[RAM] Add support for aggregating over any params to RulesClient

[banderror]

Summary

The RulesClient.aggregate() method should allow solutions to aggregate over any fields inside the params object.

This is needed for various functionality in Security Solution, such as:

• https://github.com/elastic/security-team/issues/2905 (in progress)
• [Security Solution] Detection Engine health API #125642 (in progress)
• Enhancing filtering UX in the Rules table

Details

Currently, this support is "added" via adding alert.attributes.params.* to ALLOW_FIELDS, but it doesn't work:

kibana/x-pack/plugins/alerting/server/rules_client/lib/validate_rule_aggregation_fields.ts

Line 20 in e893133

'alert.attributes.params.*',

The support for the * pattern should be added to the validateFields function:

kibana/x-pack/plugins/alerting/server/rules_client/lib/validate_rule_aggregation_fields.ts

Lines 61 to 73 in e893133

	const validateFields = (container: AggregationsAggregationContainer) => {
	Object.entries(container).forEach(([aggType, aggContainer]) => {
	// Found field, check field against blocklist
	if (AGG_TYPES_TO_VERIFY.includes(aggType) && !ALLOW_FIELDS.includes(aggContainer)) {
	throw Boom.badRequest(`Invalid aggregation term: ${aggContainer}`);
	}
	// Did not find anything, keep recursing if possible
	if (typeof aggContainer === 'object' && aggContainer !== null && !Array.isArray(aggContainer)) {
	validateFields(aggContainer);
	}
	});
	};

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[XavierM]

We talked about it and we will change the logic to allow alert.attributes.params.* for 8.10