Implement functionality to add observables, procedures and custom fields to alerts for TheHive by brijesh-elastic · Pull Request #207255 · elastic/kibana

brijesh-elastic · 2025-01-20T18:53:10Z

Summary

Added a toggle to retain the severity from the rule. When enabled, alerts generated from the rule will inherit its severity; otherwise, users must manually select a severity level from the dropdown.
Added a textarea field for the body, in which users can add observables and procedures using Mustache templates.

Screenshots

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

…lds to alerts

github-actions · 2025-01-20T18:53:23Z

A documentation preview will be available soon.

🔨 Buildkite builds
📚 HTML diff
📙 Preview page

Request a new doc build by commenting

Rebuild this PR: run docs-build
Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}

elasticmachine · 2025-01-21T06:52:15Z

Pinging @elastic/response-ops (Team:ResponseOps)

elasticmachine · 2025-01-21T06:52:48Z

Pinging @elastic/response-ops-cases (Feature:Cases)

jcger · 2025-01-27T13:31:27Z

Shouldn't this also be reviewed by someone in security? I thought we do not own this connector

semd · 2025-01-27T15:38:46Z

...red/triggers_actions_ui/public/application/components/json_editor_with_message_variables.tsx


  useEffect(() => {
-    if (!xJson && inputTargetValue) {
+    if ((!xJson && inputTargetValue) || (xJson && inputTargetValue && inputTargetValue !== xJson)) {


This is a bit hard to understand, isn't it the same as:

Suggested change

if ((!xJson && inputTargetValue) || (xJson && inputTargetValue && inputTargetValue !== xJson)) {

if (inputTargetValue && (!xJson || xJson !== inputTargetValue)) {

Instead of changing this useEffect what about using the key prop in JsonEditorWithMessageVariables component?

For example:

<JsonEditorWithMessageVariables key={subActionsParams.template} />

I don't quite understand. Are you suggesting creating a new key prop? Regardless, we still need to change xJson (the internal state) to ensure it works properly.

semd

LGTM

cnasikas · 2025-01-27T15:44:36Z

x-pack/platform/plugins/shared/stack_connectors/common/thehive/schema.ts

  severity: schema.nullable(schema.number({ defaultValue: TheHiveSeverity.MEDIUM })),
  tlp: schema.nullable(schema.number({ defaultValue: TheHiveTLP.AMBER })),
  tags: schema.nullable(schema.arrayOf(schema.string())),
+  template: schema.number(),


This should be optional (nullable); otherwise, it may break rules with TheHive configured.

Also, I think it is better to have keys (strings) instead of numbers. For users, using the API directly would make it easier to figure out which template they can use.

cnasikas · 2025-01-27T15:48:45Z

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/constants.ts

+  },
+];
+
+export const bodyOptions = [


If it is only used for tests better to be moved to the test files or to a mock.ts file. Same for testBodyOptions.

Ok, I saw they are being used for the component. Better to use a record with key-value pairs. It is very hard to understand what each value means and how it is being used.

cnasikas · 2025-01-27T15:50:24Z

...red/triggers_actions_ui/public/application/components/json_editor_with_message_variables.tsx


  useEffect(() => {
-    if (!xJson && inputTargetValue) {
+    if ((!xJson && inputTargetValue) || (xJson && inputTargetValue && inputTargetValue !== xJson)) {


Instead of changing this useEffect what about using the key prop in JsonEditorWithMessageVariables component?

For example:

<JsonEditorWithMessageVariables key={subActionsParams.template} />

cnasikas · 2025-01-27T15:50:52Z

x-pack/platform/plugins/shared/stack_connectors/server/connector_types/thehive/thehive.ts

    connectorUsageCollector: ConnectorUsageCollector
  ) {
+    const { body, template, ...restOfAlert } = alert;
+    const bodyJson = JSON.parse(body ?? '{}');


Better to move the logic on a function outside of the component and use a try/catch in case of an error.

cnasikas · 2025-01-27T15:53:49Z

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/params_alert.tsx

      } as unknown as ExecutorSubActionCreateAlertParams),
    [actionParams.subActionParams]
  );
+  const isTest = useMemo(() => executionMode === ActionConnectorMode.Test, [executionMode]);


nit: we can remove the useMemo.

cnasikas · 2025-01-27T15:59:00Z

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/params_alert.tsx

+              {
+                ...alert,
+                body: isTest
+                  ? testBodyOptions[parseInt(e.target.value, 10)]


Why do we provide different values in test mode?

Because we are using a Mustache template in the body textarea.
So, we are providing testBodyOption to ensure the test page functions correctly.

Is it a product decision, or does TheHive throw an error if you send mustache variables instead of proper observable values?

Yes, it will throw an error.

…-fix'

cnasikas · 2025-01-29T20:13:00Z

x-pack/platform/plugins/shared/stack_connectors/common/thehive/constants.ts

  RED = 4,
 }
+export enum TheHiveTemplate {
+  BUILD_YOUR_OWN = 'Build Your Own',


Does this mean users must put Build Your Own when using the API? If yes, I think it is better for the keys to be:

build-your-own

compromised-user-account-investigation

malicious-file-analysis

suspicious-network-activity

Maybe using an object instead of an enum would be easier to handle.

No, its not necessary to provide template field in request body while using the API.

cnasikas

LGTM! My only concerns are a) that the isRuleSeverity is required (it should be nullable`) and b) we do not hide the rule severity toggle for the serverless release. I provided suggestions to aid you. After these changes we can merge.

cnasikas · 2025-06-17T15:35:33Z

x-pack/platform/plugins/shared/stack_connectors/common/thehive/schema.ts

  source: schema.string(),
  sourceRef: schema.string(),
  severity: schema.nullable(schema.number({ defaultValue: TheHiveSeverity.MEDIUM })),
+  isRuleSeverity: schema.boolean(),


Suggested change

isRuleSeverity: schema.boolean(),

isRuleSeverity: schema.nullable(schema.boolean({ defaultValue: false })),

cnasikas · 2025-06-17T15:38:52Z

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/params_alert.tsx

      ({
        tlp: 2,
        severity: 2,
+        isRuleSeverity: true,


The value can be null. Better to remove it from here.

cnasikas · 2025-06-17T15:40:52Z

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/params_alert.tsx

-          }}
-        />
-      </EuiFormRow>
+      {!isTest && isRuleSeverity && (


Suggested change

{!isTest && isRuleSeverity && (

{!isTest && Boolean(isRuleSeverity) && (

cnasikas · 2025-06-17T15:41:08Z

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/params_alert.tsx

+        <EuiFormRow fullWidth>
+          <EuiSwitch
+            label={translations.IS_RULE_SEVERITY_LABEL}
+            checked={isRuleSeverity}


Suggested change

checked={isRuleSeverity}

checked={Boolean(isRuleSeverity)}

cnasikas · 2025-06-17T15:41:33Z

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/params_alert.tsx

+          />
+        </EuiFormRow>
+      )}
+      {!isRuleSeverity && (


Suggested change

{!isRuleSeverity && (

{!iBoolean(isRuleSeverity) && (

cnasikas · 2025-06-17T15:42:59Z

x-pack/platform/plugins/shared/stack_connectors/server/connector_types/thehive/render.test.ts

+const logger = loggingSystemMock.createLogger();
+
+describe('TheHive - renderParameterTemplates', () => {
+  it('should rendered subActionParams with variables', () => {


Let's add a test where isRuleSeverity: false.

brijesh-elastic · 2025-06-19T11:33:02Z

Discussed with @cnasikas and @semd, decided to remove custom templates feature for this release.

cnasikas

Thanks for addressing our feedback. Code review only as the testing done by Security solution. LGTM! Could you please add an integration test in x-pack/platform/test/alerting_api_integration/security_and_spaces/group2/tests/actions/connector_types/thehive.ts in your upcoming PR where you unhide the fields in the UI?

brijesh-elastic · 2025-06-19T12:27:29Z

Could you please add an integration test in x-pack/platform/test/alerting_api_integration/security_and_spaces/group2/tests/actions/connector_types/thehive.ts in your upcoming PR where you unhide the fields in the UI?

Yes, we'll add.

elasticmachine · 2025-06-19T13:25:19Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 46492e6

Failed CI Steps

FTR Configs #38

Test Failures

[job] [logs] FTR Configs #38 / core route timeouts idle socket should timeout if payload sending has too long of an idle period

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`stackConnectors`	624.9KB	627.8KB	+2.9KB

History

💚 Build #310252 succeeded 80644a2
💛 Build #309896 was flaky 4d664bd
💛 Build #309370 was flaky 6c7cc74
💔 Build #308904 failed 2c84bbe
💛 Build #305851 was flaky d394209
💚 Build #303948 succeeded 4d8dcbe

Already addressed

kibanamachine · 2025-06-19T14:13:17Z

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15759950221

kibanamachine · 2025-06-19T14:19:27Z

💔 All backports failed

Status	Branch	Result
❌	8.19	Backport failed because of merge conflicts You might need to backport the following PRs to 8.19: - [APM] integration new tail sampling settings (#224479) - [Security Solution][Auto migrations] Remove tech preview (GA) (#224544) - [Response Ops][Reporting] Scheduled Reports (#221028) - [Logs Essentials] Set tier for local ES test cluster (#224428) - [Discover][Traces] Fix processed OTel waterfall flyout (#224548) - [Streams 🌊] Make management view the main page for individual stream (#224461) - [streams] enable streams ui setting (#224111) - [Synthetics] Add monitor downtime alert on no data (#220127) - [ES\|QL] Update grammars (#224010) - [Logs] Replace log stream component (#219425)

Manual backport

To create the backport manually run:

node scripts/backport --pr 207255

Questions ?

Please refer to the Backport tool documentation

semd · 2025-06-19T14:22:51Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…lds to alerts for TheHive (elastic#207255) ## Summary - Added a toggle to retain the severity from the rule. When enabled, alerts generated from the rule will inherit its severity; otherwise, users must manually select a severity level from the dropdown. - Added a template selection menu with predefined basic templates. These templates come with preset configurations, including observables and procedures, which automatically populate the Body field upon selection. Users also have the option to modify an existing template or create a custom one using the `Custom Template` option. ## Screenshots ![image (35)](https://github.com/user-attachments/assets/d7a7b6c8-ae27-4ef4-8396-6625ddbd960c) ![image (36)](https://github.com/user-attachments/assets/85314883-a2aa-4a9c-b1e3-ebdd9a5c3e29) ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [x] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit 884e51a) # Conflicts: # docs/reference/connectors-kibana/thehive-action-type.md

…tom fields to alerts for TheHive (#207255) (#224591) # Backport This will backport the following commits from `main` to `8.19`: - [Implement functionality to add observables, procedures and custom fields to alerts for TheHive (#207255)](#207255)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Brijesh Khunt <123942796+brijesh-elastic@users.noreply.github.com>

… UI (#224669) ## Summary - This PR unhides rule severity toggle and body jsoneditor in UI. (kept hidden in PR : #207255 ) - Add functional test related to `createAlert` subaction. - Remove unused variables from `translations.ts`. - Remove the custom template description from documentation. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [x] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

… UI (elastic#224669) ## Summary - This PR unhides rule severity toggle and body jsoneditor in UI. (kept hidden in PR : elastic#207255 ) - Add functional test related to `createAlert` subaction. - Remove unused variables from `translations.ts`. - Remove the custom template description from documentation. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [x] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit de031df)

…itor in UI (#224669) (#225023) # Backport This will backport the following commits from `main` to `8.19`: - [[Connector][TheHive] Show rule severity toggle and body jsoneditor in UI (#224669)](#224669)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Brijesh Khunt <123942796+brijesh-elastic@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…lds to alerts for TheHive (elastic#207255) ## Summary - Added a toggle to retain the severity from the rule. When enabled, alerts generated from the rule will inherit its severity; otherwise, users must manually select a severity level from the dropdown. - Added a template selection menu with predefined basic templates. These templates come with preset configurations, including observables and procedures, which automatically populate the Body field upon selection. Users also have the option to modify an existing template or create a custom one using the `Custom Template` option. ## Screenshots ![image (35)](https://github.com/user-attachments/assets/d7a7b6c8-ae27-4ef4-8396-6625ddbd960c) ![image (36)](https://github.com/user-attachments/assets/85314883-a2aa-4a9c-b1e3-ebdd9a5c3e29) ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [x] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

… UI (elastic#224669) ## Summary - This PR unhides rule severity toggle and body jsoneditor in UI. (kept hidden in PR : elastic#207255 ) - Add functional test related to `createAlert` subaction. - Remove unused variables from `translations.ts`. - Remove the custom template description from documentation. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [x] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Implement functionality to add observables, procedures and custom fie…

103b558

…lds to alerts

brijesh-elastic requested a review from a team as a code owner January 20, 2025 18:53

kcreddy added the Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// label Jan 21, 2025

kcreddy added Feature:Cases Cases feature Feature:Actions/ConnectorTypes Issues related to specific Connector Types on the Actions Framework labels Jan 21, 2025

brijesh-elastic added 2 commits January 21, 2025 15:34

Resolve build issue

c8c0320

Update a condition in JsonEditorWithMessageVariables component

ed9ac93

adcoelho approved these changes Jan 27, 2025

View reviewed changes

adcoelho requested a review from semd January 27, 2025 15:38

semd reviewed Jan 27, 2025

View reviewed changes

semd approved these changes Jan 27, 2025

View reviewed changes

cnasikas requested changes Jan 27, 2025

View reviewed changes

cnasikas reviewed Jan 27, 2025

View reviewed changes

semd requested review from semd and removed request for semd January 27, 2025 16:02

brijesh-elastic and others added 2 commits January 29, 2025 11:57

Resolve comments

3623b98

Merge branch 'main' into thehive_enhancement

a9c28c0

brijesh-elastic requested a review from cnasikas January 29, 2025 06:28

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

513d311

…-fix'

cnasikas added release_note:enhancement v9.0.0 backport:prev-minor v8.18.0 labels Jan 29, 2025

cnasikas reviewed Jan 29, 2025

View reviewed changes

Merge branch 'main' into thehive_enhancement

2c84bbe

brijesh-elastic requested review from cnasikas and pmuellr June 16, 2025 14:37

brijesh-elastic and others added 2 commits June 17, 2025 17:40

update snapshot

c1b88de

Merge branch 'main' into thehive_enhancement

6c7cc74

cnasikas reviewed Jun 17, 2025

View reviewed changes

brijesh-elastic and others added 2 commits June 18, 2025 17:09

address pr comments

eae25b0

Merge branch 'main' into thehive_enhancement

4d664bd

brijesh-elastic requested a review from cnasikas June 18, 2025 13:32

brijesh-elastic added 2 commits June 19, 2025 11:11

remove isRuleSeverity reference

80644a2

hide severity toggle

46492e6

cnasikas approved these changes Jun 19, 2025

View reviewed changes

semd merged commit 884e51a into elastic:main Jun 19, 2025
10 checks passed

semd mentioned this pull request Jun 19, 2025

[8.19] Implement functionality to add observables, procedures and custom fields to alerts for TheHive (#207255) #224591

Merged

brijesh-elastic mentioned this pull request Jun 20, 2025

[Connector][TheHive] Show rule severity toggle and body jsoneditor in UI #224669

Merged

7 tasks

florent-leborgne added a commit to florent-leborgne/kibana that referenced this pull request Jul 25, 2025

Missed applies_to in elastic#207255

20377ea

	if ((!xJson && inputTargetValue) \|\| (xJson && inputTargetValue && inputTargetValue !== xJson)) {
	if (inputTargetValue && (!xJson \|\| xJson !== inputTargetValue)) {

	isRuleSeverity: schema.boolean(),
	isRuleSeverity: schema.nullable(schema.boolean({ defaultValue: false })),

	{!isTest && isRuleSeverity && (
	{!isTest && Boolean(isRuleSeverity) && (

Conversation

brijesh-elastic commented Jan 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Screenshots

Checklist

Uh oh!

github-actions bot commented Jan 20, 2025

Uh oh!

elasticmachine commented Jan 21, 2025

Uh oh!

elasticmachine commented Jan 21, 2025

Uh oh!

jcger commented Jan 27, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

semd left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cnasikas Jan 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cnasikas left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

brijesh-elastic commented Jun 19, 2025

Uh oh!

cnasikas left a comment

Choose a reason for hiding this comment

Uh oh!

brijesh-elastic commented Jun 19, 2025

Uh oh!

elasticmachine commented Jun 19, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

brijesh-elastic commented Jan 20, 2025 •

edited

Loading

cnasikas Jan 27, 2025 •

edited

Loading

cnasikas left a comment •

edited

Loading