Merge branch 'master' into alerting/licensing-ux

.ci/Jenkinsfile_security_cypress

@@ -10,7 +10,8 @@ kibanaPipeline(timeoutMinutes: 180) {
   ) {
     catchError {
       withEnv([
-        'CI_PARALLEL_PROCESS_NUMBER=1'
+        'CI_PARALLEL_PROCESS_NUMBER=1',
+        'IGNORE_SHIP_CI_STATS_ERROR=true',
       ]) {
         def job = 'xpack-securityCypress'
 

.ci/es-snapshots/Jenkinsfile_verify_es

@@ -26,7 +26,10 @@ kibanaPipeline(timeoutMinutes: 150) {
       message: "[${SNAPSHOT_VERSION}] ES Snapshot Verification Failure",
     ) {
       retryable.enable(2)
-      withEnv(["ES_SNAPSHOT_MANIFEST=${SNAPSHOT_MANIFEST}"]) {
+      withEnv([
+        "ES_SNAPSHOT_MANIFEST=${SNAPSHOT_MANIFEST}",
+        'IGNORE_SHIP_CI_STATS_ERROR=true',
+      ]) {
         parallel([
           'kibana-intake-agent': workers.intake('kibana-intake', './test/scripts/jenkins_unit.sh'),
           'kibana-oss-agent': workers.functional('kibana-oss-tests', { kibanaPipeline.buildOss() }, [

packages/kbn-dev-utils/src/ci_stats_reporter/ship_ci_stats_cli.ts

@@ -22,10 +22,18 @@ export function shipCiStatsCli() {
         throw createFlagError('expected --metrics to be a string');
       }
 
+      const maybeFail = (message: string) => {
+        const error = createFailError(message);
+        if (process.env.IGNORE_SHIP_CI_STATS_ERROR === 'true') {
+          error.exitCode = 0;
+        }
+        return error;
+      };
+
       const reporter = CiStatsReporter.fromEnv(log);
 
       if (!reporter.isEnabled()) {
-        throw createFailError('unable to initilize the CI Stats reporter');
+        throw maybeFail('unable to initilize the CI Stats reporter');
       }
 
       for (const path of metricPaths) {
@@ -35,7 +43,7 @@ export function shipCiStatsCli() {
         if (await reporter.metrics(JSON.parse(json))) {
           log.success('shipped metrics from', path);
         } else {
-          throw createFailError('failed to ship metrics');
+          throw maybeFail('failed to ship metrics');
         }
       }
     },

x-pack/plugins/infra/common/alerting/metrics/types.ts

@@ -4,15 +4,14 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
 import * as rt from 'io-ts';
-import { ANOMALY_THRESHOLD } from '../../infra_ml';
 import { ItemTypeRT } from '../../inventory_models/types';
 
 // TODO: Have threshold and inventory alerts import these types from this file instead of from their
 // local directories
 export const METRIC_THRESHOLD_ALERT_TYPE_ID = 'metrics.alert.threshold';
 export const METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID = 'metrics.alert.inventory.threshold';
-export const METRIC_ANOMALY_ALERT_TYPE_ID = 'metrics.alert.anomaly';
 
 export enum Comparator {
   GT = '>',
@@ -35,26 +34,6 @@ export enum Aggregators {
   P99 = 'p99',
 }
 
-const metricAnomalyNodeTypeRT = rt.union([rt.literal('hosts'), rt.literal('k8s')]);
-const metricAnomalyMetricRT = rt.union([
-  rt.literal('memory_usage'),
-  rt.literal('network_in'),
-  rt.literal('network_out'),
-]);
-const metricAnomalyInfluencerFilterRT = rt.type({
-  fieldName: rt.string,
-  fieldValue: rt.string,
-});
-
-export interface MetricAnomalyParams {
-  nodeType: rt.TypeOf<typeof metricAnomalyNodeTypeRT>;
-  metric: rt.TypeOf<typeof metricAnomalyMetricRT>;
-  alertInterval?: string;
-  sourceId?: string;
-  threshold: Exclude<ANOMALY_THRESHOLD, ANOMALY_THRESHOLD.LOW>;
-  influencerFilter: rt.TypeOf<typeof metricAnomalyInfluencerFilterRT> | undefined;
-}
-
 // Alert Preview API
 const baseAlertRequestParamsRT = rt.intersection([
   rt.partial({
@@ -72,6 +51,7 @@ const baseAlertRequestParamsRT = rt.intersection([
       rt.literal('M'),
       rt.literal('y'),
     ]),
+    criteria: rt.array(rt.any),
     alertInterval: rt.string,
     alertThrottle: rt.string,
     alertOnNoData: rt.boolean,
@@ -85,7 +65,6 @@ const metricThresholdAlertPreviewRequestParamsRT = rt.intersection([
   }),
   rt.type({
     alertType: rt.literal(METRIC_THRESHOLD_ALERT_TYPE_ID),
-    criteria: rt.array(rt.any),
   }),
 ]);
 export type MetricThresholdAlertPreviewRequestParams = rt.TypeOf<
@@ -97,33 +76,15 @@ const inventoryAlertPreviewRequestParamsRT = rt.intersection([
   rt.type({
     nodeType: ItemTypeRT,
     alertType: rt.literal(METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID),
-    criteria: rt.array(rt.any),
   }),
 ]);
 export type InventoryAlertPreviewRequestParams = rt.TypeOf<
   typeof inventoryAlertPreviewRequestParamsRT
 >;
 
-const metricAnomalyAlertPreviewRequestParamsRT = rt.intersection([
-  baseAlertRequestParamsRT,
-  rt.type({
-    nodeType: metricAnomalyNodeTypeRT,
-    metric: metricAnomalyMetricRT,
-    threshold: rt.number,
-    alertType: rt.literal(METRIC_ANOMALY_ALERT_TYPE_ID),
-  }),
-  rt.partial({
-    influencerFilter: metricAnomalyInfluencerFilterRT,
-  }),
-]);
-export type MetricAnomalyAlertPreviewRequestParams = rt.TypeOf<
-  typeof metricAnomalyAlertPreviewRequestParamsRT
->;
-
 export const alertPreviewRequestParamsRT = rt.union([
   metricThresholdAlertPreviewRequestParamsRT,
   inventoryAlertPreviewRequestParamsRT,
-  metricAnomalyAlertPreviewRequestParamsRT,
 ]);
 export type AlertPreviewRequestParams = rt.TypeOf<typeof alertPreviewRequestParamsRT>;
 

x-pack/plugins/infra/common/infra_ml/anomaly_results.ts

@@ -5,44 +5,36 @@
  * 2.0.
  */
 
-export enum ANOMALY_SEVERITY {
-  CRITICAL = 'critical',
-  MAJOR = 'major',
-  MINOR = 'minor',
-  WARNING = 'warning',
-  LOW = 'low',
-  UNKNOWN = 'unknown',
-}
+export const ML_SEVERITY_SCORES = {
+  warning: 3,
+  minor: 25,
+  major: 50,
+  critical: 75,
+};
 
-export enum ANOMALY_THRESHOLD {
-  CRITICAL = 75,
-  MAJOR = 50,
-  MINOR = 25,
-  WARNING = 3,
-  LOW = 0,
-}
+export type MLSeverityScoreCategories = keyof typeof ML_SEVERITY_SCORES;
 
-export const SEVERITY_COLORS = {
-  CRITICAL: '#fe5050',
-  MAJOR: '#fba740',
-  MINOR: '#fdec25',
-  WARNING: '#8bc8fb',
-  LOW: '#d2e9f7',
-  BLANK: '#ffffff',
+export const ML_SEVERITY_COLORS = {
+  critical: 'rgb(228, 72, 72)',
+  major: 'rgb(229, 113, 0)',
+  minor: 'rgb(255, 221, 0)',
+  warning: 'rgb(125, 180, 226)',
 };
 
-export const getSeverityCategoryForScore = (score: number): ANOMALY_SEVERITY | undefined => {
-  if (score >= ANOMALY_THRESHOLD.CRITICAL) {
-    return ANOMALY_SEVERITY.CRITICAL;
-  } else if (score >= ANOMALY_THRESHOLD.MAJOR) {
-    return ANOMALY_SEVERITY.MAJOR;
-  } else if (score >= ANOMALY_THRESHOLD.MINOR) {
-    return ANOMALY_SEVERITY.MINOR;
-  } else if (score >= ANOMALY_THRESHOLD.WARNING) {
-    return ANOMALY_SEVERITY.WARNING;
+export const getSeverityCategoryForScore = (
+  score: number
+): MLSeverityScoreCategories | undefined => {
+  if (score >= ML_SEVERITY_SCORES.critical) {
+    return 'critical';
+  } else if (score >= ML_SEVERITY_SCORES.major) {
+    return 'major';
+  } else if (score >= ML_SEVERITY_SCORES.minor) {
+    return 'minor';
+  } else if (score >= ML_SEVERITY_SCORES.warning) {
+    return 'warning';
   } else {
     // Category is too low to include
-    return ANOMALY_SEVERITY.LOW;
+    return undefined;
   }
 };
 

x-pack/plugins/infra/public/alerting/common/components/alert_preview.tsx

@@ -37,7 +37,7 @@ interface Props {
   alertInterval: string;
   alertThrottle: string;
   alertType: PreviewableAlertTypes;
-  alertParams: { criteria?: any[]; sourceId: string } & Record<string, any>;
+  alertParams: { criteria: any[]; sourceId: string } & Record<string, any>;
   validate: (params: any) => ValidationResult;
   showNoDataResults?: boolean;
   groupByDisplayName?: string;
@@ -109,7 +109,6 @@ export const AlertPreview: React.FC<Props> = (props) => {
   }, [previewLookbackInterval, alertInterval]);
 
   const isPreviewDisabled = useMemo(() => {
-    if (!alertParams.criteria) return false;
     const validationResult = validate({ criteria: alertParams.criteria } as any);
     const hasValidationErrors = Object.values(validationResult.errors).some((result) =>
       Object.values(result).some((arr) => Array.isArray(arr) && arr.length)

x-pack/plugins/infra/public/alerting/common/components/get_alert_preview.ts

@@ -10,15 +10,13 @@ import {
   INFRA_ALERT_PREVIEW_PATH,
   METRIC_THRESHOLD_ALERT_TYPE_ID,
   METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID,
-  METRIC_ANOMALY_ALERT_TYPE_ID,
   AlertPreviewRequestParams,
   AlertPreviewSuccessResponsePayload,
 } from '../../../../common/alerting/metrics';
 
 export type PreviewableAlertTypes =
   | typeof METRIC_THRESHOLD_ALERT_TYPE_ID
-  | typeof METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID
-  | typeof METRIC_ANOMALY_ALERT_TYPE_ID;
+  | typeof METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID;
 
 export async function getAlertPreview({
   fetch,