[Cases] Case action: Phase 2 #169229

cnasikas · 2023-10-18T12:17:01Z

Summary

This PR is a continuation of the work for the Case action. This PR implements the basic logic of the case connector. Specifically:

Group the alerts based on the grouping provided by the user
Create the Oracle's SO IDs to fetch the records. If they do not exist they will get created and the counter will be set to 1.
Create the cases' SO IDs to fetch the Cases. If they do not exist they will get created.
Attach the alerts to the corresponding cases.

Not in this PR:

Handle errors
Retries on errors
Reopen cases
Time window
Race conditions
Circuit breakers

Depends on: #168370, #169484

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

…te --fix'

…o register_case_action

…te --fix'

…o register_case_action

elasticmachine · 2023-11-10T11:19:49Z

Pinging @elastic/response-ops (Team:ResponseOps)

elasticmachine · 2023-11-10T11:19:50Z

Pinging @elastic/response-ops-cases (Feature:Cases)

js-jankisalvi

Code looks good 👍 just few questions to understand the feature.
I am assuming that we will be able to test it locally when the feature branch is ready, right?

x-pack/plugins/cases/server/connectors/cases/cases_service.test.ts

js-jankisalvi · 2023-11-13T17:26:18Z

x-pack/plugins/cases/server/connectors/cases/types.ts


 type Optional<T, K extends keyof T> = Pick<Partial<T>, K> & Omit<T, K>;

 interface OracleKeyAllRequired {
  ruleId: string;
  spaceId: string;
  owner: string;
-  grouping: Record<string, string>;
+  grouping: Record<string, unknown>;
 }

 type OracleKeyWithOptionalKey = Optional<OracleKeyAllRequired, 'ruleId'>;
 type OracleKeyWithOptionalGrouping = Optional<OracleKeyAllRequired, 'grouping'>;

 export type OracleKey = ExclusiveUnion<OracleKeyWithOptionalKey, OracleKeyWithOptionalGrouping>;


Why don't we use io-ts here?

What kind of usage do you have in mind?

I saw ExclusiveUnion here and thought maybe we can use io-ts here.

io-ts is usually suited for runtime validation of data. In this case, it is not needed because we control the data.

x-pack/plugins/cases/server/connectors/cases/cases_connector.ts

x-pack/plugins/cases/server/connectors/cases/cases_connector.test.ts

jcger

LGTM

jcger · 2023-11-14T09:51:11Z

x-pack/plugins/cases/server/connectors/cases/cases_connector.ts

+    /**
+     * TODO: Add grouping info to
+     */
+    return {


what about the required custom fields?

Great point. I need to think about it. We need the default value feature. I will put a TODO comment to not forget about it.

cnasikas · 2023-11-14T12:04:13Z

I am assuming that we will be able to test it locally when the feature branch is ready, right?

Thanks @js-jankisalvi! Yes, we are waiting for the System actions PR to get merged to be able to test the case action.

kibana-ci · 2023-11-14T14:18:24Z

💔 Build Failed

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #77 / EPM Endpoints Install endpoint package install should have installed the [endpoint.metadata_current-default] transform
[job] [logs] FTR Configs #57 / management index management index templates get all should list all the index templates with the expected parameters
[job] [logs] FTR Configs #57 / management index management index templates get all should list all the index templates with the expected parameters

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [bc79e00]

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @cnasikas

## Summary Depends on: #166267, #170326, #169484, #173740, #173763, #178068, #178307, #178600, #180437 PRs: - #168370 - #169229 - #171754 - #172709 - #173012 - #175107 - #175452 - #175505 - #177033 - #178277 - #177139 - #179796 Fixes: #153837 ## Testing Run Kibana with `--run-examples` if you want to use the "Always firing" rule. Create a rule with a case action in observability and the stack. The security solution is not supported. You should not be able to assign a case action in a security solution rule. 1. Test the "Reopen closed cases" configuration. 2. Test the "Grouping by" configuration. Only one field is allowed. Not all fields are persisted in alerts. If you select a field not part of the alert the case action will create a case where the grouping value is set to `unknow`. 3. Test the "Time window" feature. You can comment out the validation to test for shorter times. 4. Verify that the case action is experimental. 5. Verify that based on the rule type the case is created in the correct solution. 6. Verify that you cannot create a rule with the case action on the basic license. 7. Verify that the execution of the case action fails if you do not have permission for cases. Pending work on the system actions framework level to not allow users to create rules with system actions where they do not have permission. 8. Stress test the case action by creating multiple rules. ### Checklist Delete any items that are not applicable to this PR. - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) ## Release notes Automatically create cases when an alert is triggered. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: adcoelho <antonio.coelho@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com>

cnasikas and others added 25 commits October 9, 2023 17:16

Register the case action

0e1bfb0

Register the cases oracle

4777f9c

[CI] Auto-commit changed files from 'node scripts/check_mappings_upda…

65a88fa

…te --fix'

Calculate the hash of the record ID

eeb35a6

Merge branch 'register_case_action' of github.com:cnasikas/kibana int…

649dea9

…o register_case_action

Get oracle record

4491476

Rename folder

f4a81a1

Sort grouping definition

5822d73

Increase counter

df77537

Change grouping to record

9955239

Make the rule ID optional in the key

58bc3d6

Better types

581819a

Add version when updating

449a1b7

Improve types

c210a0c

Fix tests

c802637

Merge branch 'case_action' into register_case_action

b249032

Add model version and improve mapping

c120c97

Fix tests

043a9fe

Fix mapping test

a9db13f

[CI] Auto-commit changed files from 'node scripts/check_mappings_upda…

32af9e3

…te --fix'

Merge branch 'case_action' into register_case_action

90acabf

Merge branch 'register_case_action' of github.com:cnasikas/kibana int…

b7605b7

…o register_case_action

Define connector params initial schema

7b27008

Bulk get records

13fd013

Group alerts and bulk get oracle records

69a8778

cnasikas added release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) Feature:Cases Cases feature v8.12.0 labels Oct 18, 2023

cnasikas self-assigned this Oct 18, 2023

cnasikas force-pushed the ca_part_2 branch from 54a3fbc to c997e7e Compare October 20, 2023 13:52

Generate case ids

40f865e

cnasikas force-pushed the ca_part_2 branch from c997e7e to 40f865e Compare October 21, 2023 11:44

cnasikas added 4 commits October 21, 2023 15:07

Get service with a factory

f70bf1e

Fix docs

04805ac

Merge branch 'main' into saf_get_instance

a3d47e6

Merge branch 'saf_get_instance' into ca_part_2

3988644

cnasikas changed the base branch from main to case_action October 21, 2023 12:37

cnasikas added 8 commits October 21, 2023 15:57

Pass the cases client to the case connector

af1b8ae

Attach alerts to a case

4c6f5ae

Merge branch 'case_action' into register_case_action

a7f1ba1

Merge branch 'register_case_action' into ca_part_2

a283b93

Merge branch 'case_action' into ca_part_2

8fd2a84

Merge branch 'case_action' into ca_part_2

13012eb

Bulk create non existing cases

c8e82e5

Improve the case request

1ead049

cnasikas marked this pull request as ready for review November 10, 2023 11:19

cnasikas requested a review from a team as a code owner November 10, 2023 11:19

Small improvements

b31c167

js-jankisalvi reviewed Nov 14, 2023

View reviewed changes

jcger approved these changes Nov 14, 2023

View reviewed changes

PR feedback

462ce47

cnasikas merged commit 28cfcb2 into elastic:case_action Nov 15, 2023
27 of 30 checks passed

cnasikas deleted the ca_part_2 branch November 15, 2023 08:09

cnasikas mentioned this pull request Nov 29, 2023

[Cases] Case action #168369

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Cases] Case action: Phase 2 #169229

[Cases] Case action: Phase 2 #169229

cnasikas commented Oct 18, 2023 •

edited

Loading

elasticmachine commented Nov 10, 2023

elasticmachine commented Nov 10, 2023

js-jankisalvi left a comment

js-jankisalvi Nov 13, 2023

cnasikas Nov 14, 2023

js-jankisalvi Nov 14, 2023

cnasikas Nov 15, 2023

jcger left a comment

jcger Nov 14, 2023

cnasikas Nov 14, 2023 •

edited

Loading

cnasikas commented Nov 14, 2023 •

edited

Loading

kibana-ci commented Nov 14, 2023 •

edited

Loading

[Cases] Case action: Phase 2 #169229

[Cases] Case action: Phase 2 #169229

Conversation

cnasikas commented Oct 18, 2023 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Nov 10, 2023

elasticmachine commented Nov 10, 2023

js-jankisalvi left a comment

Choose a reason for hiding this comment

js-jankisalvi Nov 13, 2023

Choose a reason for hiding this comment

cnasikas Nov 14, 2023

Choose a reason for hiding this comment

js-jankisalvi Nov 14, 2023

Choose a reason for hiding this comment

cnasikas Nov 15, 2023

Choose a reason for hiding this comment

jcger left a comment

Choose a reason for hiding this comment

jcger Nov 14, 2023

Choose a reason for hiding this comment

cnasikas Nov 14, 2023 • edited Loading

Choose a reason for hiding this comment

cnasikas commented Nov 14, 2023 • edited Loading

kibana-ci commented Nov 14, 2023 • edited Loading

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

History

cnasikas commented Oct 18, 2023 •

edited

Loading

cnasikas Nov 14, 2023 •

edited

Loading

cnasikas commented Nov 14, 2023 •

edited

Loading

kibana-ci commented Nov 14, 2023 •

edited

Loading