[SecuritySolution] Create PrivMon index import flow

[machadoum]

Depends on #221610

This PR adds the import index workflow to privileged user monitoring and API changes required to support it.

API Enhancements

• New API for privilege monitoring index creation: Added a new API endpoint (PUT /api/entity_analytics/monitoring/privileges/indices) to create indices for privilege monitoring with support for standard and lookup modes. This includes the implementation of request and response schemas (create_indidex.gen.ts, create_indidex.schema.yaml). [1] [2]
• Updated privilege monitoring health response: Modified the health response schema to include a status field and an optional error object for detailed error handling (privilege_monitoring/health.gen.ts, privilege_monitoring/health.schema.yaml). [1] [2]

Frontend Integration

• **Introduce the create index modal that opens when the create index button is clicked.
• Onboarding modal improvements: Updated the AddDataSourcePanel component to handle index creation more robustly by passing callbacks to the modal (add_data_source.tsx).
• Error handling in UI: Enhanced the PrivilegedUserMonitoring component to display error callouts when privilege monitoring data fails to load (privileged_user_monitoring/index.tsx). [1] [2]

How to test it?

• Go to the priv mon page with an empty cluster
• Click on the data source by the index button
• Search for available indices, it should return indices with user.name.keyword fields
• Click 'create index' and create a new index
• Choose the created index and click 'Add privileged users'
• You should be redirected to the dashboard (The API is currently not working)

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

• See some risk examples
• ...

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[machadoum]

The engine requires user.name.keyword to work.

[tiansivive]

didnt pay much attention to code but desk tested and look good!
Many thanks Pablo!
🚀

[florent-leborgne]

output docs files LGTM!

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 10e0772

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	7671	7673	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	9.4MB	9.4MB	+4.8KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	95.2KB	95.2KB	-1.0B

History

• 💔 Build #311528 failed 0e27097
• 💔 Build #311393 failed 2e66488

cc @machadoum