[EDR Workflows] Add About tab UI for osquery query details

oas_docs/output/kibana.serverless.yaml

@@ -62218,7 +62218,7 @@ paths:
 
         Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
 
-        Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).
+        Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp, and optionally queryInterval when the resultCountsEnabled experimental feature is enabled).
       operationId: OsqueryGetScheduledActionResults
       parameters:
         - description: The schedule ID of the scheduled query.
@@ -62292,6 +62292,7 @@ paths:
                       executionCount: 3
                       packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                       packName: My Pack
+                      queryInterval: 3600
                       queryName: uptime
                       queryText: select * from uptime;
                       scheduleId: pack_my_pack_uptime
@@ -113529,6 +113530,11 @@ components:
               saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
               status: completed
               successful: 0
+          result_counts:
+            error_agents: 0
+            responded_agents: 1
+            successful_agents: 1
+            total_rows: 42
           status: completed
           user_id: elastic
       type: object
@@ -113595,6 +113601,26 @@ components:
                     description: Number of successful agents.
                     type: integer
               type: array
+            result_counts:
+              description: |
+                Aggregated result count statistics for the query. May be omitted when aggregation data is unavailable. Single-query actions include responded_agents; pack actions include queries_with_results and queries_total instead.
+              type: object
+              properties:
+                error_agents:
+                  type: integer
+                queries_total:
+                  description: Total number of sub-queries in the pack (pack actions only).
+                  type: integer
+                queries_with_results:
+                  description: Number of sub-queries that returned at least one row (pack actions only).
+                  type: integer
+                responded_agents:
+                  description: Number of agents that responded (single-query actions only).
+                  type: integer
+                successful_agents:
+                  type: integer
+                total_rows:
+                  type: integer
             status:
               description: Global status of the live query (completed, running).
               enum:
@@ -113683,12 +113709,20 @@ components:
                               type: string
                         type: array
                       result_counts:
-                        description: Result count statistics (present when withResultCounts is true).
+                        description: |
+                          Result count statistics (present when withResultCounts is true). Single-query actions include responded_agents; pack actions include queries_with_results and queries_total instead.
                         type: object
                         properties:
                           error_agents:
                             type: integer
+                          queries_total:
+                            description: Total number of sub-queries in the pack (pack actions only).
+                            type: integer
+                          queries_with_results:
+                            description: Number of sub-queries that returned at least one row (pack actions only).
+                            type: integer
                           responded_agents:
+                            description: Number of agents that responded (single-query actions only).
                             type: integer
                           successful_agents:
                             type: integer
@@ -114105,6 +114139,7 @@ components:
           executionCount: 3
           packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
           packName: My Pack
+          queryInterval: 3600
           queryName: uptime
           queryText: select * from uptime;
           scheduleId: pack_my_pack_uptime
@@ -114424,6 +114459,10 @@ components:
         packName:
           description: The name of the pack containing the query.
           type: string
+        queryInterval:
+          description: |
+            Interval in seconds from the pack saved object query definition. Present only when the resultCountsEnabled experimental feature is enabled and the pack query defines an interval.
+          type: integer
         queryName:
           description: The name of the query within the pack.
           type: string

oas_docs/output/kibana.yaml

@@ -65485,7 +65485,7 @@ paths:
 
         Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
 
-        Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).
+        Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp, and optionally queryInterval when the resultCountsEnabled experimental feature is enabled).
       operationId: OsqueryGetScheduledActionResults
       parameters:
         - description: The schedule ID of the scheduled query.
@@ -65559,6 +65559,7 @@ paths:
                       executionCount: 3
                       packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                       packName: My Pack
+                      queryInterval: 3600
                       queryName: uptime
                       queryText: select * from uptime;
                       scheduleId: pack_my_pack_uptime
@@ -125029,6 +125030,11 @@ components:
               saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
               status: completed
               successful: 0
+          result_counts:
+            error_agents: 0
+            responded_agents: 1
+            successful_agents: 1
+            total_rows: 42
           status: completed
           user_id: elastic
       type: object
@@ -125095,6 +125101,26 @@ components:
                     description: Number of successful agents.
                     type: integer
               type: array
+            result_counts:
+              description: |
+                Aggregated result count statistics for the query. May be omitted when aggregation data is unavailable. Single-query actions include responded_agents; pack actions include queries_with_results and queries_total instead.
+              type: object
+              properties:
+                error_agents:
+                  type: integer
+                queries_total:
+                  description: Total number of sub-queries in the pack (pack actions only).
+                  type: integer
+                queries_with_results:
+                  description: Number of sub-queries that returned at least one row (pack actions only).
+                  type: integer
+                responded_agents:
+                  description: Number of agents that responded (single-query actions only).
+                  type: integer
+                successful_agents:
+                  type: integer
+                total_rows:
+                  type: integer
             status:
               description: Global status of the live query (completed, running).
               enum:
@@ -125183,12 +125209,20 @@ components:
                               type: string
                         type: array
                       result_counts:
-                        description: Result count statistics (present when withResultCounts is true).
+                        description: |
+                          Result count statistics (present when withResultCounts is true). Single-query actions include responded_agents; pack actions include queries_with_results and queries_total instead.
                         type: object
                         properties:
                           error_agents:
                             type: integer
+                          queries_total:
+                            description: Total number of sub-queries in the pack (pack actions only).
+                            type: integer
+                          queries_with_results:
+                            description: Number of sub-queries that returned at least one row (pack actions only).
+                            type: integer
                           responded_agents:
+                            description: Number of agents that responded (single-query actions only).
                             type: integer
                           successful_agents:
                             type: integer
@@ -125605,6 +125639,7 @@ components:
           executionCount: 3
           packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
           packName: My Pack
+          queryInterval: 3600
           queryName: uptime
           queryText: select * from uptime;
           scheduleId: pack_my_pack_uptime
@@ -125924,6 +125959,10 @@ components:
         packName:
           description: The name of the pack containing the query.
           type: string
+        queryInterval:
+          description: |
+            Interval in seconds from the pack saved object query definition. Present only when the resultCountsEnabled experimental feature is enabled and the pack query defines an interval.
+          type: integer
         queryName:
           description: The name of the query within the pack.
           type: string

x-pack/platform/plugins/shared/osquery/common/api/live_query/find_live_query.gen.ts

@@ -82,14 +82,26 @@ export const FindLiveQueryResponse = z.object({
                   )
                   .optional(),
                 /**
-                 * Result count statistics (present when withResultCounts is true).
-                 */
+      * Result count statistics (present when withResultCounts is true). Single-query actions include responded_agents; pack actions include queries_with_results and queries_total instead.
+
+      */
                 result_counts: z
                   .object({
                     total_rows: z.number().int().optional(),
+                    /**
+                     * Number of agents that responded (single-query actions only).
+                     */
                     responded_agents: z.number().int().optional(),
                     successful_agents: z.number().int().optional(),
                     error_agents: z.number().int().optional(),
+                    /**
+                     * Number of sub-queries that returned at least one row (pack actions only).
+                     */
+                    queries_with_results: z.number().int().optional(),
+                    /**
+                     * Total number of sub-queries in the pack (pack actions only).
+                     */
+                    queries_total: z.number().int().optional(),
                   })
                   .optional(),
               })
@@ -119,6 +131,29 @@ export const FindLiveQueryDetailsResponse = z.object({
        * Global status of the live query (completed, running).
        */
       status: z.enum(['completed', 'running']).optional(),
+      /**
+      * Aggregated result count statistics for the query. May be omitted when aggregation data is unavailable. Single-query actions include responded_agents; pack actions include queries_with_results and queries_total instead.
+
+      */
+      result_counts: z
+        .object({
+          total_rows: z.number().int().optional(),
+          /**
+           * Number of agents that responded (single-query actions only).
+           */
+          responded_agents: z.number().int().optional(),
+          successful_agents: z.number().int().optional(),
+          error_agents: z.number().int().optional(),
+          /**
+           * Number of sub-queries that returned at least one row (pack actions only).
+           */
+          queries_with_results: z.number().int().optional(),
+          /**
+           * Total number of sub-queries in the pack (pack actions only).
+           */
+          queries_total: z.number().int().optional(),
+        })
+        .optional(),
       /**
        * The queries with their execution status.
        */

x-pack/platform/plugins/shared/osquery/common/api/live_query/find_live_query.schema.yaml

@@ -84,16 +84,28 @@ components:
                                 type: string
                       result_counts:
                         type: object
-                        description: 'Result count statistics (present when withResultCounts is true).'
+                        description: >
+                          Result count statistics (present when withResultCounts is true).
+                          Single-query actions include responded_agents; pack actions include
+                          queries_with_results and queries_total instead.
                         properties:
                           total_rows:
                             type: integer
                           responded_agents:
+                            description: 'Number of agents that responded (single-query actions only).'
                             type: integer
                           successful_agents:
                             type: integer
                           error_agents:
                             type: integer
+                          queries_with_results:
+                            description: 'Number of sub-queries that returned at least one row (pack actions only).'
+                            type: integer
+                          queries_total:
+                            description: 'Total number of sub-queries in the pack (pack actions only).'
+                            type: integer
+      # Single-query example shown below; for pack actions, result_counts uses
+      # queries_with_results and queries_total instead of responded_agents.
       example:
         data:
           total: 1
@@ -154,6 +166,29 @@ components:
               description: 'Global status of the live query (completed, running).'
               type: string
               enum: [completed, running]
+            result_counts:
+              type: object
+              description: >
+                Aggregated result count statistics for the query. May be omitted
+                when aggregation data is unavailable. Single-query actions include
+                responded_agents; pack actions include queries_with_results and
+                queries_total instead.
+              properties:
+                total_rows:
+                  type: integer
+                responded_agents:
+                  description: 'Number of agents that responded (single-query actions only).'
+                  type: integer
+                successful_agents:
+                  type: integer
+                error_agents:
+                  type: integer
+                queries_with_results:
+                  description: 'Number of sub-queries that returned at least one row (pack actions only).'
+                  type: integer
+                queries_total:
+                  description: 'Total number of sub-queries in the pack (pack actions only).'
+                  type: integer
             queries:
               description: 'The queries with their execution status.'
               type: array
@@ -193,6 +228,8 @@ components:
                     description: 'Status of this individual query.'
                     type: string
                     enum: [completed, running]
+      # Single-query example shown below; for pack actions, result_counts uses
+      # queries_with_results and queries_total instead of responded_agents.
       example:
         data:
           action_id: "3c42c847-eb30-4452-80e0-728584042334"
@@ -201,6 +238,11 @@ components:
           agents: [ "16d7caf5-efd2-4212-9b62-73dafc91fa13" ]
           user_id: "elastic"
           status: "completed"
+          result_counts:
+            total_rows: 42
+            responded_agents: 1
+            successful_agents: 1
+            error_agents: 0
           queries:
             - action_id: "609c4c66-ba3d-43fa-afdd-53e244577aa0"
               id: "6724a474-cbba-41ef-a1aa-66aebf0879e2"

x-pack/platform/plugins/shared/osquery/common/api/scheduled_results/get_scheduled_action_results.gen.ts

@@ -49,6 +49,11 @@ export const ScheduledExecutionMetadata = z.object({
    * The timestamp of the most recent response for this execution.
    */
   timestamp: z.string().optional(),
+  /**
+      * Interval in seconds from the pack saved object query definition. Present only when the resultCountsEnabled experimental feature is enabled and the pack query defines an interval.
+
+      */
+  queryInterval: z.number().int().optional(),
 });
 
 export type ScheduledActionResultsAggregations = z.infer<typeof ScheduledActionResultsAggregations>;

x-pack/platform/plugins/shared/osquery/common/api/scheduled_results/get_scheduled_action_results.schema.yaml

@@ -30,6 +30,12 @@ components:
         timestamp:
           description: 'The timestamp of the most recent response for this execution.'
           type: string
+        queryInterval:
+          description: >
+            Interval in seconds from the pack saved object query definition.
+            Present only when the resultCountsEnabled experimental feature is enabled
+            and the pack query defines an interval.
+          type: integer
 
     ScheduledActionResultsAggregations:
       type: object
@@ -86,6 +92,7 @@ components:
           queryName: 'uptime'
           queryText: 'select * from uptime;'
           timestamp: '2024-07-26T09:00:00.000Z'
+          queryInterval: 3600
         edges:
           - _id: 'result-001'
             fields:

x-pack/platform/plugins/shared/osquery/common/api/scheduled_results/scheduled_results.schema.yaml

@@ -9,7 +9,8 @@ paths:
       description: >
         Get paginated per-agent action results for a specific scheduled query
         execution, with success/failure aggregation and execution metadata
-        (pack name, query name/text, timestamp).
+        (pack name, query name/text, timestamp, and optionally queryInterval when
+        the resultCountsEnabled experimental feature is enabled).
       operationId: OsqueryGetScheduledActionResults
       x-codegen-enabled: true
       x-labels: [ serverless, ess ]
@@ -80,6 +81,7 @@ paths:
                       queryName: 'uptime'
                       queryText: 'select * from uptime;'
                       timestamp: '2024-07-26T09:00:00.000Z'
+                      queryInterval: 3600
                     edges:
                       - _id: 'result-001'
                         fields:

x-pack/platform/plugins/shared/osquery/common/experimental_features.ts

@@ -25,6 +25,12 @@ export const allowedExperimentalValues = Object.freeze({
    * adding KQL search, document flyout, per-row actions, and column curation.
    */
   unifiedDataTable: true,
+  /**
+   * Enables result_counts aggregation in the live query details and list API
+   * responses, providing total rows, agent success/error breakdowns. Required
+   * by the upcoming "About" tab on the query details page.
+   */
+  resultCountsEnabled: false,
 });
 
 type ExperimentalFeatures = { [K in keyof typeof allowedExperimentalValues]: boolean };