Skip to content

[Actions] Sub actions framework: Get Service instance with a function#169484

Merged
cnasikas merged 3 commits intoelastic:mainfrom
cnasikas:saf_get_instance
Oct 23, 2023
Merged

[Actions] Sub actions framework: Get Service instance with a function#169484
cnasikas merged 3 commits intoelastic:mainfrom
cnasikas:saf_get_instance

Conversation

@cnasikas
Copy link
Copy Markdown
Member

Summary

This PR changes the way we retrieve the instance of a connector that extends the SubActionConnector class. A function called getService should be provided by the consumers of the framework to get the instance of the connector's class. This way consumers can create closure functions and pass to their connector class more services. This is needed for the Case action that needs access to the case's client.

Checklist

Delete any items that are not applicable to this PR.

For maintainers

@cnasikas cnasikas added release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// Feature:Actions/Framework Issues related to the Actions Framework v8.12.0 labels Oct 21, 2023
@cnasikas cnasikas self-assigned this Oct 21, 2023
@cnasikas cnasikas requested review from a team as code owners October 21, 2023 12:14
@cnasikas cnasikas requested review from pzl and szwarckonrad October 21, 2023 12:14
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

import { ExecutorParams, SubActionConnectorType } from './types';
import { buildValidators } from './validators';

const validateService = <Config, Secrets>(Service: IService<Config, Secrets>) => {
Copy link
Copy Markdown
Member Author

@cnasikas cnasikas Oct 21, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We cannot validate the Service class type. We will rely on the TS types.

@cnasikas cnasikas mentioned this pull request Oct 21, 2023
2 tasks
@kibana-ci
Copy link
Copy Markdown

💚 Build Succeeded

Metrics [docs]

✅ unchanged

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @cnasikas

Copy link
Copy Markdown
Contributor

@semd semd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cnasikas cnasikas merged commit 3587c20 into elastic:main Oct 23, 2023
@cnasikas cnasikas deleted the saf_get_instance branch October 23, 2023 16:41
@kibanamachine kibanamachine added the backport:skip This PR does not require backporting label Oct 23, 2023
@cnasikas cnasikas mentioned this pull request Nov 1, 2023
3 tasks
cnasikas added a commit that referenced this pull request Nov 15, 2023
## Summary

This PR is a continuation of the work for the Case action. This PR
implements the basic logic of the case connector. Specifically:

1. Group the alerts based on the grouping provided by the user
2. Create the Oracle's SO IDs to fetch the records. If they do not exist
they will get created and the counter will be set to 1.
3. Create the cases' SO IDs to fetch the Cases. If they do not exist
they will get created.
4. Attach the alerts to the corresponding cases.

Not in this PR:
- Handle errors
- Retries on errors
- Reopen cases
- Time window
- Race conditions
- Circuit breakers

Depends on: #168370,
#169484

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
cnasikas added a commit that referenced this pull request Apr 12, 2024
## Summary

Depends on: #166267,
#170326,
#169484,
#173740,
#173763,
#178068,
#178307,
#178600,
#180437

PRs:
- #168370
- #169229
- #171754
- #172709
- #173012
- #175107
- #175452
- #175505
- #177033
- #178277
- #177139
- #179796

Fixes: #153837

## Testing

Run Kibana with `--run-examples` if you want to use the "Always firing"
rule.

Create a rule with a case action in observability and the stack. The
security solution is not supported. You should not be able to assign a
case action in a security solution rule.

1. Test the "Reopen closed cases" configuration.
2. Test the "Grouping by" configuration. Only one field is allowed. Not
all fields are persisted in alerts. If you select a field not part of
the alert the case action will create a case where the grouping value is
set to `unknow`.
3. Test the "Time window" feature. You can comment out the validation to
test for shorter times.
4. Verify that the case action is experimental.
5. Verify that based on the rule type the case is created in the correct
solution.
6. Verify that you cannot create a rule with the case action on the
basic license.
7. Verify that the execution of the case action fails if you do not have
permission for cases. Pending work on the system actions framework level
to not allow users to create rules with system actions where they do not
have permission.
8. Stress test the case action by creating multiple rules.

### Checklist

Delete any items that are not applicable to this PR.

- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

## Release notes

Automatically create cases when an alert is triggered.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: adcoelho <antonio.coelho@elastic.co>
Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting Feature:Actions/Framework Issues related to the Actions Framework release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// v8.12.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants