elastic · kfirpeled · Apr 6, 2026 · Mar 29, 2026 · Mar 30, 2026 · Mar 30, 2026
@@ -69,6 +69,7 @@ export const entitySchema = schema.object({
   name: schema.maybe(schema.string()),
   type: schema.maybe(schema.string()),
   sub_type: schema.maybe(schema.string()),
+  engine_type: schema.maybe(schema.string()),
   host: schema.maybe(
     schema.object({
       ip: schema.maybe(schema.string()),

@@ -23,7 +23,11 @@ import type {
 } from '../../schema/graph/v1';
 import { REACHED_NODES_LIMIT } from '../../schema/graph/v1';
 
-export { DOCUMENT_TYPE_ALERT, DOCUMENT_TYPE_EVENT } from '../../schema/graph/v1';
+export {
+  DOCUMENT_TYPE_ALERT,
+  DOCUMENT_TYPE_ENTITY,
+  DOCUMENT_TYPE_EVENT,
+} from '../../schema/graph/v1';
 
 export type GraphRequest = Omit<TypeOf<typeof graphRequestSchema>, 'query.esQuery'> & {
   query: { esQuery?: { bool: Partial<BoolQuery> } };

@@ -104,6 +104,11 @@ export const isEntityRelationshipExpandedForScope = (
   return store?.isEntityRelationshipExpanded(entityId) ?? false;
 };
 
+export const isInitialEntityForScope = (scopeId: string, entityId: string): boolean => {
+  const store = stores.get(scopeId);
+  return store?.isInitialEntity(entityId) ?? false;
+};
+
 /**
  * Check if a filter is active for the given scope, field, and value.
  * Returns false gracefully if no store exists (no warning logged).
@@ -142,6 +147,7 @@ const stores = new Map<string, FilterStore>();
 export class FilterStore {
   readonly scopeId: string;
   private dataViewId?: string;
+  private initialEntityIds: Array<{ id: string; isOrigin: boolean }> = [];
   private readonly filters$ = new BehaviorSubject<Filter[]>([]);
   private readonly expandedEntityIds$ = new BehaviorSubject<Set<string>>(new Set());
   private readonly filterEventSubscription: Subscription;
@@ -174,6 +180,10 @@ export class FilterStore {
     }
   }
 
+  setInitialEntityIds(initialEntityIds: Array<{ id: string; isOrigin: boolean }>): void {
+    this.initialEntityIds = initialEntityIds;
+  }
+
   /**
    * Get the current filters from the store.
    */
@@ -244,7 +254,14 @@ export class FilterStore {
    * Check if an entity's relationships are currently expanded.
    */
   isEntityRelationshipExpanded(entityId: string): boolean {
-    return this.expandedEntityIds$.value.has(entityId);
+    return this.expandedEntityIds$.value.has(entityId) || this.isInitialEntity(entityId);
+  }
+
+  /**
+   * Check if an entity ID is part of the initial set of entities (e.g. from the original graph request).
+   */
+  isInitialEntity(entityId: string): boolean {
+    return this.initialEntityIds.find((entity) => entity.id === entityId)?.isOrigin ?? false;
   }
 
   /**

@@ -27,6 +27,17 @@ import { getOrCreateFilterStore, destroyFilterStore } from './filter_store';
  */
 export const useGraphFilters = (
   scopeId: string,
+  initialEntityIds: Array<{
+    /**
+     * The ID of the entity.
+     */
+    id: string;
+
+    /**
+     * Whether this entity is the origin of the graph (for centering).
+     */
+    isOrigin: boolean;
+  }>,
   dataViewId: string
 ): {
   searchFilters: Filter[];
@@ -39,7 +50,8 @@ export const useGraphFilters = (
   // Update dataViewId when it changes
   useEffect(() => {
     store.setDataViewId(dataViewId);
-  }, [store, dataViewId]);
+    store.setInitialEntityIds(initialEntityIds);
+  }, [store, dataViewId, initialEntityIds]);
 
   // Clean up store on unmount or when scopeId changes
   useEffect(() => {
@@ -91,13 +103,17 @@ export const useGraphFilters = (
 
   // Convert expandedEntityIds Set to API format
   const entityIdsForApi = useMemo(() => {
-    if (expandedEntityIds.size === 0) return undefined;
+    if (expandedEntityIds.size === 0) return initialEntityIds;
 
-    return Array.from(expandedEntityIds).map((id) => ({
-      id,
-      isOrigin: false, // User-expanded entities are not the graph origin
-    }));
-  }, [expandedEntityIds]);
+    return initialEntityIds.concat(
+      Array.from(expandedEntityIds)
+        .filter((id) => !initialEntityIds.some((entity) => entity.id === id))
+        .map((id) => ({
+          id,
+          isOrigin: false, // User-expanded entities are not the graph origin
+        }))
+    );
+  }, [expandedEntityIds, initialEntityIds]);
 
   return {
     searchFilters,

@@ -57,6 +57,7 @@ export const EntityItem: StoryFn<EntityStoryProps> = ({
 }: EntityStoryProps) => {
   const item: EntityItemType = {
     itemType: DOCUMENT_TYPE_ENTITY,
+    entity: {},
     ...itemArgs,
   };
 

@@ -61,6 +61,7 @@ describe('<GroupedItem />', () => {
             risk: 55,
             ips: ['5.5.5.5'],
             countryCodes: ['US'],
+            entity: {},
           }}
         />
       );
@@ -138,7 +139,10 @@ describe('<GroupedItem />', () => {
       it('falls back to entity id when entity label is missing', () => {
         const entityId = 'entity-id';
         const { getByTestId } = render(
-          <GroupedItem scopeId={TEST_SCOPE_ID} item={{ itemType: 'entity', id: entityId }} />
+          <GroupedItem
+            scopeId={TEST_SCOPE_ID}
+            item={{ itemType: 'entity', id: entityId, entity: {} }}
+          />
         );
         expect(getByTestId(GROUPED_ITEM_TITLE_TEST_ID_TEXT).textContent).toBe(entityId);
       });
@@ -175,6 +179,7 @@ describe('<GroupedItem />', () => {
               itemType: 'entity',
               id: 'e1',
               label: 'entity-1',
+              entity: {},
               actor: { id: 'a1', label: 'actor' },
               target: { id: 't1', label: 'target' },
             } as any // eslint-disable-line @typescript-eslint/no-explicit-any
@@ -413,6 +418,7 @@ describe('<GroupedItem />', () => {
             itemType: 'entity',
             id: 'entity-1',
             label: 'test_entity',
+            entity: {},
           }}
         />
       );
@@ -432,6 +438,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             countryCodes: ['il'],
+            entity: {},
           }}
         />
       );
@@ -448,6 +455,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             countryCodes: undefined,
+            entity: {},
           }}
         />
       );
@@ -464,6 +472,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             countryCodes: [''],
+            entity: {},
           }}
         />
       );
@@ -480,6 +489,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             countryCodes: ['INVALID'],
+            entity: {},
           }}
         />
       );
@@ -493,6 +503,7 @@ describe('<GroupedItem />', () => {
         itemType: 'entity',
         id: 'e1',
         label: 'entity-1',
+        entity: {},
       };
 
       const { getByTestId, rerender } = render(
@@ -531,6 +542,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             ips: undefined,
+            entity: {},
           }}
         />
       );
@@ -547,6 +559,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             ips: [''],
+            entity: {},
           }}
         />
       );
@@ -564,6 +577,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             ips: [ipv4],
+            entity: {},
           }}
         />
       );
@@ -581,6 +595,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             ips: ipArray,
+            entity: {},
           }}
         />
       );
@@ -597,6 +612,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             ips: [],
+            entity: {},
           }}
         />
       );
@@ -613,6 +629,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             ips: ['', ''],
+            entity: {},
           }}
         />
       );
@@ -632,6 +649,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             countryCodes: countryArray,
+            entity: {},
           }}
         />
       );
@@ -650,6 +668,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             countryCodes: [],
+            entity: {},
           }}
         />
       );
@@ -666,6 +685,7 @@ describe('<GroupedItem />', () => {
             id: 'e1',
             label: 'entity-1',
             countryCodes: ['', ''],
+            entity: {},
           }}
         />
       );
@@ -692,6 +712,7 @@ describe('<GroupedItem />', () => {
             itemType: 'entity',
             id: 'e1',
             label: 'entity-1',
+            entity: {},
           }}
         />
       );
@@ -710,6 +731,7 @@ describe('<GroupedItem />', () => {
             itemType: 'entity',
             id: 'e1',
             label: 'entity-1',
+            entity: {},
           }}
         />
       );
@@ -727,6 +749,7 @@ describe('<GroupedItem />', () => {
             itemType: 'entity',
             id: 'e1',
             label: 'entity-1',
+            entity: {},
           }}
         />
       );

@@ -26,7 +26,7 @@ describe('EntityActionsButton', () => {
     itemType: 'entity',
     icon: 'user',
     label: 'Test Entity',
-    availableInEntityStore: true,
+    entity: { availableInEntityStore: true },
   };
 
   const scopeId = 'test-scope-id';
@@ -81,7 +81,7 @@ describe('EntityActionsButton', () => {
     describe('when entity is not available in entity store', () => {
       const notInStoreItem: EntityItem = {
         ...mockEntityItem,
-        availableInEntityStore: false,
+        entity: { availableInEntityStore: false },
       };
 
       it('should render entity details item as disabled', () => {

@@ -8,7 +8,6 @@
 import React, { useCallback, useState } from 'react';
 import { EuiButtonIcon, EuiPopover, EuiListGroup, EuiHorizontalRule } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
 import { PopoverListItem } from '../../../../popovers/primitives/popover_list_item';
 import {
   GROUPED_ITEM_ACTIONS_BUTTON_TEST_ID,
@@ -26,8 +25,8 @@ import {
   emitEntityRelationshipToggle,
   isEntityRelationshipExpandedForScope,
 } from '../../../../filters/filter_store';
-import { GenericEntityPanelKey, GENERIC_ENTITY_PREVIEW_BANNER } from '../../../constants';
 import { RELATED_ENTITY } from '../../../../../common/constants';
+import { useOpenEntityPreviewPanel } from '../../../hooks/use_open_entity_preview_panel';
 
 const actionsButtonAriaLabel = i18n.translate(
   'securitySolutionPackages.csp.graph.groupedItem.actionsButton.ariaLabel',
@@ -52,25 +51,11 @@ export interface EntityActionsButtonProps {
  */
 export const EntityActionsButton = ({ item, scopeId }: EntityActionsButtonProps) => {
   const [isPopoverOpen, setIsPopoverOpen] = useState(false);
-  const { openPreviewPanel } = useExpandableFlyoutApi();
-
   const closePopover = useCallback(() => setIsPopoverOpen(false), []);
   const togglePopover = useCallback(() => setIsPopoverOpen((prev) => !prev), []);
 
-  const handleShowEntityDetails = useCallback(() => {
-    openPreviewPanel({
-      id: GenericEntityPanelKey,
-      params: {
-        entityId: item.id,
-        scopeId,
-        isPreviewMode: true,
-        banner: GENERIC_ENTITY_PREVIEW_BANNER,
-        isEngineMetadataExist: !!item.availableInEntityStore,
-      },
-    });
-  }, [item.id, item.availableInEntityStore, openPreviewPanel, scopeId]);
-
-  const sourceFields = item.sourceFields ?? {};
+  const openEntityPreviewPanel = useOpenEntityPreviewPanel();
+  const sourceFields = item.entity.sourceFields ?? {};
 
   const entityFilterActions: EntityFilterActions = {
     toggleEntityFilter: (role, action) => {
@@ -95,7 +80,7 @@ export const EntityActionsButton = ({ item, scopeId }: EntityActionsButtonProps)
   const items = getEntityExpandItems({
     nodeId: item.id,
     entityFilterActions,
-    onShowEntityDetails: handleShowEntityDetails,
+    onShowEntityDetails: () => openEntityPreviewPanel(item.id, scopeId, item.entity),
     onClose: closePopover,
     shouldRender: {
       showEntityRelationships: true,
@@ -104,10 +89,10 @@ export const EntityActionsButton = ({ item, scopeId }: EntityActionsButtonProps)
       showRelatedEvents: true,
       showEntityDetails: true,
     },
-    showEntityDetailsDisabled: !item.availableInEntityStore,
+    showEntityDetailsDisabled: !item.entity.availableInEntityStore,
     isEntityRelationshipsExpanded: isEntityRelationshipExpandedForScope(scopeId, item.id),
     toggleEntityRelationships: (action) => emitEntityRelationshipToggle(scopeId, item.id, action),
-    showEntityRelationshipsDisabled: !item.availableInEntityStore,
+    showEntityRelationshipsDisabled: !item.entity.availableInEntityStore,
   });
 
   return (