Remove the advanced sorting switch from the rules management page

x-pack/plugins/alerting/common/rule.ts

@@ -35,6 +35,12 @@ export type RuleExecutionStatuses = typeof RuleExecutionStatusValues[number];
 export const RuleLastRunOutcomeValues = ['succeeded', 'warning', 'failed'] as const;
 export type RuleLastRunOutcomes = typeof RuleLastRunOutcomeValues[number];
 
+export const RuleLastRunOutcomeOrderMap: Record<RuleLastRunOutcomes, number> = {
+  succeeded: 0,
+  warning: 10,
+  failed: 20,
+};
+
 export enum RuleExecutionStatusErrorReasons {
   Read = 'read',
   Decrypt = 'decrypt',
@@ -93,6 +99,7 @@ export interface RuleAggregations {
 
 export interface RuleLastRun {
   outcome: RuleLastRunOutcomes;
+  outcomeOrder: number;
   warning?: RuleExecutionStatusErrorReasons | RuleExecutionStatusWarningReasons | null;
   outcomeMsg?: string[] | null;
   alertsCount: {

x-pack/plugins/alerting/public/lib/common_transformations.test.ts

@@ -81,6 +81,7 @@ describe('common_transformations', () => {
       },
       last_run: {
         outcome: RuleLastRunOutcomeValues[2],
+        outcome_order: 20,
         outcome_msg: ['this is just a test'],
         warning: RuleExecutionStatusErrorReasons.Unknown,
         alerts_count: {
@@ -137,6 +138,7 @@ describe('common_transformations', () => {
           "outcomeMsg": Array [
             "this is just a test",
           ],
+          "outcomeOrder": 20,
           "warning": "unknown",
         },
         "monitoring": Object {
@@ -255,6 +257,7 @@ describe('common_transformations', () => {
       },
       last_run: {
         outcome: 'failed',
+        outcome_order: 20,
         outcome_msg: ['this is just a test'],
         warning: RuleExecutionStatusErrorReasons.Unknown,
         alerts_count: {
@@ -300,6 +303,7 @@ describe('common_transformations', () => {
           "outcomeMsg": Array [
             "this is just a test",
           ],
+          "outcomeOrder": 20,
           "warning": "unknown",
         },
         "monitoring": Object {

x-pack/plugins/alerting/public/lib/common_transformations.ts

@@ -63,10 +63,16 @@ function transformMonitoring(input: RuleMonitoring): RuleMonitoring {
 }
 
 function transformLastRun(input: AsApiContract<RuleLastRun>): RuleLastRun {
-  const { outcome_msg: outcomeMsg, alerts_count: alertsCount, ...rest } = input;
+  const {
+    outcome_msg: outcomeMsg,
+    alerts_count: alertsCount,
+    outcome_order: outcomeOrder,
+    ...rest
+  } = input;
   return {
     outcomeMsg,
     alertsCount,
+    outcomeOrder,
     ...rest,
   };
 }

x-pack/plugins/alerting/server/lib/last_run_status.ts

@@ -8,7 +8,7 @@
 import { RuleTaskStateAndMetrics } from '../task_runner/types';
 import { getReasonFromError } from './error_with_reason';
 import { getEsErrorMessage } from './errors';
-import { ActionsCompletion, RuleLastRunOutcomes } from '../../common';
+import { ActionsCompletion, RuleLastRunOutcomeOrderMap, RuleLastRunOutcomes } from '../../common';
 import {
   RuleLastRunOutcomeValues,
   RuleExecutionStatusWarningReasons,
@@ -65,6 +65,7 @@ export const lastRunFromState = (
   return {
     lastRun: {
       outcome,
+      outcomeOrder: RuleLastRunOutcomeOrderMap[outcome],
       outcomeMsg: outcomeMsg.length > 0 ? outcomeMsg : null,
       warning: warning || null,
       alertsCount: {
@@ -80,9 +81,11 @@ export const lastRunFromState = (
 
 export const lastRunFromError = (error: Error): ILastRun => {
   const esErrorMessage = getEsErrorMessage(error);
+  const outcome = RuleLastRunOutcomeValues[2];
   return {
     lastRun: {
-      outcome: RuleLastRunOutcomeValues[2],
+      outcome,
+      outcomeOrder: RuleLastRunOutcomeOrderMap[outcome],
       warning: getReasonFromError(error),
       outcomeMsg: esErrorMessage ? [esErrorMessage] : null,
       alertsCount: {},
@@ -104,5 +107,6 @@ export const lastRunToRaw = (lastRun: ILastRun['lastRun']): RawRuleLastRun => {
     },
     warning: warning ?? null,
     outcomeMsg: outcomeMsg && !Array.isArray(outcomeMsg) ? [outcomeMsg] : outcomeMsg,
+    outcomeOrder: RuleLastRunOutcomeOrderMap[lastRun.outcome],
   };
 };

x-pack/plugins/alerting/server/routes/lib/rewrite_rule.ts

@@ -9,10 +9,11 @@ import { omit } from 'lodash';
 import { RuleTypeParams, SanitizedRule, RuleLastRun } from '../../types';
 
 export const rewriteRuleLastRun = (lastRun: RuleLastRun) => {
-  const { outcomeMsg, alertsCount, ...rest } = lastRun;
+  const { outcomeMsg, outcomeOrder, alertsCount, ...rest } = lastRun;
   return {
     alerts_count: alertsCount,
     outcome_msg: outcomeMsg,
+    outcome_order: outcomeOrder,
     ...rest,
   };
 };

x-pack/plugins/alerting/server/saved_objects/migrations/8.7/index.ts

@@ -14,7 +14,7 @@ import {
   isLogThresholdRuleType,
   pipeMigrations,
 } from '../utils';
-import { RawRule } from '../../../types';
+import { RawRule, RuleLastRunOutcomeOrderMap } from '../../../types';
 
 function addGroupByToEsQueryRule(
   doc: SavedObjectUnsanitizedDoc<RawRule>
@@ -70,9 +70,29 @@ function addLogViewRefToLogThresholdRule(
   return doc;
 }
 
+function migrateOutcomeOrder(
+  doc: SavedObjectUnsanitizedDoc<RawRule>
+): SavedObjectUnsanitizedDoc<RawRule> {
+  if (!doc.attributes.lastRun) {
+    return doc;
+  }
+
+  const outcome = doc.attributes.lastRun.outcome;
+  return {
+    ...doc,
+    attributes: {
+      ...doc.attributes,
+      lastRun: {
+        ...doc.attributes.lastRun,
+        outcomeOrder: RuleLastRunOutcomeOrderMap[outcome],
+      },
+    },
+  };
+}
+
 export const getMigrations870 = (encryptedSavedObjects: EncryptedSavedObjectsPluginSetup) =>
   createEsoMigration(
     encryptedSavedObjects,
     (doc: SavedObjectUnsanitizedDoc<RawRule>): doc is SavedObjectUnsanitizedDoc<RawRule> => true,
-    pipeMigrations(addGroupByToEsQueryRule, addLogViewRefToLogThresholdRule)
+    pipeMigrations(addGroupByToEsQueryRule, addLogViewRefToLogThresholdRule, migrateOutcomeOrder)
   );

x-pack/plugins/alerting/server/saved_objects/migrations/index.test.ts

@@ -2606,6 +2606,21 @@ describe('successful migrations', () => {
         expect(migratedAlert870.references).toEqual([]);
       });
     });
+
+    test('migrates last run outcome order', () => {
+      const migration870 = getMigrations(encryptedSavedObjectsSetup, {}, isPreconfigured)['8.7.0'];
+      const rule = getMockData({
+        lastRun: {
+          outcome: 'failed',
+        },
+      });
+      const migratedAlert870 = migration870(rule, migrationContext);
+
+      expect(migratedAlert870.attributes.lastRun).toEqual({
+        outcome: 'failed',
+        outcomeOrder: 20,
+      });
+    });
   });
 
   describe('Metrics Inventory Threshold rule', () => {

x-pack/plugins/alerting/server/task_runner/fixtures.ts

@@ -6,7 +6,14 @@
  */
 
 import { TaskStatus } from '@kbn/task-manager-plugin/server';
-import { Rule, RuleTypeParams, RecoveredActionGroup, RuleMonitoring } from '../../common';
+import {
+  Rule,
+  RuleTypeParams,
+  RecoveredActionGroup,
+  RuleMonitoring,
+  RuleLastRunOutcomeOrderMap,
+  RuleLastRunOutcomes,
+} from '../../common';
 import { getDefaultMonitoring } from '../lib/monitoring';
 import { UntypedNormalizedRuleType } from '../rule_type_registry';
 import { EVENT_LOG_ACTIONS } from '../plugin';
@@ -74,7 +81,7 @@ export const generateSavedObjectParams = ({
   error?: null | { reason: string; message: string };
   warning?: null | { reason: string; message: string };
   status?: string;
-  outcome?: string;
+  outcome?: RuleLastRunOutcomes;
   nextRun?: string | null;
   successRatio?: number;
   history?: RuleMonitoring['run']['history'];
@@ -110,6 +117,7 @@ export const generateSavedObjectParams = ({
     },
     lastRun: {
       outcome,
+      outcomeOrder: RuleLastRunOutcomeOrderMap[outcome],
       outcomeMsg:
         (error?.message && [error?.message]) || (warning?.message && [warning?.message]) || null,
       warning: error?.reason || warning?.reason || null,

x-pack/plugins/alerting/server/task_runner/task_runner.test.ts

@@ -274,7 +274,7 @@ describe('Task Runner', () => {
     );
     expect(logger.debug).nthCalledWith(
       3,
-      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":0,"new":0,"recovered":0,"ignored":0}}'
+      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":0,"new":0,"recovered":0,"ignored":0}}'
     );
     expect(logger.debug).nthCalledWith(
       4,
@@ -355,7 +355,7 @@ describe('Task Runner', () => {
       );
       expect(logger.debug).nthCalledWith(
         4,
-        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":1,"recovered":0,"ignored":0}}'
+        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":1,"recovered":0,"ignored":0}}'
       );
       expect(logger.debug).nthCalledWith(
         5,
@@ -442,7 +442,7 @@ describe('Task Runner', () => {
     );
     expect(logger.debug).nthCalledWith(
       5,
-      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":1,"recovered":0,"ignored":0}}'
+      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":1,"recovered":0,"ignored":0}}'
     );
     expect(logger.debug).nthCalledWith(
       6,
@@ -622,7 +622,7 @@ describe('Task Runner', () => {
       );
       expect(logger.debug).nthCalledWith(
         5,
-        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":2,"new":2,"recovered":0,"ignored":0}}'
+        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":2,"new":2,"recovered":0,"ignored":0}}'
       );
       expect(logger.debug).nthCalledWith(
         6,
@@ -1061,7 +1061,7 @@ describe('Task Runner', () => {
       );
       expect(logger.debug).nthCalledWith(
         5,
-        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":0,"recovered":1,"ignored":0}}'
+        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":0,"recovered":1,"ignored":0}}'
       );
       expect(logger.debug).nthCalledWith(
         6,
@@ -1187,7 +1187,7 @@ describe('Task Runner', () => {
       );
       expect(logger.debug).nthCalledWith(
         5,
-        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":0,"recovered":1,"ignored":0}}'
+        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":0,"recovered":1,"ignored":0}}'
       );
       expect(logger.debug).nthCalledWith(
         6,
@@ -2325,7 +2325,7 @@ describe('Task Runner', () => {
     );
     expect(logger.debug).nthCalledWith(
       3,
-      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":0,"new":0,"recovered":0,"ignored":0}}'
+      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":0,"new":0,"recovered":0,"ignored":0}}'
     );
     expect(logger.debug).nthCalledWith(
       4,

x-pack/plugins/alerting/server/task_runner/task_runner.ts

@@ -45,6 +45,7 @@ import {
   RuleTypeState,
   parseDuration,
   RawAlertInstance,
+  RuleLastRunOutcomeOrderMap,
 } from '../../common';
 import { NormalizedRuleType, UntypedNormalizedRuleType } from '../rule_type_registry';
 import { getEsErrorMessage } from '../lib/errors';
@@ -817,10 +818,12 @@ export class TaskRunner<
     this.logger.debug(
       `Updating rule task for ${this.ruleType.id} rule with id ${ruleId} - execution error due to timeout`
     );
+    const outcome = 'failed';
     await this.updateRuleSavedObjectPostRun(ruleId, namespace, {
       executionStatus: ruleExecutionStatusToRaw(executionStatus),
       lastRun: {
-        outcome: 'failed',
+        outcome,
+        outcomeOrder: RuleLastRunOutcomeOrderMap[outcome],
         warning: RuleExecutionStatusErrorReasons.Timeout,
         outcomeMsg,
         alertsCount: {},

x-pack/plugins/alerting/server/task_runner/task_runner_cancel.test.ts

@@ -230,6 +230,7 @@ describe('Task Runner Cancel', () => {
           outcomeMsg: [
             'test:1: execution cancelled due to timeout - exceeded rule type timeout of 5m',
           ],
+          outcomeOrder: 20,
           warning: 'timeout',
         },
         monitoring: {

x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema.test.ts

@@ -29,7 +29,7 @@ describe('Find rules request schema', () => {
     const payload: FindRulesRequestQuery = {
       per_page: 5,
       page: 1,
-      sort_field: 'some field',
+      sort_field: 'name',
       fields: ['field 1', 'field 2'],
       filter: 'some filter',
       sort_order: 'asc',
@@ -80,14 +80,14 @@ describe('Find rules request schema', () => {
 
   test('sort_field validates', () => {
     const payload: FindRulesRequestQuery = {
-      sort_field: 'value',
+      sort_field: 'name',
     };
 
     const decoded = FindRulesRequestQuery.decode(payload);
     const checked = exactCheck(payload, decoded);
     const message = pipe(checked, foldLeftRight);
     expect(getPaths(left(message.errors))).toEqual([]);
-    expect((message.schema as FindRulesRequestQuery).sort_field).toEqual('value');
+    expect((message.schema as FindRulesRequestQuery).sort_field).toEqual('name');
   });
 
   test('fields validates with a string', () => {
@@ -173,7 +173,7 @@ describe('Find rules request schema', () => {
   test('sort_order validates with desc and sort_field', () => {
     const payload: FindRulesRequestQuery = {
       sort_order: 'desc',
-      sort_field: 'some field',
+      sort_field: 'name',
     };
 
     const decoded = FindRulesRequestQuery.decode(payload);
@@ -187,7 +187,7 @@ describe('Find rules request schema', () => {
   test('sort_order does not validate with a string other than asc and desc', () => {
     const payload: Omit<FindRulesRequestQuery, 'sort_order'> & { sort_order: string } = {
       sort_order: 'some other string',
-      sort_field: 'some field',
+      sort_field: 'name',
     };
 
     const decoded = FindRulesRequestQuery.decode(payload);

x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema_validation.test.ts

@@ -18,7 +18,7 @@ describe('Find rules request schema, additional validation', () => {
 
     test('You can have both a sort_field and and a sort_order', () => {
       const schema: FindRulesRequestQuery = {
-        sort_field: 'some field',
+        sort_field: 'name',
         sort_order: 'asc',
       };
       const errors = validateFindRulesRequestQuery(schema);
@@ -27,7 +27,7 @@ describe('Find rules request schema, additional validation', () => {
 
     test('You cannot have sort_field without sort_order', () => {
       const schema: FindRulesRequestQuery = {
-        sort_field: 'some field',
+        sort_field: 'name',
       };
       const errors = validateFindRulesRequestQuery(schema);
       expect(errors).toEqual([

x-pack/plugins/security_solution/common/detection_engine/schemas/common/sorting.ts

@@ -10,7 +10,23 @@ import type { Either } from 'fp-ts/lib/Either';
 import { capitalize } from 'lodash';
 
 export type SortField = t.TypeOf<typeof SortField>;
-export const SortField = t.string;
+export const SortField = t.union([
+  t.literal('created_at'),
+  t.literal('createdAt'), // Legacy notation, keeping for backwards compatibility
+  t.literal('enabled'),
+  t.literal('execution_summary.last_execution.date'),
+  t.literal('execution_summary.last_execution.metrics.execution_gap_duration_s'),
+  t.literal('execution_summary.last_execution.metrics.total_indexing_duration_ms'),
+  t.literal('execution_summary.last_execution.metrics.total_search_duration_ms'),
+  t.literal('execution_summary.last_execution.status'),
+  t.literal('name'),
+  t.literal('risk_score'),
+  t.literal('riskScore'), // Legacy notation, keeping for backwards compatibility
+  t.literal('severity'),
+  t.literal('updated_at'),
+  t.literal('updatedAt'), // Legacy notation, keeping for backwards compatibility
+  t.literal('version'),
+]);
 
 export type SortFieldOrUndefined = t.TypeOf<typeof SortFieldOrUndefined>;
 export const SortFieldOrUndefined = t.union([SortField, t.undefined]);