[Actions][ServiceNow] Allow to close serviceNow incident when alert resolves #171760

js-jankisalvi · 2023-11-22T15:53:45Z

Summary

Fixes: #170522

This PR allows to close service now incident when alert is recovered

SN connector form shows only correlation_id field as it is mandatory field to close an incident.

How to test:

Create a rule and select serviceNow ITSM action with Run when option as Recovered
Verify that it closes an incident in SN when Alert is recovered

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

Release notes

Auto close ServiceNow incidents when alerts are resolved

…action

…-fix'

js-jankisalvi · 2023-11-27T11:08:33Z

x-pack/plugins/alerting/common/disabled_action_groups.ts

@@ -8,7 +8,7 @@
 import { RecoveredActionGroup } from './builtin_action_groups';

 const DisabledActionGroupsByActionType: Record<string, string[]> = {
-  [RecoveredActionGroup.id]: ['.jira', '.servicenow', '.resilient'],


To allow Recovered option in Run when dropdown

@elastic/response-ops-execution FYI, it seems that some connectors are missing from this list like the .servicenow-secops connector.

elasticmachine · 2023-11-27T12:04:27Z

Pinging @elastic/response-ops (Team:ResponseOps)

cnasikas

I tested and everything is working as expected 🚀. I managed to create an incident and close it when the alert recovers. I left some comments.

cnasikas · 2023-11-27T13:59:26Z

x-pack/plugins/alerting/common/disabled_action_groups.ts

@@ -8,7 +8,7 @@
 import { RecoveredActionGroup } from './builtin_action_groups';

 const DisabledActionGroupsByActionType: Record<string, string[]> = {
-  [RecoveredActionGroup.id]: ['.jira', '.servicenow', '.resilient'],


@elastic/response-ops-execution FYI, it seems that some connectors are missing from this list like the .servicenow-secops connector.

x-pack/plugins/stack_connectors/public/connector_types/servicenow_itsm/servicenow_itsm.tsx

cnasikas · 2023-11-27T14:16:12Z

x-pack/plugins/stack_connectors/public/connector_types/servicenow_itsm/servicenow_itsm.test.tsx

@@ -39,6 +39,18 @@ describe('servicenow action params validation', () => {
    });
  });

+  test(`${SERVICENOW_ITSM_CONNECTOR_TYPE_ID}: action params validation succeeds when no short_description provided and subAction is closeIncident`, async () => {


What do you think about testing that there are no errors at all? This will make the test fail if someone adds a new required field and forgets the recovered feature.

I added test in d627b86, is this what you meant?

...gins/stack_connectors/public/connector_types/servicenow_itsm/servicenow_itsm_params.test.tsx

...k/plugins/stack_connectors/public/connector_types/servicenow_itsm/servicenow_itsm_params.tsx

x-pack/plugins/stack_connectors/server/connector_types/lib/servicenow/service.test.ts

x-pack/plugins/stack_connectors/server/connector_types/servicenow_itsm/service.test.ts

..._api_integration/security_and_spaces/group2/tests/actions/connector_types/servicenow_itsm.ts

…action

cnasikas

Thanks for addressing my feedback! Some comments 🙂.

...gins/stack_connectors/public/connector_types/servicenow_itsm/servicenow_itsm_params.test.tsx

x-pack/plugins/stack_connectors/server/connector_types/lib/servicenow/service.ts

x-pack/plugins/stack_connectors/server/connector_types/lib/servicenow/types.ts

..._api_integration/security_and_spaces/group2/tests/actions/connector_types/servicenow_itsm.ts

x-pack/plugins/stack_connectors/server/connector_types/lib/servicenow/service.test.ts

…kisalvi/kibana into servicenow-recover-action

cnasikas

LGMT! I tested by creating a rule with a SN action that creates and incident and a SN action that close the incident when the alert recovers. Everything is working as expected :rocket. I found two small bugs:

if you try to close the incident through the actions API by using the externalId you get an error. It seems that we need to also provide the close_notes: 'Closed by Caller'. In the ServiceNow UI it is a required field when you try to close an incident.
If the incident is already closed the warning message is not logged.

x-pack/plugins/stack_connectors/server/connector_types/lib/servicenow/utils.ts

x-pack/plugins/stack_connectors/server/connector_types/lib/servicenow/service.test.ts

cnasikas · 2023-12-01T12:46:15Z

Ok, I found out about the second bug, we are doing incidentToBeClosed.state === 7 { // log warn } but the state is a string not an integer. It should be incidentToBeClosed.state === "7" 🙂.

js-jankisalvi · 2023-12-01T13:27:58Z

if you try to close the incident through the actions API by using the externalId you get an error. It seems that we need to also provide the close_notes: 'Closed by Caller'. In the ServiceNow UI it is a required field when you try to close an incident.

If the incident is already closed the warning message is not logged.

Fixed both bugs and added tests in e3b43c7

cnasikas

Thanks for your patience with the review 🚀 . I tested and everything is working as expected.

kibana-ci · 2023-12-01T15:56:38Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: c2ce8fb

Failed CI Steps

FTR Configs #44

Test Failures

[job] [logs] FTR Configs #44 / security APIs - Session Concurrent Limit Session Concurrent Limit cleanup should properly clean up sessions that exceeded concurrent session limit even for multiple providers

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`triggersActionsUi`	557	558	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`stackConnectors`	542.2KB	543.6KB	+1.5KB
`triggersActionsUi`	1.4MB	1.4MB	+44.0B
total			+1.5KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`alerting`	23.3KB	23.3KB	-14.0B
`stackConnectors`	39.9KB	40.5KB	+595.0B
total			+581.0B

Unknown metric groups

API count

id	before	after	diff
`triggersActionsUi`	583	584	+1

ESLint disabled line counts

id	before	after	diff
`stackConnectors`	103	102	-1

Total ESLint disabled count

id	before	after	diff
`stackConnectors`	108	107	-1

History

💚 Build #180790 succeeded 7fc2b4e
💛 Build #180575 was flaky c6b81fa
💔 Build #180435 failed e890e55
💛 Build #180128 was flaky 6cdc701
💚 Build #179479 succeeded d627b86
💚 Build #179129 succeeded a46435b

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @js-jankisalvi

js-jankisalvi added 5 commits November 16, 2023 18:08

create subaction, api, close incident service

b9575ad

update api, service arguments

66e64a4

add close data attributes internally

e03299f

Merge remote-tracking branch 'upstream/main' into servicenow-recover-…

ae5c27c

…action

add unit tests for closeIncident service and API

b56614c

js-jankisalvi added the Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) label Nov 22, 2023

js-jankisalvi self-assigned this Nov 22, 2023

kibanamachine and others added 3 commits November 22, 2023 16:38

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

c61847c

…-fix'

update UI

ca1edd7

fix api integration test, add integration test for closeIncident

bfea86f

js-jankisalvi commented Nov 27, 2023

View reviewed changes

js-jankisalvi added 2 commits November 27, 2023 12:38

cleanup

9dea10e

Merge branch 'main' into servicenow-recover-action

64630fb

js-jankisalvi added release_note:enhancement Feature:Actions v8.12.0 labels Nov 27, 2023

js-jankisalvi marked this pull request as ready for review November 27, 2023 12:04

js-jankisalvi requested a review from a team as a code owner November 27, 2023 12:04

Merge branch 'main' into servicenow-recover-action

a46435b

cnasikas reviewed Nov 27, 2023

View reviewed changes

js-jankisalvi added 6 commits November 28, 2023 12:39

PR feedback 1

d627b86

Merge remote-tracking branch 'upstream/main' into servicenow-recover-…

ce990a0

…action

PR feedabck, throw warning instead of error when incident not found

48cc417

Merge branch 'main' into servicenow-recover-action

761e4c2

updated integration test

b7b7585

cleanup

6cdc701

cnasikas reviewed Nov 30, 2023

View reviewed changes

js-jankisalvi added 2 commits November 30, 2023 12:14

PR feedback 3

e890e55

log warning if no incident found with getIncident

2cdac29

js-jankisalvi added 5 commits November 30, 2023 16:39

Merge branch 'main' into servicenow-recover-action

c8ff4fe

return null after warning

d163bc1

Merge branch 'servicenow-recover-action' of https://github.com/js-jan…

c6b81fa

…kisalvi/kibana into servicenow-recover-action

update 404 error response check

7088a16

Merge branch 'main' into servicenow-recover-action

7fc2b4e

cnasikas reviewed Dec 1, 2023

View reviewed changes

x-pack/plugins/stack_connectors/server/connector_types/lib/servicenow/utils.ts Show resolved Hide resolved

x-pack/plugins/stack_connectors/server/connector_types/lib/servicenow/service.test.ts Show resolved Hide resolved

add close_notes param to API, fix bug with state

e3b43c7

js-jankisalvi added 3 commits December 1, 2023 15:01

fix AxiosError mock

6c2d3da

update default close notes

c500f7f

remove close_notes from schema and api params

c2ce8fb

cnasikas approved these changes Dec 1, 2023

View reviewed changes

cnasikas mentioned this pull request Dec 1, 2023

Ability to resolve ServiceNow, IBM Resilient and Jira incidents #83221

Open

js-jankisalvi enabled auto-merge (squash) December 1, 2023 15:28

js-jankisalvi merged commit d31a158 into elastic:main Dec 1, 2023
32 checks passed

kibanamachine added the backport:skip This commit does not require backporting label Dec 1, 2023

ashokaditya mentioned this pull request Dec 4, 2023

Failing test: X-Pack Endpoint Functional Tests on Serverless.x-pack/test/security_solution_endpoint/apps/endpoint/responder·ts - endpoint Response Actions Responder from timeline should show Responder from alert in a timeline #172374

Closed

js-jankisalvi deleted the servicenow-recover-action branch January 24, 2024 11:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Actions][ServiceNow] Allow to close serviceNow incident when alert resolves #171760

[Actions][ServiceNow] Allow to close serviceNow incident when alert resolves #171760

js-jankisalvi commented Nov 22, 2023 •

edited by cnasikas

js-jankisalvi Nov 27, 2023 •

edited

cnasikas Nov 27, 2023

elasticmachine commented Nov 27, 2023

cnasikas left a comment

cnasikas Nov 27, 2023

cnasikas Nov 27, 2023

js-jankisalvi Nov 29, 2023

cnasikas left a comment

cnasikas left a comment

cnasikas commented Dec 1, 2023

js-jankisalvi commented Dec 1, 2023

cnasikas left a comment

kibana-ci commented Dec 1, 2023

API count

ESLint disabled line counts

Total ESLint disabled count

[Actions][ServiceNow] Allow to close serviceNow incident when alert resolves #171760

[Actions][ServiceNow] Allow to close serviceNow incident when alert resolves #171760

Conversation

js-jankisalvi commented Nov 22, 2023 • edited by cnasikas

Summary

Checklist

For maintainers

Release notes

js-jankisalvi Nov 27, 2023 • edited

Choose a reason for hiding this comment

cnasikas Nov 27, 2023

Choose a reason for hiding this comment

elasticmachine commented Nov 27, 2023

cnasikas left a comment

Choose a reason for hiding this comment

cnasikas Nov 27, 2023

Choose a reason for hiding this comment

cnasikas Nov 27, 2023

Choose a reason for hiding this comment

js-jankisalvi Nov 29, 2023

Choose a reason for hiding this comment

cnasikas left a comment

Choose a reason for hiding this comment

cnasikas left a comment

Choose a reason for hiding this comment

cnasikas commented Dec 1, 2023

js-jankisalvi commented Dec 1, 2023

cnasikas left a comment

Choose a reason for hiding this comment

kibana-ci commented Dec 1, 2023

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Public APIs missing comments

Async chunks

Page load bundle

API count

ESLint disabled line counts

Total ESLint disabled count

History

js-jankisalvi commented Nov 22, 2023 •

edited by cnasikas

js-jankisalvi Nov 27, 2023 •

edited