[9.4] fix(security-solution): preserve Painless scripts and fix group take-actions in bulk close (#289549)

oas_docs/output/kibana.serverless.yaml

@@ -111916,6 +111916,16 @@ components:
           description: Optional map of field name to runtime field type. For each entry, the server defines a runtime field of the given type that reads its value from `_source[fieldName]` and attaches it to the underlying `_update_by_query` as `runtime_mappings`. Allows the `query` to reference non-ECS fields stored on the alert `_source` but not in the alerts index mapping — for example, runtime fields the rule's source index defined at the time the alerts were created. Limited to 100 entries per request; larger maps are rejected.
           maxProperties: 100
           type: object
+        runtime_mappings:
+          additionalProperties:
+            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
+          description: |-
+            Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+            When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+            Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+          maxProperties: 100
+          type: object
         status:
           enum:
             - closed
@@ -115429,6 +115439,29 @@ components:
               $ref: '#/components/schemas/Security_Detections_API_RunScriptOsConfigValues'
       required:
         - command
+    Security_Detections_API_RuntimeFieldMapping:
+      description: A runtime field included in the status-update query so the query can match fields that are not in the alerts index mapping, for example scripted fields on a data view. Elasticsearch evaluates the field at query time.
+      type: object
+      properties:
+        format:
+          description: Format string for date runtime fields, for example `strict_date_optional_time`.
+          maxLength: 100
+          type: string
+        script:
+          additionalProperties: false
+          description: Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.
+          type: object
+          properties:
+            source:
+              description: Painless script source to execute.
+              maxLength: 10000
+              type: string
+          required:
+            - source
+        type:
+          $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldType'
+      required:
+        - type
     Security_Detections_API_RuntimeFieldType:
       description: The data type for the runtime field type. Determines how the field value is indexed and queried.
       enum:
@@ -116004,6 +116037,16 @@ components:
           description: Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.
           maxProperties: 100
           type: object
+        runtime_mappings:
+          additionalProperties:
+            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
+          description: |-
+            Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+            When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+            Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+          maxProperties: 100
+          type: object
         status:
           $ref: '#/components/schemas/Security_Detections_API_AlertStatusExceptClosed'
       required:

oas_docs/output/kibana.yaml

@@ -123161,6 +123161,16 @@ components:
           description: Optional map of field name to runtime field type. For each entry, the server defines a runtime field of the given type that reads its value from `_source[fieldName]` and attaches it to the underlying `_update_by_query` as `runtime_mappings`. Allows the `query` to reference non-ECS fields stored on the alert `_source` but not in the alerts index mapping — for example, runtime fields the rule's source index defined at the time the alerts were created. Limited to 100 entries per request; larger maps are rejected.
           maxProperties: 100
           type: object
+        runtime_mappings:
+          additionalProperties:
+            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
+          description: |-
+            Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+            When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+            Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+          maxProperties: 100
+          type: object
         status:
           enum:
             - closed
@@ -126795,6 +126805,29 @@ components:
               $ref: '#/components/schemas/Security_Detections_API_RunScriptOsConfigValues'
       required:
         - command
+    Security_Detections_API_RuntimeFieldMapping:
+      description: A runtime field included in the status-update query so the query can match fields that are not in the alerts index mapping, for example scripted fields on a data view. Elasticsearch evaluates the field at query time.
+      type: object
+      properties:
+        format:
+          description: Format string for date runtime fields, for example `strict_date_optional_time`.
+          maxLength: 100
+          type: string
+        script:
+          additionalProperties: false
+          description: Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.
+          type: object
+          properties:
+            source:
+              description: Painless script source to execute.
+              maxLength: 10000
+              type: string
+          required:
+            - source
+        type:
+          $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldType'
+      required:
+        - type
     Security_Detections_API_RuntimeFieldType:
       description: The data type for the runtime field type. Determines how the field value is indexed and queried.
       enum:
@@ -127370,6 +127403,16 @@ components:
           description: Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.
           maxProperties: 100
           type: object
+        runtime_mappings:
+          additionalProperties:
+            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
+          description: |-
+            Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+            When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+            Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+          maxProperties: 100
+          type: object
         status:
           $ref: '#/components/schemas/Security_Detections_API_AlertStatusExceptClosed'
       required:

x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/signals/set_signal_status/set_signals_status_route.gen.ts

@@ -49,6 +49,32 @@ export const ReasonEnumEnum = ReasonEnum.enum;
 export const Reason = lazySchema(() => z.union([ReasonEnum, z.string()]));
 export type Reason = z.infer<typeof Reason>;
 
+/**
+ * A runtime field included in the status-update query so the query can match fields that are not in the alerts index mapping, for example scripted fields on a data view. Elasticsearch evaluates the field at query time.
+ */
+export const RuntimeFieldMapping = lazySchema(() =>
+  z.object({
+    type: RuntimeFieldType,
+    /**
+     * Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.
+     */
+    script: z
+      .object({
+        /**
+         * Painless script source to execute.
+         */
+        source: z.string().max(10000),
+      })
+      .strict()
+      .optional(),
+    /**
+     * Format string for date runtime fields, for example `strict_date_optional_time`.
+     */
+    format: z.string().max(100).optional(),
+  })
+);
+export type RuntimeFieldMapping = z.infer<typeof RuntimeFieldMapping>;
+
 export const SetAlertsStatusByIdsBase = lazySchema(() =>
   z.object({
     /**
@@ -86,6 +112,13 @@ export const SetAlertsStatusByQueryBase = lazySchema(() =>
      * Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.
      */
     runtime_fields: z.object({}).catchall(RuntimeFieldType).optional(),
+    /**
+      * Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+      */
+    runtime_mappings: z.object({}).catchall(RuntimeFieldMapping).optional(),
   })
 );
 export type SetAlertsStatusByQueryBase = z.infer<typeof SetAlertsStatusByQueryBase>;
@@ -100,6 +133,13 @@ export const CloseAlertsByQuery = lazySchema(() =>
      * Optional map of field name to runtime field type. For each entry, the server defines a runtime field of the given type that reads its value from `_source[fieldName]` and attaches it to the underlying `_update_by_query` as `runtime_mappings`. Allows the `query` to reference non-ECS fields stored on the alert `_source` but not in the alerts index mapping — for example, runtime fields the rule's source index defined at the time the alerts were created. Limited to 100 entries per request; larger maps are rejected.
      */
     runtime_fields: z.object({}).catchall(RuntimeFieldType).optional(),
+    /**
+      * Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
+Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
+When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
+Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
+      */
+    runtime_mappings: z.object({}).catchall(RuntimeFieldMapping).optional(),
   })
 );
 export type CloseAlertsByQuery = z.infer<typeof CloseAlertsByQuery>;

x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/signals/set_signal_status/set_signals_status_route.schema.yaml

@@ -156,6 +156,38 @@ components:
         [false_positive, duplicate, true_positive, benign_positive, automated_closure, other]
         or a custom reason provided by the user through the advanced settings.
 
+    RuntimeFieldMapping:
+      type: object
+      description: >-
+        A runtime field included in the status-update query so the query
+        can match fields that are not in the alerts index mapping, for
+        example scripted fields on a data view. Elasticsearch evaluates
+        the field at query time.
+      required: [type]
+      properties:
+        type:
+          $ref: '#/components/schemas/RuntimeFieldType'
+        script:
+          type: object
+          additionalProperties: false
+          description: >-
+            Inline Painless script that Elasticsearch evaluates for each alert.
+            Only `source` is accepted. Stored scripts, parameterized scripts
+            (`params`), and non-default `lang` values are not supported. Extra
+            properties are rejected with a 400 so the script is not run with
+            different semantics.
+          required: [source]
+          properties:
+            source:
+              type: string
+              description: Painless script source to execute.
+              maxLength: 10000
+        format:
+          type: string
+          description: >-
+            Format string for date runtime fields, for example
+            `strict_date_optional_time`.
+          maxLength: 100
     SetAlertsStatusByIdsBase:
       type: object
       properties:
@@ -224,6 +256,27 @@ components:
             the query as `runtime_mappings`. Use this to reference fields stored on the
             alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping,
             for example, custom fields that the rule's source index defined when the alerts were created.
+        runtime_mappings:
+          type: object
+          maxProperties: 100
+          additionalProperties:
+            $ref: '#/components/schemas/RuntimeFieldMapping'
+          description: >-
+            Use this when the query references fields that are not in the
+            alerts index mapping, for example data view runtime fields with
+            a Painless script.
+
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch
+            as `runtime_mappings` on the status-update query. Unlike
+            `runtime_fields`, Kibana keeps your script and runs it at query
+            time. It does not replace the script with a `_source` reader.
+
+            When a script is present, Kibana sets `on_script_error` to
+            `continue`. If the script fails on one alert, that field has no
+            value for the alert and the update continues.
+
+            Unique field names across `runtime_fields` and `runtime_mappings`
+            combined cannot exceed 100. Larger maps are rejected.
       required: [query, status]
 
     CloseAlertsByQuery:
@@ -258,6 +311,27 @@ components:
             example, runtime fields the rule's source index defined at the
             time the alerts were created. Limited to 100 entries per
             request; larger maps are rejected.
+        runtime_mappings:
+          type: object
+          maxProperties: 100
+          additionalProperties:
+            $ref: '#/components/schemas/RuntimeFieldMapping'
+          description: >-
+            Use this when the query references fields that are not in the
+            alerts index mapping, for example data view runtime fields with
+            a Painless script.
+
+            Kibana sends `type`, `script.source`, and `format` to Elasticsearch
+            as `runtime_mappings` on the status-update query. Unlike
+            `runtime_fields`, Kibana keeps your script and runs it at query
+            time. It does not replace the script with a `_source` reader.
+
+            When a script is present, Kibana sets `on_script_error` to
+            `continue`. If the script fails on one alert, that field has no
+            value for the alert and the update continues.
+
+            Unique field names across `runtime_fields` and `runtime_mappings`
+            combined cannot exceed 100. Larger maps are rejected.
       required: [query, status]
 
     SetAlertsStatusByQuery: