Skip to content

Execution type field#195884

Merged
nkhristinin merged 17 commits intoelastic:mainfrom
nkhristinin:execution-type-field
Oct 14, 2024
Merged

Execution type field#195884
nkhristinin merged 17 commits intoelastic:mainfrom
nkhristinin:execution-type-field

Conversation

@nkhristinin
Copy link
Copy Markdown
Contributor

@nkhristinin nkhristinin commented Oct 11, 2024 •
edited by kibanamachine
Loading

Added new field - execution type for alerts

Added new field only for security type alerts:

kibana.alert.rule.execution.type - can be manual or scheduled

Also, move intended timestamp settings from create_persistence_rule_type_wrapper to build_alert

Also added those new field to Alert schema and types.

Screen.Recording.2024-10-11.at.16.12.08.mov

For tests:

  • tests all rule types with and without suppression: kibana.alert.rule.execution.type - should be scheduled, kibana.alert.intended_timestamp - should equal alert timestamp

  • tests all rules with and without suppression with manual run - kibana.alert.rule.execution.type - should be manual,
    kibana.alert.intended_timestamp - should equal date inside you manual rule run date range

@nkhristinin
Copy link
Copy Markdown
Contributor Author

nkhristinin commented Oct 11, 2024

/ci

@nkhristinin nkhristinin marked this pull request as ready for review October 11, 2024 14:03
@nkhristinin nkhristinin requested review from a team as code owners October 11, 2024 14:03
@nkhristinin nkhristinin requested a review from vitaliidm October 11, 2024 14:03
@nkhristinin nkhristinin added release_note:skip Skip the PR/issue when compiling release notes backport:prev-minor labels Oct 11, 2024
dominiqueclarke
dominiqueclarke approved these changes Oct 11, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@dominiqueclarke dominiqueclarke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

ymao1
ymao1 approved these changes Oct 11, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@ymao1 ymao1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

response ops changes lgtm

marshallmain
marshallmain approved these changes Oct 11, 2024
View reviewed changes
...olution/server/lib/detection_engine/rule_types/new_terms/wrap_suppressed_new_terms_alerts.ts Outdated
publicBaseUrl: string | undefined;
primaryTimestamp: string;
secondaryTimestamp?: string;
intendedTimestamp?: Date;
Copy link
Copy Markdown
Contributor

@marshallmain marshallmain Oct 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
intendedTimestamp?: Date;
intendedTimestamp: Date | undefined;

...security_solution/server/lib/detection_engine/rule_types/esql/wrap_suppressed_esql_alerts.ts Outdated
};
primaryTimestamp: string;
secondaryTimestamp?: string;
intendedTimestamp?: Date;
Copy link
Copy Markdown
Contributor

@marshallmain marshallmain Oct 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
intendedTimestamp?: Date;
intendedTimestamp: Date | undefined;

...urity_solution/server/lib/detection_engine/rule_types/eql/build_alert_group_from_sequence.ts
alertTimestampOverride: Date | undefined,
publicBaseUrl?: string
publicBaseUrl?: string,
intendedTimestamp?: Date
Copy link
Copy Markdown
Contributor

@marshallmain marshallmain Oct 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
intendedTimestamp?: Date
intendedTimestamp: Date | undefined

Copy link
Copy Markdown
Contributor Author

@nkhristinin nkhristinin Oct 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed, other places, but here we will have error:
A required parameter cannot follow an optional parameter

Because parameters here is not an object

@nkhristinin
Copy link
Copy Markdown
Contributor Author

nkhristinin commented Oct 12, 2024

@elasticmachine merge upstream

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Oct 12, 2024

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
@kbn/rule-data-utils 126 127 +1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
investigateApp 483.2KB 483.3KB +69.0B
observability 467.5KB 467.5KB +44.0B
securitySolution 20.8MB 20.8MB +278.0B
slo 855.2KB 855.2KB +44.0B
synthetics 1.2MB 1.2MB +45.0B
total +480.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
observability 103.7KB 103.8KB +58.0B
slo 24.7KB 24.8KB +58.0B
synthetics 37.1KB 37.1KB +58.0B
total +174.0B
Unknown metric groups

API count

id before after diff
@kbn/rule-data-utils 129 130 +1

History

@nkhristinin nkhristinin merged commit 3d466a7 into elastic:main Oct 14, 2024
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Oct 14, 2024

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/11329624950

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Oct 14, 2024
@nkhristinin @elasticmachine
Execution type field (elastic#195884)
aad57b4 
## Added new field - execution type for alerts

Added new field only for security type alerts:

`kibana.alert.rule.execution.type` - can be `manual` or `scheduled`

Also, move intended timestamp settings from
`create_persistence_rule_type_wrapper` to `build_alert`

Also added those new field to Alert schema and types.

https://github.com/user-attachments/assets/c5b021a6-4763-47ae-b46c-814a138be65a

For tests:

- tests all rule types with and without suppression:
`kibana.alert.rule.execution.type` - should be `scheduled`,
`kibana.alert.intended_timestamp` - should equal alert timestamp

- tests all rules with and without suppression with manual run -
`kibana.alert.rule.execution.type` - should be `manual`,
`kibana.alert.intended_timestamp` - should equal date inside you manual
rule run date range

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 3d466a7)
@kibanamachine kibanamachine mentioned this pull request Oct 14, 2024
Merged
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Oct 14, 2024

💚 All backports created successfully

Status Branch Result
✅ 8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@kibanamachine kibanamachine mentioned this pull request Oct 14, 2024
Merged
kibanamachine added a commit that referenced this pull request Oct 14, 2024
@kibanamachine @nkhristinin
[8.x] Execution type field (#195884) (#196152)
eca46fe 
# Backport

This will backport the following commits from `main` to `8.x`:
- [Execution type field
(#195884)](#195884)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Khristinin
Nikita","email":"nikita.khristinin@elastic.co"},"sourceCommit":{"committedDate":"2024-10-14T14:29:12Z","message":"Execution
type field (#195884)\n\n## Added new field - execution type for
alerts\r\n\r\nAdded new field only for security type
alerts:\r\n\r\n`kibana.alert.rule.execution.type` - can be `manual` or
`scheduled`\r\n\r\nAlso, move intended timestamp settings
from\r\n`create_persistence_rule_type_wrapper` to
`build_alert`\r\n\r\nAlso added those new field to Alert schema and
types.\r\n\r\n\r\n\r\nhttps://github.com/user-attachments/assets/c5b021a6-4763-47ae-b46c-814a138be65a\r\n\r\n\r\n\r\nFor
tests:\r\n\r\n- tests all rule types with and without
suppression:\r\n`kibana.alert.rule.execution.type` - should be
`scheduled`,\r\n`kibana.alert.intended_timestamp` - should equal alert
timestamp\r\n\r\n- tests all rules with and without suppression with
manual run -\r\n`kibana.alert.rule.execution.type` - should be
`manual`,\r\n`kibana.alert.intended_timestamp` - should equal date
inside you manual\r\nrule run date
range\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"3d466a72a8ab181aadf562ab6c27a5affa32dc96","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","backport:prev-minor"],"title":"Execution
type
field","number":195884,"url":"https://github.com/elastic/kibana/pull/195884","mergeCommit":{"message":"Execution
type field (#195884)\n\n## Added new field - execution type for
alerts\r\n\r\nAdded new field only for security type
alerts:\r\n\r\n`kibana.alert.rule.execution.type` - can be `manual` or
`scheduled`\r\n\r\nAlso, move intended timestamp settings
from\r\n`create_persistence_rule_type_wrapper` to
`build_alert`\r\n\r\nAlso added those new field to Alert schema and
types.\r\n\r\n\r\n\r\nhttps://github.com/user-attachments/assets/c5b021a6-4763-47ae-b46c-814a138be65a\r\n\r\n\r\n\r\nFor
tests:\r\n\r\n- tests all rule types with and without
suppression:\r\n`kibana.alert.rule.execution.type` - should be
`scheduled`,\r\n`kibana.alert.intended_timestamp` - should equal alert
timestamp\r\n\r\n- tests all rules with and without suppression with
manual run -\r\n`kibana.alert.rule.execution.type` - should be
`manual`,\r\n`kibana.alert.intended_timestamp` - should equal date
inside you manual\r\nrule run date
range\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"3d466a72a8ab181aadf562ab6c27a5affa32dc96"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/195884","number":195884,"mergeCommit":{"message":"Execution
type field (#195884)\n\n## Added new field - execution type for
alerts\r\n\r\nAdded new field only for security type
alerts:\r\n\r\n`kibana.alert.rule.execution.type` - can be `manual` or
`scheduled`\r\n\r\nAlso, move intended timestamp settings
from\r\n`create_persistence_rule_type_wrapper` to
`build_alert`\r\n\r\nAlso added those new field to Alert schema and
types.\r\n\r\n\r\n\r\nhttps://github.com/user-attachments/assets/c5b021a6-4763-47ae-b46c-814a138be65a\r\n\r\n\r\n\r\nFor
tests:\r\n\r\n- tests all rule types with and without
suppression:\r\n`kibana.alert.rule.execution.type` - should be
`scheduled`,\r\n`kibana.alert.intended_timestamp` - should equal alert
timestamp\r\n\r\n- tests all rules with and without suppression with
manual run -\r\n`kibana.alert.rule.execution.type` - should be
`manual`,\r\n`kibana.alert.intended_timestamp` - should equal date
inside you manual\r\nrule run date
range\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"3d466a72a8ab181aadf562ab6c27a5affa32dc96"}}]}]
BACKPORT-->

Co-authored-by: Khristinin Nikita <nikita.khristinin@elastic.co>
This was referenced Oct 14, 2024
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dominiqueclarke dominiqueclarke dominiqueclarke approved these changes

@ymao1 ymao1 ymao1 approved these changes

@marshallmain marshallmain marshallmain approved these changes

@vitaliidm vitaliidm Awaiting requested review from vitaliidm vitaliidm was automatically assigned from elastic/security-detection-engine

Assignees

No one assigned

Labels

release_note:skip Skip the PR/issue when compiling release notes v8.16.0 v9.0.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@nkhristinin @elasticmachine @kibanamachine @dominiqueclarke @ymao1 @marshallmain