[Endpoint] Use a search query for alert details

x-pack/plugins/endpoint/common/alert_constants.ts

@@ -13,10 +13,6 @@ export class AlertConstants {
    * The path for the Alert's Index Pattern API.
    */
   static INDEX_PATTERN_ROUTE = `${AlertConstants.BASE_API_URL}/index_pattern`;
-  /**
-   * Alert's Index pattern
-   */
-  static ALERT_INDEX_NAME = 'events-endpoint-1';
   /**
    * A paramter passed to Alert's Index Pattern.
    */

x-pack/plugins/endpoint/server/routes/alerts/details/handlers.ts

@@ -3,10 +3,9 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { GetResponse } from 'elasticsearch';
+import { SearchResponse } from 'elasticsearch';
 import { KibanaRequest, RequestHandler } from 'kibana/server';
 import { AlertEvent } from '../../../../common/types';
-import { AlertConstants } from '../../../../common/alert_constants';
 import { EndpointAppContext } from '../../../types';
 import { AlertDetailsRequestParams } from '../types';
 import { AlertDetailsPagination } from './lib';
@@ -20,23 +19,33 @@ export const alertDetailsHandlerWrapper = function(
     req: KibanaRequest<AlertDetailsRequestParams, unknown, unknown>,
     res
   ) => {
-    try {
-      const alertId = req.params.id;
-      const response = (await ctx.core.elasticsearch.dataClient.callAsCurrentUser('get', {
-        index: AlertConstants.ALERT_INDEX_NAME,
-        id: alertId,
-      })) as GetResponse<AlertEvent>;
+    const logger = endpointAppContext.logFactory.get('alerts');
 
+    try {
       const indexPattern = await endpointAppContext.service
         .getIndexPatternRetriever()
         .getEventIndexPattern(ctx);
 
+      const alertId = req.params.id;
+      const results = (await ctx.core.elasticsearch.dataClient.callAsCurrentUser('search', {
+        index: indexPattern,
+        body: { query: { ids: { values: [alertId] } } },
+      })) as SearchResponse<AlertEvent>;
+
+      if (results.hits.hits.length === 0) {
+        const errMsg = `Unable to find alert id: ${alertId}`;
+        logger.info(errMsg);
+        return res.notFound({ body: errMsg });
+      }
+
+      const alertResponse = results.hits.hits[0];
+
       const config = await endpointAppContext.config();
       const pagination: AlertDetailsPagination = new AlertDetailsPagination(
         config,
         ctx,
         req.params,
-        response,
+        alertResponse._source,
         indexPattern
       );
 
@@ -45,13 +54,13 @@ export const alertDetailsHandlerWrapper = function(
           endpointAppContext,
           requestHandlerContext: ctx,
         },
-        response._source.host.id
+        alertResponse._source.host.id
       );
 
       return res.ok({
         body: {
-          id: response._id,
-          ...response._source,
+          id: alertResponse._id,
+          ...alertResponse._source,
           state: {
             host_metadata: currentHostInfo?.metadata,
           },
@@ -63,6 +72,7 @@ export const alertDetailsHandlerWrapper = function(
       if (err.status === 404) {
         return res.notFound({ body: err });
       }
+      logger.warn(err);
       return res.internalError({ body: err });
     }
   };

x-pack/plugins/endpoint/server/routes/alerts/details/lib/pagination.ts

@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { GetResponse, SearchResponse } from 'elasticsearch';
+import { SearchResponse } from 'elasticsearch';
 import { AlertEvent, AlertHits, AlertAPIOrdering } from '../../../../../common/types';
 import { AlertConstants } from '../../../../../common/alert_constants';
 import { EndpointConfigType } from '../../../../config';
@@ -17,15 +17,12 @@ import { Filter } from '../../../../../../../../src/plugins/data/server';
 /**
  * Pagination class for alert details.
  */
-export class AlertDetailsPagination extends Pagination<
-  AlertDetailsRequestParams,
-  GetResponse<AlertEvent>
-> {
+export class AlertDetailsPagination extends Pagination<AlertDetailsRequestParams, AlertEvent> {
   constructor(
     config: EndpointConfigType,
     requestContext: RequestHandlerContext,
     state: AlertDetailsRequestParams,
-    data: GetResponse<AlertEvent>,
+    data: AlertEvent,
     private readonly indexPattern: string
   ) {
     super(config, requestContext, state, data);
@@ -69,8 +66,8 @@ export class AlertDetailsPagination extends Pagination<
    */
   async getNextUrl(): Promise<string | null> {
     const response = await this.doSearch('asc', [
-      this.data._source['@timestamp'].toString(),
-      this.data._source.event.id,
+      this.data['@timestamp'].toString(),
+      this.data.event.id,
     ]);
     return this.getUrlFromHits(response.hits.hits);
   }
@@ -80,8 +77,8 @@ export class AlertDetailsPagination extends Pagination<
    */
   async getPrevUrl(): Promise<string | null> {
     const response = await this.doSearch('desc', [
-      this.data._source['@timestamp'].toString(),
-      this.data._source.event.id,
+      this.data['@timestamp'].toString(),
+      this.data.event.id,
     ]);
     return this.getUrlFromHits(response.hits.hits);
   }