[Alerting] Provide services to set context for recovered alerts #124972

ymao1 · 2022-02-08T15:32:37Z

Summary

This PR provides rule executors with the ability to set context on recovered alerts. It adds the following:

Adds doesSetRecoveryContext flag to the rule type, which allows rule types to opt into using recovery services when they are ready. Defaults to false if not set.
- If doesSetRecoveryContext is true for a rule type, the context variables will be available in the list of action variables when the action group is recovered. Previously, context was always hidden for the recovered action group.
Updates alert class with context getters and setters
Updates createAlertFactory to add a done() function that is meant to be called when a rule type is done creating alerts and scheduling actions. If a rule type executor tries to create an alert after calling done(), an error will be thrown.
If doesSetRecoveryContext is true for a rule type, when the rule type executor calls done(), it will be provided a list of recovered alerts

I've updated the index threshold rule type to use these services to set recovery context so you should be able to verify this PR using that rule type.

Checklist

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

…g/alert-instance-to-alert

…/ymao1/kibana into alerting/alert-instance-to-alert

…/ymao1/kibana into alerting/recovery-context-services-2

…g/recovery-context-services-2

marshallmain

LGTM! Thanks for updating our AlertInstanceFactory stub!

pmuellr

LGTM!

gmmorris · 2022-02-21T09:50:23Z

@elasticmachine merge upstream

ymao1 · 2022-02-21T15:06:54Z

@elasticmachine merge upstream

kibana-ci · 2022-02-21T16:52:14Z

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`alerting`	281	283	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`triggersActionsUi`	678.1KB	678.2KB	+162.0B

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`alerting`	19	20	+1

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`triggersActionsUi`	54.0KB	54.1KB	+48.0B

Unknown metric groups

API count

id	before	after	diff
`alerting`	289	291	+2

History

💔 Build #25236 failed f22c83e
💔 Build #25112 failed 7e1d246
💔 Build #24971 failed 18bf52f
💚 Build #24772 succeeded 31e70c9
💚 Build #24297 succeeded 30d3f51

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @ymao1

…tic#124972) * Rename alert instance to alert and add create fn to alert factory * Rename alert instance to alert and add create fn to alert factory * Fixing types * Fixing types * Adding flag for rule types to opt into setting recovery context * Only showing context in action variable menu if flag set to true * Adding recovery functions to createAlertFactory * Setting recovery in index threshold and fixing types * Fixing lint issues and some refactoring * Cleanup * Functional tests for index threshold rule recovery context * Return array of recovered alerts instead of record * Fixing types * Fixing types * Cleanup * Handling nulls and more tests * Updating developer docs * Making getRecoveryAlerts non-optional * Setting unknown in index threshold recovery value * PR feedback * Adding a test Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

* WIP * WIP2 * Use new cases context hooks to open and close the flyout * Update timelines to use new hooks * CLose flyout on create success * Add back sucess toast * Move code to a dedicated component * Add CasesContext to observability * Remove dependency * Small refactor * Use observabilityAppId instead of observabilityFeatureId for buttons * Add CasesContext to timetable * Fix detection engine test cases * Fix broken tests * Fix broken tests * Rename hook * Add test cases for cases context ui * Add test for new hook * Remove state from the provider context * Remove basevalue * apply suggested renaming * Add usecallback * Add reducer types, fix test type, remove redundant check * Accept attachments as a prop for the cases select modal * Expose useCasesAddToExistingCase hook, reducer code and global component * use the new hook to open the select cases modasl * Fix tests and types * Add tests for cases global components * [Fleet] showing agent policy creation error message on UI (#125931) * showing agent policy creation error message on UI * mapping the error instead of showing from the backend Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * [ResponseOps] Adds tooltip to time window selector in ES query rule flyout (#125764) * [Lens] Allow detaching from global time range (#125563) * allow detaching from global time range * add test * fix time field recognition * fix tests Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * [Fleet] refactor auto upgrade package policies logic (#125909) * refactor upgrade package policies * fixed tests * code cleanup * review improvements * added api test Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * skip flaky suite (#126027) * Remove deprecated api (#125524) * [Fleet] Remove deprecated kibana APIs - License * Remove basePath from FleetApp * Replace AsyncPlugin with Plugin * Get fieldFormats from fieldFormats plugin rather than data plugin * Fix ts errors * Attempt fixing wrong type * Move licenseService to FleetStartDeps * Fix types and mocks Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Upgrade `markdown-it` dependency (`10.0.0` → `12.3.2`). (#125526) * skipping failing tests (#126039) * remove unused deprecated code and use field format plugin directly for data view field editor (#126029) * [data views] Improve preview pane (#126013) * fix preview pane * fix preview pane * one less span tag Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * [Alerting] Provide services to set context for recovered alerts (#124972) * Rename alert instance to alert and add create fn to alert factory * Rename alert instance to alert and add create fn to alert factory * Fixing types * Fixing types * Adding flag for rule types to opt into setting recovery context * Only showing context in action variable menu if flag set to true * Adding recovery functions to createAlertFactory * Setting recovery in index threshold and fixing types * Fixing lint issues and some refactoring * Cleanup * Functional tests for index threshold rule recovery context * Return array of recovered alerts instead of record * Fixing types * Fixing types * Cleanup * Handling nulls and more tests * Updating developer docs * Making getRecoveryAlerts non-optional * Setting unknown in index threshold recovery value * PR feedback * Adding a test Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * [Discover] Re-introduce saved_searches test (#126059) * [Archive Migration] index pattern without timefield (#125870) * kbn_archive date_nanos * kbn_archive date_nanos in context and discover * kbn_archiver more date_nanos tests * split out kbnArchiver for index_pattern_without_timefield * remove date_nanos files from a different PR * update another test for usage of the same archives * set default index pattern for test * remove duplicate const kibanaServer Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * delete unused es_archive visualize_embedding (#126001) * delete unused es_archive * remove other unused es_archive * more unused es_archives Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Bump packages (#126119) * url-parse 1.5.3 -> 1.5.9 * follow-redirects 1.y.z -> 1.14.9 * Add tests for all cases selector and attachments * Add tests for use add to existing case hook * First version of the cases timeline actions * export add alert to new case button from cases plugin * Make Cases ECS compatible with timelines and security_solution * Delete new case button * Add helpers * Use the cases hook directly for add to new case * Remov unused dependencies * Rename callbacks, remove timelines calls * Fixing tests for the dropdown * Fix broken test * mocking cases for tests * Fix detectiosn tests * Observability now uses the new cases hooks * Wrap events viewer into cases context * Open the create case flyout if create case was selected in the modal * Fix cases mocks for security_solution * Update tests * Add tests for use cases toast * Improve cases mock * delete security mock * replace tests mocks for cases * fix import mock * Do not require onRowClick * Show the toast inside the modal * show the toast inside the flyout * remove toast logic from the consumer plugin * fix typescript types * Rename type * Fix broken test * Fix file name and broken test * Use internal navigation hook * Update hook dependencies * Move useCaseToast * Fix mock paths * fix eslint * Add test cases for the toast content * Add cases context to the overview page Co-authored-by: Julia Bardi <90178898+juliaElastic@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: István Zoltán Szabó <szabosteve@gmail.com> Co-authored-by: Joe Reuter <johannes.reuter@elastic.co> Co-authored-by: Tiago Costa <tiago.costa@elastic.co> Co-authored-by: Cristina Amico <criamico@users.noreply.github.com> Co-authored-by: Aleh Zasypkin <aleh.zasypkin@elastic.co> Co-authored-by: Gloria Hornero <gloria.hornero@elastic.co> Co-authored-by: Matthew Kime <matt@mattki.me> Co-authored-by: Ying Mao <ying.mao@elastic.co> Co-authored-by: Maja Grubic <maja.grubic@elastic.co> Co-authored-by: Lee Drengenberg <lee.drengenberg@elastic.co> Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com>

…#126265) * WIP * WIP2 * Use new cases context hooks to open and close the flyout * Update timelines to use new hooks * CLose flyout on create success * Add back sucess toast * Move code to a dedicated component * Add CasesContext to observability * Remove dependency * Small refactor * Use observabilityAppId instead of observabilityFeatureId for buttons * Add CasesContext to timetable * Fix detection engine test cases * Fix broken tests * Fix broken tests * Rename hook * Add test cases for cases context ui * Add test for new hook * Remove state from the provider context * Remove basevalue * apply suggested renaming * Add usecallback * Add reducer types, fix test type, remove redundant check * Accept attachments as a prop for the cases select modal * Expose useCasesAddToExistingCase hook, reducer code and global component * use the new hook to open the select cases modasl * Fix tests and types * Add tests for cases global components * [Fleet] showing agent policy creation error message on UI (elastic#125931) * showing agent policy creation error message on UI * mapping the error instead of showing from the backend Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * [ResponseOps] Adds tooltip to time window selector in ES query rule flyout (elastic#125764) * [Lens] Allow detaching from global time range (elastic#125563) * allow detaching from global time range * add test * fix time field recognition * fix tests Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * [Fleet] refactor auto upgrade package policies logic (elastic#125909) * refactor upgrade package policies * fixed tests * code cleanup * review improvements * added api test Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * skip flaky suite (elastic#126027) * Remove deprecated api (elastic#125524) * [Fleet] Remove deprecated kibana APIs - License * Remove basePath from FleetApp * Replace AsyncPlugin with Plugin * Get fieldFormats from fieldFormats plugin rather than data plugin * Fix ts errors * Attempt fixing wrong type * Move licenseService to FleetStartDeps * Fix types and mocks Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Upgrade `markdown-it` dependency (`10.0.0` → `12.3.2`). (elastic#125526) * skipping failing tests (elastic#126039) * remove unused deprecated code and use field format plugin directly for data view field editor (elastic#126029) * [data views] Improve preview pane (elastic#126013) * fix preview pane * fix preview pane * one less span tag Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * [Alerting] Provide services to set context for recovered alerts (elastic#124972) * Rename alert instance to alert and add create fn to alert factory * Rename alert instance to alert and add create fn to alert factory * Fixing types * Fixing types * Adding flag for rule types to opt into setting recovery context * Only showing context in action variable menu if flag set to true * Adding recovery functions to createAlertFactory * Setting recovery in index threshold and fixing types * Fixing lint issues and some refactoring * Cleanup * Functional tests for index threshold rule recovery context * Return array of recovered alerts instead of record * Fixing types * Fixing types * Cleanup * Handling nulls and more tests * Updating developer docs * Making getRecoveryAlerts non-optional * Setting unknown in index threshold recovery value * PR feedback * Adding a test Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * [Discover] Re-introduce saved_searches test (elastic#126059) * [Archive Migration] index pattern without timefield (elastic#125870) * kbn_archive date_nanos * kbn_archive date_nanos in context and discover * kbn_archiver more date_nanos tests * split out kbnArchiver for index_pattern_without_timefield * remove date_nanos files from a different PR * update another test for usage of the same archives * set default index pattern for test * remove duplicate const kibanaServer Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * delete unused es_archive visualize_embedding (elastic#126001) * delete unused es_archive * remove other unused es_archive * more unused es_archives Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Bump packages (elastic#126119) * url-parse 1.5.3 -> 1.5.9 * follow-redirects 1.y.z -> 1.14.9 * Add tests for all cases selector and attachments * Add tests for use add to existing case hook * First version of the cases timeline actions * export add alert to new case button from cases plugin * Make Cases ECS compatible with timelines and security_solution * Delete new case button * Add helpers * Use the cases hook directly for add to new case * Remov unused dependencies * Rename callbacks, remove timelines calls * Fixing tests for the dropdown * Fix broken test * mocking cases for tests * Fix detectiosn tests * Observability now uses the new cases hooks * Wrap events viewer into cases context * Open the create case flyout if create case was selected in the modal * Fix cases mocks for security_solution * Update tests * Add tests for use cases toast * Improve cases mock * delete security mock * replace tests mocks for cases * fix import mock * Do not require onRowClick * Show the toast inside the modal * show the toast inside the flyout * remove toast logic from the consumer plugin * fix typescript types * Rename type * Fix broken test * Fix file name and broken test * Use internal navigation hook * Update hook dependencies * Move useCaseToast * Fix mock paths * fix eslint * Add test cases for the toast content * Add cases context to the overview page Co-authored-by: Julia Bardi <90178898+juliaElastic@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: István Zoltán Szabó <szabosteve@gmail.com> Co-authored-by: Joe Reuter <johannes.reuter@elastic.co> Co-authored-by: Tiago Costa <tiago.costa@elastic.co> Co-authored-by: Cristina Amico <criamico@users.noreply.github.com> Co-authored-by: Aleh Zasypkin <aleh.zasypkin@elastic.co> Co-authored-by: Gloria Hornero <gloria.hornero@elastic.co> Co-authored-by: Matthew Kime <matt@mattki.me> Co-authored-by: Ying Mao <ying.mao@elastic.co> Co-authored-by: Maja Grubic <maja.grubic@elastic.co> Co-authored-by: Lee Drengenberg <lee.drengenberg@elastic.co> Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com>

ymao1 and others added 29 commits February 2, 2022 12:56

Rename alert instance to alert and add create fn to alert factory

72255bb

Rename alert instance to alert and add create fn to alert factory

93082d6

Fixing types

5875e52

Fixing types

c254b9d

Merge branch 'main' into alerting/alert-instance-to-alert

4b0ef8b

Merge branch 'main' of https://github.com/elastic/kibana into alertin…

18ed715

…g/alert-instance-to-alert

Merge branch 'alerting/alert-instance-to-alert' of https://github.com…

6a7e256

…/ymao1/kibana into alerting/alert-instance-to-alert

Adding flag for rule types to opt into setting recovery context

a4a56a6

Merge branch 'main' into alerting/alert-instance-to-alert

a5c2506

Only showing context in action variable menu if flag set to true

be68324

Merge branch 'alerting/alert-instance-to-alert' of https://github.com…

ba6a84f

…/ymao1/kibana into alerting/recovery-context-services-2

Merge branch 'main' of https://github.com/elastic/kibana into alertin…

f0046f2

…g/recovery-context-services-2

Adding recovery functions to createAlertFactory

41e75cf

Setting recovery in index threshold and fixing types

d6ed52b

Merge branch 'main' of https://github.com/elastic/kibana into alertin…

cbc8402

…g/recovery-context-services-2

Fixing lint issues and some refactoring

98fd000

Merge branch 'main' of https://github.com/elastic/kibana into alertin…

3e002aa

…g/recovery-context-services-2

Cleanup

35be5b6

Functional tests for index threshold rule recovery context

fe49c49

Merge branch 'main' of https://github.com/elastic/kibana into alertin…

5754075

…g/recovery-context-services-2

Merge branch 'main' of https://github.com/elastic/kibana into alertin…

5bb918b

…g/recovery-context-services-2

Return array of recovered alerts instead of record

8e585fe

Merge branch 'main' of https://github.com/elastic/kibana into alertin…

e6e85f3

…g/recovery-context-services-2

Fixing types

002f94b

Fixing types

3bd343b

Merge branch 'main' of https://github.com/elastic/kibana into alertin…

3666f6c

…g/recovery-context-services-2

Cleanup

61c6b77

Merge branch 'main' of https://github.com/elastic/kibana into alertin…

50bbc78

…g/recovery-context-services-2

Handling nulls and more tests

fbe5973

ymao1 changed the title ~~Alerting/recovery context services 2~~ [Alerting] Provide services to set context for recovered alerts Feb 10, 2022

ymao1 added 3 commits February 17, 2022 14:44

PR feedback

afe0c45

Merge branch 'main' of https://github.com/elastic/kibana into alertin…

1a5df73

…g/recovery-context-services-2

Adding a test

7e1d246

marshallmain approved these changes Feb 17, 2022

View reviewed changes

pmuellr approved these changes Feb 17, 2022

View reviewed changes

Merge branch 'main' into alerting/recovery-context-services-2

f22c83e

Merge branch 'main' into alerting/recovery-context-services-2

181657d

ymao1 enabled auto-merge (squash) February 21, 2022 15:07

ymao1 merged commit b395e53 into elastic:main Feb 21, 2022

ymao1 deleted the alerting/recovery-context-services-2 branch February 22, 2022 03:01

darnautov mentioned this pull request Mar 3, 2022

[ML] Add context for recovered alerts #126803

Closed

2 tasks

This was referenced Mar 7, 2022

[Infrastructure UI][Rules] Specify recovery context for Metric Threshold rule type #127078

Closed

[Infrastructure UI][Rules] Specify recovery context for Log Threshold rule type #127080

Closed

nickpeihl mentioned this pull request Mar 8, 2022

[Maps] Add context for recovered alerts #127191

Closed

mgiota mentioned this pull request Mar 21, 2022

[Infrastructure UI][Rules] Refactor Metric Threshold rule to push evaluations to Elasticsearch #126214

Merged

dominiqueclarke mentioned this pull request Mar 29, 2022

[Uptime] Specify alert recovery context #128761

Closed

ymao1 mentioned this pull request Jun 20, 2022

Containment alert missing context when "no longer contained" action is selected #134772

Closed

tylersmalley added ci:cloud-deploy Create or update a Cloud deployment and removed ci:deploy-cloud labels Aug 17, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Alerting] Provide services to set context for recovered alerts #124972

[Alerting] Provide services to set context for recovered alerts #124972

ymao1 commented Feb 8, 2022 •

edited

Loading

marshallmain left a comment

pmuellr left a comment

gmmorris commented Feb 21, 2022

ymao1 commented Feb 21, 2022

kibana-ci commented Feb 21, 2022

API count

[Alerting] Provide services to set context for recovered alerts #124972

[Alerting] Provide services to set context for recovered alerts #124972

Conversation

ymao1 commented Feb 8, 2022 • edited Loading

Summary

Checklist

marshallmain left a comment

Choose a reason for hiding this comment

pmuellr left a comment

Choose a reason for hiding this comment

gmmorris commented Feb 21, 2022

ymao1 commented Feb 21, 2022

kibana-ci commented Feb 21, 2022

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Async chunks

Public APIs missing exports

Page load bundle

API count

History

ymao1 commented Feb 8, 2022 •

edited

Loading