[Cases][WIP] Linked Cases

[adcoelho]

Kibana Cases are used for issue investigation and collaborations. To help users in their investigations with cases(reviewing previous cases, researching connected cases) the system needs to allow for defining relationships between cases.

Backend

Mapping

Option 1 - “Array”

linkedCases: {
  type: 'keyword',
},

• Pros:
  • Faster search?
• Cons:
  • Every new relationship type will need a new field

Option 2 - Nested field type

linkedCases: {
  type: 'nested',
  properties: {
    caseId: {
      type: 'keyword',
    },
    relationshipType: {
      type: 'keyword',
    },
  },
},

• Pros:
  • Easier to implement new relationship types
• Cons:
  • More complex implementation?

API

linkedCases schema

linkedCases: rt.union([
  limitedArraySchema({
    codec: rt.strict({
      caseId: limitedStringSchema({
        fieldName: 'caseID',
        min: CASEID_LENGTH,
        max: CASEID_LENGTH,
      }),
      relationshipType: rt.string, // possibly part of an enum
    }),
    fieldName: 'linkedCases',
    min: 0,
    max: MAX_LINKED_CASES_LENGTH,
  }),
  rt.null,
]),

Create and update Cases

• The CasePatchRequest will include the new linkedCases field.
• The CasePostRequestRt will include the new linkedCases field.
• We will validate the number of linked cases.
• We can only link cases we have access to.
• Linking and unlinking a case will update the “other” case with the same/reverse relationship.
• We cannot link multiple times the same case with the same relationship
• What if the current case has not reached the limit but we try to link a case that reached the MAX_LINKED_CASES ?

GET Cases

• Should now return the linkedCases field.

Delete Case

• Do we need to delete the relationships in all linked cases?

Find Cases

Frontend

Displaying linked cases

• Jira uses sections with lists. Should we use a table with Relationship, Name, etc?

• An alternative to the design suggestion above would be a new tab with linked cases where this table would be shown alone.

• We use the bulkGet API to get all related cases by ID.
• Do we just display the name? Name and relationship? What else?
• Clicking a linked case leads to its detail page.
• What happens when a linked case is deleted? Is it still shown? We won’t have access to the name.
• Design?

Linking cases

• Two pages with similar behavior:
  • Case Detail
  • Create Case

• Search by case name with autocomplete.
  • Search also by id?
  • A case cannot be linked to itself.
• Linking a case should be logged in the activity feed.
• Limit the number of linked cases

• Do we want multiple relationship types?
  • Selectbox with possible relationships?
• Bulk linking cases? Next release?

Cases table

• Filtering by linked cases

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[elasticmachine]

Pinging @elastic/response-ops-cases (Feature:Cases)