[Actions] Notify only on action group change

x-pack/plugins/alerts/common/alert.ts

@@ -5,6 +5,7 @@
  */
 
 import { SavedObjectAttribute, SavedObjectAttributes } from 'kibana/server';
+import { AlertNotifyWhenType } from './alert_notify_when_type';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export type AlertTypeState = Record<string, any>;
@@ -68,6 +69,7 @@ export interface Alert {
  apiKey: string | null;
  apiKeyOwner: string | null;
  throttle: string | null;
+ notifyWhen: AlertNotifyWhenType | null;
  muteAll: boolean;
  mutedInstanceIds: string[];
  executionStatus: AlertExecutionStatus;

x-pack/plugins/alerts/common/alert_notify_when_type.test.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { validateNotifyWhenType } from './alert_notify_when_type';
+
+test('validates valid notify when type', () => {
+ expect(validateNotifyWhenType('onActionGroupChange')).toBeUndefined();
+ expect(validateNotifyWhenType('onActiveAlert')).toBeUndefined();
+ expect(validateNotifyWhenType('onThrottleInterval')).toBeUndefined();
+});
+test('returns error string if input is not valid notify when type', () => {
+ expect(validateNotifyWhenType('randomString')).toEqual(
+ `string is not a valid AlertNotifyWhenType: randomString`
+ );
+});

x-pack/plugins/alerts/common/alert_notify_when_type.ts

@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+const AlertNotifyWhenTypeValues = [
+ 'onActionGroupChange',
+ 'onActiveAlert',
+ 'onThrottleInterval',
+] as const;
+export type AlertNotifyWhenType = typeof AlertNotifyWhenTypeValues[number];
+
+export function validateNotifyWhenType(notifyWhen: string) {
+ if (AlertNotifyWhenTypeValues.includes(notifyWhen as AlertNotifyWhenType)) {
+ return;
+ }
+ return `string is not a valid AlertNotifyWhenType: ${notifyWhen}`;
+}

x-pack/plugins/alerts/common/index.ts

@@ -14,6 +14,7 @@ export * from './alert_navigation';
 export * from './alert_instance_summary';
 export * from './builtin_action_groups';
 export * from './disabled_action_groups';
+export * from './alert_notify_when_type';
 
 export interface AlertingFrameworkHealth {
  isSufficientlySecure: boolean;

x-pack/plugins/alerts/server/alert_instance/alert_instance.test.ts

@@ -72,6 +72,114 @@ describe('isThrottled', () => {
  });
 });
 
+describe('scheduledActionGroupOrSubgroupHasChanged()', () => {
+ test('should be false if no last scheduled and nothing scheduled', () => {
+ const alertInstance = new AlertInstance();
+ expect(alertInstance.scheduledActionGroupOrSubgroupHasChanged()).toEqual(false);
+ });
+
+ test('should be false if group does not change', () => {
+ const alertInstance = new AlertInstance({
+ meta: {
+ lastScheduledActions: {
+ date: new Date(),
+ group: 'default',
+ },
+ },
+ });
+ alertInstance.scheduleActions('default');
+ expect(alertInstance.scheduledActionGroupOrSubgroupHasChanged()).toEqual(false);
+ });
+
+ test('should be false if group and subgroup does not change', () => {
+ const alertInstance = new AlertInstance({
+ meta: {
+ lastScheduledActions: {
+ date: new Date(),
+ group: 'default',
+ subgroup: 'subgroup',
+ },
+ },
+ });
+ alertInstance.scheduleActionsWithSubGroup('default', 'subgroup');
+ expect(alertInstance.scheduledActionGroupOrSubgroupHasChanged()).toEqual(false);
+ });
+
+ test('should be false if group does not change and subgroup goes from undefined to defined', () => {
+ const alertInstance = new AlertInstance({
+ meta: {
+ lastScheduledActions: {
+ date: new Date(),
+ group: 'default',
+ },
+ },
+ });
+ alertInstance.scheduleActionsWithSubGroup('default', 'subgroup');
+ expect(alertInstance.scheduledActionGroupOrSubgroupHasChanged()).toEqual(false);
+ });
+
+ test('should be false if group does not change and subgroup goes from defined to undefined', () => {
+ const alertInstance = new AlertInstance({
+ meta: {
+ lastScheduledActions: {
+ date: new Date(),
+ group: 'default',
+ subgroup: 'subgroup',
+ },
+ },
+ });
+ alertInstance.scheduleActions('default');
+ expect(alertInstance.scheduledActionGroupOrSubgroupHasChanged()).toEqual(false);
+ });
+
+ test('should be true if no last scheduled and has scheduled action', () => {
+ const alertInstance = new AlertInstance();
+ alertInstance.scheduleActions('default');
+ expect(alertInstance.scheduledActionGroupOrSubgroupHasChanged()).toEqual(true);
+ });
+
+ test('should be true if group does change', () => {
+ const alertInstance = new AlertInstance({
+ meta: {
+ lastScheduledActions: {
+ date: new Date(),
+ group: 'default',
+ },
+ },
+ });
+ alertInstance.scheduleActions('penguin');
+ expect(alertInstance.scheduledActionGroupOrSubgroupHasChanged()).toEqual(true);
+ });
+
+ test('should be true if group does change and subgroup does change', () => {
+ const alertInstance = new AlertInstance({
+ meta: {
+ lastScheduledActions: {
+ date: new Date(),
+ group: 'default',
+ subgroup: 'subgroup',
+ },
+ },
+ });
+ alertInstance.scheduleActionsWithSubGroup('penguin', 'fish');
+ expect(alertInstance.scheduledActionGroupOrSubgroupHasChanged()).toEqual(true);
+ });
+
+ test('should be true if group does not change and subgroup does change', () => {
+ const alertInstance = new AlertInstance({
+ meta: {
+ lastScheduledActions: {
+ date: new Date(),
+ group: 'default',
+ subgroup: 'subgroup',
+ },
+ },
+ });
+ alertInstance.scheduleActionsWithSubGroup('default', 'fish');
+ expect(alertInstance.scheduledActionGroupOrSubgroupHasChanged()).toEqual(true);
+ });
+});
+
 describe('getScheduledActionOptions()', () => {
  test('defaults to undefined', () => {
  const alertInstance = new AlertInstance();

x-pack/plugins/alerts/server/alert_instance/alert_instance.ts

@@ -70,6 +70,31 @@ export class AlertInstance<
  return false;
  }
 
+ scheduledActionGroupOrSubgroupHasChanged(): boolean {
+ if (!this.meta.lastScheduledActions && this.scheduledExecutionOptions) {
+ // it is considered a change when there are no previous scheduled actions
+ // and new scheduled actions
+ return true;
+ }
+
+ if (this.meta.lastScheduledActions && this.scheduledExecutionOptions) {
+ // compare previous and new scheduled actions if both exist
+ return (
+ !this.scheduledActionGroupIsUnchanged(
+ this.meta.lastScheduledActions,
+ this.scheduledExecutionOptions
+ ) ||
+ !this.scheduledActionSubgroupIsUnchanged(
+ this.meta.lastScheduledActions,
+ this.scheduledExecutionOptions
+ )
+ );
+ }
+
+ // no previous and no new scheduled actions
+ return false;
+ }
+
  private scheduledActionGroupIsUnchanged(
  lastScheduledActions: NonNullable<AlertInstanceMeta['lastScheduledActions']>,
  scheduledExecutionOptions: ScheduledExecutionOptions<State, Context>

x-pack/plugins/alerts/server/alerts_client/alerts_client.ts

@@ -29,8 +29,13 @@ import {
  AlertTaskState,
  AlertInstanceSummary,
  AlertExecutionStatusValues,
+ AlertNotifyWhenType,
 } from '../types';
-import { validateAlertTypeParams, alertExecutionStatusFromRaw } from '../lib';
+import {
+ validateAlertTypeParams,
+ alertExecutionStatusFromRaw,
+ getAlertNotifyWhenType,
+} from '../lib';
 import {
  GrantAPIKeyResult as SecurityPluginGrantAPIKeyResult,
  InvalidateAPIKeyResult as SecurityPluginInvalidateAPIKeyResult,
@@ -157,6 +162,7 @@ interface UpdateOptions {
  actions: NormalizedAlertAction[];
  params: Record<string, unknown>;
  throttle: string | null;
+ notifyWhen: AlertNotifyWhenType | null;
  };
 }
 
@@ -251,6 +257,8 @@ export class AlertsClient {
  const createTime = Date.now();
  const { references, actions } = await this.denormalizeActions(data.actions);
 
+ const notifyWhen = getAlertNotifyWhenType(data.notifyWhen, data.throttle);
+
  const rawAlert: RawAlert = {
  ...data,
  ...this.apiKeyAsAlertAttributes(createdAPIKey, username),
@@ -262,6 +270,7 @@ export class AlertsClient {
  params: validatedAlertTypeParams as RawAlert['params'],
  muteAll: false,
  mutedInstanceIds: [],
+ notifyWhen,
  executionStatus: {
  status: 'pending',
  lastExecutionDate: new Date().toISOString(),
@@ -694,6 +703,7 @@ export class AlertsClient {
  ? await this.createAPIKey(this.generateAPIKeyName(alertType.id, data.name))
  : null;
  const apiKeyAttributes = this.apiKeyAsAlertAttributes(createdAPIKey, username);
+ const notifyWhen = getAlertNotifyWhenType(data.notifyWhen, data.throttle);
 
  let updatedObject: SavedObject<RawAlert>;
  const createAttributes = this.updateMeta({
@@ -702,6 +712,7 @@ export class AlertsClient {
  ...apiKeyAttributes,
  params: validatedAlertTypeParams as RawAlert['params'],
  actions,
+ notifyWhen,
  updatedBy: username,
  updatedAt: new Date().toISOString(),
  });
@@ -1326,7 +1337,7 @@ export class AlertsClient {
 
  private getPartialAlertFromRaw(
  id: string,
- { createdAt, updatedAt, meta, scheduledTaskId, ...rawAlert }: Partial<RawAlert>,
+ { createdAt, updatedAt, meta, notifyWhen, scheduledTaskId, ...rawAlert }: Partial<RawAlert>,
  references: SavedObjectReference[] | undefined
  ): PartialAlert {
  // Not the prettiest code here, but if we want to use most of the
@@ -1341,6 +1352,7 @@ export class AlertsClient {
  const executionStatus = alertExecutionStatusFromRaw(this.logger, id, rawAlert.executionStatus);
  return {
  id,
+ notifyWhen,
  ...rawAlertWithoutExecutionStatus,
  // we currently only support the Interval Schedule type
  // Once we support additional types, this type signature will likely change