Commit graph

273 commits

Author SHA1 Message Date
Mike Côté
a0b787c39a
Fix flaky test for legacy authorization (#87642)
* Unskip test

* Increase attempts to 2 for retryIfConflicts

* Cleanup authorization for updateApiKey
2021-01-15 08:13:15 -05:00
Gidi Meir Morris
b99ca969e0
[Alerting] revert the revert of Enforces typing of Alert's ActionGroups (#87382)
The https://github.com/elastic/kibana/pull/86761 PR was reverted due to a small typing issue.

This PR reverts that revert and adds a commit to address the issue: 9e4ab2002c.
2021-01-06 10:38:33 +00:00
Jonathan Budzenski
051be28c69 Revert "[Alerting] Enforces typing of Alert's ActionGroups (#86761)"
This reverts commit 76b8c491ee.
2021-01-05 13:24:59 -06:00
Gidi Meir Morris
76b8c491ee
[Alerting] Enforces typing of Alert's ActionGroups (#86761)
This PR tightens the typing on the Alerting framework's `AlertType` and its deeper typing around `AlertServices ` and `AlertExecutorOptions`.

This ensures the following:

1. It's now impossible<sup>✴</sup> to schedule actions on any ActionGroup other than the groups specified on the AlertType (including the Recovery group)
2. It's now impossible<sup>✴</sup> to schedule actions with incorrect `InstanceState` or `InstanceContext`

✴ Unless they bypass the Typescript typing, which is an explicit choice to bypass type safety
2021-01-05 18:44:57 +00:00
Jonathan Budzenski
308827a67c skip "should schedule actions on legacy alerts" #87010 2021-01-01 11:22:10 -06:00
Gidi Meir Morris
2db76660ce
[Alerting] Encourage type safe usage of Alerting (#86623)
This PR encourages type safe usage of the Alerting framework by replacing the current default Params/State/InstanceState/InstanceContext types (which are `AlertTypeParams`/`AlertTypeState`/etc.) with `never`.
This means that code can continue to omit the specific types for these fields, as long as they aren't referenced.
Once an alert developer wishes to actually reference the parameters (or state/context), then they have to specify the type.

This PR also changed the typing of the `AlertTypeParams` and `AlertTypeState` from `Record<string, any>` to `Record<string, unknown>`, to ensure that where these catch-all types are used they will at least enforce `unknown` rather than `any`.
This change broke some usage in both @elastic/kibana-alerting-services  plugins, but also other plugins in the Stack/Solutions. I tried to fix these where I could, but some of these require new types and refactoring in other teams' code, which I decided is best done by the team who own and maintain that code - I've added explicit `TODO` comments in all of these places, describing the required fix.

This PR also introduced a Generics based typing for the `Alert` type so that the `params` field can be typed as something other than `AlertTypeParams`.
2020-12-21 19:17:04 +00:00
Patrick Mueller
f693697c18
[actions] expand object context variables as JSON (#85903)
resolves https://github.com/elastic/kibana/issues/75601

Previously, if a context variable that is an object is referenced in a
mustache template used as an action parameter, the resulting variable
expansion will be `[Object object]`.  In this PR, we change this so that
the expansion is a JSON representation of the object.

This is primarily for diagnostic purposes, so that customers can see
all the context variables available, and their values, while testing
testing their alerting actions.
2020-12-15 16:31:36 -05:00
Mike Côté
ccfb4b6b1d
Add footer to all emails sent by Kibana email connector with a link to open Kibana or to the alert details page (#84371)
* Initial work

* Change messaging from copy

* Fix jest tests for email connector

* Fix jest tests for alerts plugin

* Update copy

* Use server.publicBaseUrl

* Fix jest tests

* Update tests

* Cleanup jest test

* Code cleanup

* Improve email parameter names for kibana footer url

* Cleanup

* Add test for kibana footer link

* Fix type check

* Fix jest test

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2020-12-15 13:51:44 -05:00
Steph Milovic
335cd1f6fc
[Security Solution] [Cases] Move field mappings from actions to cases (#84587) 2020-12-15 07:06:11 -07:00
Yuliia Naumenko
37525f80a0
License checks for alerts plugin (#85649)
* [Alerts][License] Define minimum license required for each alert type (#84997)

* Define minimum license required for each alert type

* fixed typechecks

* fixed tests

* fixed tests

* fixed due to comments

* fixed due to comments

* removed file

* removed casting to LicenseType

* [Alerts][License] Add license checks to alerts HTTP APIs and execution (#85223)

* [Alerts][License] Add license checks to alerts HTTP APIs and execution

* fixed typechecks

* resolved conflicts

* resolved conflicts

* added router tests

* fixed typechecks

* added license check support for alert task running

* fixed typechecks

* added integration tests

* fixed due to comments

* fixed due to comments

* fixed tests

* fixed typechecks

* [Alerting UI][License] Disable alert types in UI when the license doesn't support it. (#85496)

* [Alerting UI][License] Disable alert types in UI when the license doesn't support it.

* fixed typechecks

* added licensing for alert list and details page

* fixed multy select menu

* fixed due to comments

* fixed due to comments

* fixed due to comments

* fixed typechecks

* fixed license error message

* fixed license error message

* fixed typechecks

* fixed license error message

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2020-12-14 19:29:39 -08:00
Patrick Mueller
7873e3685b
Allow action types to perform their own mustache variable escaping in parameter templates (#83919)
resolves https://github.com/elastic/kibana/issues/79371
resolves https://github.com/elastic/kibana/issues/62928

In this PR, we allow action types to determine how to escape the
variables used in their parameters, when rendered as mustache
templates.  Prior to this, action parameters were recursively
rendered as mustache templates using the default mustache
templating, by the alerts library.  The default mustache
templating used html escaping.

Action types opt-in to the new capability via a new optional
method in the action type, `renderParameterTemplates()`.  If not
provided, the previous recursive rendering is done, but now with
no escaping at all.

For #62928, changed the mustache template rendering to be
replaced with the error message, if an error occurred,
so at least you can now see that an error occurred.  Useful
to diagnose problems with invalid mustache templates.
2020-12-14 20:41:13 -05:00
ymao1
ab082647ac
[Actions] Notify only on action group change (#82969)
* plugged Task Manager lifecycle into status reactively

* fixed tests

* Revert "fixed tests"

This reverts commit e9f2cd05bd.

* made action group fields optional

* revert deletion

* again

* extracted action type for mto its own component

* extracted more sections of the action form to their own components

* updated icon

* added docs

* fixed always firing alert

* fixed export of components

* fixed react warning

* Adding flag for notifying on state change

* Updating logic in task runner

* Starting to update tests

* Adding tests

* Fixing types check

* Tests and types

* Tests

* Tests

* Tests

* Tests

* Tests

* Renaming field to a more descriptive name. Adding migrations

* Renaming field to a more descriptive name. Adding migrations

* Fixing tests

* Type check and tests

* Moving schedule and notify interval to bottom of flyout. Implementing dropdown from mockup in new component

* Changing boolean flag to enum type and updating in triggers_actions_ui

* Changing boolean flag to enum type and updating in alerts plugin

* Fixing types check

* Fixing monitoring jest tests

* Changing last references to old variable names

* Moving form inputs back to the top

* Renaming to alert_notify_when

* Updating functional tests

* Adding new functional test for notifyWhen onActionGroupChange

* Updating wording

* Incorporating action subgroups into logic

* PR fixes

* Updating functional test

* Fixing types check

* Changing default throttle interval to hour

* Fixing types check

Co-authored-by: Gidi Meir Morris <github@gidi.io>
2020-12-10 15:51:52 -05:00
Gidi Meir Morris
015f3c994b
[Alerting] Introduces a ActionSubGroup which allows for more granular action group scheduling (#84751)
This PR introduces a new concept of an _Action Subgroup_ (naming is open for discussion) which can be used by an Alert Type when scheduling actions.
An Action Subgroup can be dynamically specified, unlike Action Groups which have to be specified on the AlertType definition.
When scheduling actions, and AlertType can specify an _Action Subgroup_ along side the scheduled _Action Group_, which denotes that the alert instance falls into some kind of narrower grouping in the action group.
2020-12-10 15:16:42 +00:00
Aleh Zasypkin
88e61a6651
Migrate API keys functionality to a new Elasticsearch client. (#85029) 2020-12-09 20:43:24 +01:00
ymao1
46e8c540aa
[Alerting] Fixes Failing test: X-Pack Alerting API Integration Tests.x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting - alerting api integration security and spaces enabled Alerts do stuff when AAD is broken (#84707)
* Adding delay between creating and updating alert to avoid 409 conflicts

* Unskipping update test

* Using retry.try instead of delay

* PR fixes

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2020-12-07 11:52:37 -05:00
Gidi Meir Morris
249a1a41aa
[Alerting] Enables AlertTypes to define the custom recovery action groups (#84408)
In this PR we introduce a new `recoveryActionGroup` field on AlertTypes which allows an implementor to specify a custom action group which the framework will use when an alert instance goes from _active_ to _inactive_.
By default all alert types will use the existing `RecoveryActionGroup`, but when `recoveryActionGroup` is specified, this group is used instead.

This is applied across the UI, event log and underlying object model, rather than just being a label change.
To support this we also introduced the `alertActionGroupName` message variable which is the human readable version of existing `alertActionGroup` variable.
2020-12-04 13:54:48 +00:00
Gidi Meir Morris
eb0569b1ff
[Alerting][Event Log] ensures we wait for the right number of events in test (#84189)
Keeps the exact same assertions, but ensures the retry loop waits for them to complete so we don't assert too soon.
2020-12-03 15:13:59 +00:00
Mikhail Shustov
78123a109d
Rename server.xsrf.whitelist to server.xsrf.allowlist (#84791)
* rename xsrd.whitelist to xsrf.allowlist

* update docs

* update telemetry schema

* update kbn-config tests
2020-12-03 07:19:36 +01:00
Gidi Meir Morris
6da6db28ac
Revert the Revert of "[Alerting] renames Resolved action group to Recovered (#84123)" (#84662)
Reapplies the #84123 PR:
This PR changes the default term from “Resolved” to “Recovered”, as it fits most use cases and we feel users are most likely to understand its meaning across domains.
2020-12-01 17:30:05 +00:00
Tyler Smalley
0b5c55c597 Revert "[Alerting] renames Resolved action group to Recovered (#84123)"
This reverts commit 7dcaff5ddd.
2020-12-01 07:10:09 -08:00
Gidi Meir Morris
7dcaff5ddd
[Alerting] renames Resolved action group to Recovered (#84123)
This PR changes the default term from “Resolved” to “Recovered”, as it fits most use cases and we feel users are most likely to understand its meaning across domains.
2020-12-01 10:38:28 +00:00
ymao1
69845cc161
Fixes Failing test: X-Pack Alerting API Integration Tests.x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/rbac_legacy·ts - alerting api integration security and spaces enabled Alerts alerts "before all" hook in "alerts" (#84255)
* Unskipping update test

* Changing order of tests

* Cleanup

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2020-11-30 13:41:41 -05:00
ymao1
82abb05722
[Alerting UI] Updating defaultActionMessage for Index Threshold Alert (#83934)
* Renaming function to conditions

* Making comparators human readable. Tests

* i18n fix

* Fixing tests

* Fixing tests

* i18n fix

* PR comments
2020-11-23 16:02:06 -05:00
Tiago Costa
0a0672f15a
skip flaky suite (#81668) 2020-11-23 15:08:52 +00:00
ymao1
e45b76c1b2
[Alerting] Add alert.updatedAt field to represent date of last user edit (#83784)
* Adding alert.updatedAt field that only updates on user edit

* Updating unit tests

* Functional tests

* Updating alert attributes excluded from AAD

* Fixing test

* PR comments

* Unskipping tests and updating es archiver data
2020-11-19 14:52:16 -05:00
Patrick Mueller
f83e06f718
[alerts] adds action group and date to mustache template variables for actions (#83195)
resolves: https://github.com/elastic/kibana/issues/67389

Adds new variables to the existing set of variables that can be used in mustache templates to be used in action parameters when creating alerts.

- `alertActionGroup` - the action group associated with the alert scheduling actions
- `date` - the current date, in ISO format
2020-11-19 12:01:44 -05:00
Ying Mao
6a2c415a98 Revert "[Alerting] Add alert.updatedAt field to represent date of last user edit (#83578)"
This reverts commit acc3e2f443.
2020-11-19 06:08:56 -05:00
ymao1
acc3e2f443
[Alerting] Add alert.updatedAt field to represent date of last user edit (#83578)
* Adding alert.updatedAt field that only updates on user edit

* Updating unit tests

* Functional tests

* Updating alert attributes excluded from AAD

* Fixing test

* PR comments
2020-11-18 16:02:31 -05:00
Yuliia Naumenko
8b658fbcd2
Used SO for saving the API key IDs that should be deleted (#82211)
* Used SO for saving the API key IDs that should be deleted and create a configuration option where can set an execution interval for a TM task which will get the data from this SO and remove marked for delete keys.

* removed invalidateApiKey from AlertsClient

* Fixed type checks

* Fixed jest tests

* Removed test code

* Changed SO name

* fixed type cheks

* Moved invalidate logic out of alerts client

* fixed type check

* Added functional tests

* Fixed due to comments

* added configurable delay for invalidation task

* added interval to the task response

* Fixed jest tests

* Fixed due to comments

* Fixed task

* fixed paging

* Fixed date filter

* Fixed jest tests

* fixed due to comments

* fixed due to comments

* Fixed e2e test

* Fixed e2e test

* Fixed due to comments. Changed api key invalidation task to use SavedObjectClient

* Use encryptedSavedObjectClient

* set back flaky test comment
2020-11-17 06:44:54 -08:00
Yuliia Naumenko
4ad3cefec9
Added ability to fire actions when an alert instance is resolved (#82799)
* Added ability to fire actions when an alert instance is resolved

* Fixed due to comments

* Fixed merge issue

* Fixed tests and added skip for muted resolve

* added test for muted alert

* Fixed due to comments

* Fixed registry error message

* Fixed jest test
2020-11-13 17:35:04 -08:00
Thomas Watson
4c49d5d1be
Upgrade Node.js to version 12 (#61587) 2020-11-12 22:00:57 +01:00
Gidi Meir Morris
ab72206da3
[Alerting] Moves the Index & Geo Threshold UIs into the Stack Alerts Public Plugin (#82951)
This PR includes the following refactors:
1. Moves the Index Pattern Api from _Stack Alerts_ to the _Server_ plugin of _Trigger Actions UI_. This fixes a potential bug where a user could disable the _Stack Alerts_ plugin and inadvertently break the UI of the _ES Index _ action type.
2. Extracts the UI components for _Index Threshold_ and _Geo Threshold_ from the _Trigger Actions UI_ plugin and moves them into _Stack Alerts_.
2020-11-12 16:39:40 +00:00
Patrick Mueller
c3e57943ad
[alerts] add executionStatus to event log doc for action execute (#82401)
resolves https://github.com/elastic/kibana/issues/79785

Until now, the execution status was available in the the event
log document for the execute action.  In this PR we add it.

The event log is extended to add the following fields:

- `kibana.alerting.status` - from executionStatus.status
- `event.reason`           - from executionStatus.error.reason

The date from the executionStatus and start date in the event
log will be set to the same value.

Previously, errors encountered while trying to execute an
alert executor, eg decrypting the alert, would not end up
with an event doc generated.  Now they will.

In addition, there were a few places where events that could
have had the action group in them did not, and one where the
instance id was undefined - those were fixed up.
2020-11-12 09:32:22 -05:00
Tiago Costa
6003cadce4
skip flaky suite (#82804) 2020-11-10 12:43:39 +00:00
Steph Milovic
e1b7073a64
[Alerting][Connectors] Add new executor subaction to get 3rd party case fields (#82519) 2020-11-09 10:08:00 -07:00
Dhruv Bodani
c78cf35ba8
Added defaultActionMessage to index threshold alert UI type definition (#80936)
* resolves https://github.com/elastic/kibana/issues/78148

Adds a `defaultActionMessage` to the index threshold alert, so that the `message` parameter for actions will be pre-filled with a useful message
2020-11-09 08:35:05 -05:00
Yuliia Naumenko
802c6dccb4
Implemented Alerting health status pusher by using task manager and status pooler for Kibana status plugins 'kibanahost/api/status' (#79056)
* Implemented Alerting health status pusher by using task manager and status pooler for Kibana status plugins 'kibanahost/api/status'

* Exposed health task registration to alerts plugin

* Fixed type error

* Extended health API endpoint with info about decryption failures, added correct health task implementation

* adjusted query

* Tested locally and got it working as expected, fixed tests and type check

* Added unit tests

* Changed AlertExecutionStatusErrorReasons to be enum

* Uppercase the enum

* Replaced string values to enum

* Fixed types

* Extended AlertsClient with getHealth method

* added return type to healthStatus$

* Added configurable health check interval and timestamps

* Extended update core status interval to 5mins

* Fixed failing tests

* Registered alerts config

* Fixed date for ok health state

* fixed jest test

* fixed task state

* Fixed due to comments, moved getHealth to a plugin level

* fixed type checks

* Added sorting to the latest Ok state last update

* adjusted error queries

* Fixed jest tests

* removed unused

* fixed type check
2020-11-06 16:20:39 -08:00
ymao1
dae28519e6
[Alerting] Display Action Group in Alert Details (#82645)
* Adding action group id to event log. Showing action group as part of status in alert details view

* Simplifying getting action group id

* Cleanup

* Adding unit tests

* Updating functional tests

* Updating test

* Fix types check

* Updating test

* PR fixes

* PR fixes
2020-11-06 07:28:08 -05:00
ymao1
ae007c2e8a
[Alerting] Return alert execution status rollup from _find API (#81819)
* wip

* wip

* Adding aggregation option to find function and using those results in UI

* Requesting aggregations from client instead of hard-coding in route

* alert_api test

* i18n fix

* Adding functional test

* Adding unit test for filters

* Splitting into two API endpoints

* Fixing test

* Fixing test

* Adding comment

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2020-11-03 07:26:44 -05:00
Tiago Costa
0eeaafa722
chore(NA): move into single pkg json (#80015)
* chore(NA): update gitignore to include first changes from moving into a single package.json

* chore(NA): update gitignore

* chore(NA): move all the dependencies into the single package.json and apply changes to bootstrap

* chore(NA): fix types problems after the single package json

* chore(NA): include code to find the dependencies used across the code

* chore(NA): introduce pure lockfile for install dependencies on build

* chore(NA): update clean task to not delete anything from xpack node_modules

* chore(NA): update gitignore to remove development temporary rules

* chore(NA): update notice file

* chore(NA): update jest snapshots

* chore(NA): fix whitelisted licenses to include a new specify form of an already included one

* chore(NA): remove check lockfile symlinks from child projects

* chore(NA): fix eslint and add missing declared deps on single pkg json

* chore(NA): correctly update notice

* chore(NA): fix failing jest test for storyshots.test.tsx

* chore(NA): fix cypress multi reporter path

* chore(NA): fix Project tests check

* chore(NA): fix problem with logic to detect used dependes on oss build

* chore(NA): include correct x-pack plugins dep discovery

* chore(NA): discover entries under dynamic requires on vis_type_timelion

* chore(NA): remove canvas

* test(NA): fix jest unit tests

* chore(NA): remove double react declaration from storyshot test file

* chore(NA): try removing isOSS check

* chore(NA): support for plugin development

* chore(NA): update logic to fix unit tests and typechecking

* chore(NA): support to run npm scripts in child kbn projects across all envs

* chore(NA): support github checks reporter on x-pack and remove cpy types as the package correctly provides them

* chore(NA): update cpy version

* chore(NA): include last kbn pm changes

* chore(NA): update style on build_production_projects.ts

* chore(NA): remove any cast fom telemetry opt in stats

* chore(NA): remove del and re-use rm -rf again

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2020-11-02 21:18:52 +00:00
Gidi Meir Morris
51acfb9795
[Task Manager] Changed alerts schedule logic to use Task Manager internals (#80149)
* spiked intervals in alerts

* ensure scheduled tasks dont get wiped

* Fixed type checks and unit tests

* Added simple test, which only covers successful case when edit happened right after task was complete previous execution

* fixed jest

* fallback to existing task schedule when possible

* added missing test

* Added support for day and hour schedule interval values

* added docs for new schedule run result

* fixed doc

* added UnrecoverableError support for task runners nad pluged it into alerting where needed

* typo

Co-authored-by: Yuliia Naumenko <yuliia.naumenko@elastic.com>
2020-11-02 09:49:55 -08:00
ymao1
8b1ff4ca59
[Actions] Adding hasAuth to Webhook Configuration to avoid confusing UX (#81778)
* Adding hasAuth to server and client

* Adding migration and fixing tests

* Fixing test

* Adding spacing

* Adding functional test

* Fixing migration

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2020-10-27 13:34:23 -04:00
Ying Mao
9d602e364e Revert "[Actions] Adding hasAuth to Webhook Configuration to avoid confusing UX (#81390)"
This reverts commit fd7f6b5716.
2020-10-27 09:38:36 -04:00
ymao1
fd7f6b5716
[Actions] Adding hasAuth to Webhook Configuration to avoid confusing UX (#81390)
* Adding hasAuth to server and client

* Adding migration and fixing tests

* Fixing test

* Adding spacing

* Adding functional test

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2020-10-27 07:45:02 -04:00
Yuliia Naumenko
ee7f16e312
Fixed migration issue for case specific actions, by extending email action migrator checks (#81673)
* Fixed migration issue for case specific actions, by extending email action migrator checks

* Fixed e2e test

* fixed due to comments
2020-10-26 17:03:41 -07:00
Justin Kambic
cc43b14d17
[Alerting] Add scoped cluster client to alerts and actions services (#80794)
* Add scoped cluster client to alerts and actions services.

* Modify functional test to use new ES client.
2020-10-20 09:54:48 -04:00
Mike Côté
3ad698d6a0
Licensed feature usage for connectors (#77679)
* Initial work

* Fix type check and jest failures

* Add unit tests

* No need to notifyUsage from alert execution handler

* Fix ESLint

* Log action usage from alerts

* Add integration tests

* Fix jest test

* Skip feature usage of basic action types

* Fix types

* Fix ESLint issue

* Clarify comment

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-10-15 14:47:46 -04:00
ymao1
1e35c3a857
Remove manage_api_key privilege usage in API Integration tests (#80039)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2020-10-13 14:06:05 -04:00
Patrick Mueller
3bbd679afe
[Alerts] fix failing executionStatus function test with null deref (#79809)
resolves https://github.com/elastic/kibana/issues/79248

Added some additional checks for potential null/undefined objects before
dereferencing them.
2020-10-08 08:26:16 -04:00
Tyler Smalley
c2409365de skip flaky suite (#79248) 2020-10-06 12:45:08 -07:00
Christos Nasikas
287541891e
[Security Solutions][Case] Settings per case per connector (#77327)
Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>
Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2020-10-06 20:03:46 +03:00
Gidi Meir Morris
25c5daa83a
Renames "Built-In Alerts" feature to "Stack Alerts" and "Actions" feature to "Actions and Connectors" (#79513)
Renames "Built-In Alerts" feature to "Stack Alerts" and "Actions" feature to "Actions and Connectors" as we've decided these names make more appropriate and better communicate what these features are.
2020-10-06 17:51:05 +01:00
Patrick Mueller
a812db3e26
[Alerts] resolve flaky lastExecutionDate tests (#79436)
resolves https://github.com/elastic/kibana/issues/79249

The tests that were flaky were capturing a date while the test was running,
and then comparing to a lastExecutionDate field.  Most of the time this
worked, but were sometimes out of order because of the way the searches
are done and status changing dynamically.  The only current dates we can test
against are really at the very beginning and very end of the tests.
2020-10-05 14:05:34 -04:00
Gidi Meir Morris
4fdf2f1566
[Actions] makes savedObjectId field optional (#79186)
This PR makes the `savedObjectId` parameter optional in the Jira, ServiceNow and IBM Resilient Connectors.
This allows them to execute without this field outside of Alerts, as it is currently populated using the `alertId` which isn't available in other places.
Additionally this adds an optional field in the `Params` Components for all three of the connectors, which allows users to provide a value for the `savedObjectId` field if the so wish.
2020-10-05 18:21:20 +01:00
Tiago Costa
0628cfecf4
skip flaky suite (#79249) 2020-10-02 14:30:32 +01:00
Patrick Mueller
117b5771dc
[Alerting] formalize alert status and add status fields to alert saved object (#75553)
resolves https://github.com/elastic/kibana/issues/51099

This formalizes the concept of "alert status", in terms of it's execution, with
some new fields in the alert saved object and types used with the alert client
and http APIs.

These fields are read-only from the client point-of-view; they are provided in
the alert structures, but are only updated by the alerting framework itself.
The values will be updated after each run of the alert type executor.

The data is added to the alert as the `executionStatus` field, with the
following shape:

```ts
interface AlertExecutionStatus {
  status: 'ok' | 'active' | 'error' | 'pending' | 'unknown';
  lastExecutionDate: Date;
  error?: {
    reason: 'read' | 'decrypt' | 'execute' | 'unknown';
    message: string;
  };
}
```
2020-10-01 18:06:26 -04:00
Yuliia Naumenko
63ff0606df
Extended Email action configuration with hasAuth property to identify if the connector require user credentials. Improved UX for Email connector (#78235)
* Extended Email action configuration with hasAuth property to identify if the connector require user credentials. Improved UX for Email connector

* Fixed failing tests and comments

* Fixed type check and reverted logic of Add user and password switch button

* Fixed due to the latest design requirenments

* Fixed due to review comments
2020-10-01 13:57:28 -07:00
Christos Nasikas
3d9ea52803
[Actions][Jira] Set parent issue for Sub-task issue type (#78772) 2020-10-01 09:34:25 +03:00
Christos Nasikas
4f6df624e9
[Actions] Migrate cases configuration object (#77998)
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Gidi Meir Morris <github@gidi.io>
2020-09-29 21:10:57 +03:00
Gidi Meir Morris
8547b32bab
[Actions] avoids setting a default dedupKey on PagerDuty (#77773)
The PagerDuty Action currently defaults to a dedupKey that's shared between all action executions of the same connector.
To ensure we don't group unrelated executions together this PR avoids setting a default, which means each execution will result in its own incident in PD.

As part of this change we've also made the `dedupKey` a required field whenever a `resolve` or `acknowledge` event_action is chosen. This ensure we don't try to resolve without a dedupKey, which would result in an error in PD.

A migration has been introduced to migrate existing alerts which might not have a `dedupKey` configured.
2020-09-28 14:56:20 +01:00
Larry Gregory
9f3992f6c2
Grouped features for space management (#74151)
* Grouped features for space management

* Apply suggestions from code review

Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com>

* Address PR Feedback

* docs changes

* updating types/docs

* update APM feature name

* Reintroduce extraAction following EUI update

* change ordering of infra features, and render callout for management category

Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-09-18 12:30:59 -04:00
Gidi Meir Morris
3101ca3195
[Alerting] renames code in alerting RBAC exemption to make it easier to maintain (#77598)
Refactor of code to make it a little clearer what it's doing and improve maintenance.
2020-09-18 09:54:49 +01:00
Gidi Meir Morris
fd624b1077
[Alerting & Actions] Overwrite SOs when updating instead of partially updating (#73688)
This PR changes the Alerts & Actions clients to ensure they require full updates (rather than partial) to SOs and overwrites the entire document when making the update.
This is to prevent the situation where nested objects get _merged_ instead of replaced when a user makes an `update`.

We also enhanced the EncryptedSavedObjectsClient to allow specified `id`s when overwriting an existing object.
2020-09-18 09:53:35 +01:00
Gidi Meir Morris
efe76121c7
[Alerting] Exempt Alerts pre 7.10 from RBAC on their Action execution until updated (#75563)
Marks all Alerts with a `versionApiKeyLastmodified ` field that tracks what version the alert's Api Key was last updated in. We then use this field to exempt legacy alerts (created pre `7.10.0`) in order to use a _dialed down_ version of RBAC which should allow old alerts to continue to function after the upgrade, until they are updates (at which point they will no longer be **Legacy**).

More details here: https://github.com/elastic/kibana/issues/74858#issuecomment-688324039
2020-09-16 11:47:37 +01:00
Larry Gregory
2e34eb239f
Hide management sections based on cluster/index privileges (#67791)
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-09-14 09:30:47 -04:00
Christos Nasikas
22b4e40ea0
[Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one) (#74357)
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-09-11 10:24:46 +03:00
Christos Nasikas
db5652e020
[Alerting][Connectors] Refactor Jira: Generic Implementation (phase one) (#73778) 2020-09-09 16:17:11 +03:00
Mike Côté
075e75e2f7
Rename status API to instance summary (#76541)
* Rename status API to instance summary

* Remove unused translations

* Fix typos

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-09-08 11:53:21 -04:00
Yuliia Naumenko
ef533721ed
Revert back ESO migration for alerting, added try/catch logic to avoid failing Kibana on start (#76220)
* Revert back ESO migration for alerting, added try/catch logic to avoid failing Kibana on start

* Revert back ESO migration for alerting, added try/catch logic to avoid failing Kibana on start

* fixed due to comments

* removed unused logger

* fixed type checks

* did renaming from 7.9 to 7.10

* Added migration failure unit test
2020-09-03 17:13:17 -07:00
Yuliia Naumenko
630d2d5fad
Exposed separate from ProxySettings rejectUnauthorized configuration option. (#76061)
* Exposed separate from ProxySettings rejectUnauthorized configuration option.

* Fixed type checks

* fixed tests
2020-08-31 18:11:57 -07:00
Mike Côté
50193eaabb
Fix alerts unable to create / update when the name has trailing whitepace(s) (#76079)
* Trim alert name in API key name

* Add API integration tests
2020-08-27 16:00:03 -04:00
Mikhail Shustov
37ec1e1053
Update to TS v4 (#73924)
* bump ts to v4

* MOAR RAM

* fix type errors for OSS

* first pass on x-pack errors

* second pass on x-pack type errors

* 3rd pass on x-pack type-errors

* mute errors if complex cases

* don't delete if spread suffices

* mute other complex cases

* make User fields optional

* fix optional types

* fix tests

* fix typings for time_range

* fix type errors in x-pack/tests

* rebuild kbn-pm

* remove leftovers from master update

* fix alert tests

* [Telemetry Checker] TS4 Fixes

* bump to 4.0.1-rc

* fix new errors in master

* bump typescript-eslint to version supporting TS v4 syntax

* fix merge commit errors

* update to the stable TS version 4.0.2

* bump ts-eslint to version supporting ts v4

* fix typo

* fix type errors after merge

* update ts in another new package.json

* TEMP: remove me

* Revert "TEMP: remove me"

This reverts commit dc0fc3bae6.

* [Telemetry] Update snapshot for new TS4 SyntaxKind

* bump prettier to support TS v4 syntax

* fix prettier rules

* last style change

* fix new type errors

Co-authored-by: Alejandro Fernández Haro <alejandro.haro@elastic.co>
2020-08-27 10:28:02 +02:00
Yuliia Naumenko
59c4cd4a69
Reduced the number of targets for a proxy server, only actions executions should be affected (#75839)
* Reduced the number of targets for a proxy server, only actions executions should be affected

* fixed typecheck
2020-08-25 06:33:04 -07:00
Yuliia Naumenko
e31a0c27e6
Fixed alerting_api_integration/security_and_spaces tests failing if actions proxy set on for parallel process running using commands 'scripts/functional_tests_server' and 'scripts/functional_test_runner' (#75232)
* Fixed alerting_api_integration/security_and_spaces tests failing if actions proxy set on for parallel process running using commands 'scripts/functional_tests_server' and 'scripts/functional_test_runner'

* -

* Fixed get port from range for Slack and webhook simulators, removed some test warnings

* Added check for listening proxy server

* changed logger to debug removed not useful error

* -

* changed proxy to dynamic target in a single place

* test retry

* -

* -

* -

* -

* test with no cleanup

* -

* -

* -

* -

* Added environment variable ALERTING_PROXY_PORT

* fixed type checks

* fixed clean up proxy server port
2020-08-24 16:43:44 -07:00
Yuliia Naumenko
f28a9e6e2d
Rename Whitelist to AllowList in Actions and Alerting (#75099)
* Rename Whitelist to AllowList in Actions and Alerting

* revert not related change

* Fixed due to comments and tests failing

* Fixed failing tests

* Fixed due to comments
2020-08-24 16:25:05 -07:00
Tiago Costa
f2f83b0f68
skip flaky suite (#75722) 2020-08-24 17:01:43 +01:00
spalger
f1248072d3 skip flaky suite (#75522) 2020-08-19 23:00:53 -07:00
spalger
a68f4beb8a skip flaky suite (#75386) 2020-08-19 08:42:11 -07:00
Yuliia Naumenko
52bd6d98ea
Actions add proxy support (#74289)
* Added proxy support for action types

* Fixed tests

* added rejectUnauthorizedCertificates config setting

* removed slack not used code

* Fixed Slack proxy

* fixed typecheck errors

* Cleanup code

* Fixed slack

* Added unit tests

* added proxy server for test

* Fixed build

* Added functional tests

* fixed due to comments

* Fixed tests and some changes due to comments

* Fixed functional tests

* fixed circular deps

* Added proxy unit test to action type
2020-08-14 14:20:12 -07:00
Mike Côté
d56b792e9c
Make the alerts plugin support generics (#72716)
* Initial work

* Expand generic support to alert instances

* Convert index threshold to use generics

* Make fixture alert types use generics

* Make alert instance related types use unknown

* Fix typecheck failures

* Cleanup + add instance generic support to registry.get API

* Shallow clone

* Rename some TS variables

* Fix failing api integration tests

* Change code for easier review and keep more history

* Fix

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-08-14 12:52:42 -04:00
Patrick Mueller
67e28ac8b4
[EventLog] Populate alert instances view with event log data (#68437)
resolves https://github.com/elastic/kibana/issues/57446

Adds a new API (AlertClient and HTTP endpoint) `getAlertStatus()` which returns
alert data calculated from the event log.
2020-08-14 08:34:26 -04:00
Gidi Meir Morris
eb03295f85
[Task manager] Prevents edge case where already running tasks are reschedule every polling interval (#74606)
Fixes flaky tests in Task Manager and Alerting.

The fix in #73244 was correct, but it missed an edge case which causes the already running task to be rescheduled over and over.

This prevents that edge case which was effecting both TM in general and Alerting specifically.
2020-08-13 12:20:38 +01:00
Yuliia Naumenko
124bd126f8
Migrated last pieces of legacy fixture code (#74470)
* Migrated last pieces of legacy fixture code

* Implemented own server for webhook simulator

* Fixed type checks. Moved slack simulator to own server

* close server after tests run

* Fixed due to comments

* fixed failing tests
2020-08-12 14:08:02 -07:00
Gidi Meir Morris
67025579ba
[Event log] Use Alerts client & Actions client when fetching these types of SOs (#73257)
Introduces a pluggable API to Event Log which allows custom Providers for Saved Objects which is used to ensure a user is authorised to get the Saved Object referenced in the Event Log whenever the find api is called.
2020-08-11 15:00:02 +01:00
Gidi Meir Morris
5c770e5930
[Task Manager] Correctly handle running tasks when calling RunNow and reduce flakiness in related tests (#73244)
This PR addresses two issues which caused several tests to be flaky in TM.

When `runNow` was introduced to TM we added a pinned query which returned specific tasks by ID.
This query does not have the filter applied to it which causes task to return when they're already marked as `running` but we didn't address these correctly which caused flakyness in the tests.
This didn't cause a broken beahviour, but it did cause beahviour that was hard to reason about - we now address them correctly.

It seems that sometimes, especially if the ES queue is overworked, it can take some time for the update to the underlying task to be visible (we don't user `refresh:true` on purpose), so adding a wait for the index to refresh to make sure the task is updated in time for the next stage of the test.
2020-08-05 17:35:38 +01:00
Mikhail Shustov
88c0631344
Update @typescript-eslint to ensure compatibility with TypeScript v3.9 (#74091)
* bump @typescript-eslint deps

* update rules

* fix errors in pacakges

* fix src/

* fix x-pack

* fix test

* fix typings

* fix examples

* allow _ as prefix and suffix

* roll back prefix and suffix changes

* add eslint-plugin-eslint-comments

* report unused rules

* remove unused eslint comments from tests

* remove unused eslint comments 2nd pass

* remove unused eslint comments from src/

* remove unused comments in x-pack

* use no-script-url and no-unsanitized/property for ts files

* remove unused eslint comments

* eui/href-or-on-click removed when not complained

* no import/* rules for ts files

* cleanup

* remove the unused eslint-disable

* rollback unnecessary changes

* allow underscore prefix & sufix in type name

* update docs

* fix type error in enterprise search plugin mocks

* rename platform hack __coreProvider --> _coreProvider

* rollback space removal in src/core/public/legacy/legacy_service.test.ts

* fix naming convention in APM
2020-08-05 17:32:19 +02:00
Mike Côté
54e13ad6f6
Make the actions plugin support generics (#71439)
* Initial attempt at making the actions plugin support generics

* Export WebhookMethods

* Fix typings for registry

* Usage of Record<string, unknown>

* Apply feedback from Gidi

* Cleanup

* Fix validate_with_schema

* Cleanup pt2

* Fix failing tests

* Add generics to ActionType for ActionTypeExecutorResult

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-08-04 15:50:17 -04:00
Gidi Meir Morris
5e8e01fd0f
removed ESO migration from alerting (#73420)
This PR removes the use of ESO migration from alerting as we do not actually need this until the RBAC work lands, which should be 7.10.
This allows us to concentrate the challenges of introducing RBAC into one single release which hopefully will help us better mitigate potential regressions.
2020-07-28 15:00:41 +01:00
Yuliia Naumenko
badbfa0eb5
Added more {{context}} fields for Index Threshold alert type (including requested 'threshold' field). Extended action variables UX with tooltip containing variable description. (#71141)
* Added more {{context}} fields for Index Threshold alert type (including requested 'threshold' field). Extended action variables UX with tooltip containing variable description.

* Fixed type checks and failing tests

* fixed type check

* Splited params variables

* Fixed tests and type checks

* Fixed styles

* Fixed type check

* fixed styles

* fixed missing type

* Fixed due to comments

* fixed variables description

* fixed type check

* Fixed due to comments

* fixed typecheck

* Merge remote-tracking branch upstream/master into alerting-additional-context-fields

* fixed type checks and tests

* fixed tests
2020-07-23 08:39:51 -07:00
Patrick Mueller
f974c242ab
[eventLog] fix FT event log tests to filter on event actions (#72445)
resolves https://github.com/elastic/kibana/issues/72207

The `getEventLog()` should have been filtering the events returned by the
actions requested in the parameters, but wasn't.

Also un-skips the describe block that was skipped because of this failure.
2020-07-22 13:06:28 -04:00
spalger
b12d19f8fa skip flaky suite (#72803) 2020-07-22 09:11:20 -07:00
Gidi Meir Morris
4abe864f10
Adds Role Based Access-Control to the Alerting & Action plugins based on Kibana Feature Controls (#67157)
This PR adds _Role Based Access-Control_ to the Alerting framework & Actions feature using  Kibana Feature Controls, addressing most of the Meta issue: https://github.com/elastic/kibana/issues/43994

This also closes https://github.com/elastic/kibana/issues/62438

This PR includes the following:

1. Adds `alerting` specific Security Actions (not to be confused with Alerting Actions) to the `security` plugin which allows us to assign alerting specific privileges to users of other plugins using the `features` plugin.
2. Removes the security wrapper from the savedObjectsClient in AlertsClient and instead plugs in the new AlertsAuthorization which performs the privilege checks on each api call made to the AlertsClient.
3. Adds privileges in each plugin that is already using the Alerting Framework which mirror (as closely as possible) the existing api-level tag-based privileges and plugs them into the AlertsClient.
4. Adds feature granted privileges arounds Actions (by relying on Saved Object privileges under the hood) and plugs them into the ActionsClient
5. Removes the legacy api-level tag-based privilege system from both the Alerts and Action HTTP APIs
2020-07-22 14:45:57 +01:00
spalger
fead1f2d1d skip flaky suite (#77207) 2020-07-16 16:42:41 -07:00
Patrick Mueller
b167d77e3e
[eventLog] search for actions/alerts as hidden saved objects (#70395)
resolves https://github.com/elastic/kibana/issues/70086

Configures the saved object client for the event log to access the recently
hidden action and alert saved objects.

We didn't have tests for action/alert event log activity, so added some now.

Also found a buglet that was preventing access to event log data from actions
and alerts in non-default spaces.
2020-07-16 09:10:51 -04:00
Tyler Smalley
d27ac2d5c5
[test] Reverts skipped tests caused by null API name (#71632)
* Revert "[test] Skips test preventing promotion of ES snapshot #71582"

This reverts commit 683fb42df7.

* Revert "[test] Skips test preventing promotion of ES snapshot #71555"

This reverts commit 8555ecbcf4.

* Revert "[test] Skips Alerting test preventing ES snapshot promotion"

This reverts commit b217cb3f96.

* Revert "[test] Skips test preventing promotion of ES snapshot"

This reverts commit 0194f8c149.

* Revert "[skip test] Skips Alerting API test due to failing ES promotion"

This reverts commit 439f2dd047.
2020-07-15 11:53:40 -07:00
James Gowdy
a1e511a727
[ML] Changing all calls to ML endpoints to use internal user (#70487)
* [ML] Changing all calls to ML endpoints to use internal user

* updating alerting

* updating documentation

* [ML] Changing all calls to ML endpoints to use internal user

* updating alerting

* updating documentation

* fixing missed types

* adding authorization headers to endpoint calls

* correcting has privileges call

* updating security tests

* odd eslint error

* adding auth header to module setup

* fixing missing auth argument

* fixing delete DFA job permission checks

* removing debug test tag

* removing additional ml privilege checks

* adding authorization header to _evaluate

* updating alerting cluster client name

* code clean up

* changing authorizationHeader name

* updating alterting documentation

* fixing secondary credentials

* adding management links

* updating SIEM telemetry

* fixing merge conflicts

* granting access to index patterns

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-07-14 15:48:24 +01:00
Tiago Costa
683fb42df7
[test] Skips test preventing promotion of ES snapshot #71582 2020-07-14 02:33:00 +01:00
Tyler Smalley
439f2dd047 [skip test] Skips Alerting API test due to failing ES promotion
https://github.com/elastic/kibana/issues/71558

Signed-off-by: Tyler Smalley <tyler.smalley@elastic.co>
2020-07-13 15:19:50 -07:00
Christos Nasikas
1a81eb5c19
[SIEM][CASE] IBM Resilient Connector (#66385) 2020-07-10 02:23:20 +03:00
Yuliia Naumenko
57915e1641
ServiceNow push to Incident generic implementation (supporting both Case specific and generic Alerts) (#68464)
* Draft ServiceNow generic implementation

* simple working servicenow incident per alert

* fixed running times

* rely on externalId for update incident on the next execution

* Added consumer to the action type to be able to split ServiceNow for Cases and Alerts

* Added subActions support for ServiceNow action form

* Basic version for Alerts part for ServiceNow

* Keep Case ServiceNow functionality working

* Revert changes on app_router

* Fixed type checks

* Fixed language check issues

* Fixed actions unit tests

* Fixed functional tests

* Fixed jest tests

* fixed tests

* Copied case mappings to alerting plugin

* made consumer optional

* Cleanup tests

* more cleanup

* Fixed jest tests and type checks

* fixed tests

* fixed servicenow validation tests

* Added ServiceNow unit tests

* Removed consumer for actions

* fixed client side isCaseOwned support

* fixed failing tests

* fixed jest tests

* Fixed URL validation

* fixed due to comments

* fixed tests

* fixed jest tests

* Fixed due to comments. Moved ServiceNow filtering in case plugin to server side

* fixed mock for ServiceNow

* fixed consumer config

* fixed test

* fixed type check

* Fixed jest test

* fixed type check
2020-07-06 16:38:45 -07:00