Prevent removal of actions via the UI from breaking rule AAD (#68184) (…

…#68681)

This fixes #64870 _for real_.

The issue ended up being caused by a
conditional form field that mapped to a nested field on the rule's
params: when a rule is created with an action, it has a
meta.kibana_siem_app_url field. When the rule's actions were removed via
the UI, that field was _also_ removed, which broke AAD and thus rule
execution.

This fixes the issue by making that field unconditional, and also
removes the previous workaround.

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_rule_actions/index.tsx

@@ -158,7 +158,6 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
             {myStepData.throttle !== stepActionsDefaultValue.throttle ? (
               <>
                 <EuiSpacer />
-
                 <UseField
                   path="actions"
                   defaultValue={myStepData.actions}
@@ -167,11 +166,6 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
                     messageVariables: actionMessageParams,
                   }}
                 />
-                <UseField
-                  path="kibanaSiemAppUrl"
-                  defaultValue={kibanaAbsoluteUrl}
-                  component={GhostFormField}
-                />
               </>
             ) : (
               <UseField
@@ -180,6 +174,11 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
                 component={GhostFormField}
               />
             )}
+            <UseField
+              path="kibanaSiemAppUrl"
+              defaultValue={kibanaAbsoluteUrl}
+              component={GhostFormField}
+            />
             <UseField path="enabled" defaultValue={myStepData.enabled} component={GhostFormField} />
           </EuiForm>
         </Form>

x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules_notifications.ts

@@ -45,8 +45,5 @@ export const updateRulesNotifications = async ({
     interval: ruleActions.alertThrottle,
   });
 
-  // TODO: Workaround for https://github.com/elastic/kibana/issues/67290
-  await alertsClient.updateApiKey({ id: ruleAlertId });
-
   return ruleActions;
 };