[Security Solution][Detections] Extend alerts schema to accommodate the list of assigned users (#7647)

[e40pud]

Summary

Closes https://github.com/elastic/security-team/issues/7647

This PR extends alert's schema. We add a new field kibana.alert.workflow_assignee_ids where assignees will live.

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[vitaliidm]

as ALERT_WORKFLOW_ASSIGNEE_IDS defined as not required

  [ALERT_WORKFLOW_ASSIGNEE_IDS]: {
    type: 'keyword',
    array: true,
    required: false,
  },

should it be added here as optional property?

[e40pud]

good question, I mimicked the same behaviour we have for workflow_tags that we introduced in 8.9 https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/common/api/detection_engine/model/alerts/8.9.0/index.ts#L29. It is also not required.

@dplumlee do you remember why we skipped making tags optional property?

[e40pud]

Made this field optional, @dplumlee let me know if there is a reason to keep it required here.

[dplumlee]

I don't recall if there was a specific reason for not making the tags optional here, I believe since it was a new field, our use case just wanted to always count on it being there. I think the right way to go is keeping it aligned with the field maps definition as @vitaliidm points out though, I probably shouldn't have listed ours as optional in that file.

[stephmilovic]

LGTM from explore side, thanks!

[vitaliidm]

it looks good to me
Left comment on optional typing: with undefined it still will be required to pass everywhere, so proposing to use question mark
just one, note, once you make ALERT_WORKFLOW_ASSIGNEE_IDS I don't think you need to add empty array everywhere

[kibana-ci]

💔 Build Failed

• Buildkite Build
• Commit: 3d49abc
• Interpreting CI Failures

Failed CI Steps

• Osquery Cypress Tests #3
• Post-Build

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [d508c9e]

History

• 💔 Build #161193 failed 3d49abc
• 💔 Build #161148 failed e36611d
• 💚 Build #160675 succeeded 8bd99a0
• 💛 Build #160416 was flaky b79f3f8

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @e40pud