Risk engine initialisation, update from legacy risk engine workflow and status change

[nkhristinin]

Risk engine initialisation, update from legacy risk engine workflow and status change

Screen.Recording.2023-08-01.at.15.00.35.mov

Green areas it is what was implemented

This pr has:

• Upgrade workflow. If the user has a risk host or user transforms, we will show the panel with a call to action for the upgrade.
• Introduce new Saved object to save the configuration of risk engine
• API which is described bellow

It required experiment enabled - riskScoringRoutesEnabled

New API

/engine/status

GET

Get the status of the Risk Engine

Description:

Returns the status of both the legacy transform-based risk engine, as well as the new risk engine

Responses

{
  "legacy_risk_engine_status": "NOT_INSTALLED" , "ENABLED"
  ,
  "risk_engine_status": "NOT_INSTALLED" , "ENABLED" , "DISABLED"
}

/engine/init

POST

Initialize the Risk Engine

Description:

Initializes the Risk Engine by creating the necessary indices and mappings, removing old transforms, creating saved object configuration

Responses

{
  "result": {
    "risk_engine_enabled": true,
    "risk_engine_resources_installed": true,
    "risk_engine_configuration_created": true,
    "legacy_risk_engine_disabled": true,
    "errors": [
      "string"
    ]
  }
}

/engine/enable

POST

Enable the Risk Engine

Description:

Change saved object configuration and in the future here we will start task

/engine/disable

POST

Disable the Risk Engine
Change saved object configuration and in the future here we will stop task

[rylnd]

I missed this with your previous PR, but: can you explain the logic behind the folder naming here? Explore team originally introduced risk_score folders, and I tried to generalize that to risk_engine stuff, but now it seems like we're broadening that to entity_analytics, here? Not a judgement, I'm just trying to understand the intention and keep things consistent.

[nkhristinin]

My original idea was to introduce the new public folder, for all things related to EA (watchlist, etc)

If you think we should rename/move things please let me know

[rylnd]

That sounds reasonable; thanks for the explanation. Perhaps as we move the client code to pull from the new risk score data, we can move those files/folders under entity_analytics ?

[rylnd]

Suggested change

	leggacyRiskEngineDisabled: boolean;
	legacyRiskEngineDisabled: boolean;

[nkhristinin]

@elasticmachine merge upstream

[dmlemeshko]

Appex QA changes LGTM

[tomsonpl]

Nice job 👍
I left just one question as a Defend Workflows review :)

[tomsonpl]

Defend Workflows lgtm 👍

[machadoum]

threat-hunting-explore changes LGTM!

You need to check for entity-analytics UI privileges to hide the new page and the update panel for serverless essentials.

Hey!
I took a second look and the call to action on the entity analytics page is still showing for serverless essentials.

[nkhristinin]

@elasticmachine merge upstream

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: b44c3b6

Failed CI Steps

• Defend Workflows Cypress Tests #1
• Defend Workflows Endpoint Cypress Tests #6

Test Failures

• [job] [logs] Defend Workflows Cypress Tests #1 / Endpoint Policy Response from Endpoint List page should display policy response with errors should display policy response with errors
• [job] [logs] Defend Workflows Cypress Tests #1 / Endpoint Policy Response from Fleet Agent Details page should display policy response with errors should display policy response with errors
• [job] [logs] Defend Workflows Endpoint Cypress Tests #6 / Response console document signing should fail if data tampered should fail if data tampered

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	4360	4365	+5

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	15.5MB	15.5MB	+7.7KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	57.8KB	58.0KB	+233.0B

Unknown metric groups

References to deprecated APIs

id	before	after	diff
securitySolution	622	625	+3

History

• 💔 Build #147553 failed b44c3b6
• 💔 Build #147441 failed b8b638e
• 💛 Build #147292 was flaky 1bc3314
• 💛 Build #147222 was flaky 7df7d22
• 💔 Build #147192 failed 7237b5f
• 💔 Build #147166 failed 96b6ddc

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[nkhristinin]

@elasticmachine merge upstream

[kibanamachine]

ignoring request to update branch, pull request is closed