From 833d557fcd28f1d1a0f2dfc8cec93ef6ab36a26c Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Thu, 21 Nov 2024 03:36:59 +1100
Subject: [PATCH] [8.15] [Entity Analytics][Bug] Only refresh the asset
 criticality index after bulk upload (#200897) (#200918)

# Backport

This will backport the following commits from `main` to `8.15`:
- [[Entity Analytics][Bug] Only refresh the asset criticality index
after bulk upload
(#200897)](https://github.com/elastic/kibana/pull/200897)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Mark
Hopkin","email":"mark.hopkin@elastic.co"},"sourceCommit":{"committedDate":"2024-11-20T13:25:31Z","message":"[Entity
Analytics][Bug] Only refresh the asset criticality index after bulk
upload (#200897)\n\n## Summary\r\n\r\nWe were unintentionally refreshing
all indices after an asset\r\ncriticality bulk upload was performed,
this fix makes it so we only\r\nrefresh the asset criticality
index.\r\n\r\nbackporting to all 8.x versions\r\n\r\n## Test
steps\r\n\r\n- 1. I created an index by uploading a document, the
content isn't\r\nimportant:\r\n```\r\nPOST
/logs-test-hello/_doc\r\n{\r\n \"host\" : {\r\n \"name\" :
\"my_host\",\r\n \"domain\" : \"my_domain\",\r\n \"ip\" : [\"1.1.1.1\",
\"2.2.2.2\", \"3.3.3.3\"]\r\n }\r\n}\r\n```\r\n\r\n- 2. I then used the
refresh stats API to see how many refreshes have\r\nhappened on that
index:\r\n\r\n```\r\nGET /_stats/refresh\r\n\r\n// lots ommited
here:\r\n\r\n \".ds-logs-test-hello-2024.11.20-000001\": {\r\n \"uuid\":
\"DRxQd3rgQC2YSMIahzDCrw\",\r\n \"health\": \"yellow\",\r\n \"status\":
\"open\",\r\n \"primaries\": {\r\n \"refresh\": {\r\n \"total\": 10,\r\n
\"total_time_in_millis\": 66,\r\n \"external_total\": 9,\r\n
\"external_total_time_in_millis\": 67,\r\n \"listeners\": 0\r\n }\r\n
},\r\n \"total\": {\r\n \"refresh\": {\r\n \"total\": 10, //
<--------------------------------- Index has had 10 refreshes\r\n
\"total_time_in_millis\": 66,\r\n \"external_total\": 9,\r\n
\"external_total_time_in_millis\": 67,\r\n \"listeners\": 0\r\n }\r\n
}\r\n },\r\n```\r\n3. perform an asset criticality bulk upload\r\n4.
call the `GET /_stats/refresh` API again, before the fix notice
the\r\nnumber has gone up on the logs index (I did this a few times just
to\r\nmake sure) OR after the fix, this number does not go
up.","sha":"d95fa7263a74d7fb45fdff7718011e75e560536e","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","v9.0.0","Team:
SecuritySolution","Team:Entity
Analytics","backport:version","v8.17.0","v8.18.0","v8.15.5","v8.16.2"],"title":"[Entity
Analytics][Bug] Only refresh the asset criticality index after bulk
upload","number":200897,"url":"https://github.com/elastic/kibana/pull/200897","mergeCommit":{"message":"[Entity
Analytics][Bug] Only refresh the asset criticality index after bulk
upload (#200897)\n\n## Summary\r\n\r\nWe were unintentionally refreshing
all indices after an asset\r\ncriticality bulk upload was performed,
this fix makes it so we only\r\nrefresh the asset criticality
index.\r\n\r\nbackporting to all 8.x versions\r\n\r\n## Test
steps\r\n\r\n- 1. I created an index by uploading a document, the
content isn't\r\nimportant:\r\n```\r\nPOST
/logs-test-hello/_doc\r\n{\r\n \"host\" : {\r\n \"name\" :
\"my_host\",\r\n \"domain\" : \"my_domain\",\r\n \"ip\" : [\"1.1.1.1\",
\"2.2.2.2\", \"3.3.3.3\"]\r\n }\r\n}\r\n```\r\n\r\n- 2. I then used the
refresh stats API to see how many refreshes have\r\nhappened on that
index:\r\n\r\n```\r\nGET /_stats/refresh\r\n\r\n// lots ommited
here:\r\n\r\n \".ds-logs-test-hello-2024.11.20-000001\": {\r\n \"uuid\":
\"DRxQd3rgQC2YSMIahzDCrw\",\r\n \"health\": \"yellow\",\r\n \"status\":
\"open\",\r\n \"primaries\": {\r\n \"refresh\": {\r\n \"total\": 10,\r\n
\"total_time_in_millis\": 66,\r\n \"external_total\": 9,\r\n
\"external_total_time_in_millis\": 67,\r\n \"listeners\": 0\r\n }\r\n
},\r\n \"total\": {\r\n \"refresh\": {\r\n \"total\": 10, //
<--------------------------------- Index has had 10 refreshes\r\n
\"total_time_in_millis\": 66,\r\n \"external_total\": 9,\r\n
\"external_total_time_in_millis\": 67,\r\n \"listeners\": 0\r\n }\r\n
}\r\n },\r\n```\r\n3. perform an asset criticality bulk upload\r\n4.
call the `GET /_stats/refresh` API again, before the fix notice
the\r\nnumber has gone up on the logs index (I did this a few times just
to\r\nmake sure) OR after the fix, this number does not go
up.","sha":"d95fa7263a74d7fb45fdff7718011e75e560536e"}},"sourceBranch":"main","suggestedTargetBranches":["8.x","8.18","8.15","8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/200897","number":200897,"mergeCommit":{"message":"[Entity
Analytics][Bug] Only refresh the asset criticality index after bulk
upload (#200897)\n\n## Summary\r\n\r\nWe were unintentionally refreshing
all indices after an asset\r\ncriticality bulk upload was performed,
this fix makes it so we only\r\nrefresh the asset criticality
index.\r\n\r\nbackporting to all 8.x versions\r\n\r\n## Test
steps\r\n\r\n- 1. I created an index by uploading a document, the
content isn't\r\nimportant:\r\n```\r\nPOST
/logs-test-hello/_doc\r\n{\r\n \"host\" : {\r\n \"name\" :
\"my_host\",\r\n \"domain\" : \"my_domain\",\r\n \"ip\" : [\"1.1.1.1\",
\"2.2.2.2\", \"3.3.3.3\"]\r\n }\r\n}\r\n```\r\n\r\n- 2. I then used the
refresh stats API to see how many refreshes have\r\nhappened on that
index:\r\n\r\n```\r\nGET /_stats/refresh\r\n\r\n// lots ommited
here:\r\n\r\n \".ds-logs-test-hello-2024.11.20-000001\": {\r\n \"uuid\":
\"DRxQd3rgQC2YSMIahzDCrw\",\r\n \"health\": \"yellow\",\r\n \"status\":
\"open\",\r\n \"primaries\": {\r\n \"refresh\": {\r\n \"total\": 10,\r\n
\"total_time_in_millis\": 66,\r\n \"external_total\": 9,\r\n
\"external_total_time_in_millis\": 67,\r\n \"listeners\": 0\r\n }\r\n
},\r\n \"total\": {\r\n \"refresh\": {\r\n \"total\": 10, //
<--------------------------------- Index has had 10 refreshes\r\n
\"total_time_in_millis\": 66,\r\n \"external_total\": 9,\r\n
\"external_total_time_in_millis\": 67,\r\n \"listeners\": 0\r\n }\r\n
}\r\n },\r\n```\r\n3. perform an asset criticality bulk upload\r\n4.
call the `GET /_stats/refresh` API again, before the fix notice
the\r\nnumber has gone up on the logs index (I did this a few times just
to\r\nmake sure) OR after the fix, this number does not go
up.","sha":"d95fa7263a74d7fb45fdff7718011e75e560536e"}},{"branch":"8.x","label":"v8.17.0","branchLabelMappingKey":"^v8.17.0$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.15","label":"v8.15.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.16","label":"v8.16.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Mark Hopkin <mark.hopkin@elastic.co>
---
 .../asset_criticality/asset_criticality_data_client.ts          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/asset_criticality_data_client.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/asset_criticality_data_client.ts
index c5abf75b71478..efabb5ef2dbd0 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/asset_criticality_data_client.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/asset_criticality_data_client.ts
@@ -217,7 +217,7 @@ export class AssetCriticalityDataClient {
       index: this.getIndex(),
       flushBytes,
       retries,
-      refreshOnCompletion: true, // refresh the index after all records are processed
+      refreshOnCompletion: this.getIndex(),
       onDocument: ({ record }) => [
         { update: { _id: createId(record) } },
         {