Research bi-directional action types

[mikecote]

Research what it would take to accomplish #51636.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[pmuellr]

Let's get some use-cases listed!

here's one:

from #51636 (comment) :

a Slack message with a button that can Ack the alert

We don't have "Ack"ing for alerts yet, but we do have mute/un-mute/throttle kinda stuff. At the previous job, we had some Slack alerts that did this kind of thing, was SUPER useful to be able to silence a wall of noise in Slack, right from Slack.

[gmmorris]

Things to think about in this context:
Does ACKing require a concept of an Alert Instance having a start and an end?
Would ACKing an Alert Instance mean that if it comes up again on the next run we don't include it? Do we include it in some semi-muted state so it appears in the Details Page, but doesn't fire actions?

Just some things that crossed my mind reading the issue.

[pmuellr]

Does ACKing require a concept of an Alert Instance having a start and an end?
Would ACKing an Alert Instance mean that if it comes up again on the next run we don't include it?

Great questions about ACKing, which AFAIK is not related at all to bi-directional action types. We should probably open up a separate discuss issue on ACKing alerts when we're ready to discuss it ...

[gmmorris]

Haha, fair enough... you brought it up ;)

[mikecote]

Another use case:

Update a document in Kibana when a ServiceNow case has been closed. The bi-directionality here would be to check the case on an interval basis until a condition is met, then update document in Kibana.

The challenge here is to keep the credentials (API Key) of the person who originally invoked the action to lookup the case's status at a future time.

[mikecote]

Example from @alexfrancoeur

The example I give is Slack and being able to acknowledge, mute or snooze and alert from a slack message

[alexfrancoeur]

There are many out there, but here's one example from OpsGenie. If we intend to eventually introduce ownership and acknowledgement natively from Kibana alerts, supporting this use case and functionality probably makes sense. Otherwise, we can defer to third party tools (like OpsGenie or PagerDuty)

https://docs.opsgenie.com/docs/slack-app-integration

[mikecote]

Closing issue and merging with #51636.