Merge branch '8.11' into backport/8.11/pr-170499

x-pack/plugins/fleet/common/openapi/bundled.json

@@ -2740,14 +2740,6 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "revoke": {
-                    "type": "boolean",
-                    "description": "Revokes API keys of agents"
-                  },
-                  "force": {
-                    "type": "boolean",
-                    "description": "Unenroll hosted agents too"
-                  },
                   "agents": {
                     "oneOf": [
                       {
@@ -2762,6 +2754,18 @@
                         "description": "list of agent IDs"
                       }
                     ]
+                  },
+                  "revoke": {
+                    "type": "boolean",
+                    "description": "Revokes API keys of agents"
+                  },
+                  "force": {
+                    "type": "boolean",
+                    "description": "Unenrolls hosted agents too"
+                  },
+                  "includeInactive": {
+                    "type": "boolean",
+                    "description": "When passing agents by KQL query, unenrolls inactive agents too"
                   }
                 },
                 "required": [

x-pack/plugins/fleet/common/openapi/bundled.yaml

@@ -1719,12 +1719,6 @@ paths:
             schema:
               type: object
               properties:
-                revoke:
-                  type: boolean
-                  description: Revokes API keys of agents
-                force:
-                  type: boolean
-                  description: Unenroll hosted agents too
                 agents:
                   oneOf:
                     - type: string
@@ -1733,6 +1727,17 @@ paths:
                       items:
                         type: string
                       description: list of agent IDs
+                revoke:
+                  type: boolean
+                  description: Revokes API keys of agents
+                force:
+                  type: boolean
+                  description: Unenrolls hosted agents too
+                includeInactive:
+                  type: boolean
+                  description: >-
+                    When passing agents by KQL query, unenrolls inactive agents
+                    too
               required:
                 - agents
             example:

x-pack/plugins/fleet/common/openapi/paths/agents@bulk_unenroll.yaml

@@ -23,12 +23,6 @@ post:
         schema:
           type: object
           properties:
-            revoke:
-              type: boolean
-              description: Revokes API keys of agents
-            force:
-              type: boolean
-              description: Unenroll hosted agents too
             agents:
               oneOf:
                 - type: string
@@ -37,6 +31,15 @@ post:
                   items:
                     type: string
                   description: list of agent IDs
+            revoke:
+              type: boolean
+              description: Revokes API keys of agents
+            force:
+              type: boolean
+              description: Unenrolls hosted agents too
+            includeInactive:
+              type: boolean
+              description: When passing agents by KQL query, unenrolls inactive agents too
           required:
             - agents
         example:

x-pack/plugins/fleet/common/types/rest_spec/agent.ts

@@ -85,6 +85,7 @@ export interface PostBulkAgentUnenrollRequest {
     agents: string[] | string;
     force?: boolean;
     revoke?: boolean;
+    includeInactive?: boolean;
   };
 }
 

x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx

@@ -47,6 +47,8 @@ export const AgentUnenrollAgentModal: React.FunctionComponent<Props> = ({
         : await sendPostBulkAgentUnenroll({
             agents: Array.isArray(agents) ? agents.map((agent) => agent.id) : agents,
             revoke: forceUnenroll,
+            // includeInactive is only used when the agents are selected by query, it's ignored in the case of agent ids
+            includeInactive: true,
           });
       if (error) {
         throw error;

x-pack/plugins/fleet/server/routes/agent/unenroll_handler.ts

@@ -55,6 +55,7 @@ export const postBulkAgentsUnenrollHandler: RequestHandler<
       revoke: request.body?.revoke,
       force: request.body?.force,
       batchSize: request.body?.batchSize,
+      showInactive: request.body?.includeInactive,
     });
 
     return response.ok({ body: { actionId: results.actionId } });

x-pack/plugins/fleet/server/services/agents/unenroll.ts

@@ -73,6 +73,7 @@ export async function unenrollAgents(
     force?: boolean;
     revoke?: boolean;
     batchSize?: number;
+    showInactive?: boolean;
   }
 ): Promise<{ actionId: string }> {
   if ('agentIds' in options) {

x-pack/plugins/fleet/server/types/rest_spec/agent.ts

@@ -95,6 +95,7 @@ export const PostBulkAgentUnenrollRequestSchema = {
     force: schema.maybe(schema.boolean()),
     revoke: schema.maybe(schema.boolean()),
     batchSize: schema.maybe(schema.number()),
+    includeInactive: schema.maybe(schema.boolean()),
   }),
 };
 

x-pack/plugins/ml/public/application/jobs/new_job/job_from_lens/utils.ts

@@ -186,6 +186,8 @@ export async function getVisTypeFactory(lens: LensPublicStart) {
 export async function isCompatibleVisualizationType(chartInfo: ChartInfo) {
   return (
     chartInfo.visualizationType === COMPATIBLE_VISUALIZATION &&
+    // @ts-expect-error esql is missing in the type
+    chartInfo.query.esql === undefined &&
     chartInfo.layers.some((l) => l.layerType === layerTypes.DATA && l.dataView !== undefined)
   );
 }

x-pack/test/fleet_api_integration/apis/agents/unenroll.ts

@@ -8,6 +8,7 @@
 import expect from '@kbn/expect';
 import { v4 as uuidv4 } from 'uuid';
 
+import { AGENTS_INDEX } from '@kbn/fleet-plugin/common';
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { setupFleetAndAgents } from './services';
 import { skipIfNoDockerRegistry } from '../../helpers';
@@ -149,7 +150,7 @@ export default function (providerContext: FtrProviderContext) {
       expect(actionStatus.nbAgentsFailed).to.eql(2);
     });
 
-    it('/agents/bulk_unenroll should allow to unenroll multiple agents by id from an regular agent policy', async () => {
+    it('/agents/bulk_unenroll should allow to unenroll multiple agents by id from a regular agent policy', async () => {
       // set policy to regular
       await supertest
         .put(`/api/fleet/agent_policies/policy1`)
@@ -188,6 +189,78 @@ export default function (providerContext: FtrProviderContext) {
       expect(body.total).to.eql(0);
     });
 
+    it('/agents/bulk_unenroll should allow to unenroll active and inactive agents by kuery with includeInactive', async () => {
+      // Agent inactive
+      await esClient.update({
+        id: 'agent4',
+        refresh: 'wait_for',
+        index: AGENTS_INDEX,
+        body: {
+          doc: {
+            policy_id: 'policy1',
+            policy_revision_idx: 1,
+            last_checkin: new Date(Date.now() - 1000 * 60).toISOString(), // policy timeout 1 min
+          },
+        },
+      });
+      // unenroll all agents that had last checkin before "now"
+      await supertest
+        .post(`/api/fleet/agents/bulk_unenroll`)
+        .set('kbn-xsrf', 'xxx')
+        .send({
+          agents: `last_checkin<="${new Date(Date.now()).toISOString()}"`,
+          revoke: true,
+          includeInactive: true,
+        })
+        .expect(200);
+
+      const { body } = await supertest.get(`/api/fleet/agents`);
+      expect(body.total).to.eql(0);
+    });
+    it('/agents/bulk_unenroll should allow to unenroll inactive agents that never had last checkin by kuery with includeInactive', async () => {
+      // Agent inactive
+      await esClient.update({
+        id: 'agent4',
+        refresh: 'wait_for',
+        index: AGENTS_INDEX,
+        body: {
+          doc: {
+            policy_id: 'policy1',
+            policy_revision_idx: 1,
+            last_checkin: new Date(Date.now() - 1000 * 60).toISOString(), // policy timeout 1 min
+          },
+        },
+      });
+      // agent inactive through enrolled_at as no last_checkin
+      await esClient.create({
+        id: 'agent5',
+        refresh: 'wait_for',
+        index: AGENTS_INDEX,
+        document: {
+          active: true,
+          access_api_key_id: 'api-key-4',
+          policy_id: 'policy1',
+          type: 'PERMANENT',
+          local_metadata: { host: { hostname: 'host6' } },
+          user_provided_metadata: {},
+          enrolled_at: new Date(Date.now() - 1000 * 60).toISOString(), // policy timeout 1 min
+        },
+      });
+      // unenroll all agents
+      await supertest
+        .post(`/api/fleet/agents/bulk_unenroll`)
+        .set('kbn-xsrf', 'xxx')
+        .send({
+          agents: 'active: true',
+          revoke: true,
+          includeInactive: true,
+        })
+        .expect(200);
+
+      const { body } = await supertest.get(`/api/fleet/agents`);
+      expect(body.total).to.eql(0);
+    });
+
     it('/agents/bulk_unenroll should allow to unenroll multiple agents by kuery in batches async', async () => {
       const { body } = await supertest
         .post(`/api/fleet/agents/bulk_unenroll`)