Fix dupe detection on upgrade

x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_wrapper.ts

@@ -46,7 +46,9 @@ export const createPersistenceRuleTypeWrapper: CreatePersistenceRuleTypeWrapper
                     body: {
                       query: {
                         ids: {
-                          values: alertChunk.map((alert) => alert._id),
+                          values: alertChunk
+                            .flatMap((alert) => [alert._id, alert._meta?.legacyId])
+                            .filter((item) => item != null) as string[],
                         },
                       },
                       aggs: {
@@ -81,8 +83,9 @@ export const createPersistenceRuleTypeWrapper: CreatePersistenceRuleTypeWrapper
                 }
 
                 const augmentedAlerts = filteredAlerts.map((alert) => {
+                  const { _meta, ...rest } = alert;
                   return {
-                    ...alert,
+                    ...rest,
                     _source: {
                       [VERSION]: ruleDataClient.kibanaVersion,
                       ...commonRuleFields,

x-pack/plugins/rule_registry/server/utils/persistence_types.ts

@@ -20,6 +20,9 @@ import { IRuleDataClient } from '../rule_data_client';
 export type PersistenceAlertService = <T>(
   alerts: Array<{
     _id: string;
+    _meta?: {
+      legacyId: string;
+    };
     _source: T;
   }>,
   refresh: boolean | 'wait_for'

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/bulk_create_factory.ts

@@ -30,7 +30,7 @@ export const bulkCreateFactory =
     refreshForBulkCreate: RefreshTypes
   ) =>
   async <T extends Record<string, unknown>>(
-    wrappedDocs: Array<BaseHit<T>>
+    wrappedDocs: Array<BaseHit<T> & { _meta: { legacyId: string } }>
   ): Promise<GenericBulkCreateResponse<T>> => {
     if (wrappedDocs.length === 0) {
       return {
@@ -47,6 +47,7 @@ export const bulkCreateFactory =
     const { createdAlerts } = await alertWithPersistence(
       wrappedDocs.map((doc) => ({
         _id: doc._id,
+        _meta: doc._meta,
         // `fields` should have already been merged into `doc._source`
         _source: doc._source,
       })),

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/wrap_hits_factory.ts

@@ -37,6 +37,14 @@ export const wrapHitsFactory =
       return {
         _id: id,
         _index: '',
+        _meta: {
+          legacyId: generateId(
+            event._index,
+            event._id,
+            String(event._version),
+            completeRule.alertId
+          ),
+        },
         _source: {
           ...buildBulkBody(
             spaceId,