[8.17] [Entity Analytics] API changes for right placement of deleting the old component template (#199734) (#212378)

# Backport This will backport the following commits from `main` to `8.17`: - [[Entity Analytics] API changes for right placement of deleting the old component template (#199734)](https://github.com/elastic/kibana/pull/199734)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) \n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\\n\\n### Questions ?\\nPlease refer to the\n[Backport\ntool\\ndocumentation](https://github.com/sqren/backport)\\n\\n\"}}]}]\nBACKPORT-->\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>"}},{"branch":"8.16","label":"v8.16.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/200591","number":200591,"state":"MERGED","mergeCommit":{"sha":"06999139d210464c236a3784c58b7e5dcbd64ce3","message":"[8.16] [Entity Analytics] API changes for right placement of deleting the old component template (#199734) (#200591)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.16`:\n- [[Entity Analytics] API changes for right placement of deleting the\nold component template\n(#199734)](https://github.com/elastic/kibana/pull/199734)\n\n\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n"}},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT-->
2025-04-24 17:59:23 -04:00 · 2025-02-26 17:21:47 +05:30 · 2025-02-26 17:21:47 +05:30 · 01a430a06c
commit 01a430a06c
parent 83391ca5d9
4 changed files with 498 additions and 350 deletions
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/configurations.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/configurations.ts
@ -129,6 +129,9 @@ export const riskScoreFieldMap: FieldMap = {
 } as const;

 export const mappingComponentName = '.risk-score-mappings';
+export const nameSpaceAwareMappingsComponentName = (namespace: string): string => {
+  return `${mappingComponentName}-${namespace}`;
+};
 export const totalFieldsLimit = 1000;

 export const getIndexPatternDataStream = (namespace: string): IIndexPatternString => ({
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_data_client.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_data_client.test.ts
@ -40,6 +40,7 @@ jest.spyOn(transforms, 'scheduleTransformNow').mockResolvedValue(Promise.resolve

 describe('RiskScoreDataClient', () => {
  let riskScoreDataClient: RiskScoreDataClient;
+  let riskScoreDataClientWithNameSpace: RiskScoreDataClient;
  let mockSavedObjectClient: ReturnType<typeof savedObjectsClientMock.create>;
  let logger: ReturnType<typeof loggingSystemMock.createLogger>;
  const esClient = elasticsearchServiceMock.createScopedClusterClient().asCurrentUser;
@ -56,6 +57,8 @@ describe('RiskScoreDataClient', () => {
      namespace: 'default',
    };
    riskScoreDataClient = new RiskScoreDataClient(options);
+    const optionsWithNamespace = { ...options, namespace: 'space-1' };
+    riskScoreDataClientWithNameSpace = new RiskScoreDataClient(optionsWithNamespace);
  });

  afterEach(() => {
@ -80,369 +83,396 @@ describe('RiskScoreDataClient', () => {
  });

  describe('init success', () => {
-    it('should initialize risk engine resources', async () => {
-      await riskScoreDataClient.init();
+    it('should initialize risk engine resources in the appropriate space', async () => {
+      const assertComponentTemplate = (namespace: string) => {
+        expect(createOrUpdateComponentTemplate).toHaveBeenCalledWith(
+          expect.objectContaining({
+            logger,
+            esClient,
+            template: expect.objectContaining({
+              name: `.risk-score-mappings-${namespace}`,
+              _meta: {
+                managed: true,
+              },
+            }),
+            totalFieldsLimit: 1000,
+          })
+        );
+      };

-      expect(createOrUpdateComponentTemplate).toHaveBeenCalledWith(
-        expect.objectContaining({
+      const assertIndexTemplate = (namespace: string) => {
+        expect(createOrUpdateIndexTemplate).toHaveBeenCalledWith({
          logger,
          esClient,
-          template: expect.objectContaining({
-            name: '.risk-score-mappings',
-            _meta: {
-              managed: true,
+          template: {
+            name: `.risk-score.risk-score-${namespace}-index-template`,
+            body: {
+              data_stream: { hidden: true },
+              index_patterns: [`risk-score.risk-score-${namespace}`],
+              composed_of: [`.risk-score-mappings-${namespace}`],
+              template: {
+                lifecycle: {},
+                settings: {
+                  'index.mapping.total_fields.limit': totalFieldsLimit,
+                },
+                mappings: {
+                  dynamic: false,
+                  _meta: {
+                    kibana: {
+                      version: '8.9.0',
+                    },
+                    managed: true,
+                    namespace,
+                  },
+                },
+              },
+              _meta: {
+                kibana: {
+                  version: '8.9.0',
+                },
+                managed: true,
+                namespace,
+              },
            },
-          }),
-          totalFieldsLimit: 1000,
-        })
-      );
+          },
+        });
+      };
+
+      const assertDataStream = (namespace: string) => {
+        expect(createDataStream).toHaveBeenCalledWith({
+          logger,
+          esClient,
+          totalFieldsLimit,
+          indexPatterns: {
+            template: `.risk-score.risk-score-${namespace}-index-template`,
+            alias: `risk-score.risk-score-${namespace}`,
+          },
+        });
+      };
+
+      const assertIndex = (namespace: string) => {
+        expect(createOrUpdateIndex).toHaveBeenCalledWith({
+          logger,
+          esClient,
+          options: {
+            index: `risk-score.risk-score-latest-${namespace}`,
+            mappings: {
+              dynamic: false,
+              properties: {
+                '@timestamp': {
+                  ignore_malformed: false,
+                  type: 'date',
+                },
+                host: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                    },
+                    risk: {
+                      properties: {
+                        calculated_level: {
+                          type: 'keyword',
+                        },
+                        calculated_score: {
+                          type: 'float',
+                        },
+                        calculated_score_norm: {
+                          type: 'float',
+                        },
+                        category_1_count: {
+                          type: 'long',
+                        },
+                        category_1_score: {
+                          type: 'float',
+                        },
+                        id_field: {
+                          type: 'keyword',
+                        },
+                        id_value: {
+                          type: 'keyword',
+                        },
+                        inputs: {
+                          properties: {
+                            category: {
+                              type: 'keyword',
+                            },
+                            description: {
+                              type: 'keyword',
+                            },
+                            id: {
+                              type: 'keyword',
+                            },
+                            index: {
+                              type: 'keyword',
+                            },
+                            risk_score: {
+                              type: 'float',
+                            },
+                            timestamp: {
+                              type: 'date',
+                            },
+                          },
+                          type: 'object',
+                        },
+                        notes: {
+                          type: 'keyword',
+                        },
+                      },
+                      type: 'object',
+                    },
+                  },
+                },
+                user: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                    },
+                    risk: {
+                      properties: {
+                        calculated_level: {
+                          type: 'keyword',
+                        },
+                        calculated_score: {
+                          type: 'float',
+                        },
+                        calculated_score_norm: {
+                          type: 'float',
+                        },
+                        category_1_count: {
+                          type: 'long',
+                        },
+                        category_1_score: {
+                          type: 'float',
+                        },
+                        id_field: {
+                          type: 'keyword',
+                        },
+                        id_value: {
+                          type: 'keyword',
+                        },
+                        inputs: {
+                          properties: {
+                            category: {
+                              type: 'keyword',
+                            },
+                            description: {
+                              type: 'keyword',
+                            },
+                            id: {
+                              type: 'keyword',
+                            },
+                            index: {
+                              type: 'keyword',
+                            },
+                            risk_score: {
+                              type: 'float',
+                            },
+                            timestamp: {
+                              type: 'date',
+                            },
+                          },
+                          type: 'object',
+                        },
+                        notes: {
+                          type: 'keyword',
+                        },
+                      },
+                      type: 'object',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        });
+      };
+
+      const assertTransform = (namespace: string) => {
+        expect(transforms.createTransform).toHaveBeenCalledWith({
+          logger,
+          esClient,
+          transform: {
+            dest: {
+              index: `risk-score.risk-score-latest-${namespace}`,
+            },
+            frequency: '1h',
+            latest: {
+              sort: '@timestamp',
+              unique_key: ['host.name', 'user.name'],
+            },
+            source: {
+              index: [`risk-score.risk-score-${namespace}`],
+            },
+            sync: {
+              time: {
+                delay: '0s',
+                field: '@timestamp',
+              },
+            },
+            transform_id: `risk_score_latest_transform_${namespace}`,
+            settings: {
+              unattended: true,
+            },
+            _meta: {
+              version: 2,
+              managed: true,
+              managed_by: 'security-entity-analytics',
+            },
+          },
+        });
+      };
+
+      // Default namespace
+      esClient.cluster.existsComponentTemplate.mockResolvedValue(false);
+      await riskScoreDataClient.init();
+      assertComponentTemplate('default');
+      assertIndexTemplate('default');
+      assertDataStream('default');
+      assertIndex('default');
+      assertTransform('default');
+
+      // Space-1 namespace
+      esClient.cluster.existsComponentTemplate.mockResolvedValue(false);
+      await riskScoreDataClientWithNameSpace.init();
+      assertComponentTemplate('space-1');
+      assertIndexTemplate('space-1');
+      assertDataStream('space-1');
+      assertIndex('space-1');
+      assertTransform('space-1');
+
      expect((createOrUpdateComponentTemplate as jest.Mock).mock.lastCall[0].template.template)
        .toMatchInlineSnapshot(`
-            Object {
-              "mappings": Object {
-                "dynamic": "strict",
-                "properties": Object {
-                  "@timestamp": Object {
-                    "ignore_malformed": false,
-                    "type": "date",
-                  },
-                  "host": Object {
-                    "properties": Object {
-                      "name": Object {
-                        "type": "keyword",
-                      },
-                      "risk": Object {
-                        "properties": Object {
-                          "calculated_level": Object {
-                            "type": "keyword",
-                          },
-                          "calculated_score": Object {
-                            "type": "float",
-                          },
-                          "calculated_score_norm": Object {
-                            "type": "float",
-                          },
-                          "category_1_count": Object {
-                            "type": "long",
-                          },
-                          "category_1_score": Object {
-                            "type": "float",
-                          },
-                          "id_field": Object {
-                            "type": "keyword",
-                          },
-                          "id_value": Object {
-                            "type": "keyword",
-                          },
-                          "inputs": Object {
-                            "properties": Object {
-                              "category": Object {
-                                "type": "keyword",
-                              },
-                              "description": Object {
-                                "type": "keyword",
-                              },
-                              "id": Object {
-                                "type": "keyword",
-                              },
-                              "index": Object {
-                                "type": "keyword",
-                              },
-                              "risk_score": Object {
-                                "type": "float",
-                              },
-                              "timestamp": Object {
-                                "type": "date",
-                              },
+          Object {
+            "mappings": Object {
+              "dynamic": "strict",
+              "properties": Object {
+                "@timestamp": Object {
+                  "ignore_malformed": false,
+                  "type": "date",
+                },
+                "host": Object {
+                  "properties": Object {
+                    "name": Object {
+                      "type": "keyword",
+                    },
+                    "risk": Object {
+                      "properties": Object {
+                        "calculated_level": Object {
+                          "type": "keyword",
+                        },
+                        "calculated_score": Object {
+                          "type": "float",
+                        },
+                        "calculated_score_norm": Object {
+                          "type": "float",
+                        },
+                        "category_1_count": Object {
+                          "type": "long",
+                        },
+                        "category_1_score": Object {
+                          "type": "float",
+                        },
+                        "id_field": Object {
+                          "type": "keyword",
+                        },
+                        "id_value": Object {
+                          "type": "keyword",
+                        },
+                        "inputs": Object {
+                          "properties": Object {
+                            "category": Object {
+                              "type": "keyword",
                            },
-                            "type": "object",
-                          },
-                          "notes": Object {
-                            "type": "keyword",
-                          },
-                        },
-                        "type": "object",
-                      },
-                    },
-                  },
-                  "user": Object {
-                    "properties": Object {
-                      "name": Object {
-                        "type": "keyword",
-                      },
-                      "risk": Object {
-                        "properties": Object {
-                          "calculated_level": Object {
-                            "type": "keyword",
-                          },
-                          "calculated_score": Object {
-                            "type": "float",
-                          },
-                          "calculated_score_norm": Object {
-                            "type": "float",
-                          },
-                          "category_1_count": Object {
-                            "type": "long",
-                          },
-                          "category_1_score": Object {
-                            "type": "float",
-                          },
-                          "id_field": Object {
-                            "type": "keyword",
-                          },
-                          "id_value": Object {
-                            "type": "keyword",
-                          },
-                          "inputs": Object {
-                            "properties": Object {
-                              "category": Object {
-                                "type": "keyword",
-                              },
-                              "description": Object {
-                                "type": "keyword",
-                              },
-                              "id": Object {
-                                "type": "keyword",
-                              },
-                              "index": Object {
-                                "type": "keyword",
-                              },
-                              "risk_score": Object {
-                                "type": "float",
-                              },
-                              "timestamp": Object {
-                                "type": "date",
-                              },
+                            "description": Object {
+                              "type": "keyword",
+                            },
+                            "id": Object {
+                              "type": "keyword",
+                            },
+                            "index": Object {
+                              "type": "keyword",
+                            },
+                            "risk_score": Object {
+                              "type": "float",
+                            },
+                            "timestamp": Object {
+                              "type": "date",
                            },
-                            "type": "object",
-                          },
-                          "notes": Object {
-                            "type": "keyword",
                          },
+                          "type": "object",
+                        },
+                        "notes": Object {
+                          "type": "keyword",
                        },
-                        "type": "object",
                      },
+                      "type": "object",
+                    },
+                  },
+                },
+                "user": Object {
+                  "properties": Object {
+                    "name": Object {
+                      "type": "keyword",
+                    },
+                    "risk": Object {
+                      "properties": Object {
+                        "calculated_level": Object {
+                          "type": "keyword",
+                        },
+                        "calculated_score": Object {
+                          "type": "float",
+                        },
+                        "calculated_score_norm": Object {
+                          "type": "float",
+                        },
+                        "category_1_count": Object {
+                          "type": "long",
+                        },
+                        "category_1_score": Object {
+                          "type": "float",
+                        },
+                        "id_field": Object {
+                          "type": "keyword",
+                        },
+                        "id_value": Object {
+                          "type": "keyword",
+                        },
+                        "inputs": Object {
+                          "properties": Object {
+                            "category": Object {
+                              "type": "keyword",
+                            },
+                            "description": Object {
+                              "type": "keyword",
+                            },
+                            "id": Object {
+                              "type": "keyword",
+                            },
+                            "index": Object {
+                              "type": "keyword",
+                            },
+                            "risk_score": Object {
+                              "type": "float",
+                            },
+                            "timestamp": Object {
+                              "type": "date",
+                            },
+                          },
+                          "type": "object",
+                        },
+                        "notes": Object {
+                          "type": "keyword",
+                        },
+                      },
+                      "type": "object",
                    },
                  },
                },
              },
-              "settings": Object {},
-            }
-          `);
-
-      expect(createOrUpdateIndexTemplate).toHaveBeenCalledWith({
-        logger,
-        esClient,
-        template: {
-          name: '.risk-score.risk-score-default-index-template',
-          body: {
-            data_stream: { hidden: true },
-            index_patterns: ['risk-score.risk-score-default'],
-            composed_of: ['.risk-score-mappings'],
-            template: {
-              lifecycle: {},
-              settings: {
-                'index.mapping.total_fields.limit': totalFieldsLimit,
-              },
-              mappings: {
-                dynamic: false,
-                _meta: {
-                  kibana: {
-                    version: '8.9.0',
-                  },
-                  managed: true,
-                  namespace: 'default',
-                },
-              },
            },
-            _meta: {
-              kibana: {
-                version: '8.9.0',
-              },
-              managed: true,
-              namespace: 'default',
-            },
-          },
-        },
-      });
-
-      expect(createDataStream).toHaveBeenCalledWith({
-        logger,
-        esClient,
-        totalFieldsLimit,
-        indexPatterns: {
-          template: `.risk-score.risk-score-default-index-template`,
-          alias: `risk-score.risk-score-default`,
-        },
-      });
-
-      expect(createOrUpdateIndex).toHaveBeenCalledWith({
-        logger,
-        esClient,
-        options: {
-          index: `risk-score.risk-score-latest-default`,
-          mappings: {
-            dynamic: false,
-            properties: {
-              '@timestamp': {
-                ignore_malformed: false,
-                type: 'date',
-              },
-              host: {
-                properties: {
-                  name: {
-                    type: 'keyword',
-                  },
-                  risk: {
-                    properties: {
-                      calculated_level: {
-                        type: 'keyword',
-                      },
-                      calculated_score: {
-                        type: 'float',
-                      },
-                      calculated_score_norm: {
-                        type: 'float',
-                      },
-                      category_1_count: {
-                        type: 'long',
-                      },
-                      category_1_score: {
-                        type: 'float',
-                      },
-                      id_field: {
-                        type: 'keyword',
-                      },
-                      id_value: {
-                        type: 'keyword',
-                      },
-                      inputs: {
-                        properties: {
-                          category: {
-                            type: 'keyword',
-                          },
-                          description: {
-                            type: 'keyword',
-                          },
-                          id: {
-                            type: 'keyword',
-                          },
-                          index: {
-                            type: 'keyword',
-                          },
-                          risk_score: {
-                            type: 'float',
-                          },
-                          timestamp: {
-                            type: 'date',
-                          },
-                        },
-                        type: 'object',
-                      },
-                      notes: {
-                        type: 'keyword',
-                      },
-                    },
-                    type: 'object',
-                  },
-                },
-              },
-              user: {
-                properties: {
-                  name: {
-                    type: 'keyword',
-                  },
-                  risk: {
-                    properties: {
-                      calculated_level: {
-                        type: 'keyword',
-                      },
-                      calculated_score: {
-                        type: 'float',
-                      },
-                      calculated_score_norm: {
-                        type: 'float',
-                      },
-                      category_1_count: {
-                        type: 'long',
-                      },
-                      category_1_score: {
-                        type: 'float',
-                      },
-                      id_field: {
-                        type: 'keyword',
-                      },
-                      id_value: {
-                        type: 'keyword',
-                      },
-                      inputs: {
-                        properties: {
-                          category: {
-                            type: 'keyword',
-                          },
-                          description: {
-                            type: 'keyword',
-                          },
-                          id: {
-                            type: 'keyword',
-                          },
-                          index: {
-                            type: 'keyword',
-                          },
-                          risk_score: {
-                            type: 'float',
-                          },
-                          timestamp: {
-                            type: 'date',
-                          },
-                        },
-                        type: 'object',
-                      },
-                      notes: {
-                        type: 'keyword',
-                      },
-                    },
-                    type: 'object',
-                  },
-                },
-              },
-            },
-          },
-        },
-      });
-
-      expect(transforms.createTransform).toHaveBeenCalledWith({
-        logger,
-        esClient,
-        transform: {
-          dest: {
-            index: 'risk-score.risk-score-latest-default',
-          },
-          frequency: '1h',
-          latest: {
-            sort: '@timestamp',
-            unique_key: ['host.name', 'user.name'],
-          },
-          source: {
-            index: ['risk-score.risk-score-default'],
-          },
-          sync: {
-            time: {
-              delay: '0s',
-              field: '@timestamp',
-            },
-          },
-          transform_id: 'risk_score_latest_transform_default',
-          settings: {
-            unattended: true,
-          },
-          _meta: {
-            version: 2,
-            managed: true,
-            managed_by: 'security-entity-analytics',
-          },
-        },
-      });
+            "settings": Object {},
+          }
+        `);
    });
  });

--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_data_client.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_data_client.ts
@ -22,6 +22,7 @@ import {
  getIndexPatternDataStream,
  getTransformOptions,
  mappingComponentName,
+  nameSpaceAwareMappingsComponentName,
  riskScoreFieldMap,
  totalFieldsLimit,
 } from './configurations';
@ -114,12 +115,22 @@ export class RiskScoreDataClient {
        namespace,
      };

+      // Check if there are any existing component templates with the namespace in the name
+
+      const oldComponentTemplateExists = await esClient.cluster.existsComponentTemplate({
+        name: mappingComponentName,
+      });
+      if (oldComponentTemplateExists) {
+        await this.updateComponentTemplateNamewithNamespace(namespace);
+      }
+
+      // Update the new component template with the required data
      await Promise.all([
        createOrUpdateComponentTemplate({
          logger: this.options.logger,
          esClient,
          template: {
-            name: mappingComponentName,
+            name: nameSpaceAwareMappingsComponentName(namespace),
            _meta: {
              managed: true,
            },
@ -140,7 +151,7 @@ export class RiskScoreDataClient {
          body: {
            data_stream: { hidden: true },
            index_patterns: [indexPatterns.alias],
-            composed_of: [mappingComponentName],
+            composed_of: [nameSpaceAwareMappingsComponentName(namespace)],
            template: {
              lifecycle: {},
              settings: {
@ -156,6 +167,14 @@ export class RiskScoreDataClient {
        },
      });

+      // Delete the component template without the namespace in the name
+      await esClient.cluster.deleteComponentTemplate(
+        {
+          name: mappingComponentName,
+        },
+        { ignore: [404] }
+      );
+
      await createDataStream({
        logger: this.options.logger,
        esClient,
@ -286,4 +305,20 @@ export class RiskScoreDataClient {
      { logger: this.options.logger }
    );
  }
+
+  private async updateComponentTemplateNamewithNamespace(namespace: string): Promise<void> {
+    const esClient = this.options.esClient;
+    const oldComponentTemplateResponse = await esClient.cluster.getComponentTemplate(
+      {
+        name: mappingComponentName,
+      },
+      { ignore: [404] }
+    );
+    const oldComponentTemplate = oldComponentTemplateResponse?.component_templates[0];
+    const newComponentTemplateName = nameSpaceAwareMappingsComponentName(namespace);
+    await esClient.cluster.putComponentTemplate({
+      name: newComponentTemplateName,
+      body: oldComponentTemplate.component_template,
+    });
+  }
 }