[ResponseOps][Rules] Add custom query description field to rules (#240956)

## Summary

closes #240081

## QA
create a rule with type:
- Synthetics monitor status (xpack.synthetics.alerts.monitorStatus)
- Synthetics TLS certificate (xpack.synthetics.alerts.tls)

check the rule detail page, it should now include the query

<img width="376" height="275" alt="Screenshot 2025-10-28 at 11 09 50"
src="https://github.com/user-attachments/assets/1b560098-42a2-4c7f-903a-56a5d1198e6f"
/>

---------

Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Francesco Fagnani <[email protected]>

Author: 3 people

x-pack/solutions/observability/plugins/synthetics/public/apps/synthetics/lib/alert_types/get_description_fields.test.tsx

@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { RULE_PREBUILD_DESCRIPTION_FIELDS } from '@kbn/triggers-actions-ui-plugin/public';
+import type { Rule, PrebuildFieldsMap } from '@kbn/triggers-actions-ui-plugin/public/types';
+import type { HttpSetup } from '@kbn/core/public';
+import { getDescriptionFields } from './get_description_fields';
+import type { TLSRuleParams } from '@kbn/response-ops-rule-params/synthetics_tls';
+
+describe('synthetics getDescriptionFields', () => {
+  const indexField = { type: 'indexPattern', value: 'synthetics-*' };
+  const mockPrebuildField = jest.fn();
+  const mockPrebuildFields = {
+    [RULE_PREBUILD_DESCRIPTION_FIELDS.CUSTOM_QUERY]: mockPrebuildField,
+    [RULE_PREBUILD_DESCRIPTION_FIELDS.INDEX_PATTERN]: jest.fn().mockReturnValue(indexField),
+  } as unknown as PrebuildFieldsMap;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should return empty array when rule is not provided', () => {
+    const result = getDescriptionFields({
+      rule: undefined as unknown as Rule<TLSRuleParams>,
+      prebuildFields: mockPrebuildFields,
+      http: {} as HttpSetup,
+    });
+
+    expect(result).toEqual([]);
+  });
+
+  it('should return empty array when prebuildFields is not provided', () => {
+    const mockRule = {
+      params: {
+        kqlQuery: '_id: *',
+      },
+    } as unknown as Rule<TLSRuleParams>;
+
+    const result = getDescriptionFields({
+      rule: mockRule,
+      prebuildFields: undefined,
+      http: {} as HttpSetup,
+    });
+
+    expect(result).toEqual([]);
+  });
+
+  it('should return empty array when both rule and prebuildFields are not provided', () => {
+    const result = getDescriptionFields({
+      rule: undefined as unknown as Rule<TLSRuleParams>,
+      prebuildFields: undefined,
+      http: {} as HttpSetup,
+    });
+
+    expect(result).toEqual([]);
+  });
+
+  it('should return the custom query', () => {
+    const mockRule = {
+      params: {
+        kqlQuery: '_id: *',
+      },
+    } as unknown as Rule<TLSRuleParams>;
+
+    const mockReturnValue = { type: 'customQuery', value: '_id: *' };
+    mockPrebuildField.mockReturnValue(mockReturnValue);
+
+    const result = getDescriptionFields({
+      rule: mockRule,
+      prebuildFields: mockPrebuildFields,
+      http: {} as HttpSetup,
+    });
+
+    expect(mockPrebuildField).toHaveBeenCalledWith('_id: *');
+    expect(result).toEqual([indexField, mockReturnValue]);
+  });
+});

x-pack/solutions/observability/plugins/synthetics/public/apps/synthetics/lib/alert_types/get_description_fields.ts

@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { TLSRuleParams } from '@kbn/response-ops-rule-params/synthetics_tls';
+import type { GetDescriptionFieldsFn } from '@kbn/triggers-actions-ui-plugin/public/types';
+import type { SyntheticsMonitorStatusRuleParams } from '@kbn/response-ops-rule-params/synthetics_monitor_status';
+import { SYNTHETICS_INDEX_PATTERN } from '../../../../../common/constants/ui';
+
+export const getDescriptionFields: GetDescriptionFieldsFn<
+  TLSRuleParams | SyntheticsMonitorStatusRuleParams
+> = ({ rule, prebuildFields }) => {
+  if (!rule || !prebuildFields) {
+    return [];
+  }
+
+  const fields = [prebuildFields.indexPattern([SYNTHETICS_INDEX_PATTERN])];
+
+  if (rule.params.kqlQuery) {
+    fields.push(prebuildFields.customQuery(rule.params.kqlQuery));
+  }
+
+  return fields;
+};

x-pack/solutions/observability/plugins/synthetics/public/apps/synthetics/lib/alert_types/monitor_status.tsx

@@ -16,6 +16,7 @@ import { getSyntheticsErrorRouteFromMonitorId } from '../../../../../common/util
 import { STATE_ID } from '../../../../../common/field_names';
 import { SyntheticsMonitorStatusTranslations } from '../../../../../common/rules/synthetics/translations';
 import type { AlertTypeInitializer } from './types';
+import { getDescriptionFields } from './get_description_fields';
 
 const { defaultActionMessage, defaultRecoveryMessage, description } =
   SyntheticsMonitorStatusTranslations;
@@ -51,4 +52,5 @@ export const initMonitorStatusAlertType: AlertTypeInitializer = ({
       }),
     };
   },
+  getDescriptionFields,
 });

x-pack/solutions/observability/plugins/synthetics/public/apps/synthetics/lib/alert_types/tls.tsx

@@ -15,6 +15,7 @@ import { TlsTranslations } from '../../../../../common/rules/synthetics/translat
 import { CERTIFICATES_ROUTE } from '../../../../../common/constants/ui';
 
 import type { AlertTypeInitializer } from './types';
+import { getDescriptionFields } from './get_description_fields';
 
 let validateFunc: (ruleParams: any) => ValidationResult;
 
@@ -55,4 +56,5 @@ export const initTlsAlertType: AlertTypeInitializer = ({
     reason: fields[ALERT_REASON] || '',
     link: `/app/synthetics${CERTIFICATES_ROUTE}`,
   }),
+  getDescriptionFields,
 });