github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 09:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

Universal entity installation

Browse source
This commit is contained in:
Ido Cohen 2025-01-22 15:10:52 +02:00 • committed by GitHub
parent 26350ff3ba
commit c932cfa562
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 26 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

10
x-pack/solutions/security/plugins/security_solution/common/entity_analytics/entity_store/utils.ts
View file

@ -6,18 +6,12 @@
*/
import type { ExperimentalFeatures } from '../../experimental_features';
import { EntityType } from '../types';
import { getAllEntityTypes, getDisabledEntityTypes } from '../utils';
const ENTITY_STORE_UNAVAILABLE_TYPES = [EntityType.universal];
// TODO delete this function when the universal entity support is added
export const getEnabledStoreEntityTypes = (experimentalFeatures: ExperimentalFeatures) => {
const allEntityTypes = getAllEntityTypes();
const disabledEntityTypes = getDisabledEntityTypes(experimentalFeatures);
return allEntityTypes.filter(
(value) =>
!disabledEntityTypes.includes(value) && !ENTITY_STORE_UNAVAILABLE_TYPES.includes(value)
);
return allEntityTypes.filter((value) => !disabledEntityTypes.includes(value));
};

27
x-pack/solutions/security/plugins/security_solution/server/lib/asset_inventory/asset_inventory_data_client.ts
View file

@ -5,12 +5,10 @@
* 2.0.
*/
import type { Logger, ElasticsearchClient, IScopedClusterClient } from '@kbn/core/server';
import type { Logger, IScopedClusterClient } from '@kbn/core/server';
import type { ExperimentalFeatures } from '../../../common';
import { createKeywordBuilderPipeline, deleteKeywordBuilderPipeline } from './ingest_pipelines';
interface AssetInventoryClientOpts {
logger: Logger;
clusterClient: IScopedClusterClient;
@ -20,12 +18,7 @@ interface AssetInventoryClientOpts {
// AssetInventoryDataClient is responsible for managing the asset inventory,
// including initializing and cleaning up resources such as Elasticsearch ingest pipelines.
export class AssetInventoryDataClient {
private esClient: ElasticsearchClient;
constructor(private readonly options: AssetInventoryClientOpts) {
const { clusterClient } = options;
this.esClient = clusterClient.asCurrentUser;
}
constructor(private readonly options: AssetInventoryClientOpts) {}
// Enables the asset inventory by deferring the initialization to avoid blocking the main thread.
public async enable() {
@ -58,12 +51,7 @@ export class AssetInventoryDataClient {
private async asyncSetup() {
const { logger } = this.options;
try {
logger.debug('creating keyword builder pipeline');
await createKeywordBuilderPipeline({
logger,
esClient: this.esClient,
});
logger.debug('keyword builder pipeline created');
logger.debug('Initializing asset inventory');
} catch (err) {
logger.error(`Error initializing asset inventory: ${err.message}`);
await this.delete();
@ -77,15 +65,6 @@ export class AssetInventoryDataClient {
logger.debug(`Deleting asset inventory`);
try {
logger.debug(`Deleting asset inventory keyword builder pipeline`);
await deleteKeywordBuilderPipeline({
logger,
esClient: this.esClient,
}).catch((err) => {
logger.error('Error on deleting keyword builder pipeline', err);
});
logger.debug(`Deleted asset inventory`);
return { deleted: true };
} catch (err) {

21
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.ts
View file

@ -87,6 +87,10 @@ import {
import { CRITICALITY_VALUES } from '../asset_criticality/constants';
import { createEngineDescription } from './installation/engine_description';
import { convertToEntityManagerDefinition } from './entity_definitions/entity_manager_conversion';
import {
createKeywordBuilderPipeline,
deleteKeywordBuilderPipeline,
} from '../../asset_inventory/ingest_pipelines';
// Workaround. TransformState type is wrong. The health type should be: TransformHealth from '@kbn/transform-plugin/common/types/transform_stats'
export interface TransformHealth extends estypes.TransformGetTransformStatsTransformStatsHealth {
@ -379,6 +383,14 @@ export class EntityStoreDataClient {
});
this.log(`debug`, entityType, `Created entity definition`);
if (entityType === EntityType.universal) {
logger.debug('creating keyword builder pipeline');
await createKeywordBuilderPipeline({
logger,
esClient: this.esClient,
});
}
// the index must be in place with the correct mapping before the enrich policy is created
// this is because the enrich policy will fail if the index does not exist with the correct fields
await createEntityIndexComponentTemplate(description, this.esClient);
@ -655,6 +667,15 @@ export class EntityStoreDataClient {
});
this.log('debug', entityType, `Deleted field retention enrich policy`);
if (entityType === EntityType.universal) {
logger.debug(`Deleting asset inventory keyword builder pipeline`);
await deleteKeywordBuilderPipeline({
logger,
esClient: this.esClient,
});
}
if (deleteData) {
await deleteEntityIndex({
entityType,