[SecuritySolution] Load entity store indices from security solution d…

…ata view (#195862) ## Summary * Update the Entity Store to retrieve indices from the security solution data view. * Create a new API that updates all installed entity engine indices (`api/entity_store/engines/apply_dataview_indices`) ### How to test it? * Install the entity store * Check if the transform index has the security solutions data view indices * Call `apply_dataview_indices` API; it should not return changes * Update the security solution data view indices * Call `apply_dataview_indices` API and if the API response contains the updated indices * Check if the transform index also got updated --------- Co-authored-by: kibanamachine <[email protected]>
elastic · Oct 14, 2024 · 489c090 · 489c090
1 parent 1062296
commit 489c090
Show file tree

Hide file tree

Showing 28 changed files with 954 additions and 56 deletions.
diff --git a/oas_docs/output/kibana.serverless.staging.yaml b/oas_docs/output/kibana.serverless.staging.yaml
@@ -8421,6 +8421,56 @@ paths:
       summary: Stop an Entity Engine
       tags:
         - Security Entity Analytics API
+  /api/entity_store/engines/apply_dataview_indices:
+    post:
+      operationId: ApplyEntityEngineDataviewIndices
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  result:
+                    items:
+                      $ref: >-
+                        #/components/schemas/Security_Entity_Analytics_API_EngineDataviewUpdateResult
+                    type: array
+                  success:
+                    type: boolean
+          description: Successful response
+        '207':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  errors:
+                    items:
+                      type: string
+                    type: array
+                  result:
+                    items:
+                      $ref: >-
+                        #/components/schemas/Security_Entity_Analytics_API_EngineDataviewUpdateResult
+                    type: array
+                  success:
+                    type: boolean
+          description: Partial successful response
+        '500':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  body:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Error response
+      summary: Apply DataView indices to all installed engines
+      tags:
+        - Security Entity Analytics API
   /api/entity_store/entities/list:
     get:
       description: List entities records, paging, sorting and filtering as needed.
@@ -47909,6 +47959,20 @@ components:
                 #/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel
           required:
             - criticality_level
+    Security_Entity_Analytics_API_EngineDataviewUpdateResult:
+      type: object
+      properties:
+        changes:
+          type: object
+          properties:
+            indexPatterns:
+              items:
+                type: string
+              type: array
+        type:
+          type: string
+      required:
+        - type
     Security_Entity_Analytics_API_EngineDescriptor:
       type: object
       properties:
@@ -47932,6 +47996,7 @@ components:
         - installing
         - started
         - stopped
+        - updating
       type: string
     Security_Entity_Analytics_API_Entity:
       oneOf:

diff --git a/oas_docs/output/kibana.serverless.yaml b/oas_docs/output/kibana.serverless.yaml
@@ -8421,6 +8421,56 @@ paths:
       summary: Stop an Entity Engine
       tags:
         - Security Entity Analytics API
+  /api/entity_store/engines/apply_dataview_indices:
+    post:
+      operationId: ApplyEntityEngineDataviewIndices
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  result:
+                    items:
+                      $ref: >-
+                        #/components/schemas/Security_Entity_Analytics_API_EngineDataviewUpdateResult
+                    type: array
+                  success:
+                    type: boolean
+          description: Successful response
+        '207':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  errors:
+                    items:
+                      type: string
+                    type: array
+                  result:
+                    items:
+                      $ref: >-
+                        #/components/schemas/Security_Entity_Analytics_API_EngineDataviewUpdateResult
+                    type: array
+                  success:
+                    type: boolean
+          description: Partial successful response
+        '500':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  body:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Error response
+      summary: Apply DataView indices to all installed engines
+      tags:
+        - Security Entity Analytics API
   /api/entity_store/entities/list:
     get:
       description: List entities records, paging, sorting and filtering as needed.
@@ -47909,6 +47959,20 @@ components:
                 #/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel
           required:
             - criticality_level
+    Security_Entity_Analytics_API_EngineDataviewUpdateResult:
+      type: object
+      properties:
+        changes:
+          type: object
+          properties:
+            indexPatterns:
+              items:
+                type: string
+              type: array
+        type:
+          type: string
+      required:
+        - type
     Security_Entity_Analytics_API_EngineDescriptor:
       type: object
       properties:
@@ -47932,6 +47996,7 @@ components:
         - installing
         - started
         - stopped
+        - updating
       type: string
     Security_Entity_Analytics_API_Entity:
       oneOf:

diff --git a/oas_docs/output/kibana.staging.yaml b/oas_docs/output/kibana.staging.yaml
@@ -11850,6 +11850,56 @@ paths:
       summary: Stop an Entity Engine
       tags:
         - Security Entity Analytics API
+  /api/entity_store/engines/apply_dataview_indices:
+    post:
+      operationId: ApplyEntityEngineDataviewIndices
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  result:
+                    items:
+                      $ref: >-
+                        #/components/schemas/Security_Entity_Analytics_API_EngineDataviewUpdateResult
+                    type: array
+                  success:
+                    type: boolean
+          description: Successful response
+        '207':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  errors:
+                    items:
+                      type: string
+                    type: array
+                  result:
+                    items:
+                      $ref: >-
+                        #/components/schemas/Security_Entity_Analytics_API_EngineDataviewUpdateResult
+                    type: array
+                  success:
+                    type: boolean
+          description: Partial successful response
+        '500':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  body:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Error response
+      summary: Apply DataView indices to all installed engines
+      tags:
+        - Security Entity Analytics API
   /api/entity_store/entities/list:
     get:
       description: List entities records, paging, sorting and filtering as needed.
@@ -56675,6 +56725,20 @@ components:
                 #/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel
           required:
             - criticality_level
+    Security_Entity_Analytics_API_EngineDataviewUpdateResult:
+      type: object
+      properties:
+        changes:
+          type: object
+          properties:
+            indexPatterns:
+              items:
+                type: string
+              type: array
+        type:
+          type: string
+      required:
+        - type
     Security_Entity_Analytics_API_EngineDescriptor:
       type: object
       properties:
@@ -56698,6 +56762,7 @@ components:
         - installing
         - started
         - stopped
+        - updating
       type: string
     Security_Entity_Analytics_API_Entity:
       oneOf:

diff --git a/oas_docs/output/kibana.yaml b/oas_docs/output/kibana.yaml
@@ -11850,6 +11850,56 @@ paths:
       summary: Stop an Entity Engine
       tags:
         - Security Entity Analytics API
+  /api/entity_store/engines/apply_dataview_indices:
+    post:
+      operationId: ApplyEntityEngineDataviewIndices
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  result:
+                    items:
+                      $ref: >-
+                        #/components/schemas/Security_Entity_Analytics_API_EngineDataviewUpdateResult
+                    type: array
+                  success:
+                    type: boolean
+          description: Successful response
+        '207':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  errors:
+                    items:
+                      type: string
+                    type: array
+                  result:
+                    items:
+                      $ref: >-
+                        #/components/schemas/Security_Entity_Analytics_API_EngineDataviewUpdateResult
+                    type: array
+                  success:
+                    type: boolean
+          description: Partial successful response
+        '500':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  body:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Error response
+      summary: Apply DataView indices to all installed engines
+      tags:
+        - Security Entity Analytics API
   /api/entity_store/entities/list:
     get:
       description: List entities records, paging, sorting and filtering as needed.
@@ -56675,6 +56725,20 @@ components:
                 #/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel
           required:
             - criticality_level
+    Security_Entity_Analytics_API_EngineDataviewUpdateResult:
+      type: object
+      properties:
+        changes:
+          type: object
+          properties:
+            indexPatterns:
+              items:
+                type: string
+              type: array
+        type:
+          type: string
+      required:
+        - type
     Security_Entity_Analytics_API_EngineDescriptor:
       type: object
       properties:
@@ -56698,6 +56762,7 @@ components:
         - installing
         - started
         - stopped
+        - updating
       type: string
     Security_Entity_Analytics_API_Entity:
       oneOf:

diff --git a/...ck/plugins/entity_manager/server/lib/entities/errors/entity_definition_update_conflict.ts b/...ck/plugins/entity_manager/server/lib/entities/errors/entity_definition_update_conflict.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export class EntityDefinitionUpdateConflict extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'EntityDefinitionUpdateConflict';
+  }
+}