Skip to content

[Security Solution] Add new fields to indices metadata#219246

Merged
szaffarano merged 3 commits intomainfrom
szaffarano/update-indices-metadata
Apr 28, 2025
Merged

[Security Solution] Add new fields to indices metadata#219246
szaffarano merged 3 commits intomainfrom
szaffarano/update-indices-metadata

Conversation

@szaffarano
Copy link
Copy Markdown
Contributor

@szaffarano szaffarano commented Apr 25, 2025

Summary

Adds _source.mode and index.mode fields to the TELEMETRY_INDEX_SETTINGS_EVENT EBT event:

export interface IndexSettings {
  index_name: string;
  index_mode?: string;
  default_pipeline?: string;
  final_pipeline?: string;
  source_mode?: string;
}

References:

The goal is to enhance the index settings EBT event with two new fields to enrich the telemetry information we collect about the indices used by the security integrations.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

@szaffarano szaffarano requested review from a team as code owners April 25, 2025 13:40
@szaffarano szaffarano added release_note:skip Skip the PR/issue when compiling release notes backport:all-open Backport to all branches that could still receive a release Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Apr 25, 2025
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@szaffarano
Copy link
Copy Markdown
Contributor Author

@elasticmachine merge upstream

@kibanamachine
Copy link
Copy Markdown
Contributor

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#8224

[✅] x-pack/test/security_solution_api_integration/test_suites/telemetry/configs/ess.config.ts: 25/25 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/telemetry/configs/serverless.config.ts: 25/25 tests passed.

see run history

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Apr 28, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

✅ unchanged

History

Copy link
Copy Markdown
Contributor

@dejadavi-el dejadavi-el left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@szaffarano Could you add extend the PR's description with an explanation why you've made this change? Links to tickets and documentation pages would be helpful for reviewers and any code readers.

@szaffarano
Copy link
Copy Markdown
Contributor Author

@szaffarano Could you add extend the PR's description with an explanation why you've made this change? Links to tickets and documentation pages would be helpful for reviewers and any code readers.

Done

Copy link
Copy Markdown
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes LGTM

@szaffarano szaffarano merged commit 8c596d3 into main Apr 28, 2025
9 checks passed
@szaffarano szaffarano deleted the szaffarano/update-indices-metadata branch April 28, 2025 18:18
@kibanamachine
Copy link
Copy Markdown
Contributor

Starting backport for target branches: 7.17, 8.17, 8.18, 8.19, 9.0

https://github.com/elastic/kibana/actions/runs/14714905010

@kibanamachine
Copy link
Copy Markdown
Contributor

💔 All backports failed

Status Branch Result
7.17 Backport failed because of merge conflicts

You might need to backport the following PRs to 7.17:
- chore(deps): bump formidable from to 3.5.2 to 3.5.4 (#219385)
8.17 Backport failed because of merge conflicts
8.18 Backport failed because of merge conflicts
8.19 Backport failed because of merge conflicts
9.0 Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 219246

Questions ?

Please refer to the Backport tool documentation

@szaffarano
Copy link
Copy Markdown
Contributor Author

💚 All backports created successfully

Status Branch Result
9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

szaffarano added a commit to szaffarano/kibana that referenced this pull request Apr 29, 2025
## Summary

Adds `_source.mode` and `index.mode` fields to the
[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)
EBT event:

```typescript
export interface IndexSettings {
  index_name: string;
  index_mode?: string;
  default_pipeline?: string;
  final_pipeline?: string;
  source_mode?: string;
}
```
References:
- elastic#194004 Initial version for the
updated EBT event.
- elastic#213822 This is a Similar PR
updating the feature.

The goal is to enhance the index settings EBT event with two new fields
to enrich the telemetry information we collect about the indices used by
the security integrations.

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 8c596d3)

# Conflicts:
#	x-pack/test/common/utils/security_solution/detections_response/tasks/indices_metadata.ts
@szaffarano
Copy link
Copy Markdown
Contributor Author

💚 All backports created successfully

Status Branch Result
8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@szaffarano
Copy link
Copy Markdown
Contributor Author

💚 All backports created successfully

Status Branch Result
8.18

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

szaffarano added a commit to szaffarano/kibana that referenced this pull request Apr 29, 2025
## Summary

Adds `_source.mode` and `index.mode` fields to the
[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)
EBT event:

```typescript
export interface IndexSettings {
  index_name: string;
  index_mode?: string;
  default_pipeline?: string;
  final_pipeline?: string;
  source_mode?: string;
}
```
References:
- elastic#194004 Initial version for the
updated EBT event.
- elastic#213822 This is a Similar PR
updating the feature.

The goal is to enhance the index settings EBT event with two new fields
to enrich the telemetry information we collect about the indices used by
the security integrations.

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 8c596d3)

# Conflicts:
#	x-pack/test/common/utils/security_solution/detections_response/tasks/indices_metadata.ts
@szaffarano
Copy link
Copy Markdown
Contributor Author

💚 All backports created successfully

Status Branch Result
8.17

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

szaffarano added a commit to szaffarano/kibana that referenced this pull request Apr 29, 2025
## Summary

Adds `_source.mode` and `index.mode` fields to the
[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)
EBT event:

```typescript
export interface IndexSettings {
  index_name: string;
  index_mode?: string;
  default_pipeline?: string;
  final_pipeline?: string;
  source_mode?: string;
}
```
References:
- elastic#194004 Initial version for the
updated EBT event.
- elastic#213822 This is a Similar PR
updating the feature.

The goal is to enhance the index settings EBT event with two new fields
to enrich the telemetry information we collect about the indices used by
the security integrations.

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 8c596d3)

# Conflicts:
#	x-pack/test/common/utils/security_solution/detections_response/tasks/indices_metadata.ts
szaffarano added a commit that referenced this pull request Apr 29, 2025
… (#219507)

# Backport

This will backport the following commits from `main` to `8.17`:
- [[Security Solution] Add new fields to indices metadata
(#219246)](#219246)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Sebastián
Zaffarano","email":"sebastian.zaffarano@elastic.co"},"sourceCommit":{"committedDate":"2025-04-28T18:18:43Z","message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","backport:all-open","ci:build-cloud-image","v9.1.0"],"title":"[Security
Solution] Add new fields to indices
metadata","number":219246,"url":"https://github.com/elastic/kibana/pull/219246","mergeCommit":{"message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/219246","number":219246,"mergeCommit":{"message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278"}},{"url":"https://github.com/elastic/kibana/pull/219499","number":219499,"branch":"9.0","state":"OPEN"},{"url":"https://github.com/elastic/kibana/pull/219503","number":219503,"branch":"8.19","state":"OPEN"},{"url":"https://github.com/elastic/kibana/pull/219504","number":219504,"branch":"8.18","state":"OPEN"}]}]
BACKPORT-->
szaffarano added a commit that referenced this pull request Apr 29, 2025
… (#219503)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Add new fields to indices metadata
(#219246)](#219246)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Sebastián
Zaffarano","email":"sebastian.zaffarano@elastic.co"},"sourceCommit":{"committedDate":"2025-04-28T18:18:43Z","message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","backport:all-open","ci:build-cloud-image","v9.1.0"],"title":"[Security
Solution] Add new fields to indices
metadata","number":219246,"url":"https://github.com/elastic/kibana/pull/219246","mergeCommit":{"message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/219246","number":219246,"mergeCommit":{"message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278"}},{"url":"https://github.com/elastic/kibana/pull/219499","number":219499,"branch":"9.0","state":"OPEN"}]}]
BACKPORT-->
szaffarano added a commit that referenced this pull request Apr 29, 2025
#219499)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Add new fields to indices metadata
(#219246)](#219246)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Sebastián
Zaffarano","email":"sebastian.zaffarano@elastic.co"},"sourceCommit":{"committedDate":"2025-04-28T18:18:43Z","message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","backport:all-open","ci:build-cloud-image","v9.1.0"],"title":"[Security
Solution] Add new fields to indices
metadata","number":219246,"url":"https://github.com/elastic/kibana/pull/219246","mergeCommit":{"message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/219246","number":219246,"mergeCommit":{"message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278"}}]}]
BACKPORT-->
szaffarano added a commit that referenced this pull request Apr 29, 2025
… (#219504)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Add new fields to indices metadata
(#219246)](#219246)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Sebastián
Zaffarano","email":"sebastian.zaffarano@elastic.co"},"sourceCommit":{"committedDate":"2025-04-28T18:18:43Z","message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","backport:all-open","ci:build-cloud-image","v9.1.0"],"title":"[Security
Solution] Add new fields to indices
metadata","number":219246,"url":"https://github.com/elastic/kibana/pull/219246","mergeCommit":{"message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/219246","number":219246,"mergeCommit":{"message":"[Security
Solution] Add new fields to indices metadata (#219246)\n\n##
Summary\n\nAdds `_source.mode` and `index.mode` fields to
the\n[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)\nEBT
event:\n\n```typescript\nexport interface IndexSettings {\n index_name:
string;\n index_mode?: string;\n default_pipeline?: string;\n
final_pipeline?: string;\n source_mode?: string;\n}\n```\nReferences:\n-
#194004 Initial version for
the\nupdated EBT event.\n- #213822
This is a Similar PR\nupdating the feature.\n\nThe goal is to enhance
the index settings EBT event with two new fields\nto enrich the
telemetry information we collect about the indices used by\nthe security
integrations.\n\n### Checklist\n\nCheck the PR satisfies following
conditions. \n\nReviewers should verify this PR satisfies this list as
well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Elastic
Machine
<elasticmachine@users.noreply.github.com>","sha":"8c596d32010ad96eeac794f1938e686f9cbdb278"}},{"url":"https://github.com/elastic/kibana/pull/219499","number":219499,"branch":"9.0","state":"OPEN"},{"url":"https://github.com/elastic/kibana/pull/219503","number":219503,"branch":"8.19","state":"OPEN"}]}]
BACKPORT-->

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
## Summary

Adds `_source.mode` and `index.mode` fields to the
[TELEMETRY_INDEX_SETTINGS_EVENT](https://github.com/elastic/kibana/blob/szaffarano/update-indices-metadata/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts#L470C14-L470C44)
EBT event:

```typescript
export interface IndexSettings {
  index_name: string;
  index_mode?: string;
  default_pipeline?: string;
  final_pipeline?: string;
  source_mode?: string;
}
```
References:
- elastic#194004 Initial version for the
updated EBT event.
- elastic#213822 This is a Similar PR
updating the feature.

The goal is to enhance the index settings EBT event with two new fields
to enrich the telemetry information we collect about the indices used by
the security integrations.

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:all-open Backport to all branches that could still receive a release ci:build-cloud-image release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.17.6 v8.18.1 v8.19.0 v9.0.1 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants