## Summary
Resolves (a portion of) https://github.com/elastic/kibana/issues/107068 for the `siem-detection-engine-rule-status` type by migrating the `alertId` to be within the `SO references[]`. Based on: https://github.com/elastic/kibana/pull/113577
* Migrates the legacy `siem-detection-engine-rule-status` `alertId` to saved object references array
* Adds an e2e test for `siem-detection-engine-rule-status`
* Breaks out `siem-detection-engine-rule-status` & `security-rule` SO's to their own dedicated files/directories, and cleaned up typings/imports
Before migration you can observe the existing data structure of `siem-detection-engine-rule-status` via Dev tools as follows:
```
GET .kibana/_search
{
"size": 10000,
"query": {
"term": {
"type": {
"value": "siem-detection-engine-rule-status"
}
}
}
}
```
``` JSON
{
"_index" : ".kibana-spong_8.0.0_001",
"_id" : "siem-detection-engine-rule-status:d580f1a0-2afe-11ec-8621-8d6bfcdfd75e",
"_score" : 2.150102,
"_source" : {
"siem-detection-engine-rule-status" : {
"alertId" : "d62d2980-27c4-11ec-92b0-f7b47106bb35", <-- alertId which we want in the references array and removed
"statusDate" : "2021-10-12T01:50:52.898Z",
"status" : "failed",
"lastFailureAt" : "2021-10-12T01:50:52.898Z",
"lastSuccessAt" : "2021-10-12T01:18:29.195Z",
"lastFailureMessage" : "6 minutes (385585ms) were not queried between this rule execution and the last execution, so signals may have been missed. Consider increasing your look behind time or adding more Kibana instances. name: \"I am the Host who Names!\" id: \"d62d2980-27c4-11ec-92b0-f7b47106bb35\" rule id: \"214ccef6-e98e-493a-98c5-5bcc2d497b79\" signals index: \".siem-signals-spong-default\"",
"lastSuccessMessage" : "succeeded",
"gap" : "6 minutes",
"lastLookBackDate" : "2021-10-07T23:43:27.961Z"
},
"type" : "siem-detection-engine-rule-status",
"references" : [ ],
"coreMigrationVersion" : "7.14.0",
"updated_at" : "2021-10-12T01:50:53.404Z"
}
}
```
Post migration the data structure should be updated as follows:
``` JSON
{
"_index": ".kibana-spong_8.0.0_001",
"_id": "siem-detection-engine-rule-status:d580f1a0-2afe-11ec-8621-8d6bfcdfd75e",
"_score": 2.1865466,
"_source": {
"siem-detection-engine-rule-status": {
"statusDate": "2021-10-12T01:50:52.898Z", <-- alertId is no more!
"status": "failed",
"lastFailureAt": "2021-10-12T01:50:52.898Z",
"lastSuccessAt": "2021-10-12T01:18:29.195Z",
"lastFailureMessage": "6 minutes (385585ms) were not queried between this rule execution and the last execution, so signals may have been missed. Consider increasing your look behind time or adding more Kibana instances. name: \"I am the Host who Names!\" id: \"d62d2980-27c4-11ec-92b0-f7b47106bb35\" rule id: \"214ccef6-e98e-493a-98c5-5bcc2d497b79\" signals index: \".siem-signals-spong-default\"",
"lastSuccessMessage": "succeeded",
"gap": "6 minutes",
"lastLookBackDate": "2021-10-07T23:43:27.961Z"
},
"type": "siem-detection-engine-rule-status",
"references": [
{
"id": "d62d2980-27c4-11ec-92b0-f7b47106bb35", <-- previous alertId has been converted to references[]
"type": "alert",
"name": "alert_0"
}
],
"migrationVersion": {
"siem-detection-engine-rule-status": "7.16.0"
},
"coreMigrationVersion": "8.0.0",
"updated_at": "2021-10-12T01:50:53.406Z"
}
},
```
#### Manual testing
---
There are e2e tests but for any manual testing or verification you can do the following:
##### Manual upgrade test
If you have a 7.15.0 system and can migrate it forward that is the most straight forward way to ensure this does migrate correctly. You should see that the `Rule Monitoring` table and Rule Details `Failure History` table continue to function without error.
##### Downgrade via script and test migration on kibana reboot
If you have a migrated `Rule Status SO` and want to test the migration, you can run the below script to downgrade the status SO then restart Kibana and observe the migration on startup.
Note: Since this PR removes the mapping, you would need to [update the SO mapping](https://github.com/elastic/kibana/pull/114585/files#r729386126) to include `alertId` again else you will receive a strict/dynamic mapping error.
```json
# Replace id w/ correct Rule Status SO id of existing migrated object
POST .kibana/_update/siem-detection-engine-rule-status:d580ca91-2afe-11ec-8621-8d6bfcdfd75e
{
"script" : {
"source": """
ctx._source.migrationVersion['siem-detection-engine-rule-status'] = "7.15.0";
ctx._source['siem-detection-engine-rule-status'].alertId = ctx._source.references[0].id;
ctx._source.references.remove(0);
""",
"lang": "painless"
}
}
```
Restart Kibana and now it should be migrated correctly and you shouldn't see any errors in your console. You should also see that the `Rule Monitoring` table and Rule Details `Failure History` table continue to function without error.
### Checklist
Delete any items that are not applicable to this PR.
- [ ] ~[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials~
- [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
### For maintainers
- [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
fe979e4932