[Entity Store] Store EUID Scripts

x-pack/solutions/security/plugins/entity_store/server/domain/asset_manager.ts

@@ -49,6 +49,7 @@ import {
 } from './assets/component_templates';
 import { getUpdatesEntitiesDataStreamName } from './assets/updates_data_stream';
 import type { LogsExtractionClient } from './logs_extraction_client';
+import { installEuidStoredScripts, deleteEuidStoredScripts } from './assets/euid_stored_scripts';
 
 interface AssetManagerDependencies {
   logger: Logger;
@@ -88,16 +89,21 @@ export class AssetManager {
     logExtractionParams?: LogExtractionBodyParams
   ) {
     try {
-      await Promise.all(
-        entityTypes.map((type) => this.initEntity(request, type, logExtractionParams))
-      );
+      await Promise.all([
+        ...entityTypes.map((type) => this.initEntity(request, type, logExtractionParams)),
 
-      await scheduleEntityMaintainerTasks({
-        logger: this.logger,
-        taskManager: this.taskManager,
-        namespace: this.namespace,
-        request,
-      });
+        scheduleEntityMaintainerTasks({
+          logger: this.logger,
+          taskManager: this.taskManager,
+          namespace: this.namespace,
+          request,
+        }),
+
+        installEuidStoredScripts({
+          esClient: this.esClient,
+          logger: this.logger,
+        }),
+      ]);
     } catch (error) {
       this.logger.error('Error during entity store init:', error);
       throw error;
@@ -161,6 +167,10 @@ export class AssetManager {
           definition,
           namespace: this.namespace,
         }),
+        deleteEuidStoredScripts({
+          esClient: this.esClient,
+          logger: this.logger,
+        }),
       ]);
       this.logger.get(type).debug(`Uninstalled definition: ${type}`);
 

x-pack/solutions/security/plugins/entity_store/server/domain/assets/euid_stored_scripts.ts

@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ElasticsearchClient, Logger } from '@kbn/core/server';
+import { getEuidPainlessEvaluation } from '../../../common/domain/euid/painless';
+import type { EntityType } from '../../../common/domain/definitions/entity_schema';
+import { putStoredScript, deleteStoredScript } from '../../infra/elasticsearch/scripts';
+
+const storedScriptName: Record<EntityType, string> = {
+  user: 'euid_user_entity',
+  host: 'euid_host_entity',
+  service: 'euid_service_entity',
+  generic: 'euid_generic_entity',
+} as const satisfies Record<EntityType, string>;
+
+export async function installEuidStoredScripts({
+  esClient,
+  logger,
+}: {
+  esClient: ElasticsearchClient;
+  logger: Logger;
+}) {
+  logger.debug('Installing/updating EUID stored scripts');
+
+  for (const [type, name] of Object.entries(storedScriptName)) {
+    await putStoredScript(esClient, name, getEuidPainlessEvaluation(type as EntityType));
+  }
+}
+
+export async function deleteEuidStoredScripts({
+  esClient,
+  logger,
+}: {
+  esClient: ElasticsearchClient;
+  logger: Logger;
+}) {
+  logger.debug('Deleting EUID stored scripts');
+  for (const name of Object.values(storedScriptName)) {
+    await deleteStoredScript(esClient, name);
+  }
+}

x-pack/solutions/security/plugins/entity_store/server/infra/elasticsearch/scripts.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ElasticsearchClient as EsClient } from '@kbn/core/server';
+
+export const putStoredScript = async (
+  esClient: EsClient,
+  name: string,
+  painlessSource: string
+): Promise<void> => {
+  await esClient.putScript({
+    id: name,
+    script: {
+      lang: 'painless',
+      source: painlessSource,
+    },
+  });
+};
+
+export const deleteStoredScript = async (esClient: EsClient, name: string) => {
+  await esClient.deleteScript({ id: name }, { ignore: [404] });
+};