Skip to content

[Alerting V2] Register "assign episode" workflow trigger#268915

Merged
adcoelho merged 32 commits into
elastic:mainfrom
adcoelho:alerting-v2-workflow-trigger-assign-episode
Jun 2, 2026
Merged

[Alerting V2] Register "assign episode" workflow trigger#268915
adcoelho merged 32 commits into
elastic:mainfrom
adcoelho:alerting-v2-workflow-trigger-assign-episode

Conversation

@adcoelho

@adcoelho adcoelho commented May 12, 2026

Copy link
Copy Markdown
Contributor

Closes #264977

Summary

  • This PR registers a new workflow trigger type for alerting episode assignment.
  • This specific event is emitted by the (bulk) create action APIs when:
    • The action type is assign.
    • The assignee is not null.

Testing

Create a workflow that uses the new trigger:

name: New workflow
description: This is a new workflow
enabled: true

triggers:
  - type: alertingV2.episodeAssigned
    on:
      condition: 'event.ruleId: *'

steps:
  - name: hello_world_step
    type: cases.addComment
    with:
      case_id: "2be77e8a-d26a-4290-b192-b7c9854c92f8"
      comment: "It works!"
  1. Assign an episode to any user.
  2. Confirm in the workflow's execution tab that it ran successfully
  3. Confirm that the event data was populated properly
  4. Test different conditions, steps, and comments.

@adcoelho adcoelho requested a review from umbopepato May 12, 2026 14:11
@adcoelho adcoelho self-assigned this May 12, 2026
@adcoelho adcoelho requested review from a team as code owners May 12, 2026 14:11
@adcoelho adcoelho added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// labels May 12, 2026
@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

Pinging @elastic/response-ops (Team:ResponseOps)

@botelastic botelastic Bot added the Team:One Workflow Team label for One Workflow (Workflow automation) label May 12, 2026
Comment thread x-pack/platform/plugins/shared/alerting_v2/server/setup/bind_services.ts Outdated
@cnasikas cnasikas self-requested a review May 14, 2026 11:18
@cnasikas cnasikas marked this pull request as draft May 20, 2026 08:22
@cnasikas cnasikas force-pushed the alerting-v2-workflow-trigger-assign-episode branch from 96980ed to 2714f6f Compare May 21, 2026 12:03
@adcoelho adcoelho marked this pull request as ready for review May 21, 2026 14:41
@cnasikas cnasikas self-assigned this May 21, 2026
@adcoelho adcoelho requested a review from a team as a code owner May 22, 2026 18:29
import { z } from '@kbn/zod/v4';
import type { CommonTriggerDefinition } from '@kbn/workflows-extensions/common';

export const EPISODE_ASSIGNED_TRIGGER_ID = 'alertingV2.episodeAssigned' as const;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we really need to specify V2 here? isn't that an implementation detail?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We want to distinguish between the existing alerting and the new one (v2) in case we want to introduce triggers for the v1 alerting in the future. Any suggestions?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

don't have any suggestions atm, maybe @tinnytintin10 could help

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discussed briefly this one with @tinnytintin10, suggestion is to remove V2 from name, as it also felt a bit as implementation detail. The next step will be for us to offer extra metadata for supporting V1 and V2 if you decide to ship something for alerting V1. Also you can explicitly put in the description that this one is related to V2 if that could help users further, wdyt?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tiamliu based on our recent conversations around how to cater to "mixed experiences" effectively, please check my thinking here?

I think we should call these kinds of events/triggers "alerting.[event_name]" and as much as possible make them version-agnostic. For events that apply to both, we can send them through the same flow, and include "version" as a payload discriminator for people who only want to handle one or the other for some reason (likely suggested by a consultant, support, etc).

Very rough examples:

for alerting.ruleSnoozed
payload might be

{
  "rule.id":  "some-id-for-rule",
  "alerting.version": 2,
  "timestamp": //...
    // ...etc
}

for alerting.alertAssigned and alerting.alertAcknowledged, maybe only v2 alerts have these features, but that's still okay.

Thoughts?

@tinnytintin10 tinnytintin10 Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we actually want event-driven triggers for v1?

maybe we can make a deliberate product choice that event driven triggers are v2-only. v1 users still have the run workflow action, so they can invoke workflows when alerts fire or recover. event-driven triggers would only come with v2, and only show up once v2 features are enabled. If users want event driven triggers, that's a reason to move to v2. i think this would enable us to:

  1. sidesteps the whole naming question here. If there's never a v1 trigger to disambiguate from, we don't need the version in the ID and can just call it alerting.episodeAssigned.
  2. and on the product side, event-driven automation is exactly the kind of capability that pulls people toward v2, instead of us building it twice for a framework we're winding down.

wdyt @jasonrhodes @tiamliu

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My first instinct is to say I think this is a really good idea. We need to support v1 rules and alerts for a long time, likely, as users will want to continue using their existing rules and put off migration as long as possible even if we make it easy, but that doesn't mean we need to give v1 rules every new thing.

If we do get pressure to add these down the road, let's let those events bear the burden of naming with something like alerting.classic.{trigger_name} or alerting.legacy.{trigger_name} depending on how far down the road we are when we decide we want it. I may be missing some context that makes this not work, so I'll check with Tia and others on our side, but on first glance I think this is a nice solution.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a good middle ground. We can deliberately choose to support event triggers in alerting v2 only. In alerting v1, workflows can be attached as an action and can already be triggered per execution. If we make this a v2 only thing , it also gives users incentive to migrate. Thanks for all your thorough considerations @cnasikas @jasonrhodes @tinnytintin10

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you all! I also agree. I will go with alerting.episodeAssigned then. Thanks!

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yngrdyn @tinnytintin10 I pushed the changes. Could you plz take another look?

@TamerlanG TamerlanG removed the request for review from a team May 25, 2026 11:33
@cnasikas

Copy link
Copy Markdown
Member

@elasticmachine merge upstream

*/
export const APPROVED_TRIGGER_DEFINITIONS: Array<{ id: string; schemaHash: string }> = [
{
id: 'alertingV2.episodeAssigned',

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You probably need to change this as well

@yngrdyn yngrdyn left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

@kibanamachine

Copy link
Copy Markdown
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] Scout Lane #2 - stateful-classic / default / local-stateful-classic - Query streams - Delete query stream - should support deleting an existing query stream

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
alertingVTwo 1283 1287 +4

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
alertingVTwo 963.2KB 964.7KB +1.5KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
alertingVTwo 48.4KB 51.1KB +2.6KB
Unknown metric groups

async chunk count

id before after diff
alertingVTwo 17 18 +1

History

cc @adcoelho @cnasikas

@adcoelho adcoelho merged commit c20748c into elastic:main Jun 2, 2026
33 checks passed
qn895 pushed a commit to qn895/kibana that referenced this pull request Jun 4, 2026
)

Closes elastic#264977

## Summary

- This PR registers a new workflow trigger type for alerting episode
assignment.
- This specific event is emitted by the (bulk) create action APIs when:
  - The action type is `assign`.
  - The assignee is not `null`.

## Testing

Create a workflow that uses the new trigger:

```
name: New workflow
description: This is a new workflow
enabled: true

triggers:
  - type: alertingV2.episodeAssigned
    on:
      condition: 'event.ruleId: *'

steps:
  - name: hello_world_step
    type: cases.addComment
    with:
      case_id: "2be77e8a-d26a-4290-b192-b7c9854c92f8"
      comment: "It works!"
```

1. Assign an episode to any user.
2. Confirm in the workflow's `execution` tab that it ran successfully
3. Confirm that the event data was populated properly
4. Test different conditions, steps, and comments.

---------

Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
patrykkopycinski pushed a commit to patrykkopycinski/kibana that referenced this pull request Jun 5, 2026
)

Closes elastic#264977

## Summary

- This PR registers a new workflow trigger type for alerting episode
assignment.
- This specific event is emitted by the (bulk) create action APIs when:
  - The action type is `assign`.
  - The assignee is not `null`.

## Testing

Create a workflow that uses the new trigger:

```
name: New workflow
description: This is a new workflow
enabled: true

triggers:
  - type: alertingV2.episodeAssigned
    on:
      condition: 'event.ruleId: *'

steps:
  - name: hello_world_step
    type: cases.addComment
    with:
      case_id: "2be77e8a-d26a-4290-b192-b7c9854c92f8"
      comment: "It works!"
```

1. Assign an episode to any user.
2. Confirm in the workflow's `execution` tab that it ran successfully
3. Confirm that the event data was populated properly
4. Test different conditions, steps, and comments.

---------

Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
@nastasha-solomon nastasha-solomon added the av2-docs-needed Tracks PRs that may need v2 alerting docs label Jun 8, 2026
tfcmarques pushed a commit to tfcmarques/kibana that referenced this pull request Jun 11, 2026
)

Closes elastic#264977

## Summary

- This PR registers a new workflow trigger type for alerting episode
assignment.
- This specific event is emitted by the (bulk) create action APIs when:
  - The action type is `assign`.
  - The assignee is not `null`.

## Testing

Create a workflow that uses the new trigger:

```
name: New workflow
description: This is a new workflow
enabled: true

triggers:
  - type: alertingV2.episodeAssigned
    on:
      condition: 'event.ruleId: *'

steps:
  - name: hello_world_step
    type: cases.addComment
    with:
      case_id: "2be77e8a-d26a-4290-b192-b7c9854c92f8"
      comment: "It works!"
```

1. Assign an episode to any user.
2. Confirm in the workflow's `execution` tab that it ran successfully
3. Confirm that the event data was populated properly
4. Test different conditions, steps, and comments.

---------

Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

av2-docs-needed Tracks PRs that may need v2 alerting docs backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:One Workflow Team label for One Workflow (Workflow automation) Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// v9.5.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Alerting V2] Add workflow event triggers for when an episode is assigned to a user

10 participants