Entity store/schedule maintainers

x-pack/platform/plugins/shared/streams/moon.yml

@@ -79,6 +79,7 @@ dependsOn:
   - '@kbn/esql-language'
   - '@kbn/core-elasticsearch-server-mocks'
   - '@kbn/core-logging-server-mocks'
+  - '@kbn/logging-mocks'
 tags:
   - plugin
   - prod

x-pack/platform/plugins/shared/task_manager/server/task_scheduling.ts

@@ -204,7 +204,8 @@ export class TaskScheduling {
 
   public async bulkUpdateState(
     taskIds: string[],
-    stateMapFn: (s: ConcreteTaskInstance['state'], id: string) => ConcreteTaskInstance['state']
+    stateMapFn: (s: ConcreteTaskInstance['state'], id: string) => ConcreteTaskInstance['state'],
+    options?: ApiKeyOptions
   ) {
     return await retryableBulkUpdate({
       taskIds,
@@ -216,6 +217,7 @@ export class TaskScheduling {
         state: stateMapFn(task.state, task.id),
       }),
       validate: false,
+      options,
     });
   }
 

x-pack/solutions/security/plugins/entity_store/common/index.ts

@@ -60,6 +60,10 @@ export const ENTITY_STORE_ROUTES = {
   CRUD_UPSERT: `${ENTITY_STORE_BASE_ROUTE}/entities/{entityType}`,
   CRUD_UPSERT_BULK: `${ENTITY_STORE_BASE_ROUTE}/entities/bulk`,
   CRUD_DELETE: `${ENTITY_STORE_BASE_ROUTE}/entities/`,
+  ENTITY_MAINTAINERS_START: `${ENTITY_STORE_BASE_ROUTE}/entity_maintainers/start/{id}`,
+  ENTITY_MAINTAINERS_STOP: `${ENTITY_STORE_BASE_ROUTE}/entity_maintainers/stop/{id}`,
+  ENTITY_MAINTAINERS_GET: `${ENTITY_STORE_BASE_ROUTE}/entity_maintainers`,
+  ENTITY_MAINTAINERS_INIT: `${ENTITY_STORE_BASE_ROUTE}/entity_maintainers/init`,
 } as const satisfies Record<string, string>;
 
 export const getErrorMessage = (error: unknown): string => {

x-pack/solutions/security/plugins/entity_store/public/hooks/useInstallEntityStoreV2.test.tsx

@@ -44,104 +44,101 @@ describe('useInstallEntityStoreV2', () => {
     expect(mockServices.http.post).not.toHaveBeenCalled();
   });
 
-  it('should not install when not in default space', async () => {
+  it('should do nothing when not in default space and entity store is not installed', async () => {
     const mockServices = createMockServices();
     mockServices.uiSettings.get.mockReturnValue(true);
     mockServices.spaces.getActiveSpace.mockResolvedValue({ id: 'custom-space' });
+    mockServices.http.get.mockResolvedValueOnce({ status: EntityStoreStatus.Values.not_installed });
 
     renderHook(() => useInstallEntityStoreV2(asServices(mockServices)));
 
     await waitFor(() => {
-      expect(mockServices.spaces.getActiveSpace).toHaveBeenCalled();
+      expect(mockServices.http.get).toHaveBeenCalled();
     });
 
     expect(mockServices.http.post).not.toHaveBeenCalled();
   });
 
-  it("should not install when entity store status is 'running'", async () => {
+  it('when not default space but entity store is already installed, inits entity maintainers only', async () => {
     const mockServices = createMockServices();
     mockServices.uiSettings.get.mockReturnValue(true);
-    mockServices.spaces.getActiveSpace.mockResolvedValue({ id: 'default' });
+    mockServices.spaces.getActiveSpace.mockResolvedValue({ id: 'custom-space' });
     mockServices.http.get.mockResolvedValueOnce({ status: EntityStoreStatus.Values.running });
+    mockServices.http.post.mockResolvedValue({});
 
     renderHook(() => useInstallEntityStoreV2(asServices(mockServices)));
 
     await waitFor(() => {
-      expect(mockServices.http.get).toHaveBeenCalledWith({
-        path: ENTITY_STORE_ROUTES.STATUS,
-        query: { apiVersion: '2', include_components: false },
-      });
+      expect(mockServices.http.post).toHaveBeenCalledTimes(1);
     });
 
-    expect(mockServices.http.post).not.toHaveBeenCalled();
-  });
-
-  it("should not install when entity store status is 'installing'", async () => {
-    const mockServices = createMockServices();
-    mockServices.uiSettings.get.mockReturnValue(true);
-    mockServices.spaces.getActiveSpace.mockResolvedValue({ id: 'default' });
-    mockServices.http.get.mockResolvedValueOnce({ status: EntityStoreStatus.Values.installing });
-
-    renderHook(() => useInstallEntityStoreV2(asServices(mockServices)));
-
-    await waitFor(() => {
-      expect(mockServices.http.get).toHaveBeenCalledTimes(1);
+    expect(mockServices.http.post).toHaveBeenCalledWith({
+      path: ENTITY_STORE_ROUTES.ENTITY_MAINTAINERS_INIT,
+      body: JSON.stringify({}),
+      query: { apiVersion: '2' },
     });
-
-    expect(mockServices.http.post).not.toHaveBeenCalled();
-  });
-
-  it("should not install when entity store status is 'stopped'", async () => {
-    const mockServices = createMockServices();
-    mockServices.uiSettings.get.mockReturnValue(true);
-    mockServices.spaces.getActiveSpace.mockResolvedValue({ id: 'default' });
-    mockServices.http.get.mockResolvedValueOnce({ status: EntityStoreStatus.Values.stopped });
-
-    renderHook(() => useInstallEntityStoreV2(asServices(mockServices)));
-
-    await waitFor(() => {
-      expect(mockServices.http.get).toHaveBeenCalledTimes(1);
+    expect(mockServices.http.post).not.toHaveBeenCalledWith({
+      path: ENTITY_STORE_ROUTES.INSTALL,
+      body: JSON.stringify({}),
+      query: { apiVersion: '2' },
     });
-
-    expect(mockServices.http.post).not.toHaveBeenCalled();
   });
 
-  it("should not install when entity store status is 'error'", async () => {
+  it('when entity store is already installed, inits entity maintainers only', async () => {
     const mockServices = createMockServices();
     mockServices.uiSettings.get.mockReturnValue(true);
     mockServices.spaces.getActiveSpace.mockResolvedValue({ id: 'default' });
-    mockServices.http.get.mockResolvedValueOnce({ status: EntityStoreStatus.Values.error });
+    mockServices.http.get.mockResolvedValueOnce({ status: EntityStoreStatus.Values.running });
+    mockServices.http.post.mockResolvedValue({});
 
     renderHook(() => useInstallEntityStoreV2(asServices(mockServices)));
 
     await waitFor(() => {
-      expect(mockServices.http.get).toHaveBeenCalledTimes(1);
+      expect(mockServices.http.post).toHaveBeenCalledTimes(1);
     });
 
-    expect(mockServices.http.post).not.toHaveBeenCalled();
+    expect(mockServices.http.get).toHaveBeenCalledWith({
+      path: ENTITY_STORE_ROUTES.STATUS,
+      query: { apiVersion: '2', include_components: false },
+    });
+    expect(mockServices.http.post).toHaveBeenCalledWith({
+      path: ENTITY_STORE_ROUTES.ENTITY_MAINTAINERS_INIT,
+      body: JSON.stringify({}),
+      query: { apiVersion: '2' },
+    });
+    expect(mockServices.http.post).not.toHaveBeenCalledWith({
+      path: ENTITY_STORE_ROUTES.INSTALL,
+      body: JSON.stringify({}),
+      query: { apiVersion: '2' },
+    });
   });
 
-  it('should install when entity store is not installed', async () => {
+  it('when entity store is not installed and space is default, installs entity store then inits entity maintainers', async () => {
     const mockServices = createMockServices();
     mockServices.uiSettings.get.mockReturnValue(true);
     mockServices.spaces.getActiveSpace.mockResolvedValue({ id: 'default' });
     mockServices.http.get.mockResolvedValueOnce({ status: EntityStoreStatus.Values.not_installed });
-    mockServices.http.post.mockResolvedValueOnce({});
+    mockServices.http.post.mockResolvedValue({});
 
     renderHook(() => useInstallEntityStoreV2(asServices(mockServices)));
 
     await waitFor(() => {
-      expect(mockServices.http.post).toHaveBeenCalledTimes(1);
+      expect(mockServices.http.post).toHaveBeenCalledTimes(2);
     });
 
     expect(mockServices.http.get).toHaveBeenCalledWith({
       path: ENTITY_STORE_ROUTES.STATUS,
       query: { apiVersion: '2', include_components: false },
     });
-    expect(mockServices.http.post).toHaveBeenCalledWith({
+    expect(mockServices.http.post).toHaveBeenNthCalledWith(1, {
       path: ENTITY_STORE_ROUTES.INSTALL,
       body: JSON.stringify({}),
       query: { apiVersion: '2' },
     });
+    expect(mockServices.http.post).toHaveBeenNthCalledWith(2, {
+      path: ENTITY_STORE_ROUTES.ENTITY_MAINTAINERS_INIT,
+      body: JSON.stringify({}),
+      query: { apiVersion: '2' },
+    });
   });
 });

x-pack/solutions/security/plugins/entity_store/public/hooks/useInstallEntityStoreV2.tsx

@@ -34,6 +34,12 @@ const installAllEntitiesRequest: HttpFetchOptionsWithPath = {
   query: { apiVersion: '2' },
 };
 
+const initEntityMaintainersRequest: HttpFetchOptionsWithPath = {
+  path: ENTITY_STORE_ROUTES.ENTITY_MAINTAINERS_INIT,
+  body: JSON.stringify({}),
+  query: { apiVersion: '2' },
+};
+
 /**
  * Hook to install Entity Store V2. Should be called from the root Security Solution app component.
  * @param services - Kibana services required to install Entity Store V2
@@ -46,14 +52,21 @@ export const useInstallEntityStoreV2 = (services: Services) => {
         if (!isEntityStoreV2Enabled) return;
 
         const space = await services.spaces.getActiveSpace();
-        if (space.id !== 'default') return;
-
         const statusResponse = await services.http.get<{ status: EntityStoreStatus }>(
           getStatusRequest
         );
-        if (isEntityStoreInstalled(statusResponse.status)) return;
-
-        await services.http.post(installAllEntitiesRequest);
+        const installed = isEntityStoreInstalled(statusResponse.status);
+        // Entity store already installed → init entity maintainers only (any space).
+        if (installed) {
+          await services.http.post(initEntityMaintainersRequest);
+          return;
+        }
+        // Entity store not installed and default space → install entity store, then init entity maintainers.
+        if (space.id === 'default') {
+          await services.http.post(installAllEntitiesRequest);
+          await services.http.post(initEntityMaintainersRequest);
+        }
+        // Entity store not installed and non-default space → do nothing.
       } catch (e) {
         services.logger.error('Failed to initialize Entity Store V2');
         services.logger.error(e);

x-pack/solutions/security/plugins/entity_store/server/domain/asset_manager.ts

@@ -13,7 +13,6 @@ import type { CheckPrivilegesResponse } from '@kbn/security-plugin-types-server'
 import { SavedObjectsErrorHelpers } from '@kbn/core/server';
 import type { EntityType } from '../../common';
 import { scheduleExtractEntityTask, stopExtractEntityTask } from '../tasks/extract_entity_task';
-import { scheduleEntityMaintainerTasks } from '../tasks/entity_maintainer';
 import { installElasticsearchAssets, uninstallElasticsearchAssets } from './assets/install_assets';
 import {
   EngineDescriptorTypeName,
@@ -44,7 +43,7 @@ import {
   getUpdatesComponentTemplateName,
 } from './assets/component_templates';
 import { getUpdatesEntitiesDataStreamName } from './assets/updates_data_stream';
-import type { LogsExtractionClient } from './logs_extraction_client';
+import type { LogsExtractionClient } from './logs_extraction';
 import type { ManagedEntityDefinition } from '../../common/domain/definitions/entity_schema';
 import { getEntityDefinition } from '../../common/domain/definitions/registry';
 import { installEuidStoredScripts, deleteEuidStoredScripts } from './assets/euid_stored_scripts';
@@ -100,13 +99,6 @@ export class AssetManager {
       await Promise.all([
         ...entityTypes.map((type) => this.initEntity(request, type, logExtractionParams)),
 
-        scheduleEntityMaintainerTasks({
-          logger: this.logger,
-          taskManager: this.taskManager,
-          namespace: this.namespace,
-          request,
-        }),
-
         installEuidStoredScripts({
           esClient: this.esClient,
           logger: this.logger,
@@ -263,7 +255,7 @@ export class AssetManager {
     });
   }
 
-  public async install(
+  private async install(
     type: EntityType,
     logExtractionParams?: LogExtractionBodyParams
   ): Promise<boolean> {