From 67d96e3585b690662750173898ce579c52a89522 Mon Sep 17 00:00:00 2001 From: Tiago Vila Verde Date: Tue, 29 Oct 2024 12:13:14 +0100 Subject: [PATCH] [Entity Analytics] [Entity Store] Telemetry (#196880) ## Summary This PR adds telemetry for the Entity Store. Client side tracks UI enablement actions, whilst Kibana side tracks execution time of the store initialisation process and execution time of the enrich policy task. Finally we also track number of entities in the store --- .../public/common/lib/telemetry/constants.ts | 2 + .../events/entity_analytics/index.ts | 33 +++++++++ .../events/entity_analytics/types.ts | 21 +++++- .../lib/telemetry/events/telemetry_events.ts | 4 ++ .../lib/telemetry/telemetry_client.mock.ts | 2 + .../common/lib/telemetry/telemetry_client.ts | 10 +++ .../public/common/lib/telemetry/types.ts | 17 ++--- .../entity_store/hooks/use_entity_store.ts | 25 ++++++- .../entity_store/entity_store_data_client.ts | 18 +++++ .../task/field_retention_enrichment_task.ts | 53 ++++++++++++++- .../lib/telemetry/event_based/events.ts | 67 +++++++++++++++++++ .../security_solution/server/plugin.ts | 1 + .../server/request_context_factory.ts | 1 + 13 files changed, 237 insertions(+), 17 deletions(-) diff --git a/x-pack/plugins/security_solution/public/common/lib/telemetry/constants.ts b/x-pack/plugins/security_solution/public/common/lib/telemetry/constants.ts index cb247891d79b3..5d0e9bcfd918a 100644 --- a/x-pack/plugins/security_solution/public/common/lib/telemetry/constants.ts +++ b/x-pack/plugins/security_solution/public/common/lib/telemetry/constants.ts @@ -68,6 +68,8 @@ export enum TelemetryEventTypes { EntityDetailsClicked = 'Entity Details Clicked', EntityAlertsClicked = 'Entity Alerts Clicked', EntityRiskFiltered = 'Entity Risk Filtered', + EntityStoreEnablementToggleClicked = 'Entity Store Enablement Toggle Clicked', + EntityStoreDashboardInitButtonClicked = 'Entity Store Initialization Button Clicked', MLJobUpdate = 'ML Job Update', AddRiskInputToTimelineClicked = 'Add Risk Input To Timeline Clicked', ToggleRiskSummaryClicked = 'Toggle Risk Summary Clicked', diff --git a/x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/index.ts b/x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/index.ts index aedbc7eb01fae..5a45970de6af1 100644 --- a/x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/index.ts +++ b/x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/index.ts @@ -214,3 +214,36 @@ export const assetCriticalityCsvImportedEvent: TelemetryEvent = { }, }, }; + +export const entityStoreInitEvent: TelemetryEvent = { + eventType: TelemetryEventTypes.EntityStoreDashboardInitButtonClicked, + schema: { + timestamp: { + type: 'date', + _meta: { + description: 'Timestamp of the event', + optional: false, + }, + }, + }, +}; + +export const entityStoreEnablementEvent: TelemetryEvent = { + eventType: TelemetryEventTypes.EntityStoreEnablementToggleClicked, + schema: { + timestamp: { + type: 'date', + _meta: { + description: 'Timestamp of the event', + optional: false, + }, + }, + action: { + type: 'keyword', + _meta: { + description: 'Event toggle action', + optional: false, + }, + }, + }, +}; diff --git a/x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/types.ts b/x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/types.ts index 91a71a7dacca2..3313e99a31184 100644 --- a/x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/types.ts +++ b/x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/types.ts @@ -59,6 +59,15 @@ export interface ReportAssetCriticalityCsvImportedParams { }; } +export interface ReportEntityStoreEnablementParams { + timestamp: string; + action: 'start' | 'stop'; +} + +export interface ReportEntityStoreInitParams { + timestamp: string; +} + export type ReportEntityAnalyticsTelemetryEventParams = | ReportEntityDetailsClickedParams | ReportEntityAlertsClickedParams @@ -68,7 +77,9 @@ export type ReportEntityAnalyticsTelemetryEventParams = | ReportAddRiskInputToTimelineClickedParams | ReportAssetCriticalityCsvPreviewGeneratedParams | ReportAssetCriticalityFileSelectedParams - | ReportAssetCriticalityCsvImportedParams; + | ReportAssetCriticalityCsvImportedParams + | ReportEntityStoreEnablementParams + | ReportEntityStoreInitParams; export type EntityAnalyticsTelemetryEvent = | { @@ -106,4 +117,12 @@ export type EntityAnalyticsTelemetryEvent = | { eventType: TelemetryEventTypes.AssetCriticalityCsvImported; schema: RootSchema; + } + | { + eventType: TelemetryEventTypes.EntityStoreEnablementToggleClicked; + schema: RootSchema; + } + | { + eventType: TelemetryEventTypes.EntityStoreDashboardInitButtonClicked; + schema: RootSchema; }; diff --git a/x-pack/plugins/security_solution/public/common/lib/telemetry/events/telemetry_events.ts b/x-pack/plugins/security_solution/public/common/lib/telemetry/events/telemetry_events.ts index a0328099b9ff7..3e7c9f1138391 100644 --- a/x-pack/plugins/security_solution/public/common/lib/telemetry/events/telemetry_events.ts +++ b/x-pack/plugins/security_solution/public/common/lib/telemetry/events/telemetry_events.ts @@ -21,6 +21,8 @@ import { assetCriticalityCsvPreviewGeneratedEvent, assetCriticalityFileSelectedEvent, assetCriticalityCsvImportedEvent, + entityStoreEnablementEvent, + entityStoreInitEvent, } from './entity_analytics'; import { assistantInvokedEvent, @@ -172,6 +174,8 @@ export const telemetryEvents = [ assetCriticalityCsvPreviewGeneratedEvent, assetCriticalityFileSelectedEvent, assetCriticalityCsvImportedEvent, + entityStoreEnablementEvent, + entityStoreInitEvent, toggleRiskSummaryClickedEvent, RiskInputsExpandedFlyoutOpenedEvent, addRiskInputToTimelineClickedEvent, diff --git a/x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.mock.ts b/x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.mock.ts index 98d6aa64bb9cb..87d4b215543dc 100644 --- a/x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.mock.ts +++ b/x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.mock.ts @@ -43,4 +43,6 @@ export const createTelemetryClientMock = (): jest.Mocked = reportOpenNoteInExpandableFlyoutClicked: jest.fn(), reportAddNoteFromExpandableFlyoutClicked: jest.fn(), reportPreviewRule: jest.fn(), + reportEntityStoreEnablement: jest.fn(), + reportEntityStoreInit: jest.fn(), }); diff --git a/x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.ts b/x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.ts index e09f0a3c2eb66..689209f284dbb 100644 --- a/x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.ts +++ b/x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.ts @@ -45,6 +45,8 @@ import type { ReportEventLogShowSourceEventDateRangeParams, ReportEventLogFilterByRunTypeParams, PreviewRuleParams, + ReportEntityStoreEnablementParams, + ReportEntityStoreInitParams, } from './types'; import { TelemetryEventTypes } from './constants'; @@ -216,4 +218,12 @@ export class TelemetryClient implements TelemetryClientStart { public reportPreviewRule = (params: PreviewRuleParams) => { this.analytics.reportEvent(TelemetryEventTypes.PreviewRule, params); }; + + public reportEntityStoreEnablement = (params: ReportEntityStoreEnablementParams) => { + this.analytics.reportEvent(TelemetryEventTypes.EntityStoreEnablementToggleClicked, params); + }; + + public reportEntityStoreInit = (params: ReportEntityStoreInitParams) => { + this.analytics.reportEvent(TelemetryEventTypes.EntityStoreDashboardInitButtonClicked, params); + }; } diff --git a/x-pack/plugins/security_solution/public/common/lib/telemetry/types.ts b/x-pack/plugins/security_solution/public/common/lib/telemetry/types.ts index 55b91837a2585..95896bf74a6a7 100644 --- a/x-pack/plugins/security_solution/public/common/lib/telemetry/types.ts +++ b/x-pack/plugins/security_solution/public/common/lib/telemetry/types.ts @@ -32,6 +32,8 @@ import type { ReportAssetCriticalityCsvPreviewGeneratedParams, ReportAssetCriticalityFileSelectedParams, ReportAssetCriticalityCsvImportedParams, + ReportEntityStoreEnablementParams, + ReportEntityStoreInitParams, } from './events/entity_analytics/types'; import type { AssistantTelemetryEvent, @@ -78,17 +80,7 @@ export * from './events/ai_assistant/types'; export * from './events/alerts_grouping/types'; export * from './events/data_quality/types'; export * from './events/onboarding/types'; -export type { - ReportEntityAlertsClickedParams, - ReportEntityDetailsClickedParams, - ReportEntityRiskFilteredParams, - ReportRiskInputsExpandedFlyoutOpenedParams, - ReportToggleRiskSummaryClickedParams, - ReportAddRiskInputToTimelineClickedParams, - ReportAssetCriticalityCsvPreviewGeneratedParams, - ReportAssetCriticalityFileSelectedParams, - ReportAssetCriticalityCsvImportedParams, -} from './events/entity_analytics/types'; +export * from './events/entity_analytics/types'; export * from './events/document_details/types'; export * from './events/manual_rule_run/types'; export * from './events/event_log/types'; @@ -168,6 +160,9 @@ export interface TelemetryClientStart { ): void; reportAssetCriticalityCsvImported(params: ReportAssetCriticalityCsvImportedParams): void; reportCellActionClicked(params: ReportCellActionClickedParams): void; + // Entity Analytics Entity Store + reportEntityStoreEnablement(params: ReportEntityStoreEnablementParams): void; + reportEntityStoreInit(params: ReportEntityStoreInitParams): void; reportAnomaliesCountClicked(params: ReportAnomaliesCountClickedParams): void; reportDataQualityIndexChecked(params: ReportDataQualityIndexCheckedParams): void; diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts index 0ac684555fd0d..2d9fa716faf1c 100644 --- a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts +++ b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts @@ -9,6 +9,7 @@ import type { UseMutationOptions } from '@tanstack/react-query'; import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'; import { useCallback, useState } from 'react'; +import { useKibana } from '../../../../common/lib/kibana/kibana_react'; import type { DeleteEntityEngineResponse, InitEntityEngineResponse, @@ -21,6 +22,7 @@ const ENTITY_STORE_ENABLEMENT_INIT = 'ENTITY_STORE_ENABLEMENT_INIT'; export const useEntityStoreEnablement = () => { const [polling, setPolling] = useState(false); + const { telemetry } = useKibana().services; useEntityEngineStatus({ disabled: !polling, @@ -46,8 +48,11 @@ export const useEntityStoreEnablement = () => { }); const enable = useCallback(() => { + telemetry?.reportEntityStoreInit({ + timestamp: new Date().toISOString(), + }); initialize().then(() => setPolling(true)); - }, [initialize]); + }, [initialize, telemetry]); return { enable }; }; @@ -65,10 +70,17 @@ export const useInvalidateEntityEngineStatusQuery = () => { }; export const useInitEntityEngineMutation = (options?: UseMutationOptions<{}>) => { + const { telemetry } = useKibana().services; const invalidateEntityEngineStatusQuery = useInvalidateEntityEngineStatusQuery(); const { initEntityStore } = useEntityStoreRoutes(); return useMutation( - () => Promise.all([initEntityStore('user'), initEntityStore('host')]), + () => { + telemetry?.reportEntityStoreEnablement({ + timestamp: new Date().toISOString(), + action: 'start', + }); + return Promise.all([initEntityStore('user'), initEntityStore('host')]); + }, { ...options, mutationKey: INIT_ENTITY_ENGINE_STATUS_KEY, @@ -86,10 +98,17 @@ export const useInitEntityEngineMutation = (options?: UseMutationOptions<{}>) => export const STOP_ENTITY_ENGINE_STATUS_KEY = ['POST', 'STOP_ENTITY_ENGINE']; export const useStopEntityEngineMutation = (options?: UseMutationOptions<{}>) => { + const { telemetry } = useKibana().services; const invalidateEntityEngineStatusQuery = useInvalidateEntityEngineStatusQuery(); const { stopEntityStore } = useEntityStoreRoutes(); return useMutation( - () => Promise.all([stopEntityStore('user'), stopEntityStore('host')]), + () => { + telemetry?.reportEntityStoreEnablement({ + timestamp: new Date().toISOString(), + action: 'stop', + }); + return Promise.all([stopEntityStore('user'), stopEntityStore('host')]); + }, { ...options, mutationKey: STOP_ENTITY_ENGINE_STATUS_KEY, diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.ts index 429d77482841e..6b1d52661fa2c 100644 --- a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.ts +++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.ts @@ -11,12 +11,14 @@ import type { SavedObjectsClientContract, AuditLogger, IScopedClusterClient, + AnalyticsServiceSetup, } from '@kbn/core/server'; import { EntityClient } from '@kbn/entityManager-plugin/server/lib/entity_client'; import type { SortOrder } from '@elastic/elasticsearch/lib/api/types'; import type { TaskManagerStartContract } from '@kbn/task-manager-plugin/server'; import type { DataViewsService } from '@kbn/data-views-plugin/common'; import { isEqual } from 'lodash/fp'; +import moment from 'moment'; import type { AppClient } from '../../..'; import type { Entity, @@ -53,6 +55,10 @@ import { isPromiseFulfilled, isPromiseRejected, } from './utils'; +import { + ENTITY_ENGINE_INITIALIZATION_EVENT, + ENTITY_ENGINE_RESOURCE_INIT_FAILURE_EVENT, +} from '../../telemetry/event_based/events'; import type { EntityRecord } from './types'; import { CRITICALITY_VALUES } from '../asset_criticality/constants'; @@ -66,6 +72,7 @@ interface EntityStoreClientOpts { kibanaVersion: string; dataViewsService: DataViewsService; appClient: AppClient; + telemetry?: AnalyticsServiceSetup; } interface SearchEntitiesParams { @@ -170,6 +177,7 @@ export class EntityStoreDataClient { filter: string, pipelineDebugMode: boolean ) { + const setupStartTime = moment().utc().toISOString(); const { logger, namespace, appClient, dataViewsService } = this.options; const indexPatterns = await buildIndexPatterns(namespace, appClient, dataViewsService); @@ -249,12 +257,22 @@ export class EntityStoreDataClient { }); logger.info(`Entity store initialized for ${entityType}`); + const setupEndTime = moment().utc().toISOString(); + const duration = moment(setupEndTime).diff(moment(setupStartTime), 'seconds'); + this.options.telemetry?.reportEvent(ENTITY_ENGINE_INITIALIZATION_EVENT.eventType, { + duration, + }); + return updated; } catch (err) { this.options.logger.error( `Error initializing entity store for ${entityType}: ${err.message}` ); + this.options.telemetry?.reportEvent(ENTITY_ENGINE_RESOURCE_INIT_FAILURE_EVENT.eventType, { + error: err.message, + }); + await this.engineClient.update(entityType, ENGINE_STATUS.ERROR); await this.delete(entityType, taskManager, { deleteData: true, deleteEngine: false }); diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/task/field_retention_enrichment_task.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/task/field_retention_enrichment_task.ts index d008c3afe6f17..5227473e0e51b 100644 --- a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/task/field_retention_enrichment_task.ts +++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/task/field_retention_enrichment_task.ts @@ -6,6 +6,7 @@ */ import moment from 'moment'; +import type { AnalyticsServiceSetup } from '@kbn/core/server'; import { type Logger, SavedObjectsErrorHelpers } from '@kbn/core/server'; import type { ConcreteTaskInstance, @@ -26,6 +27,12 @@ import { } from '../united_entity_definitions'; import { executeFieldRetentionEnrichPolicy } from '../elasticsearch_assets'; +import { getEntitiesIndexName } from '../utils'; +import { + FIELD_RETENTION_ENRICH_POLICY_EXECUTION_EVENT, + ENTITY_STORE_USAGE_EVENT, +} from '../../../telemetry/event_based/events'; + const logFactory = (logger: Logger, taskId: string) => (message: string): void => @@ -44,14 +51,17 @@ type ExecuteEnrichPolicy = ( namespace: string, entityType: EntityType ) => ReturnType; +type GetStoreSize = (index: string | string[]) => Promise; export const registerEntityStoreFieldRetentionEnrichTask = ({ getStartServices, logger, + telemetry, taskManager, }: { getStartServices: EntityAnalyticsRoutesDeps['getStartServices']; logger: Logger; + telemetry: AnalyticsServiceSetup; taskManager: TaskManagerSetupContract | undefined; }): void => { if (!taskManager) { @@ -75,6 +85,14 @@ export const registerEntityStoreFieldRetentionEnrichTask = ({ }); }; + const getStoreSize: GetStoreSize = async (index) => { + const [coreStart] = await getStartServices(); + const esClient = coreStart.elasticsearch.client.asInternalUser; + + const { count } = await esClient.count({ index }); + return count; + }; + taskManager.registerTaskDefinitions({ [getTaskName()]: { title: 'Entity Analytics Entity Store - Execute Enrich Policy Task', @@ -82,6 +100,8 @@ export const registerEntityStoreFieldRetentionEnrichTask = ({ stateSchemaByVersion, createTaskRunner: createTaskRunnerFactory({ logger, + telemetry, + getStoreSize, executeEnrichPolicy, }), }, @@ -140,14 +160,18 @@ export const removeEntityStoreFieldRetentionEnrichTask = async ({ export const runTask = async ({ executeEnrichPolicy, + getStoreSize, isCancelled, logger, taskInstance, + telemetry, }: { logger: Logger; isCancelled: () => boolean; executeEnrichPolicy: ExecuteEnrichPolicy; + getStoreSize: GetStoreSize; taskInstance: ConcreteTaskInstance; + telemetry: AnalyticsServiceSetup; }): Promise<{ state: EntityStoreFieldRetentionTaskState; }> => { @@ -171,13 +195,14 @@ export const runTask = async ({ } const entityTypes = getAvailableEntityTypes(); + for (const entityType of entityTypes) { const start = Date.now(); debugLog(`executing field retention enrich policy for ${entityType}`); try { const { executed } = await executeEnrichPolicy(state.namespace, entityType); if (!executed) { - debugLog(`Field retention encrich policy for ${entityType} does not exist`); + debugLog(`Field retention enrich policy for ${entityType} does not exist`); } else { log( `Executed field retention enrich policy for ${entityType} in ${Date.now() - start}ms` @@ -192,6 +217,18 @@ export const runTask = async ({ const taskDurationInSeconds = moment(taskCompletionTime).diff(moment(taskStartTime), 'seconds'); log(`task run completed in ${taskDurationInSeconds} seconds`); + telemetry.reportEvent(FIELD_RETENTION_ENRICH_POLICY_EXECUTION_EVENT.eventType, { + duration: taskDurationInSeconds, + interval: INTERVAL, + }); + + // Track entity store usage + const indices = entityTypes.map((entityType) => + getEntitiesIndexName(entityType, state.namespace) + ); + const storeSize = await getStoreSize(indices); + telemetry.reportEvent(ENTITY_STORE_USAGE_EVENT.eventType, { storeSize }); + return { state: updatedState, }; @@ -202,7 +239,17 @@ export const runTask = async ({ }; const createTaskRunnerFactory = - ({ logger, executeEnrichPolicy }: { logger: Logger; executeEnrichPolicy: ExecuteEnrichPolicy }) => + ({ + logger, + telemetry, + executeEnrichPolicy, + getStoreSize, + }: { + logger: Logger; + telemetry: AnalyticsServiceSetup; + executeEnrichPolicy: ExecuteEnrichPolicy; + getStoreSize: GetStoreSize; + }) => ({ taskInstance }: { taskInstance: ConcreteTaskInstance }) => { let cancelled = false; const isCancelled = () => cancelled; @@ -210,9 +257,11 @@ const createTaskRunnerFactory = run: async () => runTask({ executeEnrichPolicy, + getStoreSize, isCancelled, logger, taskInstance, + telemetry, }), cancel: async () => { cancelled = true; diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/event_based/events.ts b/x-pack/plugins/security_solution/server/lib/telemetry/event_based/events.ts index b8a2df85f10ad..02a39be555110 100644 --- a/x-pack/plugins/security_solution/server/lib/telemetry/event_based/events.ts +++ b/x-pack/plugins/security_solution/server/lib/telemetry/event_based/events.ts @@ -128,6 +128,69 @@ export const ASSET_CRITICALITY_SYSTEM_PROCESSED_ASSIGNMENT_FILE_EVENT: EventType }, }; +export const FIELD_RETENTION_ENRICH_POLICY_EXECUTION_EVENT: EventTypeOpts<{ + duration: number; + interval: string; +}> = { + eventType: 'field_retention_enrich_policy_execution', + schema: { + duration: { + type: 'long', + _meta: { + description: 'Duration (in seconds) of the field retention enrich policy execution time', + }, + }, + interval: { + type: 'keyword', + _meta: { + description: 'Configured interval for the field retention enrich policy task', + }, + }, + }, +}; + +export const ENTITY_ENGINE_RESOURCE_INIT_FAILURE_EVENT: EventTypeOpts<{ + error: string; +}> = { + eventType: 'entity_engine_resource_init_failure', + schema: { + error: { + type: 'keyword', + _meta: { + description: 'Error message for a resource initialization failure', + }, + }, + }, +}; + +export const ENTITY_ENGINE_INITIALIZATION_EVENT: EventTypeOpts<{ + duration: number; +}> = { + eventType: 'entity_engine_initialization', + schema: { + duration: { + type: 'long', + _meta: { + description: 'Duration (in seconds) of the entity engine initialization', + }, + }, + }, +}; + +export const ENTITY_STORE_USAGE_EVENT: EventTypeOpts<{ + storeSize: number; +}> = { + eventType: 'entity_store_usage', + schema: { + storeSize: { + type: 'long', + _meta: { + description: 'Number of entities stored in the entity store', + }, + }, + }, +}; + export const ALERT_SUPPRESSION_EVENT: EventTypeOpts<{ suppressionAlertsCreated: number; suppressionAlertsSuppressed: number; @@ -390,4 +453,8 @@ export const events = [ ENDPOINT_RESPONSE_ACTION_SENT_EVENT, ENDPOINT_RESPONSE_ACTION_SENT_ERROR_EVENT, ENDPOINT_RESPONSE_ACTION_STATUS_CHANGE_EVENT, + FIELD_RETENTION_ENRICH_POLICY_EXECUTION_EVENT, + ENTITY_ENGINE_RESOURCE_INIT_FAILURE_EVENT, + ENTITY_ENGINE_INITIALIZATION_EVENT, + ENTITY_STORE_USAGE_EVENT, ]; diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts index 794c37cd38b40..428db0309346d 100644 --- a/x-pack/plugins/security_solution/server/plugin.ts +++ b/x-pack/plugins/security_solution/server/plugin.ts @@ -232,6 +232,7 @@ export class Plugin implements ISecuritySolutionPlugin { registerEntityStoreFieldRetentionEnrichTask({ getStartServices: core.getStartServices, logger: this.logger, + telemetry: core.analytics, taskManager: plugins.taskManager, }); } diff --git a/x-pack/plugins/security_solution/server/request_context_factory.ts b/x-pack/plugins/security_solution/server/request_context_factory.ts index 8e3af9b9bce8a..e57141b3a5ae7 100644 --- a/x-pack/plugins/security_solution/server/request_context_factory.ts +++ b/x-pack/plugins/security_solution/server/request_context_factory.ts @@ -225,6 +225,7 @@ export class RequestContextFactory implements IRequestContextFactory { taskManager: startPlugins.taskManager, auditLogger: getAuditLogger(), kibanaVersion: options.kibanaVersion, + telemetry: core.analytics, }); }), };