[Response Ops][Alerting] Implement alert deletion UI

[ymao1]

Blocked by https://github.com/elastic/kibana/issues/208615, https://github.com/elastic/kibana/issues/208789

We would like to allow users the ability to delete their alerts based on certain configuration conditions. This issue covers the UI changes required for the alert deletion MVP and would use the API from https://github.com/elastic/kibana/issues/208789

• This UI should appear on the Stack Management > Rules page under the existing Settings option
• This UI should allow users to enable/disable 2 conditions
  1. delete active alerts created more than N days ago (where N is configurable by the user)
  2. delete inactive alerts that were recovered/closed/untracked more than N days ago (where N is configurable by the user)
• By default, the configuration should show "Delete inactive alerts were recovered, closed or untracked more than 90 days ago"
• This UI should allow users to select whether the setting applies to Observability/Stack/Security alerts (can select 1+)
• This UI should call the "last run" API from https://github.com/elastic/kibana/issues/208615 to show the last time the task was run
• As the user changes the configuration, the UI should call the preview API from https://github.com/elastic/kibana/issues/208789 to show the number of alerts that would be deleted with the current configuration
• If the user changes the rules setting configuration, the UI should show a "Save and Run" button that saves the changes and schedules the task. If the user does not change the configuration, the UI should show a "Run" button that schedules the task
• The UI should be a reusable component that Security Solutions can show in their UI. If it's shown in their UI, the option for Observability/Stack/Security should not be shown, instead it should auto-select Security.

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[cnasikas]

This UI should allow users to select whether the setting applies to Observability/Stack/Security alerts (can select 1+)

I think we should move away from picking solutions. The feedback we get constantly from users is that they do not know to which solution each rule type belongs, and they should not care. What is the reason behind this requirement?

[ymao1]

@cnasikas We specifically asked this question in the RFC and both the O11y and Security product people reviewing the RFC said they thought users should be able to select these options. Perhaps there's something we can do across both this and the maintenance window solution to clarify what it means to pick from the solutions?

[cnasikas]

Thanks @ymao1! I initiated a discussion on Slack with the O11y and Security PMs.