fix(security-solution): preserve Painless scripts and fix group take-actions in bulk close

oas_docs/output/kibana.serverless.yaml

@@ -480,7 +480,7 @@
         '200':
           description: Returns the OAuth callback script
       summary: ''
       tags: []
       x-state: ''
       x-metaTags:
         - content: Kibana, Elastic Cloud Serverless
@@ -128134,6 +128134,16 @@
           description: Optional map of field name to runtime field type. For each entry, the server defines a runtime field of the given type that reads its value from `_source[fieldName]` and attaches it to the underlying `_update_by_query` as `runtime_mappings`. Allows the `query` to reference non-ECS fields stored on the alert `_source` but not in the alerts index mapping — for example, runtime fields the rule's source index defined at the time the alerts were created. Limited to 100 entries per request; larger maps are rejected.
           maxProperties: 100
           type: object
+        runtime_mappings:
+          additionalProperties:
+            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
+          description: |-
+            Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+            When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+            Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+          maxProperties: 100
+          type: object
         status:
           enum:
             - closed
@@ -131694,6 +131704,29 @@
               $ref: '#/components/schemas/Security_Detections_API_RunScriptOsConfigValues'
       required:
         - command
+    Security_Detections_API_RuntimeFieldMapping:
+      description: A runtime field included in the status-update query so the query can match fields that are not in the alerts index mapping, for example scripted fields on a data view. Elasticsearch evaluates the field at query time.
+      type: object
+      properties:
+        format:
+          description: Format string for date runtime fields, for example `strict_date_optional_time`.
+          maxLength: 100
+          type: string
+        script:
+          additionalProperties: false
+          description: Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.
+          type: object
+          properties:
+            source:
+              description: Painless script source to execute.
+              maxLength: 10000
+              type: string
+          required:
+            - source
+        type:
+          $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldType'
+      required:
+        - type
     Security_Detections_API_RuntimeFieldType:
       description: The data type for the runtime field type. Determines how the field value is indexed and queried.
       enum:
@@ -132269,6 +132302,16 @@
           description: Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.
           maxProperties: 100
           type: object
+        runtime_mappings:
+          additionalProperties:
+            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
+          description: |-
+            Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+            When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+            Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+          maxProperties: 100
+          type: object
         status:
           $ref: '#/components/schemas/Security_Detections_API_AlertStatusExceptClosed'
       required:

oas_docs/output/kibana.yaml

@@ -544,7 +544,7 @@
         '200':
           description: Returns the OAuth callback script
       summary: ''
       tags: []
       x-state: Added in 9.4.0
       x-metaTags:
         - content: Kibana
@@ -135939,6 +135939,16 @@
           description: Optional map of field name to runtime field type. For each entry, the server defines a runtime field of the given type that reads its value from `_source[fieldName]` and attaches it to the underlying `_update_by_query` as `runtime_mappings`. Allows the `query` to reference non-ECS fields stored on the alert `_source` but not in the alerts index mapping — for example, runtime fields the rule's source index defined at the time the alerts were created. Limited to 100 entries per request; larger maps are rejected.
           maxProperties: 100
           type: object
+        runtime_mappings:
+          additionalProperties:
+            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
+          description: |-
+            Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+            When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+            Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+          maxProperties: 100
+          type: object
         status:
           enum:
             - closed
@@ -139620,6 +139630,29 @@
               $ref: '#/components/schemas/Security_Detections_API_RunScriptOsConfigValues'
       required:
         - command
+    Security_Detections_API_RuntimeFieldMapping:
+      description: A runtime field included in the status-update query so the query can match fields that are not in the alerts index mapping, for example scripted fields on a data view. Elasticsearch evaluates the field at query time.
+      type: object
+      properties:
+        format:
+          description: Format string for date runtime fields, for example `strict_date_optional_time`.
+          maxLength: 100
+          type: string
+        script:
+          additionalProperties: false
+          description: Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.
+          type: object
+          properties:
+            source:
+              description: Painless script source to execute.
+              maxLength: 10000
+              type: string
+          required:
+            - source
+        type:
+          $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldType'
+      required:
+        - type
     Security_Detections_API_RuntimeFieldType:
       description: The data type for the runtime field type. Determines how the field value is indexed and queried.
       enum:
@@ -140195,6 +140228,16 @@
           description: Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.
           maxProperties: 100
           type: object
+        runtime_mappings:
+          additionalProperties:
+            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
+          description: |-
+            Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+            When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+            Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+          maxProperties: 100
+          type: object
         status:
           $ref: '#/components/schemas/Security_Detections_API_AlertStatusExceptClosed'
       required:

x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/signals/set_signal_status/set_signals_status_route.gen.ts

@@ -29,6 +29,39 @@ export type RuntimeFieldType = z.infer<typeof RuntimeFieldType>;
 export type RuntimeFieldTypeEnum = typeof RuntimeFieldType.enum;
 export const RuntimeFieldTypeEnum = RuntimeFieldType.enum;
 
+/**
+ * A runtime field included in the status-update query so the query can match fields that are not in the alerts index mapping, for example scripted fields on a data view. Elasticsearch evaluates the field at query time.
+ */
+export const RuntimeFieldMapping = lazySchema(() =>
+  z.object({
+    type: RuntimeFieldType,
+    /**
+     * Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.
+     */
+    script: z
+      .object({
+        /**
+         * Painless script source to execute.
+         */
+        source: z.string().max(10000).describe('Painless script source to execute.'),
+      })
+      .strict()
+      .optional()
+      .describe(
+        'Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.'
+      ),
+    /**
+     * Format string for date runtime fields, for example `strict_date_optional_time`.
+     */
+    format: z
+      .string()
+      .max(100)
+      .optional()
+      .describe('Format string for date runtime fields, for example `strict_date_optional_time`.'),
+  })
+);
+export type RuntimeFieldMapping = z.infer<typeof RuntimeFieldMapping>;
+
 export const SetAlertsStatusByIdsBase = lazySchema(() =>
   z.object({
     /**
@@ -82,6 +115,19 @@ export const SetAlertsStatusByQueryBase = lazySchema(() =>
       .describe(
         "Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created."
       ),
+    /**
+      * Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+      */
+    runtime_mappings: z
+      .object({})
+      .catchall(RuntimeFieldMapping)
+      .optional()
+      .describe(
+        'Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.\nKibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.\nWhen a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.\nUnique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.'
+      ),
   })
 );
 export type SetAlertsStatusByQueryBase = z.infer<typeof SetAlertsStatusByQueryBase>;
@@ -102,6 +148,19 @@ export const CloseAlertsByQuery = lazySchema(() =>
       .describe(
         "Optional map of field name to runtime field type. For each entry, the server defines a runtime field of the given type that reads its value from `_source[fieldName]` and attaches it to the underlying `_update_by_query` as `runtime_mappings`. Allows the `query` to reference non-ECS fields stored on the alert `_source` but not in the alerts index mapping — for example, runtime fields the rule's source index defined at the time the alerts were created. Limited to 100 entries per request; larger maps are rejected."
       ),
+    /**
+      * Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+      */
+    runtime_mappings: z
+      .object({})
+      .catchall(RuntimeFieldMapping)
+      .optional()
+      .describe(
+        'Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.\nKibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.\nWhen a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.\nUnique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.'
+      ),
   })
 );
 export type CloseAlertsByQuery = z.infer<typeof CloseAlertsByQuery>;

x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/signals/set_signal_status/set_signals_status_route.schema.yaml

@@ -153,6 +153,39 @@ components:
         - geo_point
       description: >-
         The data type for the runtime field type. Determines how the field value is indexed and queried.
+
+    RuntimeFieldMapping:
+      type: object
+      description: >-
+        A runtime field included in the status-update query so the query
+        can match fields that are not in the alerts index mapping, for
+        example scripted fields on a data view. Elasticsearch evaluates
+        the field at query time.
+      required: [type]
+      properties:
+        type:
+          $ref: '#/components/schemas/RuntimeFieldType'
+        script:
+          type: object
+          additionalProperties: false
+          description: >-
+            Inline Painless script that Elasticsearch evaluates for each alert.
+            Only `source` is accepted. Stored scripts, parameterized scripts
+            (`params`), and non-default `lang` values are not supported. Extra
+            properties are rejected with a 400 so the script is not run with
+            different semantics.
+          required: [source]
+          properties:
+            source:
+              type: string
+              description: Painless script source to execute.
+              maxLength: 10000
+        format:
+          type: string
+          description: >-
+            Format string for date runtime fields, for example
+            `strict_date_optional_time`.
+          maxLength: 100
     SetAlertsStatusByIdsBase:
       type: object
       properties:
@@ -221,6 +254,27 @@ components:
             the query as `runtime_mappings`. Use this to reference fields stored on the
             alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping,
             for example, custom fields that the rule's source index defined when the alerts were created.
+        runtime_mappings:
+          type: object
+          maxProperties: 100
+          additionalProperties:
+            $ref: '#/components/schemas/RuntimeFieldMapping'
+          description: >-
+            Use this when the query references fields that are not in the
+            alerts index mapping, for example data view runtime fields with
+            a Painless script.
+
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch
+            as `runtime_mappings` on the status-update query. Unlike
+            `runtime_fields`, Kibana keeps your script and runs it at query
+            time. It does not replace the script with a `_source` reader.
+
+            When a script is present, Kibana sets `on_script_error` to
+            `continue`. If the script fails on one alert, that field has no
+            value for the alert and the update continues.
+
+            Unique field names across `runtime_fields` and `runtime_mappings`
+            combined cannot exceed 100. Larger maps are rejected.
       required: [query, status]
 
     CloseAlertsByQuery:
@@ -255,6 +309,27 @@ components:
             example, runtime fields the rule's source index defined at the
             time the alerts were created. Limited to 100 entries per
             request; larger maps are rejected.
+        runtime_mappings:
+          type: object
+          maxProperties: 100
+          additionalProperties:
+            $ref: '#/components/schemas/RuntimeFieldMapping'
+          description: >-
+            Use this when the query references fields that are not in the
+            alerts index mapping, for example data view runtime fields with
+            a Painless script.
+
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch
+            as `runtime_mappings` on the status-update query. Unlike
+            `runtime_fields`, Kibana keeps your script and runs it at query
+            time. It does not replace the script with a `_source` reader.
+
+            When a script is present, Kibana sets `on_script_error` to
+            `continue`. If the script fails on one alert, that field has no
+            value for the alert and the update continues.
+
+            Unique field names across `runtime_fields` and `runtime_mappings`
+            combined cannot exceed 100. Larger maps are rejected.
       required: [query, status]
 
     SetAlertsStatusByQuery: