Privmon User Count - use grouping with count in place of count distinct for > 4000 users limitation

x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/key_insights_panel/common/key_insights_tile.tsx

@@ -8,6 +8,7 @@
 import React, { useState, useEffect } from 'react';
 import { EuiFlexItem, EuiFlexGroup, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
+import type { LensAttributes } from '@kbn/lens-embeddable-utils';
 import type { ReactElement } from 'react';
 import { isLeft } from 'fp-ts/Either';
 import { createKeyInsightsPanelLensAttributes } from './lens_attributes';
@@ -24,7 +25,8 @@ const LENS_VISUALIZATION_HEIGHT = 140;
 interface KeyInsightsTileProps {
   title: string;
   label: string;
-  getEsqlQuery: (namespace: string) => EsqlQueryOrInvalidFields;
+  getEsqlQuery?: (namespace: string) => EsqlQueryOrInvalidFields;
+  getLensAttributes?: (namespace: string) => LensAttributes;
   id: string;
   inspectTitle: ReactElement;
   spaceId?: string;
@@ -34,6 +36,7 @@ export const KeyInsightsTile: React.FC<KeyInsightsTileProps> = ({
   title,
   label,
   getEsqlQuery,
+  getLensAttributes,
   id,
   inspectTitle,
   spaceId: propSpaceId,
@@ -63,14 +66,16 @@ export const KeyInsightsTile: React.FC<KeyInsightsTileProps> = ({
     setHasStartedLoading(false);
   }, [timerange.from, timerange.to, filterQuery, effectiveSpaceId]);
 
-  const esqlQuery = getEsqlQuery(effectiveSpaceId);
+  const esqlQuery = getEsqlQuery ? getEsqlQuery(effectiveSpaceId) : null;
 
   // Only show error state if:
   // 1. Loading has started at least once (hasStartedLoading)
   // 2. Loading is now complete (loading === false)
   // 3. We have no tables (indicating an error)
+  const hasInvalidEsqlQuery = esqlQuery ? isLeft(esqlQuery) : false;
+
   if (
-    isLeft(esqlQuery) ||
+    hasInvalidEsqlQuery ||
     (hasStartedLoading &&
       visualizationResponse &&
       visualizationResponse.loading === false &&
@@ -108,13 +113,17 @@ export const KeyInsightsTile: React.FC<KeyInsightsTileProps> = ({
     );
   }
 
-  const lensAttributes = createKeyInsightsPanelLensAttributes({
-    title,
-    label,
-    esqlQuery: esqlQuery.right,
-    dataViewId: 'default-dataview',
-    filterQuery,
-  });
+  const esqlQueryString = esqlQuery && !isLeft(esqlQuery) ? esqlQuery.right : '';
+
+  const lensAttributes = getLensAttributes
+    ? getLensAttributes(effectiveSpaceId)
+    : createKeyInsightsPanelLensAttributes({
+        title,
+        label,
+        esqlQuery: esqlQueryString,
+        dataViewId: 'default-dataview',
+        filterQuery,
+      });
 
   // If we reach here, either still loading or we have a valid response, so show the embeddable
   return (

x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/key_insights_panel/common/lens_attributes.tsx

@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import type { Filter } from '@kbn/es-query';
 import type { LensAttributes } from '@kbn/lens-embeddable-utils';
 import type { ESBoolQuery } from '../../../../../../../common/typed_json';
 
@@ -16,6 +17,14 @@ interface KeyInsightsPanelParams {
   filterQuery: ESBoolQuery | undefined;
 }
 
+interface KeyInsightsPanelFormBasedParams {
+  title: string;
+  label: string;
+  dataViewId: string;
+  dataViewTitle: string;
+  filters: Filter[];
+}
+
 export const createKeyInsightsPanelLensAttributes = ({
   title,
   label,
@@ -75,3 +84,77 @@ export const createKeyInsightsPanelLensAttributes = ({
     references: [],
   };
 };
+
+export const createKeyInsightsPanelFormBasedLensAttributes = ({
+  title,
+  label,
+  dataViewId,
+  dataViewTitle,
+  filters,
+}: KeyInsightsPanelFormBasedParams): LensAttributes => {
+  const layerId = 'key-insights-privileged-users-layer';
+  const countColumnId = 'key-insights-privileged-users-count';
+
+  return {
+    title,
+    description: '',
+    visualizationType: 'lnsMetric',
+    state: {
+      visualization: {
+        layerId,
+        layerType: 'data',
+        metricAccessor: countColumnId,
+      },
+      query: {
+        query: '',
+        language: 'kuery',
+      },
+      filters,
+      datasourceStates: {
+        formBased: {
+          layers: {
+            [layerId]: {
+              columns: {
+                [countColumnId]: {
+                  label,
+                  dataType: 'number',
+                  isBucketed: false,
+                  operationType: 'unique_count',
+                  scale: 'ratio',
+                  sourceField: 'user.name',
+                  customLabel: true,
+                },
+              },
+              columnOrder: [countColumnId],
+              incompleteColumns: {},
+            },
+          },
+        },
+        textBased: {
+          layers: {},
+        },
+      },
+      internalReferences: [
+        {
+          type: 'index-pattern',
+          id: dataViewId,
+          name: `indexpattern-datasource-layer-${layerId}`,
+        },
+      ],
+      adHocDataViews: {
+        [dataViewId]: {
+          id: dataViewId,
+          title: dataViewTitle,
+          timeFieldName: '@timestamp',
+          sourceFilters: [],
+          fieldFormats: {},
+          runtimeFieldMap: {},
+          fieldAttrs: {},
+          allowNoIndex: false,
+          name: dataViewTitle,
+        },
+      },
+    },
+    references: [],
+  };
+};

x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/key_insights_panel/privileged_users_tile/esql_query.tsx

@@ -11,4 +11,5 @@ export const getPrivilegedUsersEsqlCount = (
   namespace: string
 ) => `FROM ${getPrivilegedMonitorUsersIndex(namespace)}
       | WHERE user.is_privileged == true
-      | STATS count = COUNT_DISTINCT(user.name)`;
+      | STATS BY user.name
+      | STATS count = COUNT(*)`;