[Entity Store] CRUD API - add delete single by kubasobon · Pull Request #239314 · elastic/kibana

kubasobon · 2025-10-16T10:55:24Z

Summary

Closes https://github.com/elastic/security-team/issues/13823

Adds an endpoint enabling users to delete a specific Entity. Its historical record will also remain in the past .entities.v1.history.* indices. It will however be gone from the .entities.v1.latest.* indices and no longer present in the Daily Snapshots moving forward.

This is true until the Entity is observed again in the incoming logs, events, or asset discovery.

DELETE kbn:/api/entity_store/entities/<entity-type>
{
  "id": "<entity-id>"
}

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

csr

Code-only review, src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/security/roles.yml changes LGTM

romulets

Looks good overall! I mostly wonder about receiving the id in the path

src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/security/roles.yml

...ecurity_solution/common/api/entity_analytics/entity_store/entities/delete_entity.schema.yaml

...ugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_crud_client.ts

Co-authored-by: Rômulo Farias <romulo.farias@elastic.co>

hop-dev · 2025-10-23T12:21:58Z

@romulets @kubasobon should we also remove any update docs from the .entities.v1.updates.security_ for the entity to make sure they don't immediately get recreated from one of our internal documents? (I understand we can't prevent it from the users data of course)

romulets · 2025-10-23T12:37:51Z

@hop-dev We could delete data from the past few minutes or so just to make sure. But in theory if a document has been processed by the transform it won't be seen again because of the checkpoint.

So the scenario is: send an update and straight after run a delete. Sounds like we should cover that too

hop-dev · 2025-10-23T12:39:34Z

@romulets

it won't be seen again because of the checkpoint.

Of course you're right, deleting them is probably overkill then I would be happy to keep it as-is and save Kuba some work 👍

florent-leborgne

LGTM, just one question about version availability

...curity_solution/server/lib/entity_analytics/entity_store/routes/entity_crud/delete_entity.ts

…ete-api

kubasobon · 2025-10-24T10:57:26Z

@romulets Updated to accept ID in request body instead of url. Curiously, Kibana Dev Console does not support sending DELETE requests with body object, so tested with CURL.

…/entity_analytics/entity_store/routes/entity_crud/delete_entity.ts Co-authored-by: florent-leborgne <florent.leborgne@elastic.co>

elasticmachine · 2025-10-24T11:21:22Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: eadabb2

Failed CI Steps

Checks

History

💛 Build #354054 was flaky b60755a
💔 Build #351706 failed 4baacdf

cc @kubasobon

## Summary From #239314 (comment) the `entityID` is expected to be supplied in the request body, but the path parameter was only partially removed. This results in an invalid API specification which breaks [client generation](elastic/terraform-provider-elasticstack#1402 (comment)). ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [x] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Summary From elastic#239314 (comment) the `entityID` is expected to be supplied in the request body, but the path parameter was only partially removed. This results in an invalid API specification which breaks [client generation](elastic/terraform-provider-elasticstack#1402 (comment)). ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [x] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

add delete single entity route

4baacdf

kubasobon self-assigned this Oct 16, 2025

kibanamachine and others added 5 commits October 16, 2025 12:05

[CI] Auto-commit changed files from 'yarn openapi:bundle'

be112ee

[CI] Auto-commit changed files from 'yarn openapi:generate'

57ab867

update error handling

0dac9e3

update order of operations, add tests

ec3946b

Merge branch 'main' into es-delete-api

12627e0

kubasobon added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Oct 23, 2025

kubasobon marked this pull request as ready for review October 23, 2025 11:20

kubasobon requested review from a team as code owners October 23, 2025 11:20

kubasobon requested a review from hop-dev October 23, 2025 11:20

csr approved these changes Oct 23, 2025

View reviewed changes

[CI] Auto-commit changed files from 'make api-docs'

dbb715b

elastic-vault-github-plugin-prod bot requested a review from a team as a code owner October 23, 2025 11:35

romulets reviewed Oct 23, 2025

View reviewed changes

kubasobon and others added 2 commits October 23, 2025 13:58

Apply suggestion from @romulets

426985c

Co-authored-by: Rômulo Farias <romulo.farias@elastic.co>

[CI] Auto-commit changed files from 'yarn openapi:bundle'

ecafe89

[CI] Auto-commit changed files from 'make api-docs'

416e386

hop-dev approved these changes Oct 23, 2025

View reviewed changes

[CI] Auto-commit changed files from 'yarn openapi:generate'

b60755a

florent-leborgne approved these changes Oct 23, 2025

View reviewed changes

...curity_solution/server/lib/entity_analytics/entity_store/routes/entity_crud/delete_entity.ts Show resolved Hide resolved

kubasobon and others added 3 commits October 24, 2025 12:14

move entity id to request body

e1d4750

Merge branch 'es-delete-api' of github.com:elastic/kibana into es-del…

151b2e5

…ete-api

[CI] Auto-commit changed files from 'yarn openapi:bundle'

b14f587

[CI] Auto-commit changed files from 'make api-docs'

c3eaef4

kubasobon and others added 2 commits October 24, 2025 12:58

Update x-pack/solutions/security/plugins/security_solution/server/lib…

5fce94b

…/entity_analytics/entity_store/routes/entity_crud/delete_entity.ts Co-authored-by: florent-leborgne <florent.leborgne@elastic.co>

Merge branch 'main' into es-delete-api

eadabb2

[CI] Auto-commit changed files from 'yarn openapi:generate'

2e23653

kubasobon requested a review from romulets October 24, 2025 14:26

Merge branch 'main' into es-delete-api

0e1efa6

kubasobon merged commit f738d7a into main Oct 27, 2025
14 checks passed

kubasobon deleted the es-delete-api branch October 27, 2025 11:55

kibanamachine added the v9.3.0 label Oct 27, 2025

tobio mentioned this pull request Oct 28, 2025

Remove entityID path parameter #240920

Merged

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Entity Store] CRUD API - add delete single#239314

[Entity Store] CRUD API - add delete single#239314
kubasobon merged 19 commits intomainfrom
es-delete-api

kubasobon commented Oct 16, 2025 •

edited

Loading

Uh oh!

csr left a comment

Uh oh!

romulets left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hop-dev commented Oct 23, 2025 •

edited

Loading

Uh oh!

romulets commented Oct 23, 2025 •

edited

Loading

Uh oh!

hop-dev commented Oct 23, 2025

Uh oh!

florent-leborgne left a comment

Uh oh!

Uh oh!

kubasobon commented Oct 24, 2025

Uh oh!

elasticmachine commented Oct 24, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

kubasobon commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

csr left a comment

Choose a reason for hiding this comment

Uh oh!

romulets left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hop-dev commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

romulets commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hop-dev commented Oct 23, 2025

Uh oh!

florent-leborgne left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kubasobon commented Oct 24, 2025

Uh oh!

elasticmachine commented Oct 24, 2025

⏳ Build in-progress, with failures

Failed CI Steps

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

kubasobon commented Oct 16, 2025 •

edited

Loading

hop-dev commented Oct 23, 2025 •

edited

Loading

romulets commented Oct 23, 2025 •

edited

Loading