[AlertZero] Action catalog - #290705
Draft
patrykkopycinski wants to merge 6 commits into
Draft
Conversation
…coped discovery Implements elastic/security-team#19288. - GET /internal/alertzero/actions — lists installed action workflows (tag: action) with optional categories filter; category is a solution-owned keyword, never validated against an enum - ActionsService: tag-driven discovery, consts.actionMetadata projection, skips invalid metadata with a warning - security.alertzero.actions.listByCategory builtin Agent Builder tool wrapping the same service (tool and API cannot drift) - floor_alert_triage worker: configuration_overrides.tools wiring + managed version bump (fingerprint guard updated) Unit-tested at every layer: service, route param parsing, route handler, tool handler.
…l-id doc comment - readActionCategoriesQueryParam now throws InvalidCategoriesError; the route maps it to 400 badRequest with the param message instead of a generic 500 - doc comment on list_actions_by_category_tool referenced the pre-rename camelCase id; corrected to list_by_category - adds route test for the 400 path
|
🤖 Jobs for this PR can be triggered through checkboxes. 🚧
ℹ️ To trigger the CI, please tick the checkbox below 👇
|
This was referenced Sep 12, 2026
Contributor
Author
|
/ci |
1 similar comment
Contributor
Author
|
/ci |
Contributor
Author
|
/ci |
Contributor
Author
|
/ci |
1 similar comment
Contributor
Author
|
/ci |
# Conflicts: # x-pack/solutions/security/plugins/alertzero/moon.yml # x-pack/solutions/security/plugins/alertzero/tsconfig.json
Contributor
Author
|
/ci |
1 similar comment
Contributor
Author
|
/ci |
Contributor
⏳ Build in-progress, with failures
Failed CI StepsHistory
|
patrykkopycinski
force-pushed
the
alertzero/action-catalog
branch
from
September 14, 2026 13:12
b86ec26 to
8c8730b
Compare
Contributor
Author
|
/ci |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the AlertZero action catalog (security-team#19288): category-scoped discovery of installed action workflows, exposed both as an internal HTTP API and as an Agent Builder builtin tool so workers can discover actions at runtime instead of hard-coding workflow ids.
Builds on #289683 (action proposals common layer).
API
GET /internal/alertzero/actions?categories=contain,escalatein thealertzeropluginactionwithconsts.actionMetadataare projected to lightweight catalog entries (workflowId,name,description,category,impact,approvalPolicy)categoriesis an OR-set: repeated param (?categories=a&categories=b) or comma-joined (?categories=a,b), at most 20 values, >20 → 400alertzero_readprivilege requiredAgent Builder tool
security.alertzero.actions.list_by_category— builtin, read-only, registered from the alertzero pluginsetup()following the Cases-plugin patternActionsServicein-process (same service as the API) so the tool and API can never driftAGENT_BUILDER_BUILTIN_TOOLSWorker wiring
floor_alert_triagemanaged workflow grants the tool viaconfiguration_overrides.tools; managed version 1 → 2 with the fingerprint guard test updatedDesign notes
managedFilter: 'managed'— action workflows are managed installs in the global space; the search service'sunmanageddefault would filter them all out (caught live in e2e; guarded by a dedicated test)consts.actionMetadataon one workflow is skipped with a warning, never fails the catalogTesting
actions_service(9 incl. managed-filter + paging guards),list_actionsroute (4),read_categories_query_param(8),list_actions_by_category_tool(4), plugin registration mock — alertzero 219/219kbn-workflows2036/2036 (incl. updated fingerprint guard),kbn-alertzero-common17/17Create detection ruleaction with categorytune; filtering verified single/repeated/comma; unknown category → empty not error; 403 without privilege; tool visible in the live Agent Builder registry