[Response Ops][Alerting] Alerts as data aliases should be hidden

[ymao1]

Alerts as data indices are created as hidden but their aliases are not, leading to some inconsistencies. We should be able to create new aliases as hidden by setting is_hidden: true here but we should also add a call to update existing aliases to hidden during resource installation.

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[pmuellr]

Remembering when we did something very similar for the event log - one issue we had was that the additional processing could take a while, and encounter errors. Can't remember if we made initialization wait through these modifications, and what we do with errors - beyond ignoring them (more or less ... there's not much we can do). I'm thinking we even stopped logging them because they were noisy.

Looking through the event log PRs, this one looks particularly relevant: #122882

[ioanatia]

As a note - because these aliases are not hidden, when we execute a ESQL query that uses FROM * we actually return around ~1600 columns that belong to the mapped fields for these aliases.

[stratoula]

I would really appreciate if this got prioritized 🙏

[mikecote]

Adding a note to ensure we don't introduce any negative side effects by switching to hidden.

[stratoula]

Hey! Any updates on this one?

[heespi]

We´ll be discussing this today, @stratoula ... hoping to revert soon