Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Alert Summaries] [FE] Move “Notify When” and throttle from rule to action #143369

Closed
Tracked by #143200
ersin-erdal opened this issue Oct 14, 2022 · 0 comments · Fixed by #145637
Closed
Tracked by #143200

[Alert Summaries] [FE] Move “Notify When” and throttle from rule to action #143369

ersin-erdal opened this issue Oct 14, 2022 · 0 comments · Fixed by #145637
Assignees
@Zacqary
Labels
blocked NeededFor:SIEM Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@ersin-erdal
Copy link
Contributor

ersin-erdal commented Oct 14, 2022 •
edited
Loading

Meta: #143200

Blocked by: #143368 and #143376

As preparation for Alert Summaries feature, we need to move notify_when and throttle fields from rule object to each action in the rule.

Once the BE part is done, UI should do per-action config and move away from global settings (set them to null)

  • A user should not be able to set a lesser number for notifyWhen than schedule.interval (Check every)
  • Only the rule types that are using alert-as-data can have summary options
@botelastic botelastic bot added the needs-team Issues missing a team label label Oct 14, 2022
@ersin-erdal ersin-erdal mentioned this issue Oct 14, 2022
Open
11 tasks
@mikecote mikecote mentioned this issue Oct 20, 2022
Closed
10 tasks
@Zacqary Zacqary mentioned this issue Nov 17, 2022
Merged
2 tasks
@ersin-erdal ersin-erdal mentioned this issue Dec 13, 2022
Merged
Zacqary added a commit that referenced this issue Jan 10, 2023
@Zacqary @kibanamachine @XavierM
[Alert Summaries] [FE] Move “Notify When” and throttle from rule to a…
ff6024d 
…ction (#145637)

## Summary

Closes #143369 (~blocked by
#143376)

This PR updates the Stack Management UI and Observability UI to show
Notify When and Throttle parameters at the **action level** instead of
the **rule level**.

The rule-level Check Every dropdown is moved to the end of the rule,
right above the actions form

The Security Solution UX remains unchanged, as it has a unique way of
displaying action notification frequencies at the rule level. Instead,
the API request has changed so that the selected action frequency will
now be stored in each action's `frequency` param instead of at the rule
level.

In all three UIs, existing rules that have legacy rule-level
`notifyWhen` and `frequency` params will have these parameters
seamlessly migrated to the action level when the user edits a rule.

The Rule Details page is also updated to show Notify frequencies in the
Actions column instead of in the first, rule-level column.

### Rule Details Page update
<img width="781" alt="Screen Shot 2022-11-17 at 4 23 02 PM"
src="https://user-images.githubusercontent.com/1445834/202573067-bc55630d-f767-4a93-8d7c-752748da25c2.png">

### Rule Form update
<img width="605" alt="Screen Shot 2022-11-17 at 4 23 10 PM"
src="https://user-images.githubusercontent.com/1445834/202573057-5d50e573-1453-4b63-8e1e-6505fa0261c6.png">
<img width="605" alt="Screen Shot 2022-12-27 at 1 18 12 PM"
src="https://user-images.githubusercontent.com/1445834/209712784-34c2384b-bcc8-4db9-a42d-052d81099a40.png">

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Xavier Mouligneau <[email protected]>
jennypavlova pushed a commit to jennypavlova/kibana that referenced this issue Jan 13, 2023
@Zacqary @kibanamachine
@XavierM @jennypavlova
[Alert Summaries] [FE] Move “Notify When” and throttle from rule to a…
89d02b4 
…ction (elastic#145637)

## Summary

Closes elastic#143369 (~blocked by
elastic#143376)

This PR updates the Stack Management UI and Observability UI to show
Notify When and Throttle parameters at the **action level** instead of
the **rule level**.

The rule-level Check Every dropdown is moved to the end of the rule,
right above the actions form

The Security Solution UX remains unchanged, as it has a unique way of
displaying action notification frequencies at the rule level. Instead,
the API request has changed so that the selected action frequency will
now be stored in each action's `frequency` param instead of at the rule
level.

In all three UIs, existing rules that have legacy rule-level
`notifyWhen` and `frequency` params will have these parameters
seamlessly migrated to the action level when the user edits a rule.

The Rule Details page is also updated to show Notify frequencies in the
Actions column instead of in the first, rule-level column.

### Rule Details Page update
<img width="781" alt="Screen Shot 2022-11-17 at 4 23 02 PM"
src="https://user-images.githubusercontent.com/1445834/202573067-bc55630d-f767-4a93-8d7c-752748da25c2.png">

### Rule Form update
<img width="605" alt="Screen Shot 2022-11-17 at 4 23 10 PM"
src="https://user-images.githubusercontent.com/1445834/202573057-5d50e573-1453-4b63-8e1e-6505fa0261c6.png">
<img width="605" alt="Screen Shot 2022-12-27 at 1 18 12 PM"
src="https://user-images.githubusercontent.com/1445834/209712784-34c2384b-bcc8-4db9-a42d-052d81099a40.png">

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Xavier Mouligneau <[email protected]>
@lcawl lcawl mentioned this issue Feb 9, 2023
Closed
15 tasks
@lcawl lcawl mentioned this issue Mar 27, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Zacqary Zacqary

Labels
blocked NeededFor:SIEM Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
No open projects
AppEx: ResponseOps - Execution & Connectors
Archived in project
AppEx: ResponseOps - Rules & Alerts Management
Status: Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Alert Summaries] [FE] Move “Notify When” and throttle from rule to action Zacqary/kibana
2 participants
@Zacqary @ersin-erdal