Skip to content

[Cases] Case action refinements#175505

Merged
cnasikas merged 13 commits intoelastic:case_actionfrom
cnasikas:ca_left_overs
Jan 31, 2024
Merged

[Cases] Case action refinements#175505
cnasikas merged 13 commits intoelastic:case_actionfrom
cnasikas:ca_left_overs

Conversation

@cnasikas
Copy link
Copy Markdown
Member

@cnasikas cnasikas commented Jan 25, 2024

Summary

This PR:

  • Gets the kibana request from the actions framework
  • Gets the space ID from the kibana request
  • Adds more data to the case
  • Handles case creation limits on tags
  • Adds rule information on the oracle record
  • Improves logging
  • Adds more tests

Checklist

Delete any items that are not applicable to this PR.

For maintainers

@cnasikas cnasikas added release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// Feature:Cases Cases feature v8.13.0 labels Jan 25, 2024
@cnasikas cnasikas self-assigned this Jan 25, 2024
/**
* TODO: Verify limits
*/
tags: schema.arrayOf(schema.string({ minLength: 1, maxLength: 50 }), {
Copy link
Copy Markdown
Member Author

@cnasikas cnasikas Jan 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rules do not impose any limits on tags (https://github.com/elastic/kibana/blob/80640cf1e5aeb967d53dc4cdaa03a71c4552a0d4/x-pack/plugins/alerting/common/routes/rule/apis/create/schemas/v1.ts). The cases limits are handled inside the case connector executor.

Comment on lines +710 to +711
.splice(0, MAX_TAGS_PER_CASE)
.map((tag) => tag.slice(0, MAX_LENGTH_PER_TAG));
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Impose the case limits on tags. Rules may have more tags than the allowed ones.

@cnasikas cnasikas marked this pull request as ready for review January 29, 2024 10:23
@cnasikas cnasikas requested a review from a team as a code owner January 29, 2024 10:23
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/response-ops-cases (Feature:Cases)

Copy link
Copy Markdown
Contributor

@js-jankisalvi js-jankisalvi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code changes look good, good amount of tests 👍

* The case connector will throw an error if the Kibana request
* is not define before executing the _run method
*/
const kibanaRequest = this.kibanaRequest as KibanaRequest;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I might not be understanding the full picture here, but since we removed private readonly kibanaRequest: KibanaRequest; at line 39,
shouldn't it be const kibanaRequest = this.connectorParams.kibanaRequest as KibanaRequest; here?

Copy link
Copy Markdown
Member Author

@cnasikas cnasikas Jan 30, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you check at the x-pack/plugins/actions/server/sub_action_framework/sub_action_connector.ts we set the kibanaRequest. It is already provided by the actions framework. The SubActionConnector class extends the SubActionConnector class. That's why we can access it like this. kibanaRequest .

@cnasikas cnasikas merged commit 7a4691c into elastic:case_action Jan 31, 2024
@cnasikas cnasikas deleted the ca_left_overs branch January 31, 2024 09:22
@cnasikas cnasikas mentioned this pull request Feb 17, 2024
3 tasks
cnasikas added a commit that referenced this pull request Apr 12, 2024
## Summary

Depends on: #166267,
#170326,
#169484,
#173740,
#173763,
#178068,
#178307,
#178600,
#180437

PRs:
- #168370
- #169229
- #171754
- #172709
- #173012
- #175107
- #175452
- #175505
- #177033
- #178277
- #177139
- #179796

Fixes: #153837

## Testing

Run Kibana with `--run-examples` if you want to use the "Always firing"
rule.

Create a rule with a case action in observability and the stack. The
security solution is not supported. You should not be able to assign a
case action in a security solution rule.

1. Test the "Reopen closed cases" configuration.
2. Test the "Grouping by" configuration. Only one field is allowed. Not
all fields are persisted in alerts. If you select a field not part of
the alert the case action will create a case where the grouping value is
set to `unknow`.
3. Test the "Time window" feature. You can comment out the validation to
test for shorter times.
4. Verify that the case action is experimental.
5. Verify that based on the rule type the case is created in the correct
solution.
6. Verify that you cannot create a rule with the case action on the
basic license.
7. Verify that the execution of the case action fails if you do not have
permission for cases. Pending work on the system actions framework level
to not allow users to create rules with system actions where they do not
have permission.
8. Stress test the case action by creating multiple rules.

### Checklist

Delete any items that are not applicable to this PR.

- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

## Release notes

Automatically create cases when an alert is triggered.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: adcoelho <antonio.coelho@elastic.co>
Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Feature:Cases Cases feature release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// v8.13.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants