[Security Solution][Detections] Adds Rule Execution Log table

x-pack/plugins/event_log/generated/mappings.json

@@ -292,6 +292,12 @@
                                                 "number_of_triggered_actions": {
                                                     "type": "long"
                                                 },
+                                                "total_alerts": {
+                                                  "type": "long"
+                                                },
+                                                "total_hits": {
+                                                  "type": "long"
+                                                },
                                                 "total_indexing_duration_ms": {
                                                     "type": "long"
                                                 },
@@ -347,4 +353,4 @@
             }
         }
     }
-}
+}

x-pack/plugins/event_log/generated/schemas.ts

@@ -129,6 +129,8 @@ export const EventSchema = schema.maybe(
                     metrics: schema.maybe(
                       schema.object({
                         number_of_triggered_actions: ecsNumber(),
+                        total_alerts: ecsNumber(),
+                        total_hits: ecsNumber(),
                         total_indexing_duration_ms: ecsNumber(),
                         total_search_duration_ms: ecsNumber(),
                         execution_gap_duration_s: ecsNumber(),

x-pack/plugins/event_log/scripts/mappings.js

@@ -74,6 +74,12 @@ exports.EcsCustomPropertyMappings = {
                       number_of_triggered_actions: {
                         type: 'long',
                       },
+                      total_alerts: {
+                        type: 'long',
+                      },
+                      total_hits: {
+                        type: 'long',
+                      },
                       total_indexing_duration_ms: {
                         type: 'long',
                       },

x-pack/plugins/security_solution/common/detection_engine/schemas/common/rule_monitoring.ts

@@ -52,6 +52,7 @@ export enum RuleExecutionStatus {
 }
 
 export const ruleExecutionStatus = enumeration('RuleExecutionStatus', RuleExecutionStatus);
+export type RuleExecutionStatuslol = t.TypeOf<typeof ruleExecutionStatus>;
 
 export const ruleExecutionStatusOrder = PositiveInteger;
 export type RuleExecutionStatusOrder = t.TypeOf<typeof ruleExecutionStatusOrder>;
@@ -70,10 +71,15 @@ export const ruleExecutionStatusOrderByStatus: Record<
 // -------------------------------------------------------------------------------------------------
 // Rule execution metrics
 
+export const countMetric = PositiveInteger;
+export type CountMetric = t.TypeOf<typeof countMetric>;
+
 export const durationMetric = PositiveInteger;
 export type DurationMetric = t.TypeOf<typeof durationMetric>;
 
 export const ruleExecutionMetrics = t.partial({
+  total_alerts: countMetric,
+  total_hits: countMetric,
   total_search_duration_ms: durationMetric,
   total_indexing_duration_ms: durationMetric,
   execution_gap_duration_s: durationMetric,
@@ -106,3 +112,48 @@ export const ruleExecutionEvent = t.type({
 });
 
 export type RuleExecutionEvent = t.TypeOf<typeof ruleExecutionEvent>;
+
+// -------------------------------------------------------------------------------------------------
+// Aggregate Rule execution events
+
+const metrics = t.type({
+  total_alerts: t.number,
+  total_hits: t.number,
+  total_indexing_duration_ms: t.number,
+  total_search_duration_ms: t.number,
+});
+
+const execution = t.type({
+  metrics,
+  status: t.string,
+});
+
+const rule = t.type({
+  execution,
+});
+
+const alert = t.type({
+  rule,
+});
+
+const event = t.type({
+  duration: t.number,
+});
+
+const task = t.type({
+  schedule_delay: t.number,
+});
+
+const kibana = t.type({
+  task,
+  alert,
+});
+
+export const aggregateRuleExecutionEvent = t.type({
+  kibana,
+  event,
+  message: t.string,
+  '@timestamp': IsoDateString,
+});
+
+export type AggregateRuleExecutionEvent = t.TypeOf<typeof aggregateRuleExecutionEvent>;

x-pack/plugins/security_solution/common/detection_engine/schemas/request/get_rule_execution_events_request.ts

@@ -13,6 +13,14 @@ export const GetRuleExecutionEventsRequestParams = t.exact(
   })
 );
 
+export const GetRuleExecutionEventsQueryParams = t.exact(
+  t.type({
+    start: t.string,
+    end: t.string,
+    filters: t.union([t.string, t.undefined]),
+  })
+);
+
 export type GetRuleExecutionEventsRequestParams = t.TypeOf<
   typeof GetRuleExecutionEventsRequestParams
 >;

x-pack/plugins/security_solution/common/detection_engine/schemas/response/get_rule_execution_events_response.ts

@@ -6,7 +6,7 @@
  */
 
 import * as t from 'io-ts';
-import { ruleExecutionEvent } from '../common';
+import { aggregateRuleExecutionEvent, ruleExecutionEvent } from '../common';
 
 export const GetRuleExecutionEventsResponse = t.exact(
   t.type({
@@ -15,3 +15,14 @@ export const GetRuleExecutionEventsResponse = t.exact(
 );
 
 export type GetRuleExecutionEventsResponse = t.TypeOf<typeof GetRuleExecutionEventsResponse>;
+
+export const GetAggregateRuleExecutionEventsResponse = t.exact(
+  t.type({
+    events: t.array(aggregateRuleExecutionEvent),
+    maxEvents: t.number,
+  })
+);
+
+export type GetAggregateRuleExecutionEventsResponse = t.TypeOf<
+  typeof GetAggregateRuleExecutionEventsResponse
+>;

x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/__mocks__/api.ts

@@ -5,9 +5,8 @@
  * 2.0.
  */
 
-import { RuleExecutionStatus } from '../../../../../../common/detection_engine/schemas/common';
 import {
-  GetRuleExecutionEventsResponse,
+  GetAggregateRuleExecutionEventsResponse,
   RulesSchema,
 } from '../../../../../../common/detection_engine/schemas/response';
 
@@ -62,19 +61,46 @@ export const fetchRules = async (_: FetchRulesProps): Promise<FetchRulesResponse
 
 export const fetchRuleExecutionEvents = async ({
   ruleId,
+  start,
+  end,
+  filters,
   signal,
 }: {
   ruleId: string;
+  start: string;
+  end: string;
+  filters?: string;
   signal?: AbortSignal;
-}): Promise<GetRuleExecutionEventsResponse> => {
+}): Promise<GetAggregateRuleExecutionEventsResponse> => {
   return Promise.resolve({
     events: [
       {
-        date: '2021-12-29T10:42:59.996Z',
-        status: RuleExecutionStatus.succeeded,
-        message: 'Rule executed successfully',
+        kibana: {
+          task: {
+            schedule_delay: 13980000000,
+          },
+          alert: {
+            rule: {
+              execution: {
+                metrics: {
+                  total_alerts: 0,
+                  total_hits: 0,
+                  total_indexing_duration_ms: 0,
+                  total_search_duration_ms: 9,
+                },
+                status: 'succeeded',
+              },
+            },
+          },
+        },
+        event: {
+          duration: 2065000000,
+        },
+        message: 'succeeded',
+        '@timestamp': '2022-02-01T05:51:27.143Z',
       },
     ],
+    maxEvents: 1,
   });
 };
 

x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts

@@ -678,19 +678,36 @@ describe('Detections Rules API', () => {
     });
 
     test('calls API with correct parameters', async () => {
-      await fetchRuleExecutionEvents({ ruleId: '42', signal: abortCtrl.signal });
+      await fetchRuleExecutionEvents({
+        ruleId: '42',
+        start: 'now-30',
+        end: 'now',
+        filters: '',
+        signal: abortCtrl.signal,
+      });
 
       expect(fetchMock).toHaveBeenCalledWith(
         '/internal/detection_engine/rules/42/execution/events',
         {
           method: 'GET',
+          query: {
+            end: 'now',
+            filters: '',
+            start: 'now-30',
+          },
           signal: abortCtrl.signal,
         }
       );
     });
 
     test('returns API response as is', async () => {
-      const response = await fetchRuleExecutionEvents({ ruleId: '42', signal: abortCtrl.signal });
+      const response = await fetchRuleExecutionEvents({
+        ruleId: '42',
+        start: 'now-30',
+        end: 'now',
+        filters: '',
+        signal: abortCtrl.signal,
+      });
       expect(response).toEqual(responseMock);
     });
   });

x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts

@@ -24,7 +24,7 @@ import {
 } from '../../../../../common/detection_engine/schemas/request';
 import {
   RulesSchema,
-  GetRuleExecutionEventsResponse,
+  GetAggregateRuleExecutionEventsResponse,
 } from '../../../../../common/detection_engine/schemas/response';
 
 import {
@@ -371,20 +371,30 @@ export const exportRules = async ({
  * Fetch rule execution events (e.g. status changes) from Event Log.
  *
  * @param ruleId string Saved Object ID of the rule (`rule.id`, not static `rule.rule_id`)
+ * @param start string Start daterange either in UTC ISO8601 or as datemath string (e.g. `2021-12-29T02:44:41.653Z` or `now-30`)
+ * @param end string End daterange either in UTC ISO8601 or as datemath string (e.g. `2021-12-29T02:44:41.653Z` or `now/w`)
+ * @param filters string Filters to apply to the search in querystring format (e.g. `event.duration > 1000 OR kibana.alert.rule.execution.metrics.total_hits > 100`)
  * @param signal AbortSignal Optional signal for cancelling the request
  *
  * @throws An error if response is not OK
  */
 export const fetchRuleExecutionEvents = async ({
   ruleId,
+  start,
+  end,
+  filters,
   signal,
 }: {
   ruleId: string;
+  start: string;
+  end: string;
+  filters?: string;
   signal?: AbortSignal;
-}): Promise<GetRuleExecutionEventsResponse> => {
+}): Promise<GetAggregateRuleExecutionEventsResponse> => {
   const url = detectionEngineRuleExecutionEventsUrl(ruleId);
-  return KibanaServices.get().http.fetch<GetRuleExecutionEventsResponse>(url, {
+  return KibanaServices.get().http.fetch<GetAggregateRuleExecutionEventsResponse>(url, {
     method: 'GET',
+    query: { start, end, filters },
     signal,
   });
 };

x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/translations.ts

@@ -14,6 +14,13 @@ export const RULE_AND_TIMELINE_FETCH_FAILURE = i18n.translate(
   }
 );
 
+export const RULE_EXECUTION_FETCH_FAILURE = i18n.translate(
+  'xpack.securitySolution.containers.detectionEngine.ruleExecutionLogFailureDescription',
+  {
+    defaultMessage: 'Failed to fetch Rule Execution Events',
+  }
+);
+
 export const RULE_ADD_FAILURE = i18n.translate(
   'xpack.securitySolution.containers.detectionEngine.addRuleFailDescription',
   {

x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts

@@ -183,6 +183,8 @@ export type RulesSortingFields =
   | 'enabled'
   | 'execution_summary.last_execution.date'
   | 'execution_summary.last_execution.metrics.execution_gap_duration_s'
+  | 'execution_summary.last_execution.metrics.total_alerts'
+  | 'execution_summary.last_execution.metrics.total_hits'
   | 'execution_summary.last_execution.metrics.total_indexing_duration_ms'
   | 'execution_summary.last_execution.metrics.total_search_duration_ms'
   | 'execution_summary.last_execution.status'

x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_execution_events.test.tsx

@@ -12,7 +12,6 @@ import React from 'react';
 import { QueryClient, QueryClientProvider } from 'react-query';
 import { renderHook, cleanup } from '@testing-library/react-hooks';
 
-import { RuleExecutionStatus } from '../../../../../common/detection_engine/schemas/common';
 import { useRuleExecutionEvents } from './use_rule_execution_events';
 
 import * as api from './api';
@@ -45,9 +44,18 @@ describe('useRuleExecutionEvents', () => {
   };
 
   const render = () =>
-    renderHook(() => useRuleExecutionEvents(SOME_RULE_ID), {
-      wrapper: createReactQueryWrapper(),
-    });
+    renderHook(
+      () =>
+        useRuleExecutionEvents({
+          ruleId: SOME_RULE_ID,
+          start: 'now-30',
+          end: 'now',
+          filters: '',
+        }),
+      {
+        wrapper: createReactQueryWrapper(),
+      }
+    );
 
   it('calls the API via fetchRuleExecutionEvents', async () => {
     const fetchRuleExecutionEvents = jest.spyOn(api, 'fetchRuleExecutionEvents');
@@ -77,13 +85,36 @@ describe('useRuleExecutionEvents', () => {
     expect(result.current.isLoading).toEqual(false);
     expect(result.current.isSuccess).toEqual(true);
     expect(result.current.isError).toEqual(false);
-    expect(result.current.data).toEqual([
-      {
-        date: '2021-12-29T10:42:59.996Z',
-        status: RuleExecutionStatus.succeeded,
-        message: 'Rule executed successfully',
-      },
-    ]);
+    expect(result.current.data).toEqual({
+      events: [
+        {
+          kibana: {
+            task: {
+              schedule_delay: 13980000000,
+            },
+            alert: {
+              rule: {
+                execution: {
+                  metrics: {
+                    total_alerts: 0,
+                    total_hits: 0,
+                    total_indexing_duration_ms: 0,
+                    total_search_duration_ms: 9,
+                  },
+                  status: 'succeeded',
+                },
+              },
+            },
+          },
+          event: {
+            duration: 2065000000,
+          },
+          message: 'succeeded',
+          '@timestamp': '2022-02-01T05:51:27.143Z',
+        },
+      ],
+      maxEvents: 1,
+    });
   });
 
   it('handles exceptions from the API', async () => {