Alerting update route throttle property is missing (#59580)

* Added throttle property to update method of alertClient

* Fixed failing snapshot

* Fixed type check errors

* Fixed null update for siem throttle

x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/patch_rules.ts

@@ -43,6 +43,7 @@ export const patchRules = async ({
   type,
   references,
   version,
+  throttle,
 }: PatchRuleParams): Promise<PartialAlert | null> => {
   const rule = await readRules({ alertsClient, ruleId, id });
   if (rule == null) {
@@ -73,6 +74,7 @@ export const patchRules = async ({
     type,
     references,
     version,
+    throttle,
   });
 
   const nextParams = defaults(
@@ -108,6 +110,7 @@ export const patchRules = async ({
     id: rule.id,
     data: {
       tags: addTags(tags ?? rule.tags, rule.params.ruleId, immutable ?? rule.params.immutable),
+      throttle: throttle ?? rule.throttle ?? null,
       name: calculateName({ updatedName: name, originalName: rule.name }),
       schedule: {
         interval: calculateInterval(interval, rule.schedule.interval),

x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_prepacked_rules.ts

@@ -41,6 +41,7 @@ export const updatePrepackagedRules = async (
       threat,
       references,
       version,
+      throttle,
     } = rule;
 
     // Note: we do not pass down enabled as we do not want to suddenly disable
@@ -73,6 +74,7 @@ export const updatePrepackagedRules = async (
       threat,
       references,
       version,
+      throttle,
     });
   });
 };

x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.ts

@@ -42,6 +42,7 @@ export const updateRules = async ({
   type,
   references,
   version,
+  throttle,
 }: UpdateRuleParams): Promise<PartialAlert | null> => {
   const rule = await readRules({ alertsClient, ruleId, id });
   if (rule == null) {
@@ -72,6 +73,7 @@ export const updateRules = async ({
     type,
     references,
     version,
+    throttle,
   });
 
   const update = await alertsClient.update({
@@ -81,6 +83,7 @@ export const updateRules = async ({
       name,
       schedule: { interval },
       actions: rule.actions,
+      throttle: throttle ?? rule.throttle ?? null,
       params: {
         description,
         ruleId: rule.params.ruleId,

x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts

@@ -49,6 +49,7 @@ export interface RuleAlertParams {
   threat: ThreatParams[] | undefined | null;
   type: 'query' | 'saved_query';
   version: number;
+  throttle?: string;
 }
 
 export type RuleTypeParams = Omit<RuleAlertParams, 'name' | 'enabled' | 'interval' | 'tags'>;

x-pack/plugins/alerting/server/alerts_client.test.ts

@@ -1984,6 +1984,7 @@ describe('update()', () => {
         params: {
           bar: true,
         },
+        throttle: null,
         actions: [
           {
             group: 'default',
@@ -2101,6 +2102,7 @@ describe('update()', () => {
         "tags": Array [
           "foo",
         ],
+        "throttle": null,
         "updatedBy": "elastic",
       }
     `);
@@ -2186,6 +2188,7 @@ describe('update()', () => {
         params: {
           bar: true,
         },
+        throttle: '5m',
         actions: [
           {
             group: 'default',
@@ -2254,6 +2257,7 @@ describe('update()', () => {
         "tags": Array [
           "foo",
         ],
+        "throttle": "5m",
         "updatedBy": "elastic",
       }
     `);
@@ -2332,6 +2336,7 @@ describe('update()', () => {
         params: {
           bar: true,
         },
+        throttle: '5m',
         actions: [
           {
             group: 'default',
@@ -2401,6 +2406,7 @@ describe('update()', () => {
         "tags": Array [
           "foo",
         ],
+        "throttle": "5m",
         "updatedBy": "elastic",
       }
     `);
@@ -2441,6 +2447,7 @@ describe('update()', () => {
           params: {
             bar: true,
           },
+          throttle: null,
           actions: [
             {
               group: 'default',
@@ -2509,6 +2516,7 @@ describe('update()', () => {
         params: {
           bar: true,
         },
+        throttle: null,
         actions: [
           {
             group: 'default',
@@ -2613,6 +2621,7 @@ describe('update()', () => {
         params: {
           bar: true,
         },
+        throttle: '5m',
         actions: [
           {
             group: 'default',
@@ -2742,6 +2751,7 @@ describe('update()', () => {
           params: {
             bar: true,
           },
+          throttle: null,
           actions: [
             {
               group: 'default',
@@ -2772,6 +2782,7 @@ describe('update()', () => {
           params: {
             bar: true,
           },
+          throttle: null,
           actions: [
             {
               group: 'default',
@@ -2808,6 +2819,7 @@ describe('update()', () => {
           params: {
             bar: true,
           },
+          throttle: null,
           actions: [
             {
               group: 'default',
@@ -2843,6 +2855,7 @@ describe('update()', () => {
           params: {
             bar: true,
           },
+          throttle: null,
           actions: [
             {
               group: 'default',

x-pack/plugins/alerting/server/alerts_client.ts

@@ -107,6 +107,7 @@ interface UpdateOptions {
     schedule: IntervalSchedule;
     actions: NormalizedAlertAction[];
     params: Record<string, any>;
+    throttle: string | null;
   };
 }
 

x-pack/plugins/alerting/server/routes/update.test.ts

@@ -116,6 +116,7 @@ describe('updateAlertRoute', () => {
             "tags": Array [
               "bar",
             ],
+            "throttle": null,
           },
           "id": "1",
         },

x-pack/plugins/alerting/server/routes/update.ts

@@ -62,11 +62,11 @@ export const updateAlertRoute = (router: IRouter, licenseState: LicenseState) =>
       }
       const alertsClient = context.alerting.getAlertsClient();
       const { id } = req.params;
-      const { name, actions, params, schedule, tags } = req.body;
+      const { name, actions, params, schedule, tags, throttle } = req.body;
       return res.ok({
         body: await alertsClient.update({
           id,
-          data: { name, actions, params, schedule, tags },
+          data: { name, actions, params, schedule, tags, throttle },
         }),
       });
     })