[Alerting] Enable updating system actions through the Bulk Edit Rule API

[cnasikas]

Summarize your PR. If it involves visual changes include a screenshot or gif.

Meta: #160367
Depends on: #167871, #167884

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

For maintainers

• This was checked for breaking API changes and was labeled appropriately

[guskovaue]

@elasticmachine merge upstream

[kibanamachine]

merge conflict between base and head

[kibana-ci]

💔 Build Failed

• Buildkite Build
• Commit: 5045a47
• Interpreting CI Failures

Failed CI Steps

• Build API Docs
• Jest Tests #2
• x-pack/test/alerting_api_integration/security_and_spaces/group2/config_non_dedicated_task_runner.ts
• x-pack/test/alerting_api_integration/security_and_spaces/group2/config_non_dedicated_task_runner.ts
• x-pack/test/alerting_api_integration/security_and_spaces/group2/config.ts
• x-pack/test/alerting_api_integration/security_and_spaces/group2/config.ts
• x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts
• x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts
• x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts
• x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts
• FTR Configs #4
• FTR Configs #4
• FTR Configs #8
• FTR Configs #8
• FTR Configs #9
• FTR Configs #9
• FTR Configs #10
• FTR Configs #10
• FTR Configs #11
• FTR Configs #11
• FTR Configs #15
• FTR Configs #15
• FTR Configs #17
• FTR Configs #17
• FTR Configs #20
• FTR Configs #20
• FTR Configs #22
• FTR Configs #22
• FTR Configs #27
• FTR Configs #27
• FTR Configs #33
• FTR Configs #34
• FTR Configs #34
• FTR Configs #36
• FTR Configs #36
• FTR Configs #40
• FTR Configs #40
• FTR Configs #49
• FTR Configs #49
• FTR Configs #55
• FTR Configs #55
• FTR Configs #57
• FTR Configs #57
• FTR Configs #63
• FTR Configs #63
• FTR Configs #77
• FTR Configs #77
• Serverless Security Cypress Tests #2
• Serverless Security Cypress Tests #2
• Serverless Security Cypress Tests #3
• Serverless Security Cypress Tests #3
• Serverless Security Cypress Tests #4
• Serverless Security Cypress Tests #4
• Security Solution Cypress Tests #1
• Security Solution Cypress Tests #1
• Security Solution Cypress Tests #2
• Security Solution Cypress Tests #2
• Security Solution Cypress Tests #3
• Security Solution Cypress Tests #3
• Security Solution Cypress Tests #6
• Security Solution Cypress Tests #6
• Security Solution Cypress Tests #8
• Security Solution Cypress Tests #8
• Security Solution Cypress Tests #16
• Security Solution Cypress Tests #16
• Check Types
• Post-Build

Test Failures

• [job] [logs] FTR Configs #77 / Actions and Triggers app Rule Details Header should disable the rule
• [job] [logs] FTR Configs #77 / Actions and Triggers app Rule Details Header should disable the rule
• [job] [logs] x-pack/test/alerting_api_integration/security_and_spaces/group2/config_non_dedicated_task_runner.ts / alerting api integration security and spaces enabled - Group 2 Alerts legacy alerts alerts superuser at space1 should schedule actions on legacy alerts
• [job] [logs] x-pack/test/alerting_api_integration/security_and_spaces/group2/config.ts / alerting api integration security and spaces enabled - Group 2 Alerts legacy alerts alerts superuser at space1 should schedule actions on legacy alerts
• [job] [logs] x-pack/test/alerting_api_integration/security_and_spaces/group2/config_non_dedicated_task_runner.ts / alerting api integration security and spaces enabled - Group 2 Alerts legacy alerts alerts superuser at space1 should schedule actions on legacy alerts
• [job] [logs] x-pack/test/alerting_api_integration/security_and_spaces/group2/config.ts / alerting api integration security and spaces enabled - Group 2 Alerts legacy alerts alerts superuser at space1 should schedule actions on legacy alerts
• [job] [logs] FTR Configs #4 / Alerting APIs Alerting rules should pass updated rule params to executor
• [job] [logs] FTR Configs #9 / Alerting APIs Alerting rules should pass updated rule params to executor
• [job] [logs] FTR Configs #11 / Alerting APIs Alerting rules should pass updated rule params to executor
• [job] [logs] FTR Configs #9 / Alerting APIs Alerting rules should pass updated rule params to executor
• [job] [logs] FTR Configs #4 / Alerting APIs Alerting rules should pass updated rule params to executor
• [job] [logs] FTR Configs #11 / Alerting APIs Alerting rules should pass updated rule params to executor
• [job] [logs] FTR Configs #15 / Alerting create legacy should handle create alert request appropriately
• [job] [logs] FTR Configs #15 / Alerting create legacy should handle create alert request appropriately
• [job] [logs] Security Solution Cypress Tests #2 / Bulk editing index patterns of rules with a data view only Add index patterns to custom rules with configured data view when data view checkbox is checked: rules are updated Add index patterns to custom rules with configured data view when data view checkbox is checked: rules are updated
• [job] [logs] Security Solution Cypress Tests #2 / Bulk editing index patterns of rules with a data view only Add index patterns to custom rules with configured data view: all rules are skipped Add index patterns to custom rules with configured data view: all rules are skipped
• [job] [logs] Security Solution Cypress Tests #2 / Bulk editing index patterns of rules with a data view only Delete index patterns in custom rules with configured data view: rules are skipped Delete index patterns in custom rules with configured data view: rules are skipped
• [job] [logs] Security Solution Cypress Tests #2 / Bulk editing index patterns of rules with a data view only Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is checked: rules are updated Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is checked: rules are updated
• [job] [logs] Security Solution Cypress Tests #2 / Bulk editing index patterns of rules with a data view only Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is NOT checked:: rules are skipped Overwrite index patterns in custom rules with configured data view when overwrite data view checkbox is NOT checked:: rules are skipped
• [job] [logs] Security Solution Cypress Tests #2 / Bulk editing index patterns of rules with index patterns and rules with a data view Add index patterns to custom rules when overwrite data view checkbox is checked: all rules are updated Add index patterns to custom rules when overwrite data view checkbox is checked: all rules are updated
• [job] [logs] Security Solution Cypress Tests #2 / Bulk editing index patterns of rules with index patterns and rules with a data view Add index patterns to custom rules: one rule is updated, one rule is skipped Add index patterns to custom rules: one rule is updated, one rule is skipped
• [job] [logs] FTR Configs #77 / detection engine api security and spaces enabled - Group 1 add_actions adding actions should be able to create a new webhook action and attach it to a rule
• [job] [logs] FTR Configs #77 / detection engine api security and spaces enabled - Group 1 add_actions adding actions should be able to create a new webhook action and attach it to a rule
• [job] [logs] FTR Configs #36 / detection engine api security and spaces enabled - Group 10 import_rules importing rules with an index should migrate legacy actions in existing rule if overwrite is set to true
• [job] [logs] FTR Configs #36 / detection engine api security and spaces enabled - Group 10 import_rules importing rules with an index should migrate legacy actions in existing rule if overwrite is set to true
• [job] [logs] FTR Configs #49 / detection engine api security and spaces enabled - Group 4 Detection rule type telemetry Detection rule telemetry "kql" rule type should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active"
• [job] [logs] FTR Configs #49 / detection engine api security and spaces enabled - Group 4 Detection rule type telemetry Detection rule telemetry "kql" rule type should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active"
• [job] [logs] FTR Configs #40 / detection engine api security and spaces enabled - rule execution logic Query type rules with suppression enabled with a suppression time window should update an alert using real rule executions
• [job] [logs] FTR Configs #40 / detection engine api security and spaces enabled - rule execution logic Query type rules with suppression enabled with a suppression time window should update an alert using real rule executions
• [job] [logs] x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type date "is" operator should filter 1 single date if it is set as an exception
• [job] [logs] FTR Configs #8 / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type date "is" operator should filter 1 single date if it is set as an exception
• [job] [logs] x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type date "is" operator should filter 1 single date if it is set as an exception
• [job] [logs] FTR Configs #8 / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type date "is" operator should filter 1 single date if it is set as an exception
• [job] [logs] x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type keyword "is" operator should filter 1 single keyword if it is set as an exception
• [job] [logs] FTR Configs #20 / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type keyword "is" operator should filter 1 single keyword if it is set as an exception
• [job] [logs] x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type keyword "is" operator should filter 1 single keyword if it is set as an exception
• [job] [logs] FTR Configs #20 / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type keyword "is" operator should filter 1 single keyword if it is set as an exception
• [job] [logs] FTR Configs #34 / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type text "is" operator should filter 1 single text if it is set as an exception
• [job] [logs] FTR Configs #55 / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type text "is" operator should filter 1 single text if it is set as an exception
• [job] [logs] FTR Configs #34 / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type text "is" operator should filter 1 single text if it is set as an exception
• [job] [logs] FTR Configs #55 / Detection exceptions data types and operators @serverless @ess Rule exception operators for data type text "is" operator should filter 1 single text if it is set as an exception
• [job] [logs] Serverless Security Cypress Tests #3 / Detection rules, bulk edit of rule actions All actions privileges "before each" hook for "Add a rule action to rules (existing connector)" "before each" hook for "Add a rule action to rules (existing connector)"
• [job] [logs] Security Solution Cypress Tests #1 / Detection rules, bulk edit of rule actions All actions privileges "before each" hook for "Add a rule action to rules (existing connector)" "before each" hook for "Add a rule action to rules (existing connector)"
• [job] [logs] Security Solution Cypress Tests #1 / Detection rules, bulk edit of rule actions All actions privileges "before each" hook for "Add a rule action to rules (existing connector)" "before each" hook for "Add a rule action to rules (existing connector)"
• [job] [logs] Serverless Security Cypress Tests #3 / Detection rules, bulk edit of rule actions All actions privileges "before each" hook for "Add a rule action to rules (existing connector)" "before each" hook for "Add a rule action to rules (existing connector)"
• [job] [logs] Security Solution Cypress Tests #1 / Detection rules, bulk edit of rule actions Restricted action privileges User with no privileges can't add rule actions User with no privileges can't add rule actions
• [job] [logs] Security Solution Cypress Tests #1 / Detection rules, bulk edit of rule actions Restricted action privileges User with no privileges can't add rule actions User with no privileges can't add rule actions
• [job] [logs] FTR Configs #10 / Exceptions API @serverless @ess role_based_rule_exceptions_workflows creating rules with exceptions tests with auditbeat data should be able to execute against an exception list that does include valid entries and get back 0 alerts
• [job] [logs] FTR Configs #57 / Exceptions API @serverless @ess role_based_rule_exceptions_workflows creating rules with exceptions tests with auditbeat data should be able to execute against an exception list that does include valid entries and get back 0 alerts
• [job] [logs] FTR Configs #57 / Exceptions API @serverless @ess role_based_rule_exceptions_workflows creating rules with exceptions tests with auditbeat data should be able to execute against an exception list that does include valid entries and get back 0 alerts
• [job] [logs] FTR Configs #10 / Exceptions API @serverless @ess role_based_rule_exceptions_workflows creating rules with exceptions tests with auditbeat data should be able to execute against an exception list that does include valid entries and get back 0 alerts
• [job] [logs] Security Solution Cypress Tests #8 / Exceptions match_any Creates exception item Creates exception item
• [job] [logs] Security Solution Cypress Tests #8 / Exceptions match_any Creates exception item Creates exception item
• [job] [logs] FTR Configs #22 / Ingest pipelines app Ingest Pipelines Displays the test pipeline in the list of pipelines
• [job] [logs] FTR Configs #22 / Ingest pipelines app Ingest Pipelines Displays the test pipeline in the list of pipelines
• [job] [logs] FTR Configs #17 / Monitoring app Cluster listing Alerts should show a toast when alerts are created successfully
• [job] [logs] FTR Configs #17 / Monitoring app Cluster listing Alerts should show a toast when alerts are created successfully
• [job] [logs] FTR Configs #63 / Observability Rules Synthetics SyntheticsRules creates rule when settings are configured
• [job] [logs] FTR Configs #63 / Observability Rules Synthetics SyntheticsRules creates rule when settings are configured
• [job] [logs] Security Solution Cypress Tests #3 / Rule actions during detection rule creation Indexes a new document after the index action is triggered Indexes a new document after the index action is triggered
• [job] [logs] Security Solution Cypress Tests #3 / Rule actions during detection rule creation Indexes a new document after the index action is triggered Indexes a new document after the index action is triggered
• [job] [logs] FTR Configs #27 / Rule creation API @serverless @ess create_rules @brokenInServerless per-action frequencies actions without frequencies it sets each action's frequency attribute to default value when 'throttle' is undefined
• [job] [logs] FTR Configs #27 / Rule creation API @serverless @ess create_rules @brokenInServerless per-action frequencies actions without frequencies it sets each action's frequency attribute to default value when 'throttle' is undefined
• [job] [logs] Security Solution Cypress Tests #6 / rule snoozing Rule editing page / actions tab adds an action to a snoozed rule adds an action to a snoozed rule
• [job] [logs] Security Solution Cypress Tests #6 / rule snoozing Rule editing page / actions tab adds an action to a snoozed rule adds an action to a snoozed rule
• [job] [logs] Security Solution Cypress Tests #6 / rule snoozing Rules management table snoozes a rule with actions for 2 days snoozes a rule with actions for 2 days
• [job] [logs] Security Solution Cypress Tests #6 / rule snoozing Rules management table snoozes a rule with actions for 2 days snoozes a rule with actions for 2 days
• [job] [logs] FTR Configs #33 / Serverless observability API fleet rejects request to create a new fleet server hosts
• [job] [logs] Jest Tests #2 / update() calls the authentication API key function if the user is authenticated using an api key
• [job] [logs] Jest Tests #2 / update() calls the createApiKey function
• [job] [logs] Jest Tests #2 / update() doesn't call the createAPIKey function when alert is disabled
• [job] [logs] Jest Tests #2 / update() should call useSavedObjectReferences.extractReferences and useSavedObjectReferences.injectReferences if defined for rule type
• [job] [logs] Jest Tests #2 / update() should update a rule even if action is missing secret when allowMissingConnectorSecrets is true
• [job] [logs] Jest Tests #2 / update() should update a rule with some preconfigured actions
• [job] [logs] Jest Tests #2 / update() should update a rule with some system actions
• [job] [logs] Jest Tests #2 / update() updates an action with uuid and adds uuid to an action without it
• [job] [logs] Jest Tests #2 / update() updates given parameters

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [645e45c]

History

• 💔 Build #171535 failed 865b46e
• 💔 Build #171505 failed bc18d27
• 💔 Build #171208 failed 853d376
• 💔 Build #171190 failed b66fd6d

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)