[Security Solution] Use current user instead of internal user when querying for threshold rule history

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts

@@ -412,7 +412,7 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
                     wrapHits,
                     wrapSequences,
                     listClient,
-                    ruleDataReader: ruleDataClient.getReader({ namespace: options.spaceId }),
+                    ruleDataClient,
                     mergeStrategy,
                     primaryTimestamp,
                     secondaryTimestamp,

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/threshold/create_threshold_alert_type.ts

@@ -62,7 +62,7 @@ export const createThresholdAlertType = (
           completeRule,
           tuple,
           wrapHits,
-          ruleDataReader,
+          ruleDataClient,
           inputIndex,
           runtimeMappings,
           primaryTimestamp,
@@ -88,7 +88,7 @@ export const createThresholdAlertType = (
         state,
         bulkCreate,
         wrapHits,
-        ruleDataReader,
+        ruleDataClient,
         inputIndex,
         runtimeMappings,
         primaryTimestamp,

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/threshold/get_threshold_signal_history.ts

@@ -6,8 +6,9 @@
  */
 
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
-import type { IRuleDataReader } from '@kbn/rule-registry-plugin/server';
+import type { IRuleDataClient } from '@kbn/rule-registry-plugin/server';
 import { ALERT_RULE_UUID } from '@kbn/rule-data-utils';
+import type { ElasticsearchClient } from '@kbn/core/server';
 import type { ThresholdSignalHistory } from './types';
 import { buildThresholdSignalHistory } from './build_signal_history';
 import { createErrorsFromShard } from '../utils/utils';
@@ -17,15 +18,19 @@ interface GetThresholdSignalHistoryParams {
   to: string;
   frameworkRuleId: string;
   bucketByFields: string[];
-  ruleDataReader: IRuleDataReader;
+  spaceId: string;
+  ruleDataClient: IRuleDataClient;
+  esClient: ElasticsearchClient;
 }
 
 export const getThresholdSignalHistory = async ({
   from,
   to,
   frameworkRuleId,
   bucketByFields,
-  ruleDataReader,
+  spaceId,
+  ruleDataClient,
+  esClient,
 }: GetThresholdSignalHistoryParams): Promise<{
   signalHistory: ThresholdSignalHistory;
   searchErrors: string[];
@@ -37,7 +42,11 @@ export const getThresholdSignalHistory = async ({
     bucketByFields,
   });
 
-  const response = await ruleDataReader.search(request);
+  const indexPattern = ruleDataClient?.indexNameWithNamespace(spaceId);
+  const response = await esClient.search({
+    ...request,
+    index: indexPattern,
+  });
   return {
     signalHistory: buildThresholdSignalHistory({ alerts: response.hits.hits }),
     searchErrors: createErrorsFromShard({

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/threshold/threshold.test.ts

@@ -99,7 +99,7 @@ describe('threshold_executor', () => {
           createdItems: [],
         })),
         wrapHits: jest.fn(),
-        ruleDataReader: ruleDataClientMock.getReader({ namespace: 'default' }),
+        ruleDataClient: ruleDataClientMock,
         runtimeMappings: {},
         inputIndex: ['auditbeat-*'],
         primaryTimestamp: TIMESTAMP,
@@ -164,7 +164,7 @@ describe('threshold_executor', () => {
           createdItems: [],
         })),
         wrapHits: jest.fn(),
-        ruleDataReader: ruleDataClientMock.getReader({ namespace: 'default' }),
+        ruleDataClient: ruleDataClientMock,
         runtimeMappings: {},
         inputIndex: ['auditbeat-*'],
         primaryTimestamp: TIMESTAMP,

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/threshold/threshold.ts

@@ -17,7 +17,7 @@ import type {
   AlertInstanceState,
   RuleExecutorServices,
 } from '@kbn/alerting-plugin/server';
-import type { IRuleDataReader } from '@kbn/rule-registry-plugin/server';
+import type { IRuleDataClient } from '@kbn/rule-registry-plugin/server';
 import type { Filter, DataViewFieldBase } from '@kbn/es-query';
 import type { CompleteRule, ThresholdRuleParams } from '../../rule_schema';
 import { getFilter } from '../utils/get_filter';
@@ -59,7 +59,7 @@ export const thresholdExecutor = async ({
   state,
   bulkCreate,
   wrapHits,
-  ruleDataReader,
+  ruleDataClient,
   primaryTimestamp,
   secondaryTimestamp,
   aggregatableTimestampField,
@@ -81,7 +81,7 @@ export const thresholdExecutor = async ({
   state: ThresholdAlertState;
   bulkCreate: BulkCreate;
   wrapHits: WrapHits;
-  ruleDataReader: IRuleDataReader;
+  ruleDataClient: IRuleDataClient;
   primaryTimestamp: string;
   secondaryTimestamp?: string;
   aggregatableTimestampField: string;
@@ -112,7 +112,9 @@ export const thresholdExecutor = async ({
           to: tuple.to.toISOString(),
           frameworkRuleId: completeRule.alertId,
           bucketByFields: ruleParams.threshold.field,
-          ruleDataReader,
+          spaceId,
+          ruleDataClient,
+          esClient: services.scopedClusterClient.asCurrentUser,
         });
 
     const validSignalHistory = getSignalHistory(state, signalHistory, tuple);

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts

@@ -26,7 +26,6 @@ import type { ListClient } from '@kbn/lists-plugin/server';
 import type {
   PersistenceServices,
   IRuleDataClient,
-  IRuleDataReader,
   SuppressedAlertService,
 } from '@kbn/rule-registry-plugin/server';
 import type { EcsFieldMap } from '@kbn/rule-registry-plugin/common/assets/field_maps/ecs_field_map';
@@ -86,7 +85,7 @@ export interface RunOpts<TParams extends RuleParams> {
   bulkCreate: BulkCreate;
   wrapHits: WrapHits;
   wrapSequences: WrapSequences;
-  ruleDataReader: IRuleDataReader;
+  ruleDataClient: IRuleDataClient;
   inputIndex: string[];
   runtimeMappings: estypes.MappingRuntimeFields | undefined;
   mergeStrategy: ConfigType['alertMergeStrategy'];