Skip to content

[Entity Store] Adds anomaly job and rule name to entity behaviors #248571

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
opauloh wants to merge 5 commits into from
Closed

[Entity Store] Adds anomaly job and rule name to entity behaviors #248571

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
cf03526
Adds anomaly job and rule name to entity behaviors
opauloh Jan 10, 2026
a0183e7
Changes from yarn openapi:bundle
kibanamachine Jan 10, 2026
0f5e523
Merge branch 'main' into entity-store/behavioral-attrs-poc
opauloh Jan 17, 2026
02f2bca
Changes from make api-docs
kibanamachine Jan 17, 2026
bac1a5e
Merge branch 'main' into entity-store/behavioral-attrs-poc
opauloh Jan 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions oas_docs/output/kibana.serverless.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98538,10 +98538,18 @@ components:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
brute_force_victim:
type: boolean
new_country_login:
type: boolean
rule_names:
items:
type: string
type: array
used_usb_device:
type: boolean
EngineMetadata:
Expand Down
8 changes: 8 additions & 0 deletions oas_docs/output/kibana.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109283,10 +109283,18 @@ components:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
brute_force_victim:
type: boolean
new_country_login:
type: boolean
rule_names:
items:
type: string
type: array
used_usb_device:
type: boolean
EngineMetadata:
Expand Down
2 changes: 2 additions & 0 deletions ...plugins/security_solution/common/api/entity_analytics/entity_store/entities/common.gen.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,8 @@ export const EntityField = z
brute_force_victim: z.boolean().optional(),
new_country_login: z.boolean().optional(),
used_usb_device: z.boolean().optional(),
anomaly_job_ids: z.array(z.string()).optional(),
rule_names: z.array(z.string()).optional(),
})
.strict()
.optional(),
Expand Down
8 changes: 8 additions & 0 deletions ...ns/security_solution/common/api/entity_analytics/entity_store/entities/common.schema.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,14 @@ components:
type: boolean
used_usb_device:
type: boolean
anomaly_job_ids:
type: array
items:
type: string
rule_names:
type: array
items:
type: string
lifecycle:
type: object
additionalProperties: false
Expand Down
8 changes: 8 additions & 0 deletions ...on/docs/openapi/ess/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1876,10 +1876,18 @@ components:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
brute_force_victim:
type: boolean
new_country_login:
type: boolean
rule_names:
items:
type: string
type: array
used_usb_device:
type: boolean
EngineMetadata:
Expand Down
8 changes: 8 additions & 0 deletions .../openapi/serverless/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1876,10 +1876,18 @@ components:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
brute_force_victim:
type: boolean
new_country_login:
type: boolean
rule_names:
items:
type: string
type: array
used_usb_device:
type: boolean
EngineMetadata:
Expand Down
6 changes: 6 additions & 0 deletions ...s/entity_store/elasticsearch_assets/__snapshots__/updates_component_template.test.ts.snap
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 13 additions & 1 deletion ...server/lib/entity_analytics/entity_store/entity_definitions/entity_descriptions/common.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ import type {
} from '../../../../../../common/api/entity_analytics/entity_store';
import type { FieldDescription } from '../../installation/types';

import { oldestValue, newestValue } from './field_utils';
import { oldestValue, newestValue, collectValues } from './field_utils';

export const getCommonFieldDescriptions = (ecsField: BaseECSEntityField): FieldDescription[] => {
return [
Expand Down Expand Up @@ -111,6 +111,18 @@ export const getEntityFieldsDescriptions = (rootField?: EntityType) => {
mapping: { type: 'boolean' },
allowAPIUpdate: true,
}),
collectValues({
source: `${prefix}.behaviors.Anomaly_job_ids`,
destination: 'entity.behaviors.Anomaly_job_ids',
mapping: { type: 'keyword' },
allowAPIUpdate: true,
}),
collectValues({
source: `${prefix}.behaviors.Rule_names`,
destination: 'entity.behaviors.Rule_names',
mapping: { type: 'keyword' },
allowAPIUpdate: true,
}),

newestValue({
source: `${prefix}.risk.calculated_level`,
Expand Down
88 changes: 88 additions & 0 deletions .../entity_analytics/entity_store/installation/__snapshots__/engine_description.test.ts.snap
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

42 changes: 42 additions & 0 deletions .../test_suites/entity_analytics/entity_store/trial_license_complete_tier/upsert_crud_api.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,8 @@ export default function (providerContext: FtrProviderContext) {
},
behaviors: {
brute_force_victim: true,
anomaly_job_ids: ['job-1'],
rule_names: ['rule-1'],
},
},
},
Expand All @@ -121,6 +123,8 @@ export default function (providerContext: FtrProviderContext) {
expect(hit._source?.entity?.id).toEqual(userName);
expect(hit._source?.entity?.attributes?.Privileged).toBeTruthy();
expect(hit._source?.entity?.behaviors?.Brute_force_victim).toBeTruthy();
expect(hit._source?.entity?.behaviors?.Anomaly_job_ids).toEqual(['job-1']);
expect(hit._source?.entity?.behaviors?.Rule_names).toEqual(['rule-1']);
});

return true;
Expand Down Expand Up @@ -154,6 +158,44 @@ export default function (providerContext: FtrProviderContext) {
expect(hit._source?.entity?.id).toEqual(userName);
expect(hit._source?.entity?.attributes?.Privileged).toBeTruthy();
expect(hit._source?.entity?.behaviors?.Brute_force_victim).toBeTruthy();
expect(hit._source?.entity?.behaviors?.Anomaly_job_ids).toEqual(['job-1']);
expect(hit._source?.entity?.behaviors?.Rule_names).toEqual(['rule-1']);
});
return true;
}
);

log.info('Calling upsert api to append more behavior values...');
const { statusCode: appendStatusCode } = await securitySolutionApi.upsertEntity({
params: {
entityType: 'user',
},
body: {
entity: {
id: userName,
behaviors: {
anomaly_job_ids: ['job-2', 'job-1'], // job-1 should not be duplicated
rule_names: ['rule-2'],
},
},
},
query: {},
});

expect(appendStatusCode).toEqual(200);

log.info('Verifying behavior values were appended without duplicates...');
await retry.waitForWithTimeout(
'Behavior values are appended',
LOCAL_TIMEOUT_MS,
async () => {
await assertEntityFromES(es, userName, USER_INDEX_NAME, (hit) => {
expect(hit._source?.entity?.behaviors?.Anomaly_job_ids).toHaveLength(2);
expect(hit._source?.entity?.behaviors?.Anomaly_job_ids).toContain('job-1');
expect(hit._source?.entity?.behaviors?.Anomaly_job_ids).toContain('job-2');
expect(hit._source?.entity?.behaviors?.Rule_names).toHaveLength(2);
expect(hit._source?.entity?.behaviors?.Rule_names).toContain('rule-1');
expect(hit._source?.entity?.behaviors?.Rule_names).toContain('rule-2');
});
return true;
}
Expand Down