[Entity Analytics] New API endpoint to cleanup the risk engine installation and data

[abhishekbhatia1710]

Summary

1. Create a new public API endpoint : DELETE /api/risk_score/engine/dangerously_delete_data

Test cases Result

  PASS  x-pack/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/delete.test.ts (7.017 s)
  risk engine cleanup route
    invokes the risk engine cleanup route
      ✓ should call the router with the correct route and handler (71 ms)
      ✓ returns a 200 when cleanup is successful (64 ms)
      ✓ returns a 500 when cleanup is unsuccessful (57 ms)
      ✓ returns a 500 when cleanup is unsuccessful with multiple errors (53 ms)
    when task manager is unavailable
      ✓ returns a 400 when task manager is unavailable (55 ms)
    when user does not have the required privileges
      ✓ returns a 403 when user does not have the required privileges (88 ms)

API Responses

When multiple errors encountered

{
    "risk_engine_cleanup": false,
    "errors": [
        {
            "seq": 1,
            "error": "resource_not_found_exception\n\tRoot causes:\n\t\tresource_not_found_exception: Transform with id [risk_score_latest_transform_default] could not be found"
        },
        {
            "seq": 2,
            "error": "index_not_found_exception\n\tRoot causes:\n\t\tindex_not_found_exception: no such index [risk-score.risk-score-default]"
        },
        {
            "seq": 3,
            "error": "index_template_missing_exception\n\tRoot causes:\n\t\tindex_template_missing_exception: index_template [.risk-score.risk-score-default-index-template] missing"
        },
        {
            "seq": 4,
            "error": "resource_not_found_exception\n\tRoot causes:\n\t\tresource_not_found_exception: .risk-score-mappings"
        }
    ],
    "status_code": 500
}

Success

{
    "risk_engine_cleanup": true
}

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios

OpenAPI spec

For maintainers

• This was checked for breaking API changes and was labeled appropriately

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

[abhishekbhatia1710]

@elasticmachine merge upstream

[machadoum]

Great job! 👏 👏 👏

[kibanamachine]

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#7004

[❌] x-pack/test/alerting_api_integration/security_and_spaces/group1/config.ts: 0/1 tests passed.
[❌] x-pack/test/cases_api_integration/security_and_spaces/config_trial.ts: 0/1 tests passed.

see run history

[kibanamachine]

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#7006

[❌] x-pack/test/alerting_api_integration/security_and_spaces/group1/config.ts: 0/1 tests passed.
[❌] x-pack/test/cases_api_integration/security_and_spaces/config_trial.ts: 0/1 tests passed.

see run history

[abhishekbhatia1710]

The integration test for the tearDown failed because the other PR for allowing risk score in multiple spaces got merged today and the key is_max_amount_of_risk_engines_reached is removed now.

I have changed the integration test to not to check the key is_max_amount_of_risk_engines_reached

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 498d5bb

Failed CI Steps

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	20.4MB	20.4MB	+330.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	87.1KB	87.3KB	+116.0B

History

• 💔 Build #236854 failed b647467
• 💔 Build #236850 failed f9e7ee6
• 💚 Build #236719 succeeded 46e81b3
• 💔 Build #236653 failed 3a7473b
• 💛 Build #236568 was flaky 8cb4de7
• 💔 Build #236554 failed b9e5d7e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @abhishekbhatia1710

[kibanamachine]

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#7011

[✅] x-pack/test/alerting_api_integration/security_and_spaces/group1/config.ts: 5/5 tests passed.
[✅] x-pack/test/cases_api_integration/security_and_spaces/config_trial.ts: 5/5 tests passed.

see run history

[kibanamachine]

💔 All backports failed

Status	Branch	Result
❌	8.x	Backport failed because of merge conflicts You might need to backport the following PRs to 8.x: - [Security Solution] Omit Solution from tags and titles in Security Solution's OpenAPI bundles (#193669) - [Threat Hunting Investigations] Use OpenAPI types in more timeline routes (#189977)

Manual backport

To create the backport manually run:

node scripts/backport --pr 191843

Questions ?

Please refer to the Backport tool documentation

[abhishekbhatia1710]

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation