Skip to content

[Cases] Apply circuit breakers to the case action#175452

Merged
cnasikas merged 3 commits intoelastic:case_actionfrom
cnasikas:ca_circuit_breakers
Jan 24, 2024
Merged

[Cases] Apply circuit breakers to the case action#175452
cnasikas merged 3 commits intoelastic:case_actionfrom
cnasikas:ca_circuit_breakers

Conversation

@cnasikas
Copy link
Copy Markdown
Member

Summary

This PR applies certain circuit breakers to the case action. Specifically, if the number of produced cases is bigger than maximumCasesToOpen param provided by the user or bigger than the hard limit of ten cases, all alerts will be attached to the case that represents the rule.

Checklist

Delete any items that are not applicable to this PR.

For maintainers

@cnasikas cnasikas added release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// Feature:Cases Cases feature v8.13.0 labels Jan 24, 2024
@cnasikas cnasikas self-assigned this Jan 24, 2024
@cnasikas cnasikas requested a review from a team as a code owner January 24, 2024 15:53
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/response-ops-cases (Feature:Cases)

Copy link
Copy Markdown
Contributor

@js-jankisalvi js-jankisalvi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good amount of tests!! LGTM 👍

@kibana-ci
Copy link
Copy Markdown

kibana-ci commented Jan 24, 2024

💔 Build Failed

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #98 / cases security and spaces enabled: basic Common update_alert_status should update the status of multiple alerts attached to multiple cases using the cases client
  • [job] [logs] FTR Configs #98 / cases security and spaces enabled: basic Common update_alert_status should update the status of multiple alerts attached to multiple cases using the cases client
  • [job] [logs] FTR Configs #44 / cases security and spaces enabled: trial Common update_alert_status should update the status of multiple alerts attached to multiple cases using the cases client
  • [job] [logs] FTR Configs #44 / cases security and spaces enabled: trial Common update_alert_status should update the status of multiple alerts attached to multiple cases using the cases client
  • [job] [logs] FTR Configs #75 / dashboard Reporting Dashboard Reporting Screenshots Sample data from Kibana 7.6 "before all" hook for "PNG file matches the baseline image"

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [5a88a23]

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @cnasikas

@cnasikas cnasikas merged commit e25f522 into elastic:case_action Jan 24, 2024
@cnasikas cnasikas deleted the ca_circuit_breakers branch January 24, 2024 16:39
@cnasikas cnasikas mentioned this pull request Feb 17, 2024
3 tasks
cnasikas added a commit that referenced this pull request Apr 12, 2024
## Summary

Depends on: #166267,
#170326,
#169484,
#173740,
#173763,
#178068,
#178307,
#178600,
#180437

PRs:
- #168370
- #169229
- #171754
- #172709
- #173012
- #175107
- #175452
- #175505
- #177033
- #178277
- #177139
- #179796

Fixes: #153837

## Testing

Run Kibana with `--run-examples` if you want to use the "Always firing"
rule.

Create a rule with a case action in observability and the stack. The
security solution is not supported. You should not be able to assign a
case action in a security solution rule.

1. Test the "Reopen closed cases" configuration.
2. Test the "Grouping by" configuration. Only one field is allowed. Not
all fields are persisted in alerts. If you select a field not part of
the alert the case action will create a case where the grouping value is
set to `unknow`.
3. Test the "Time window" feature. You can comment out the validation to
test for shorter times.
4. Verify that the case action is experimental.
5. Verify that based on the rule type the case is created in the correct
solution.
6. Verify that you cannot create a rule with the case action on the
basic license.
7. Verify that the execution of the case action fails if you do not have
permission for cases. Pending work on the system actions framework level
to not allow users to create rules with system actions where they do not
have permission.
8. Stress test the case action by creating multiple rules.

### Checklist

Delete any items that are not applicable to this PR.

- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

## Release notes

Automatically create cases when an alert is triggered.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: adcoelho <antonio.coelho@elastic.co>
Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Feature:Cases Cases feature release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// v8.13.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants