[RAM] Use AAD When Running Action

x-pack/plugins/alerting/common/routes/rule/apis/create/schemas/v1.ts

@@ -77,6 +77,7 @@ export const actionSchema = schema.object({
   params: schema.recordOf(schema.string(), schema.maybe(schema.any()), { defaultValue: {} }),
   frequency: schema.maybe(actionFrequencySchema),
   alerts_filter: schema.maybe(actionAlertsFilterSchema),
+  use_alert_data_for_template: schema.maybe(schema.boolean()),
 });
 
 export const createBodySchema = schema.object({

x-pack/plugins/alerting/common/rule.ts

@@ -116,6 +116,7 @@ export interface RuleAction {
   params: RuleActionParams;
   frequency?: RuleActionFrequency;
   alertsFilter?: AlertsFilter;
+  useAlertDataForTemplate?: boolean;
 }
 
 export interface RuleLastRun {

x-pack/plugins/alerting/server/alert/alert.ts

@@ -7,6 +7,7 @@
 
 import { v4 as uuidV4 } from 'uuid';
 import { isEmpty } from 'lodash';
+import { AADAlert } from '@kbn/alerts-as-data-utils';
 import { MutableAlertInstanceMeta } from '@kbn/alerting-state-types';
 import { AlertHit, CombinedSummarizedAlerts } from '../types';
 import {
@@ -35,7 +36,7 @@ export type PublicAlert<
   Context extends AlertInstanceContext = AlertInstanceContext,
   ActionGroupIds extends string = DefaultActionGroupId
 > = Pick<
-  Alert<State, Context, ActionGroupIds>,
+  Alert<State, Context, ActionGroupIds, AADAlert>,
   | 'getContext'
   | 'getState'
   | 'getUuid'
@@ -49,13 +50,15 @@ export type PublicAlert<
 export class Alert<
   State extends AlertInstanceState = AlertInstanceState,
   Context extends AlertInstanceContext = AlertInstanceContext,
-  ActionGroupIds extends string = never
+  ActionGroupIds extends string = never,
+  AlertAsData extends AADAlert = AADAlert
 > {
   private scheduledExecutionOptions?: ScheduledExecutionOptions<State, Context, ActionGroupIds>;
   private meta: MutableAlertInstanceMeta;
   private state: State;
   private context: Context;
   private readonly id: string;
+  private alertAsData: AlertAsData | undefined;
 
   constructor(id: string, { state, meta = {} }: RawAlertInstance = {}) {
     this.id = id;
@@ -77,6 +80,18 @@ export class Alert<
     return this.meta.uuid!;
   }
 
+  isAlertAsData() {
+    return this.alertAsData !== undefined;
+  }
+
+  setAlertAsData(alertAsData: AlertAsData) {
+    this.alertAsData = alertAsData;
+  }
+
+  getAlertAsData() {
+    return this.alertAsData;
+  }
+
   getStart(): string | null {
     return this.state.start ? `${this.state.start}` : null;
   }

x-pack/plugins/alerting/server/application/rule/methods/create/schemas/create_rule_data_schema.ts

@@ -35,6 +35,7 @@ export const createRuleDataSchema = schema.object({
       ),
       uuid: schema.maybe(schema.string()),
       alertsFilter: schema.maybe(actionAlertsFilterSchema),
+      useAlertDataForTemplate: schema.maybe(schema.boolean()),
     }),
     { defaultValue: [] }
   ),

x-pack/plugins/alerting/server/application/rule/schemas/action_schemas.ts

@@ -65,6 +65,7 @@ export const actionDomainSchema = schema.object({
   params: actionParamsSchema,
   frequency: schema.maybe(actionFrequencySchema),
   alertsFilter: schema.maybe(actionDomainAlertsFilterSchema),
+  useAlertDataAsTemplate: schema.maybe(schema.boolean()),
 });
 
 /**
@@ -89,4 +90,5 @@ export const actionSchema = schema.object({
   params: actionParamsSchema,
   frequency: schema.maybe(actionFrequencySchema),
   alertsFilter: schema.maybe(actionAlertsFilterSchema),
+  useAlertDataForTemplate: schema.maybe(schema.boolean()),
 });

x-pack/plugins/alerting/server/routes/lib/actions_schema.ts

@@ -68,6 +68,7 @@ export const actionsSchema = schema.arrayOf(
         ),
       })
     ),
+    use_alert_data_for_template: schema.maybe(schema.boolean()),
   }),
   { defaultValue: [] }
 );

x-pack/plugins/alerting/server/routes/lib/rewrite_actions.ts

@@ -15,20 +15,28 @@ export const rewriteActionsReq = (
 ): NormalizedAlertAction[] => {
   if (!actions) return [];
 
-  return actions.map(({ frequency, alerts_filter: alertsFilter, ...action }) => {
-    return {
-      ...action,
-      ...(frequency
-        ? {
-            frequency: {
-              ...omit(frequency, 'notify_when'),
-              notifyWhen: frequency.notify_when,
-            },
-          }
-        : {}),
-      ...(alertsFilter ? { alertsFilter } : {}),
-    };
-  });
+  return actions.map(
+    ({
+      frequency,
+      alerts_filter: alertsFilter,
+      use_alert_data_for_template: useAlertDataForTemplate,
+      ...action
+    }) => {
+      return {
+        ...action,
+        useAlertDataForTemplate,
+        ...(frequency
+          ? {
+              frequency: {
+                ...omit(frequency, 'notify_when'),
+                notifyWhen: frequency.notify_when,
+              },
+            }
+          : {}),
+        ...(alertsFilter ? { alertsFilter } : {}),
+      };
+    }
+  );
 };
 
 export const rewriteActionsRes = (actions?: RuleAction[]) => {
@@ -37,14 +45,17 @@ export const rewriteActionsRes = (actions?: RuleAction[]) => {
     notify_when: notifyWhen,
   });
   if (!actions) return [];
-  return actions.map(({ actionTypeId, frequency, alertsFilter, ...action }) => ({
-    ...action,
-    connector_type_id: actionTypeId,
-    ...(frequency ? { frequency: rewriteFrequency(frequency) } : {}),
-    ...(alertsFilter
-      ? {
-          alerts_filter: alertsFilter,
-        }
-      : {}),
-  }));
+  return actions.map(
+    ({ actionTypeId, frequency, alertsFilter, useAlertDataForTemplate, ...action }) => ({
+      ...action,
+      connector_type_id: actionTypeId,
+      use_alert_data_for_template: useAlertDataForTemplate,
+      ...(frequency ? { frequency: rewriteFrequency(frequency) } : {}),
+      ...(alertsFilter
+        ? {
+            alerts_filter: alertsFilter,
+          }
+        : {}),
+    })
+  );
 };

x-pack/plugins/alerting/server/routes/rule/apis/bulk_edit/bulk_edit_rules_route.test.ts

@@ -114,6 +114,7 @@ describe('bulkEditRulesRoute', () => {
                   foo: true,
                 },
                 uuid: '123-456',
+                use_alert_data_for_template: false,
               },
             ],
           }),

x-pack/plugins/alerting/server/routes/rule/apis/create/create_rule_route.test.ts

@@ -124,6 +124,7 @@ describe('createRuleRoute', () => {
         },
         connector_type_id: 'test',
         uuid: '123-456',
+        use_alert_data_for_template: false,
       },
     ],
   };
@@ -198,6 +199,7 @@ describe('createRuleRoute', () => {
                 "params": Object {
                   "foo": true,
                 },
+                "useAlertDataForTemplate": undefined,
               },
             ],
             "alertTypeId": "1",
@@ -314,6 +316,7 @@ describe('createRuleRoute', () => {
                 "params": Object {
                   "foo": true,
                 },
+                "useAlertDataForTemplate": undefined,
               },
             ],
             "alertTypeId": "1",
@@ -431,6 +434,7 @@ describe('createRuleRoute', () => {
                 "params": Object {
                   "foo": true,
                 },
+                "useAlertDataForTemplate": undefined,
               },
             ],
             "alertTypeId": "1",
@@ -548,6 +552,7 @@ describe('createRuleRoute', () => {
                 "params": Object {
                   "foo": true,
                 },
+                "useAlertDataForTemplate": undefined,
               },
             ],
             "alertTypeId": "1",

x-pack/plugins/alerting/server/routes/rule/apis/create/transforms/transform_create_body/v1.ts

@@ -15,25 +15,33 @@ import type { RuleParams } from '../../../../../../application/rule/types';
 const transformCreateBodyActions = (actions: CreateRuleActionV1[]): CreateRuleData['actions'] => {
   if (!actions) return [];
 
-  return actions.map(({ frequency, alerts_filter: alertsFilter, ...action }) => {
-    return {
-      group: action.group,
-      id: action.id,
-      params: action.params,
-      actionTypeId: action.actionTypeId,
-      ...(action.uuid ? { uuid: action.uuid } : {}),
-      ...(frequency
-        ? {
-            frequency: {
-              summary: frequency.summary,
-              throttle: frequency.throttle,
-              notifyWhen: frequency.notify_when,
-            },
-          }
-        : {}),
-      ...(alertsFilter ? { alertsFilter } : {}),
-    };
-  });
+  return actions.map(
+    ({
+      frequency,
+      alerts_filter: alertsFilter,
+      use_alert_data_for_template: useAlertDataForTemplate,
+      ...action
+    }) => {
+      return {
+        group: action.group,
+        id: action.id,
+        params: action.params,
+        actionTypeId: action.actionTypeId,
+        useAlertDataForTemplate,
+        ...(action.uuid ? { uuid: action.uuid } : {}),
+        ...(frequency
+          ? {
+              frequency: {
+                summary: frequency.summary,
+                throttle: frequency.throttle,
+                notifyWhen: frequency.notify_when,
+              },
+            }
+          : {}),
+        ...(alertsFilter ? { alertsFilter } : {}),
+      };
+    }
+  );
 };
 
 export const transformCreateBody = <Params extends RuleParams = never>(

x-pack/plugins/alerting/server/routes/rule/transforms/transform_rule_to_rule_response/v1.ts

@@ -49,11 +49,21 @@ export const transformRuleToRuleResponse = <Params extends RuleParams = never>(
   consumer: rule.consumer,
   schedule: rule.schedule,
   actions: rule.actions.map(
-    ({ group, id, actionTypeId, params, frequency, uuid, alertsFilter }) => ({
+    ({
+      group,
+      id,
+      actionTypeId,
+      params,
+      frequency,
+      uuid,
+      alertsFilter,
+      useAlertDataForTemplate,
+    }) => ({
       group,
       id,
       params,
       connector_type_id: actionTypeId,
+      use_alert_data_for_template: useAlertDataForTemplate ?? false,
       ...(frequency
         ? {
             frequency: {

x-pack/plugins/alerting/server/routes/update_rule.test.ts

@@ -132,6 +132,7 @@ describe('updateRuleRoute', () => {
                 "params": Object {
                   "baz": true,
                 },
+                "useAlertDataForTemplate": undefined,
                 "uuid": "1234-5678",
               },
             ],