[Bug] Add unit tests and fix Alert Suppression schema validation for ThresholdQueryRuleData

[eric-forte-elastic]

Pull Request

Issue link(s):

Resolves #5195

Summary - What I changed

See the linked issue above for more info, but ultimately we need to update AlertSuppression support cases that either just have a duration, or have both a group_by and missing_fields strategy, or all all three (as indicator match rules can have).

This cannot be adequately handled via a validates_schema method in AlertSuppressionMapping as the rule type is not know here which would be required to adequetly enforce that the only rule type that can have only duration is ThresholdQueryRuleData. As such, this needs to be handled through the separate dataclasses we already have (See issue summary for more context).

Use the following ndjson file for testing with example rules with all of the different variations of valid alert suppression configurations in Kibana.

test_alert_suppression_all.ndjson.txt

How To Test

For testing, use the new unit tests to check for the various valid combinations of alert suppression with different rule types.

 python -m pytest tests/test_python_library.py::TestAlertSuppressionValidation -s -v

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[github-actions]

Enhancement - Guidelines

These guidelines serve as a reminder set of considerations when addressing adding a new schema feature to the code.

Documentation and Context

• Describe the feature enhancement in detail (alternative solutions, description of the solution, etc.) if not already documented in an issue.
• Include additional context or screenshots.
• Ensure the enhancement includes necessary updates to the documentation and versioning.

Code Standards and Practices

• Code follows established design patterns within the repo and avoids duplication.
• Ensure that the code is modular and reusable where applicable.

Testing

• New unit tests have been added to cover the enhancement.
• Existing unit tests have been updated to reflect the changes.
• Provide evidence of testing and validating the enhancement (e.g., test logs, screenshots).
• Validate that any rules affected by the enhancement are correctly updated.
• Ensure that performance is not negatively impacted by the changes.
• Verify that any release artifacts are properly generated and tested.
• Conducted system testing, including fleet, import, and create APIs (e.g., run make test-cli, make test-remote-cli, make test-hunting-cli)

Additional Schema Related Checks

• Verify that the enhancement works across all relevant environments (e.g., different OS versions).
• Link to the relevant Kibana PR or issue provided
• Test export/import flow:
  • Exported detection rule(s) from Kibana to showcase the feature(s)
  • Converted the exported ndjson file(s) to toml in the detection-rules repo
  • Re-exported the toml rule(s) to ndjson and re-imported into Kibana
• Updated necessary unit tests to accommodate the feature
• Incorporated a comprehensive test rule in unit tests for full schema coverage
• Applied min_compat restrictions to limit the feature to a specified minimum stack version
• Executed all unit tests locally with a test toml rule to confirm passing
• Included Kibana PR implementer as an optional reviewer for insights on the feature
• Implemented requisite downgrade functionality
• Cross-referenced the feature with product documentation for consistency
• Confirm that the proper version label is applied to the PR patch, minor, major.

[w0rk3r]

👍🏼

[eric-forte-elastic]

Make test cli and make test remote CLI completed successfully:
E.g.

❯ make test-cli > make_test_cli.txt
  Running command git clone --filter=blob:none --quiet https://github.com/elastic/detection-rules.git /tmp/pip-install-zkbwapad/detection-rules-kql_9e817640755b4e5b9e76890b7aa5ea2f
  Running command git submodule update --init --recursive -q
  Running command git clone --filter=blob:none --quiet https://github.com/elastic/detection-rules.git /tmp/pip-install-zkbwapad/detection-rules-kibana_e60911ebbb9d4bcf82d1ba76a02e4531
  Running command git submodule update --init --recursive -q

[notice] A new release of pip is available: 25.0.1 -> 25.2
[notice] To update, run: pip install --upgrade pip

[notice] A new release of pip is available: 25.0.1 -> 25.2
[notice] To update, run: pip install --upgrade pip

[notice] A new release of pip is available: 25.0.1 -> 25.2
[notice] To update, run: pip install --upgrade pip

make_test_cli.txt