuid": "uuid-1",
           },
           "alert-2": Object {
@@ -542,6 +552,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": true,
             "status": "OK",
+            "tracked": true,
             "uuid": "uuid-2",
           },
         },
@@ -593,6 +604,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": false,
             "status": "Active",
+            "tracked": true,
             "uuid": "uuid-1",
           },
           "alert-2": Object {
@@ -601,6 +613,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": false,
             "muted": false,
             "status": "OK",
+            "tracked": true,
             "uuid": "uuid-2",
           },
         },
@@ -639,6 +652,7 @@ describe('alertSummaryFromEventLog', () => {
             "flapping": true,
             "muted": false,
             "status": "Active",
+            "tracked": true,
             "uuid": "uuid-1",
           },
         },

x-pack/plugins/alerting/server/lib/alert_summary_from_event_log.ts

@@ -105,6 +105,8 @@ export function alertSummaryFromEventLog(params: AlertSummaryFromEventLogParams)
         status.activeStartDate = undefined;
         status.actionGroupId = undefined;
     }
+
+    status.tracked = action !== EVENT_LOG_ACTIONS.untrackedInstance;
   }
 
   for (const event of executionEvents.reverse()) {
@@ -169,6 +171,7 @@ function getAlertStatus(
     actionGroupId: undefined,
     activeStartDate: undefined,
     flapping: false,
+    tracked: true,
   };
   alerts.set(alertId, status);
   return status;

x-pack/plugins/alerting/server/plugin.ts

@@ -111,6 +111,7 @@ export const EVENT_LOG_ACTIONS = {
   recoveredInstance: 'recovered-instance',
   activeInstance: 'active-instance',
   executeTimeout: 'execute-timeout',
+  untrackedInstance: 'untracked-instance',
 };
 export const LEGACY_EVENT_LOG_ACTIONS = {
   resolvedInstance: 'resolved-instance',
@@ -494,6 +495,7 @@ export class AlertingPlugin {
       eventLogger: this.eventLogger,
       minimumScheduleInterval: this.config.rules.minimumScheduleInterval,
       maxScheduledPerMinute: this.config.rules.maxScheduledPerMinute,
+      getAlertIndicesAlias: createGetAlertIndicesAliasFn(this.ruleTypeRegistry!),
     });
 
     rulesSettingsClientFactory.initialize({

x-pack/plugins/alerting/server/rule_type_registry.mock.ts

@@ -18,6 +18,7 @@ const createRuleTypeRegistryMock = () => {
     list: jest.fn(),
     getAllTypes: jest.fn(),
     ensureRuleTypeEnabled: jest.fn(),
+    createAlertsClient: jest.fn(),
   };
   return mocked;
 };

x-pack/plugins/alerting/server/rule_type_registry.ts

@@ -420,6 +420,10 @@ export class RuleTypeRegistry {
   public getAllTypes(): string[] {
     return [...this.ruleTypes.keys()];
   }
+
+  public async createAlertsClient(...args: Parameters<AlertsService['createAlertsClient']>) {
+    return this.alertsService?.createAlertsClient(...args);
+  }
 }
 
 function normalizedActionVariables(actionVariables: RuleType['actionVariables']) {

x-pack/plugins/alerting/server/rules_client/lib/create_new_api_key_set.test.ts

@@ -52,6 +52,7 @@ const rulesClientParams: jest.Mocked<RulesClientContext> = {
   fieldsToExcludeFromPublicApi: [],
   isAuthenticationTypeAPIKey: jest.fn(),
   getAuthenticationAPIKey: jest.fn(),
+  getAlertIndicesAlias: jest.fn(),
 };
 
 const username = 'test';

x-pack/plugins/alerting/server/rules_client/lib/index.ts

@@ -14,7 +14,7 @@ export { getAuthorizationFilter } from './get_authorization_filter';
 export { checkAuthorizationAndGetTotal } from './check_authorization_and_get_total';
 export { scheduleTask } from './schedule_task';
 export { createNewAPIKeySet } from './create_new_api_key_set';
-export { recoverRuleAlerts } from './recover_rule_alerts';
+export { untrackRuleAlerts } from './untrack_rule_alerts';
 export { migrateLegacyActions } from './siem_legacy_actions/migrate_legacy_actions';
 export { formatLegacyActions } from './siem_legacy_actions/format_legacy_actions';
 export { addGeneratedActionValues } from './add_generated_action_values';