[Cases] Case action: Time window #171754
[Cases] Case action: Time window #171754
Conversation
…o register_case_action
…o register_case_action
|
Pinging @elastic/response-ops (Team:ResponseOps) |
|
Pinging @elastic/response-ops-cases (Feature:Cases) |
| @@ -5,6 +5,8 @@ | |||
| * 2.0. | |||
| */ | |||
|
|
|||
| import dateMath from '@kbn/datemath'; | |||
| import moment from 'moment'; | |||
There was a problem hiding this comment.
do we already use moment in cases? Is there no alternative? It's a deprecated 72.1kb (gzipped) library :(
There was a problem hiding this comment.
Hey! Good point. Unfortunately, the @kbn/datemath library which is developed and maintained by Kibana uses moment behind the scenes. I need @kbn/datemath to allow users to set the time window as 7d etc. This is a test file. I wanted to mock the datemath to make the test predicable. Do you have in mind any alternatives?
| * | ||
| * Example: 20d, 2w, 1M, etc | ||
| */ | ||
| const timeWindowRegex = new RegExp(/[1-9][0-9]*[d,w,M,y]/, 'g'); |
There was a problem hiding this comment.
Should you add the start and end of string anchors? ^[1-9][0-9]*[d,w,M,y]$
There was a problem hiding this comment.
Thank you for explaining the issue offline. Good question! I tested and I did not see any issues. I will put more tests in my next PR to cover more scenarios.
There was a problem hiding this comment.
We talked about it again offline. I was wrong. @adcoelho found an issue that the user could bypass the Regex. Thank you so much! I fixed it.
| const bulkCreateReq: BulkCreateOracleRecordRequest = []; | ||
|
|
||
| const ids = groupedAlertsWithOracleKey.map(({ oracleKey }) => oracleKey); | ||
|
|
||
| const bulkGetRes = await this.casesOracleService.bulkGetRecords(ids); | ||
| const [bulkGetValidRecords, bulkGetRecordsErrors] = partitionRecords(bulkGetRes); | ||
| const [bulkGetValidRecords, bulkGetRecordsErrors] = partitionRecordsByError(bulkGetRes); |
There was a problem hiding this comment.
Could you remind me in which scenarios records can end up with errors?
There was a problem hiding this comment.
Mostly 404 errors or 5xx transient errors.
| groupedAlertsWithOracleKey: GroupedAlertsWithOracleKey[] | ||
| ): Promise<OracleRecord[]> { | ||
| const { timeWindow } = params; |
There was a problem hiding this comment.
super nit: why not spread above in the params declaration?
private async upsertOracleRecords(
{ timeWindow }: CasesConnectorRunParams,
groupedAlertsWithOracleKey: GroupedAlertsWithOracleKey[]
): ...
💔 Build FailedFailed CI StepsTest Failures
Metrics [docs]
History
To update your PR or re-run it, just comment with: cc @cnasikas |
## Summary Depends on: #171754 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <[email protected]>
## Summary Depends on: #166267, #170326, #169484, #173740, #173763, #178068, #178307, #178600, #180437 PRs: - #168370 - #169229 - #171754 - #172709 - #173012 - #175107 - #175452 - #175505 - #177033 - #178277 - #177139 - #179796 Fixes: #153837 ## Testing Run Kibana with `--run-examples` if you want to use the "Always firing" rule. Create a rule with a case action in observability and the stack. The security solution is not supported. You should not be able to assign a case action in a security solution rule. 1. Test the "Reopen closed cases" configuration. 2. Test the "Grouping by" configuration. Only one field is allowed. Not all fields are persisted in alerts. If you select a field not part of the alert the case action will create a case where the grouping value is set to `unknow`. 3. Test the "Time window" feature. You can comment out the validation to test for shorter times. 4. Verify that the case action is experimental. 5. Verify that based on the rule type the case is created in the correct solution. 6. Verify that you cannot create a rule with the case action on the basic license. 7. Verify that the execution of the case action fails if you do not have permission for cases. Pending work on the system actions framework level to not allow users to create rules with system actions where they do not have permission. 8. Stress test the case action by creating multiple rules. ### Checklist Delete any items that are not applicable to this PR. - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) ## Release notes Automatically create cases when an alert is triggered. --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: adcoelho <[email protected]> Co-authored-by: Janki Salvi <[email protected]>
Summary
This implements the time window logic. Specifically, if a case is older than the defined time window (default is 7d) then the case action will create a new case. This is achieved by increasing the counter in the oracle record responsible for the specific grouping.
Checklist
Delete any items that are not applicable to this PR.
For maintainers