[RAC][Alerting][Security Solution] Adds Rule Execution UUID

packages/kbn-rule-data-utils/src/technical_field_names.ts

@@ -47,6 +47,7 @@ const ALERT_RULE_CREATED_AT = `${ALERT_RULE_NAMESPACE}.created_at` as const;
 const ALERT_RULE_CREATED_BY = `${ALERT_RULE_NAMESPACE}.created_by` as const;
 const ALERT_RULE_DESCRIPTION = `${ALERT_RULE_NAMESPACE}.description` as const;
 const ALERT_RULE_ENABLED = `${ALERT_RULE_NAMESPACE}.enabled` as const;
+const ALERT_RULE_EXECUTION_UUID = `${ALERT_RULE_NAMESPACE}.execution.uuid` as const;
 const ALERT_RULE_FROM = `${ALERT_RULE_NAMESPACE}.from` as const;
 const ALERT_RULE_INTERVAL = `${ALERT_RULE_NAMESPACE}.interval` as const;
 const ALERT_RULE_LICENSE = `${ALERT_RULE_NAMESPACE}.license` as const;
@@ -103,6 +104,7 @@ const fields = {
   ALERT_RULE_CREATED_BY,
   ALERT_RULE_DESCRIPTION,
   ALERT_RULE_ENABLED,
+  ALERT_RULE_EXECUTION_UUID,
   ALERT_RULE_FROM,
   ALERT_RULE_INTERVAL,
   ALERT_RULE_LICENSE,
@@ -156,6 +158,7 @@ export {
   ALERT_RULE_CREATED_BY,
   ALERT_RULE_DESCRIPTION,
   ALERT_RULE_ENABLED,
+  ALERT_RULE_EXECUTION_UUID,
   ALERT_RULE_FROM,
   ALERT_RULE_INTERVAL,
   ALERT_RULE_LICENSE,

x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.test.ts

@@ -25,6 +25,7 @@ describe('createAlertEventLogRecordObject', () => {
   test('created alert event "execute-start"', async () => {
     expect(
       createAlertEventLogRecordObject({
+        executionId: '7a7065d7-6e8b-4aae-8d20-c93613dec9fb',
         ruleId: '1',
         ruleType,
         action: 'execute-start',
@@ -50,6 +51,13 @@ describe('createAlertEventLogRecordObject', () => {
         kind: 'alert',
       },
       kibana: {
+        alert: {
+          rule: {
+            execution: {
+              uuid: '7a7065d7-6e8b-4aae-8d20-c93613dec9fb',
+            },
+          },
+        },
         saved_objects: [
           {
             id: '1',
@@ -76,6 +84,7 @@ describe('createAlertEventLogRecordObject', () => {
   test('created alert event "recovered-instance"', async () => {
     expect(
       createAlertEventLogRecordObject({
+        executionId: '7a7065d7-6e8b-4aae-8d20-c93613dec9fb',
         ruleId: '1',
         ruleName: 'test name',
         ruleType,
@@ -109,6 +118,13 @@ describe('createAlertEventLogRecordObject', () => {
         start: '1970-01-01T00:00:00.000Z',
       },
       kibana: {
+        alert: {
+          rule: {
+            execution: {
+              uuid: '7a7065d7-6e8b-4aae-8d20-c93613dec9fb',
+            },
+          },
+        },
         alerting: {
           action_group_id: 'group 1',
           action_subgroup: 'subgroup value',
@@ -138,6 +154,7 @@ describe('createAlertEventLogRecordObject', () => {
   test('created alert event "execute-action"', async () => {
     expect(
       createAlertEventLogRecordObject({
+        executionId: '7a7065d7-6e8b-4aae-8d20-c93613dec9fb',
         ruleId: '1',
         ruleName: 'test name',
         ruleType,
@@ -176,6 +193,13 @@ describe('createAlertEventLogRecordObject', () => {
         start: '1970-01-01T00:00:00.000Z',
       },
       kibana: {
+        alert: {
+          rule: {
+            execution: {
+              uuid: '7a7065d7-6e8b-4aae-8d20-c93613dec9fb',
+            },
+          },
+        },
         alerting: {
           action_group_id: 'group 1',
           action_subgroup: 'subgroup value',

x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.ts

@@ -12,6 +12,7 @@ import { UntypedNormalizedRuleType } from '../rule_type_registry';
 export type Event = Exclude<IEvent, undefined>;
 
 interface CreateAlertEventLogRecordParams {
+  executionId?: string;
   ruleId: string;
   ruleType: UntypedNormalizedRuleType;
   action: string;
@@ -36,7 +37,18 @@ interface CreateAlertEventLogRecordParams {
 }
 
 export function createAlertEventLogRecordObject(params: CreateAlertEventLogRecordParams): Event {
-  const { ruleType, action, state, message, task, ruleId, group, subgroup, namespace } = params;
+  const {
+    executionId,
+    ruleType,
+    action,
+    state,
+    message,
+    task,
+    ruleId,
+    group,
+    subgroup,
+    namespace,
+  } = params;
   const alerting =
     params.instanceId || group || subgroup
       ? {
@@ -59,6 +71,17 @@ export function createAlertEventLogRecordObject(params: CreateAlertEventLogRecor
     },
     kibana: {
       ...(alerting ? alerting : {}),
+      ...(executionId
+        ? {
+            alert: {
+              rule: {
+                execution: {
+                  uuid: executionId,
+                },
+              },
+            },
+          }
+        : {}),
       saved_objects: params.savedObjects.map((so) => ({
         ...(so.relation ? { rel: so.relation } : {}),
         type: so.type,

x-pack/plugins/alerting/server/rules_client/tests/disable.test.ts

@@ -21,6 +21,10 @@ import { getBeforeSetup, setGlobalDate } from './lib';
 import { eventLoggerMock } from '../../../../event_log/server/event_logger.mock';
 import { TaskStatus } from '../../../../task_manager/server';
 
+jest.mock('uuid', () => ({
+  v4: () => '5f6aa57d-3e22-484e-bae8-cbed868f4d28',
+}));
+
 const taskManager = taskManagerMock.createStart();
 const ruleTypeRegistry = ruleTypeRegistryMock.create();
 const unsecuredSavedObjectsClient = savedObjectsClientMock.create();

x-pack/plugins/alerting/server/task_runner/create_execution_handler.test.ts

@@ -73,6 +73,7 @@ const createExecutionHandlerParams: jest.Mocked<
   spaceId: 'test1',
   ruleId: '1',
   ruleName: 'name-of-alert',
+  executionId: '5f6aa57d-3e22-484e-bae8-cbed868f4d28',
   tags: ['tag-A', 'tag-B'],
   apiKey: 'MTIzOmFiYw==',
   kibanaBaseUrl: 'http://localhost:5601',
@@ -173,6 +174,13 @@ test('enqueues execution per selected action', async () => {
             "kind": "alert",
           },
           "kibana": Object {
+            "alert": Object {
+              "rule": Object {
+                "execution": Object {
+                  "uuid": "5f6aa57d-3e22-484e-bae8-cbed868f4d28",
+                },
+              },
+            },
             "alerting": Object {
               "action_group_id": "default",
               "instance_id": "2",

x-pack/plugins/alerting/server/task_runner/create_execution_handler.ts

@@ -36,6 +36,7 @@ export interface CreateExecutionHandlerOptions<
 > {
   ruleId: string;
   ruleName: string;
+  executionId: string;
   tags?: string[];
   actionsPlugin: ActionsPluginStartContract;
   actions: AlertAction[];
@@ -83,6 +84,7 @@ export function createExecutionHandler<
   logger,
   ruleId,
   ruleName,
+  executionId,
   tags,
   actionsPlugin,
   actions: ruleActions,
@@ -206,6 +208,7 @@ export function createExecutionHandler<
         ruleId,
         ruleType: ruleType as UntypedNormalizedRuleType,
         action: EVENT_LOG_ACTIONS.executeAction,
+        executionId,
         instanceId: alertId,
         group: actionGroup,
         subgroup: actionSubgroup,