[Request] Risk Score calculation for "closed" alerts

[abhishekbhatia1710]

Description

We are introducing a new feature that allows users to include "closed" alerts in risk score calculations. This enhancement improves the user experience by providing a more comprehensive view of the system.

Users can toggle a button to include closed alerts in the risk score calculation and specify a date/time range for the calculation. Additionally, they can preview the data before finalising and saving these changes for the next engine run.

Background & resources

• PRs:

• [API] [Entity Analytics][API] New API to allow user to configure risk engine SO kibana#201344,
• [API] [Entity Analytics][API] Changes for preview-risk-scores API to accept new params  kibana#201397,
• [UI] [Entity Analytics][UI] UI changes for Risk Engine to include closed alerts for risk score calculation kibana#201909

• Issues/metas: https://github.com/elastic/security-team/issues/10883
• Point of contact: @abhishekbhatia1710

Test environments:

Kibana: https://kibana-pr-201909-security-f6e262.kb.eu-west-1.aws.qa.elastic.cloud/login
Elasticsearch: https://kibana-pr-201909-security-f6e262.es.eu-west-1.aws.qa.elastic.cloud/

Credentials:
vault read -address=https://secrets.elastic.co:8200 secret/kibana-issues/dev/cloud-deploy/kibana-pr-201909-security

Kibana image: docker.elastic.co/kibana-ci/kibana-serverless:pr-201909-d0f22970266f

Which documentation set does this change impact?

ESS and serverless

ESS release

8.18

Serverless release

Next release

Feature differences

The feature is identical in ESS and serverless

API docs impact

New API endpoint : api/risk_score/engine/saved_object/configure
User can send a PUT request to this endpoint to use the feature to include closed alerts for risk score calculation
User can send below information with the request :

exclude_alert_statuses : ["open", "closed"]
range : {"start" : "now-40m", "end" : "now"}
exclude_alert_tags : ["False positive"]

For example :

curl --location --request PUT 'http://localhost:5601/api/risk_score/engine/saved_object/configure' \
--header 'kbn-xsrf: hello' \
--header 'elastic-api-version: 2023-10-31' \
--header 'x-elastic-internal-origin: test' \
--header 'Content-Type: application/json' \
--header 'Authorization: <REDACTED>' \
--data '{
    "exclude_alert_statuses" : ["open", "closed"],
    "range": {
        "start" : "now-23m",
        "end" : "now"
    },
    "exclude_alert_tags" : ["False-positive"]
}'

Prerequisites, privileges, feature flags

No response