Rule Type implementors can't prevent Creation of their alert types in Rules Management without also preventing Editing

[gmmorris]

@elastic/stack-monitoring have prevented the Creation and Editing of their Alert Types in Alerts Management, but they would actually like to allow Editing - it's only creation that they actually want to block.

It would be nice to allow editing of their alerts in Alerts Management, especially considering we do list these alerts and display their details.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[mikecote]

Note that stack monitoring alerts may eventually move to pre-configured alerts which would solve the issue for them (prevent creation & have singleton alerts).

[gmmorris]

Note that stack monitoring alerts may eventually move to pre-configured alerts which would solve the issue for them (prevent creation & have singleton alerts).

Yup, now that @chrisronline ran through their rationale with me, it makes sense.

[mikecote]

similar scenario to when alerts can only be edited within the application (ex: detection alerts).

[mikecote]

Moving from 7.x - Candidates to 8.x - Candidates (Backlog) after the latest 7.x planning session.

[chrisronline]

Is this much work to support? I'd be happy to do it if it's a relatively small effort.

[mikecote]

Is this much work to support? I'd be happy to do it if it's a relatively small effort.

@chrisronline I think it's relatively small, it would be great if you can help. We would just need to figure out what proposal works best for such an approach, but feel free to suggest something or let us know if you just need a direction.

[ravikesarwani]

Hi @chrisronline Do you know of issues if user creates a new alert using one of the stack monitoring alert types? The reason I ask is if we can handle this issue in 2 steps:

1. For 7.12 toggle the flag so that user can see the alert details (threshold etc) and modify them from the Alerts and Actions section.
2. For later release we can add more granular control between create and edit.
   WDYT?

[chrisronline]

@ravikesarwani

This is the original issue: #75414

It looks like the original issue (the screenshot where you couldn't configure the CPU usage alert) is now fixed:

We can change it so users can do the above screenshot if you want. I'm worried that creating more of these alerts will lead to confusion, because they can't really change the index pattern or add any filters.

LMK

[ravikesarwani]

@chrisronline , in 7.11 we have an indication in the create flow that this is stack monitoring related. Can you confirm?
If this is the case then I think the flow now is much better to enable it?
Previously with no indication I think "CPU Usage" was very general and can confuse the observability users.

I would still like to pursue the change where we have granular control over create and edit and then we can disable the create action.

[chrisronline]

in 7.11 we have an indication in the create flow that this is stack monitoring related

I don't think so. The screenshot above is master and I don't think anything has changed between 7.11 and master. The alert is just called (for example) CPU Usage without any indication that it's enabled by default by Stack Monitoring. The screenshot above is what the user would see, unless I'm missing something?

[ravikesarwani]

Hmm... This is what I see in 7.11 =>

[ravikesarwani]

There are use cases where user smay want to alert when CPU is 75% for last 5 minutes and call that a warning and send an email. When its 85% for last 10 minutes they call that an error and want to send a pagerduty alert.
Allowing creation of new alerts can help with that.

There is extension to the use case where a user want to create a new alert and apply to only some of the objects as well.

[chrisronline]

Hmm... This is what I see in 7.11 =>

Exactly. There isn't a monitoring-related alert type in the list. It sounds like we want to change that and allow users to create and edit stack monitoring alerts from the Alerts Management UI. Is that true?

[ravikesarwani]

I created 91145 to change the behaviour for stack monitoring alerts.

[XavierM]

we going close this issue please be our guess to re-open if need it