[Cases] Do not add already attached alerts to the case

[cnasikas]

Summary

This PR filters out all alerts that are already attached to the selected case. To avoid breaking changes and not confuse the users (trying to find which alert is attached to which case) the UI will not produce any error.

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

For maintainers

• This was checked for breaking API changes and was labeled appropriately

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[elasticmachine]

Pinging @elastic/response-ops-cases (Feature:Cases)

[maryam-saeidi]

Did I understand correctly that you want to avoid adding an already attached alert to a case multiple times? If yes, should it also work in observability? I tested this scenario, and the case was added multiple times:

[darnautov]

ML changes tested and LGTM

[cnasikas]

Did I understand correctly that you want to avoid adding an already attached alert to a case multiple times? If yes, should it also work in observability? I tested this scenario, and the case was added multiple times:

Hey @maryam-saeidi! How did you attach the alerts to the case? This should work only from the bulk actions, not the row actions.

[cnasikas]

@elasticmachine merge upstream

[cnasikas]

@elasticmachine merge upstream

[cnasikas]

@elasticmachine merge upstream

[cnasikas]

@elasticmachine merge upstream

[patrykkopycinski]

@elasticmachine merge upstream

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: e03b35e

Failed CI Steps

• FTR Configs #7
• Security Solution Tests #3
• Threat Intelligence Tests #4

Test Failures

• [job] [logs] FTR Configs #7 / cases security and spaces enabled: no_public_base_url push_case incident recorder server should format the comments correctly
• [job] [logs] Threat Intelligence Tests #4 / Indicators Request inspector when inspector button is clicked "before all" hook for "should render the inspector flyout"
• [job] [logs] Security Solution Tests #3 / timeline flyout button the (+) button popover menu owns focus

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
cases	370.6KB	364.0KB	-6.7KB
ml	3.4MB	3.4MB	+7.0B
observability	1.1MB	1.1MB	+14.0B
osquery	1.1MB	1.1MB	+7.0B
securitySolution	15.9MB	15.9MB	+96.0B
threatIntelligence	52.3KB	52.3KB	+7.0B
triggersActionsUi	1.4MB	1.4MB	+752.0B
total			-5.8KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
cases	31	32	+1

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
cases	133.6KB	140.7KB	+7.1KB
triggersActionsUi	84.0KB	84.1KB	+35.0B
total			+7.2KB

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
cases	58	57	-1
securitySolution	433	436	+3
total			+2

Total ESLint disabled count

id	before	after	diff
cases	76	75	-1
securitySolution	512	515	+3
total			+2

History

• 💔 Build #119711 failed 9e70861
• 💔 Build #119693 failed b5f9a73
• 💔 Build #119669 failed a20de6c
• 💔 Build #118994 failed afe554f
• 💔 Build #118974 failed 061eded

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @cnasikas