From 3fff48a2cad951cfc531e0f61e9939ae4436a77b Mon Sep 17 00:00:00 2001
From: Tiago Vila Verde <tiago.vilaverde@elastic.co>
Date: Thu, 7 Nov 2024 11:06:59 +0100
Subject: [PATCH] [Entity Store] Aligning mappings with ECS (#199001)

## Summary

This PR corrects some of the mappings set in the component template to
follow ECS guidelines.

#### How to test

Initialise an entity engine via devtools:
```
POST kbn:/api/entity_store/engines/host/init
{}
```

Check the mappings with:
```
GET .entities.v1.latest.security_<entityType>_default/_mapping
```
---
 .../entity_store/entities_list.test.tsx       |  2 +-
 .../hooks/use_entities_list_columns.tsx       |  2 +-
 .../united_entity_definitions/constants.ts    |  4 +--
 .../entity_types/host.ts                      | 12 +++++++-
 .../entity_types/user.ts                      | 12 +++++++-
 .../get_united_definition.test.ts             | 28 ++++++++++++++++---
 .../united_entity_definition.ts               | 10 +++++++
 7 files changed, 60 insertions(+), 10 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/entities_list.test.tsx b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/entities_list.test.tsx
index 91f0c42eab385..0f493304e1f87 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/entities_list.test.tsx
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/entities_list.test.tsx
@@ -109,7 +109,7 @@ describe('EntitiesList', () => {
     fireEvent.click(columnHeader);
     expect(mockUseEntitiesListQuery).toHaveBeenCalledWith(
       expect.objectContaining({
-        sortField: 'entity.name.text',
+        sortField: 'entity.name',
         sortOrder: 'asc',
       })
     );
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entities_list_columns.tsx b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entities_list_columns.tsx
index 974a80454ee21..e603c95b6604a 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entities_list_columns.tsx
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entities_list_columns.tsx
@@ -79,7 +79,7 @@ export const useEntitiesListColumns = (): EntitiesListColumns => {
       width: '5%',
     },
     {
-      field: 'entity.name.text',
+      field: 'entity.name',
       name: (
         <FormattedMessage
           id="xpack.securitySolution.entityAnalytics.entityStore.entitiesList.nameColumn.title"
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/constants.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/constants.ts
index 9f9dbb836498d..43730fa06357a 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/constants.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/constants.ts
@@ -15,10 +15,10 @@ export const BASE_ENTITY_INDEX_MAPPING: MappingProperties = {
     type: 'keyword',
   },
   'entity.name': {
-    type: 'text',
+    type: 'keyword',
     fields: {
       text: {
-        type: 'keyword',
+        type: 'match_only_text',
       },
     },
   },
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/host.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/host.ts
index db9266997743e..5abeffd05b1f1 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/host.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/host.ts
@@ -18,7 +18,17 @@ export const getHostUnitedDefinition: UnitedDefinitionBuilder = (fieldHistoryLen
       collect({ field: 'host.domain' }),
       collect({ field: 'host.hostname' }),
       collect({ field: 'host.id' }),
-      collect({ field: 'host.os.name' }),
+      collect({
+        field: 'host.os.name',
+        mapping: {
+          type: 'keyword',
+          fields: {
+            text: {
+              type: 'match_only_text',
+            },
+          },
+        },
+      }),
       collect({ field: 'host.os.type' }),
       collect({
         field: 'host.ip',
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/user.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/user.ts
index 632d1a685b992..3881425df77ce 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/user.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/user.ts
@@ -16,7 +16,17 @@ export const getUserUnitedDefinition: UnitedDefinitionBuilder = (fieldHistoryLen
     fields: [
       collect({ field: 'user.domain' }),
       collect({ field: 'user.email' }),
-      collect({ field: 'user.full_name' }),
+      collect({
+        field: 'user.full_name',
+        mapping: {
+          type: 'keyword',
+          fields: {
+            text: {
+              type: 'match_only_text',
+            },
+          },
+        },
+      }),
       collect({ field: 'user.hash' }),
       collect({ field: 'user.id' }),
       collect({ field: 'user.roles' }),
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/get_united_definition.test.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/get_united_definition.test.ts
index fa443ffa94047..07c011b4791e6 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/get_united_definition.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/get_united_definition.test.ts
@@ -32,10 +32,10 @@ describe('getUnitedEntityDefinition', () => {
             "entity.name": Object {
               "fields": Object {
                 "text": Object {
-                  "type": "keyword",
+                  "type": "match_only_text",
                 },
               },
-              "type": "text",
+              "type": "keyword",
             },
             "entity.source": Object {
               "type": "keyword",
@@ -59,9 +59,19 @@ describe('getUnitedEntityDefinition', () => {
               "type": "keyword",
             },
             "host.name": Object {
+              "fields": Object {
+                "text": Object {
+                  "type": "match_only_text",
+                },
+              },
               "type": "keyword",
             },
             "host.os.name": Object {
+              "fields": Object {
+                "text": Object {
+                  "type": "match_only_text",
+                },
+              },
               "type": "keyword",
             },
             "host.os.type": Object {
@@ -335,10 +345,10 @@ describe('getUnitedEntityDefinition', () => {
             "entity.name": Object {
               "fields": Object {
                 "text": Object {
-                  "type": "keyword",
+                  "type": "match_only_text",
                 },
               },
-              "type": "text",
+              "type": "keyword",
             },
             "entity.source": Object {
               "type": "keyword",
@@ -350,6 +360,11 @@ describe('getUnitedEntityDefinition', () => {
               "type": "keyword",
             },
             "user.full_name": Object {
+              "fields": Object {
+                "text": Object {
+                  "type": "match_only_text",
+                },
+              },
               "type": "keyword",
             },
             "user.hash": Object {
@@ -359,6 +374,11 @@ describe('getUnitedEntityDefinition', () => {
               "type": "keyword",
             },
             "user.name": Object {
+              "fields": Object {
+                "text": Object {
+                  "type": "match_only_text",
+                },
+              },
               "type": "keyword",
             },
             "user.risk.calculated_level": Object {
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/united_entity_definition.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/united_entity_definition.ts
index eced765c75193..fc7430ebb1806 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/united_entity_definition.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/united_entity_definition.ts
@@ -94,6 +94,11 @@ export class UnitedEntityDefinition {
       ...BASE_ENTITY_INDEX_MAPPING,
       [identityField]: {
         type: 'keyword',
+        fields: {
+          text: {
+            type: 'match_only_text',
+          },
+        },
       },
     };
 
@@ -107,6 +112,11 @@ export class UnitedEntityDefinition {
 
     properties[identityField] = {
       type: 'keyword',
+      fields: {
+        text: {
+          type: 'match_only_text',
+        },
+      },
     };
 
     return {