[EDR Workflows] Automated Actions in more rule types

x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/rule_schemas.gen.ts

@@ -68,13 +68,13 @@ import {
   SavedQueryId,
   KqlQueryLanguage,
 } from './common_attributes.gen';
+import { ResponseAction } from '../rule_response_actions/response_actions.gen';
 import { RuleExecutionSummary } from '../../rule_monitoring/model/execution_summary.gen';
 import {
   EventCategoryOverride,
   TiebreakerField,
   TimestampField,
 } from './specific_attributes/eql_attributes.gen';
-import { ResponseAction } from '../rule_response_actions/response_actions.gen';
 import {
   Threshold,
   ThresholdAlertSuppression,
@@ -117,6 +117,7 @@ export const BaseOptionalFields = z.object({
   meta: RuleMetadata.optional(),
   investigation_fields: InvestigationFields.optional(),
   throttle: RuleActionThrottle.optional(),
+  response_actions: z.array(ResponseAction).optional(),
 });
 
 export type BaseDefaultableFields = z.infer<typeof BaseDefaultableFields>;
@@ -261,7 +262,6 @@ export const QueryRuleOptionalFields = z.object({
   data_view_id: DataViewId.optional(),
   filters: RuleFilterArray.optional(),
   saved_id: SavedQueryId.optional(),
-  response_actions: z.array(ResponseAction).optional(),
   alert_suppression: AlertSuppression.optional(),
 });
 
@@ -312,7 +312,6 @@ export const SavedQueryRuleOptionalFields = z.object({
   index: IndexPatternArray.optional(),
   data_view_id: DataViewId.optional(),
   filters: RuleFilterArray.optional(),
-  response_actions: z.array(ResponseAction).optional(),
   alert_suppression: AlertSuppression.optional(),
   query: RuleQuery.optional(),
 });

x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/rule_schemas.schema.yaml

@@ -73,6 +73,12 @@ components:
         # Throttle
         throttle:
           $ref: './common_attributes.schema.yaml#/components/schemas/RuleActionThrottle'
+        # Response Actions
+        response_actions:
+          type: array
+          items:
+            $ref: '../rule_response_actions/response_actions.schema.yaml#/components/schemas/ResponseAction'
+
 
     BaseDefaultableFields:
       x-inline: true
@@ -354,10 +360,6 @@ components:
           $ref: './common_attributes.schema.yaml#/components/schemas/RuleFilterArray'
         saved_id:
           $ref: './common_attributes.schema.yaml#/components/schemas/SavedQueryId'
-        response_actions:
-          type: array
-          items:
-            $ref: '../rule_response_actions/response_actions.schema.yaml#/components/schemas/ResponseAction'
         alert_suppression:
           $ref: './common_attributes.schema.yaml#/components/schemas/AlertSuppression'
 
@@ -435,10 +437,6 @@ components:
           $ref: './common_attributes.schema.yaml#/components/schemas/DataViewId'
         filters:
           $ref: './common_attributes.schema.yaml#/components/schemas/RuleFilterArray'
-        response_actions:
-          type: array
-          items:
-            $ref: '../rule_response_actions/response_actions.schema.yaml#/components/schemas/ResponseAction'
         alert_suppression:
           $ref: './common_attributes.schema.yaml#/components/schemas/AlertSuppression'
         query:

x-pack/plugins/security_solution/common/detection_engine/utils.ts

@@ -93,3 +93,15 @@ export const isSuppressionRuleConfiguredWithMissingFields = (ruleType: Type) =>
 export const isSuppressionRuleInGA = (ruleType: Type): boolean => {
   return isSuppressibleAlertRule(ruleType) && SUPPRESSIBLE_ALERT_RULES_GA.includes(ruleType);
 };
+
+export const shouldShowResponseActions = (
+  ruleType: Type | undefined,
+  automatedResponseActionsForMoreRulesEnabled: boolean
+) => {
+  return automatedResponseActionsForMoreRulesEnabled
+    ? isQueryRule(ruleType) ||
+        isEsqlRule(ruleType) ||
+        isEqlRule(ruleType) ||
+        isNewTermsRule(ruleType)
+    : isQueryRule(ruleType);
+};

x-pack/plugins/security_solution/common/experimental_features.ts

@@ -52,6 +52,11 @@ export const allowedExperimentalValues = Object.freeze({
    */
   automatedProcessActionsEnabled: true,
 
+  /**
+   * Temporary feature flag to enable the Response Actions in Rules UI - intermediate release
+   */
+  automatedResponseActionsForMoreRulesEnabled: false,
+
   /**
    * Enables the ability to send Response actions to SentinelOne and persist the results
    * in ES. Adds API changes to support `agentType` and supports `isolate` and `release`