[Security Solution][DE] Investigation fields telemetry (#169482)

## Summary

Adds telemetry to determine the number of users utilizing
`investigation_fields` in 8.10. We want to eventually deprecate use of
this field as an array (in 8.10) in favor of the new object type.

Utilizes the telemetry detections rule usage logic to add a new field
`legacy_investigation_fields` - which is a total count of the number of
rules utilizing the legacy `investigation_fields` (the field as an
array).

x-pack/plugins/security_solution/server/usage/collector.ts

@@ -71,6 +71,13 @@ export const registerCollector: RegisterCollector = ({
                 type: 'long',
                 _meta: { description: 'Number of notifications enabled' },
               },
+              legacy_investigation_fields: {
+                type: 'long',
+                _meta: {
+                  description:
+                    'Number of rules using the legacy investigation fields type introduced only in 8.10 ESS',
+                },
+              },
             },
             threshold: {
               enabled: {
@@ -107,6 +114,13 @@ export const registerCollector: RegisterCollector = ({
                 type: 'long',
                 _meta: { description: 'Number of notifications enabled' },
               },
+              legacy_investigation_fields: {
+                type: 'long',
+                _meta: {
+                  description:
+                    'Number of rules using the legacy investigation fields type introduced only in 8.10 ESS',
+                },
+              },
             },
             eql: {
               enabled: { type: 'long', _meta: { description: 'Number of eql rules enabled' } },
@@ -135,6 +149,13 @@ export const registerCollector: RegisterCollector = ({
                 type: 'long',
                 _meta: { description: 'Number of notifications enabled' },
               },
+              legacy_investigation_fields: {
+                type: 'long',
+                _meta: {
+                  description:
+                    'Number of rules using the legacy investigation fields type introduced only in 8.10 ESS',
+                },
+              },
             },
             machine_learning: {
               enabled: {
@@ -171,6 +192,13 @@ export const registerCollector: RegisterCollector = ({
                 type: 'long',
                 _meta: { description: 'Number of notifications enabled' },
               },
+              legacy_investigation_fields: {
+                type: 'long',
+                _meta: {
+                  description:
+                    'Number of rules using the legacy investigation fields type introduced only in 8.10 ESS',
+                },
+              },
             },
             threat_match: {
               enabled: {
@@ -207,6 +235,13 @@ export const registerCollector: RegisterCollector = ({
                 type: 'long',
                 _meta: { description: 'Number of notifications enabled' },
               },
+              legacy_investigation_fields: {
+                type: 'long',
+                _meta: {
+                  description:
+                    'Number of rules using the legacy investigation fields type introduced only in 8.10 ESS',
+                },
+              },
             },
             new_terms: {
               enabled: {
@@ -243,6 +278,13 @@ export const registerCollector: RegisterCollector = ({
                 type: 'long',
                 _meta: { description: 'Number of notifications enabled' },
               },
+              legacy_investigation_fields: {
+                type: 'long',
+                _meta: {
+                  description:
+                    'Number of rules using the legacy investigation fields type introduced only in 8.10 ESS',
+                },
+              },
             },
             elastic_total: {
               enabled: { type: 'long', _meta: { description: 'Number of elastic rules enabled' } },
@@ -274,6 +316,13 @@ export const registerCollector: RegisterCollector = ({
                 type: 'long',
                 _meta: { description: 'Number of notifications enabled' },
               },
+              legacy_investigation_fields: {
+                type: 'long',
+                _meta: {
+                  description:
+                    'Number of rules using the legacy investigation fields type introduced only in 8.10 ESS',
+                },
+              },
             },
             custom_total: {
               enabled: { type: 'long', _meta: { description: 'Number of custom rules enabled' } },
@@ -302,6 +351,13 @@ export const registerCollector: RegisterCollector = ({
                 type: 'long',
                 _meta: { description: 'Number of notifications enabled' },
               },
+              legacy_investigation_fields: {
+                type: 'long',
+                _meta: {
+                  description:
+                    'Number of rules using the legacy investigation fields type introduced only in 8.10 ESS',
+                },
+              },
             },
           },
           detection_rule_detail: {

x-pack/plugins/security_solution/server/usage/detections/get_metrics.test.ts

@@ -99,6 +99,7 @@ describe('Detections Usage and Metrics', () => {
               updated_on: '2021-03-23T17:15:59.634Z',
               has_legacy_notification: false,
               has_notification: false,
+              has_legacy_investigation_field: false,
             },
           ],
           detection_rule_usage: {
@@ -112,6 +113,7 @@ describe('Detections Usage and Metrics', () => {
               legacy_notifications_disabled: 0,
               notifications_enabled: 0,
               notifications_disabled: 0,
+              legacy_investigation_fields: 0,
             },
             elastic_total: {
               alerts: 3400,
@@ -122,6 +124,7 @@ describe('Detections Usage and Metrics', () => {
               legacy_notifications_disabled: 0,
               notifications_enabled: 0,
               notifications_disabled: 0,
+              legacy_investigation_fields: 0,
             },
           },
         },
@@ -163,6 +166,7 @@ describe('Detections Usage and Metrics', () => {
               legacy_notifications_disabled: 0,
               notifications_enabled: 0,
               notifications_disabled: 0,
+              legacy_investigation_fields: 0,
             },
             query: {
               alerts: 800,
@@ -173,6 +177,7 @@ describe('Detections Usage and Metrics', () => {
               legacy_notifications_disabled: 0,
               notifications_enabled: 0,
               notifications_disabled: 0,
+              legacy_investigation_fields: 0,
             },
           },
         },
@@ -217,6 +222,7 @@ describe('Detections Usage and Metrics', () => {
               updated_on: '2021-03-23T17:15:59.634Z',
               has_legacy_notification: false,
               has_notification: false,
+              has_legacy_investigation_field: false,
             },
           ],
           detection_rule_usage: {
@@ -230,6 +236,7 @@ describe('Detections Usage and Metrics', () => {
               legacy_notifications_disabled: 0,
               notifications_enabled: 0,
               notifications_disabled: 0,
+              legacy_investigation_fields: 0,
             },
             query: {
               alerts: 0,
@@ -240,6 +247,7 @@ describe('Detections Usage and Metrics', () => {
               legacy_notifications_disabled: 0,
               notifications_enabled: 0,
               notifications_disabled: 0,
+              legacy_investigation_fields: 0,
             },
           },
         },

x-pack/plugins/security_solution/server/usage/detections/rules/get_initial_usage.ts

@@ -26,6 +26,7 @@ export const getInitialRulesUsage = (): RulesTypeUsage => ({
     legacy_notifications_disabled: 0,
     notifications_enabled: 0,
     notifications_disabled: 0,
+    legacy_investigation_fields: 0,
   },
   threshold: {
     enabled: 0,
@@ -36,6 +37,7 @@ export const getInitialRulesUsage = (): RulesTypeUsage => ({
     legacy_notifications_disabled: 0,
     notifications_enabled: 0,
     notifications_disabled: 0,
+    legacy_investigation_fields: 0,
   },
   eql: {
     enabled: 0,
@@ -46,6 +48,7 @@ export const getInitialRulesUsage = (): RulesTypeUsage => ({
     legacy_notifications_disabled: 0,
     notifications_enabled: 0,
     notifications_disabled: 0,
+    legacy_investigation_fields: 0,
   },
   machine_learning: {
     enabled: 0,
@@ -56,6 +59,7 @@ export const getInitialRulesUsage = (): RulesTypeUsage => ({
     legacy_notifications_disabled: 0,
     notifications_enabled: 0,
     notifications_disabled: 0,
+    legacy_investigation_fields: 0,
   },
   threat_match: {
     enabled: 0,
@@ -66,6 +70,7 @@ export const getInitialRulesUsage = (): RulesTypeUsage => ({
     legacy_notifications_disabled: 0,
     notifications_enabled: 0,
     notifications_disabled: 0,
+    legacy_investigation_fields: 0,
   },
   new_terms: {
     enabled: 0,
@@ -76,6 +81,7 @@ export const getInitialRulesUsage = (): RulesTypeUsage => ({
     legacy_notifications_disabled: 0,
     notifications_enabled: 0,
     notifications_disabled: 0,
+    legacy_investigation_fields: 0,
   },
   elastic_total: {
     enabled: 0,
@@ -86,6 +92,7 @@ export const getInitialRulesUsage = (): RulesTypeUsage => ({
     legacy_notifications_disabled: 0,
     notifications_enabled: 0,
     notifications_disabled: 0,
+    legacy_investigation_fields: 0,
   },
   custom_total: {
     enabled: 0,
@@ -96,6 +103,7 @@ export const getInitialRulesUsage = (): RulesTypeUsage => ({
     legacy_notifications_disabled: 0,
     notifications_enabled: 0,
     notifications_disabled: 0,
+    legacy_investigation_fields: 0,
   },
 });
 

x-pack/plugins/security_solution/server/usage/detections/rules/transform_utils/get_rule_object_correlations.ts

@@ -55,6 +55,7 @@ export const getRuleObjectCorrelations = ({
       cases_count_total: casesRuleIds.get(ruleId) || 0,
       has_legacy_notification: hasLegacyNotification,
       has_notification: hasNotification,
+      has_legacy_investigation_field: Array.isArray(attributes.params.investigationFields),
     };
   });
 };

x-pack/plugins/security_solution/server/usage/detections/rules/types.ts

@@ -14,6 +14,7 @@ export interface FeatureTypeUsage {
   legacy_notifications_disabled: number;
   notifications_enabled: number;
   notifications_disabled: number;
+  legacy_investigation_fields: number;
 }
 
 export interface RulesTypeUsage {
@@ -46,6 +47,7 @@ export interface RuleMetric {
   cases_count_total: number;
   has_legacy_notification: boolean;
   has_notification: boolean;
+  has_legacy_investigation_field: boolean;
 }
 
 /**