[Cases] Bulk add alerts to a case #128875
Labels
Feature:Cases
Cases feature
Team:ResponseOps
Label for the ResponseOps team (formerly the Cases and Alerting teams)
v8.3.0
Summary
At the moment of writing, users can attach one alert to a case per time. This limits users and can be a usability hurdle when users want to attach multiple alerts at once.
Architecture
Each attachment is saved as a saved object record on the
cases-comments
saved object. Each attachment has a type. The typealert
is for alert attachments. The schema of the attachment is:Cases provide two hooks for attaching attachments to a case. Both of them accept an array of attachments. With the current schema, alert attachments are grouped by rule so the consumer of the hooks should group the alerts by rule and create one attachment for each group. For example:
An internal bulk creates API will be created so one call will be made to create the attachments.
UI
A single event in the comment list (user action) will be created for each bulk action. The user can click on the
<number> alerts
text and view the alerts on the alert's table.Reference: https://github.com/elastic/stack-design-team/issues/90#issuecomment-953167079
Limits
Circuit breakers should be put in place to ensure performance. Specifically, one for how many alerts can a user attach with a single action and one for how many alerts a user can attach to a case in total. The first limit is to ensure that not many alert ids and indexes will be saved on the same saved object. The second limit is to ensure that the list of the activity in the single case page view will not grow a lot. Having a load more button on the activity timeline could allow for this limit to be relaxed.
We decided with @kobelb to limit users to 1K alerts per case and per action and relaxed it if needed in the future.
Current user flow
alerts.mp4
Tasks
Related issues
The text was updated successfully, but these errors were encountered: