[SecuritySolution] Service Entity Store

x-pack/plugins/security_solution/common/api/entity_analytics/entity_store/common.gen.ts

@@ -17,7 +17,7 @@
 import { z } from '@kbn/zod';
 
 export type EntityType = z.infer<typeof EntityType>;
-export const EntityType = z.enum(['user', 'host']);
+export const EntityType = z.enum(['user', 'host', 'service']);
 export type EntityTypeEnum = typeof EntityType.enum;
 export const EntityTypeEnum = EntityType.enum;
 

x-pack/plugins/security_solution/common/api/entity_analytics/entity_store/common.schema.yaml

@@ -11,6 +11,7 @@ components:
       enum:
         - user
         - host
+        - service
 
     EngineDescriptor:
       type: object

x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts

@@ -73,8 +73,12 @@ export const useInitEntityEngineMutation = (options?: UseMutationOptions<{}>) =>
 
   const { initEntityEngine } = useEntityStoreRoutes();
   return useMutation<InitEntityEngineResponse[]>(
-    () => Promise.all([initEntityEngine('user'), initEntityEngine('host')]),
-
+    () =>
+      Promise.all([
+        initEntityEngine('user'),
+        initEntityEngine('host'),
+        initEntityEngine('service'),
+      ]),
     {
       mutationKey: INIT_ENTITY_ENGINE_STATUS_KEY,
       onSuccess: () => queryClient.refetchQueries({ queryKey: ENTITY_STORE_STATUS }),
@@ -95,7 +99,11 @@ export const useStopEntityEngineMutation = (options?: UseMutationOptions<{}>) =>
         timestamp: new Date().toISOString(),
         action: 'stop',
       });
-      return Promise.all([stopEntityEngine('user'), stopEntityEngine('host')]);
+      return Promise.all([
+        stopEntityEngine('user'),
+        stopEntityEngine('host'),
+        stopEntityEngine('service'),
+      ]);
     },
     {
       mutationKey: STOP_ENTITY_ENGINE_STATUS_KEY,
@@ -111,7 +119,12 @@ export const useDeleteEntityEngineMutation = ({ onSuccess }: { onSuccess?: () =>
   const { deleteEntityEngine } = useEntityStoreRoutes();
 
   return useMutation<DeleteEntityEngineResponse[]>(
-    () => Promise.all([deleteEntityEngine('user', true), deleteEntityEngine('host', true)]),
+    () =>
+      Promise.all([
+        deleteEntityEngine('user', true),
+        deleteEntityEngine('host', true),
+        deleteEntityEngine('service', true),
+      ]),
     {
       mutationKey: DELETE_ENTITY_ENGINE_STATUS_KEY,
       onSuccess: () => {

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/index.ts

@@ -7,4 +7,5 @@
 
 export * from './host';
 export * from './user';
+export * from './service';
 export { getCommonUnitedFieldDefinitions } from './common';

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/service.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { collectValuesWithLength } from '../definition_utils';
+import type { UnitedDefinitionBuilder } from '../types';
+
+export const SERVICE_DEFINITION_VERSION = '1.0.0';
+export const getServiceUnitedDefinition: UnitedDefinitionBuilder = (fieldHistoryLength: number) => {
+  const collect = collectValuesWithLength(fieldHistoryLength);
+  return {
+    entityType: 'service',
+    version: SERVICE_DEFINITION_VERSION,
+    fields: [
+      collect({ field: 'service.address' }),
+      collect({ field: 'service.environment' }),
+      collect({ field: 'service.ephemeral_id' }),
+      collect({ field: 'service.id' }),
+      collect({ field: 'service.node.name' }),
+      collect({ field: 'service.node.roles' }),
+      collect({ field: 'service.state' }),
+      collect({ field: 'service.type' }),
+      collect({ field: 'service.version' }),
+    ],
+  };
+};

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/united_entity_definitions/get_united_definition.ts

@@ -12,12 +12,14 @@ import {
   getCommonUnitedFieldDefinitions,
   USER_DEFINITION_VERSION,
   HOST_DEFINITION_VERSION,
+  getServiceUnitedDefinition,
 } from './entity_types';
 import type { UnitedDefinitionBuilder } from './types';
 import { UnitedEntityDefinition } from './united_entity_definition';
 const unitedDefinitionBuilders: Record<EntityType, UnitedDefinitionBuilder> = {
   host: getHostUnitedDefinition,
   user: getUserUnitedDefinition,
+  service: getServiceUnitedDefinition,
 };
 
 interface Options {
@@ -57,8 +59,14 @@ export const getUnitedEntityDefinition = memoize(
   }
 );
 
+const versionByEntityType: Record<EntityType, string> = {
+  host: HOST_DEFINITION_VERSION,
+  user: USER_DEFINITION_VERSION,
+  service: USER_DEFINITION_VERSION,
+};
+
 export const getUnitedEntityDefinitionVersion = (entityType: EntityType): string =>
-  entityType === 'host' ? HOST_DEFINITION_VERSION : USER_DEFINITION_VERSION;
+  versionByEntityType[entityType];
 
 export const getAvailableEntityTypes = (): EntityType[] =>
   Object.keys(unitedDefinitionBuilders) as EntityType[];

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/utils/entity_utils.ts

@@ -14,13 +14,20 @@ import type { DataViewsService, DataView } from '@kbn/data-views-plugin/common';
 import type { AppClient } from '../../../../types';
 import { getRiskScoreLatestIndex } from '../../../../../common/entity_analytics/risk_engine';
 import { getAssetCriticalityIndex } from '../../../../../common/entity_analytics/asset_criticality';
-import type { EntityType } from '../../../../../common/api/entity_analytics/entity_store/common.gen';
+import {
+  EntityTypeEnum,
+  type EntityType,
+} from '../../../../../common/api/entity_analytics/entity_store/common.gen';
 import { entityEngineDescriptorTypeName } from '../saved_object';
 
-export const getIdentityFieldForEntityType = (entityType: EntityType) => {
-  if (entityType === 'host') return 'host.name';
+const identityFieldMap: Record<EntityType, string> = {
+  [EntityTypeEnum.host]: 'host.name',
+  [EntityTypeEnum.user]: 'user.name',
+  [EntityTypeEnum.service]: 'service.name',
+};
 
-  return 'user.name';
+export const getIdentityFieldForEntityType = (entityType: EntityType) => {
+  return identityFieldMap[entityType];
 };
 
 export const buildIndexPatterns = async (