[AlertZero] Action catalog - #290705
[AlertZero] Action catalog#290705
Conversation
…coped discovery Implements elastic/security-team#19288. - GET /internal/alertzero/actions — lists installed action workflows (tag: action) with optional categories filter; category is a solution-owned keyword, never validated against an enum - ActionsService: tag-driven discovery, consts.actionMetadata projection, skips invalid metadata with a warning - security.alertzero.actions.listByCategory builtin Agent Builder tool wrapping the same service (tool and API cannot drift) - floor_alert_triage worker: configuration_overrides.tools wiring + managed version bump (fingerprint guard updated) Unit-tested at every layer: service, route param parsing, route handler, tool handler.
…l-id doc comment - readActionCategoriesQueryParam now throws InvalidCategoriesError; the route maps it to 400 badRequest with the param message instead of a generic 500 - doc comment on list_actions_by_category_tool referenced the pre-rename camelCase id; corrected to list_by_category - adds route test for the 400 path
|
/ci |
1 similar comment
|
/ci |
|
/ci |
|
/ci |
1 similar comment
|
/ci |
# Conflicts: # x-pack/solutions/security/plugins/alertzero/moon.yml # x-pack/solutions/security/plugins/alertzero/tsconfig.json
|
/ci |
1 similar comment
|
/ci |
b86ec26 to
8c8730b
Compare
|
/ci |
|
/ci |
|
/ci |
|
/ci |
|
/ci |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Reviewed the action catalog change. One concrete issue: the floor_alert_triage definition.version (3) is out of sync with the fingerprint guard test's expected prefix (2:faf316b1), which will fail the managed_workflow_definitions guard. Details inline.
Generated by Claude Reviewer for #290705 · claude · opus · 131.8 AIC · ⌖ 27.3 AIC · ⊞ 5.5K
| management: ALERTZERO_WORKER_MANAGEMENT, | ||
| pluginId: ALERTZERO_MANAGED_WORKFLOW_PLUGIN_ID, | ||
| version: 1, | ||
| version: 3, |
There was a problem hiding this comment.
version is bumped to 3, but the fingerprint guard in managed_workflow_definitions.test.ts expects 2:faf316b1. That test builds `${definition.version}:${createContentFingerprint(importedYaml)}`, so it will compute 3:faf316b1 and fail (expected 2:faf316b1). The version was 1 on main and the YAML changed once here, so this should be 2 to match the guard (the PR description also says "managed version 1 → 2"). If 3 is intentional, the expected fingerprint must be updated to 3:faf316b1 instead.
| version: 3, | |
| version: 2, |
botelastic
Bot
added
the
Team:One Workflow
🔍 Preview links for changed docs⏳ Building and deploying preview... View progress This comment will be updated with preview links when the build is complete. |
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
patrykkopycinski
added
release_note:skip
|
/ci |
💛 Build succeeded, but was flaky
Failed CI Steps
Metrics [docs]
Test Failures
History
|
4 participants
Summary
Implements the AlertZero action catalog (security-team#19288): category-scoped discovery of installed action workflows, exposed both as an internal HTTP API and as an Agent Builder builtin tool so workers can discover actions at runtime instead of hard-coding workflow ids.
Builds on #289683 (action proposals common layer).
API
GET /internal/alertzero/actions?categories=contain,escalatein thealertzeropluginactionwithconsts.actionMetadataare projected to lightweight catalog entries (workflowId,name,description,category,impact,approvalPolicy)categoriesis an OR-set: repeated param (?categories=a&categories=b) or comma-joined (?categories=a,b), at most 20 values, >20 → 400alertzero_readprivilege requiredAgent Builder tool
security.alertzero.actions.list_by_category— builtin, read-only, registered from the alertzero pluginsetup()following the Cases-plugin patternActionsServicein-process (same service as the API) so the tool and API can never driftAGENT_BUILDER_BUILTIN_TOOLSWorker wiring
floor_alert_triagemanaged workflow grants the tool viaconfiguration_overrides.tools; managed version 1 → 2 with the fingerprint guard test updatedDesign notes
managedFilter: 'managed'— action workflows are managed installs in the global space; the search service'sunmanageddefault would filter them all out (caught live in e2e; guarded by a dedicated test)consts.actionMetadataon one workflow is skipped with a warning, never fails the catalogTesting
actions_service(9 incl. managed-filter + paging guards),list_actionsroute (4),read_categories_query_param(8),list_actions_by_category_tool(4), plugin registration mock — alertzero 219/219kbn-workflows2036/2036 (incl. updated fingerprint guard),kbn-alertzero-common17/17Create detection ruleaction with categorytune; filtering verified single/repeated/comma; unknown category → empty not error; 403 without privilege; tool visible in the live Agent Builder registry