Create list entities API

add API test

Add data client test

.buildkite/ftr_security_serverless_configs.yml

@@ -81,6 +81,7 @@ enabled:
   - x-pack/test/security_solution_api_integration/test_suites/genai/knowledge_base/entries/trial_license_complete_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/trial_license_complete_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/basic_license_essentials_tier/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/entity_analytics/entity_store/trial_license_complete_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/exception_lists_items/trial_license_complete_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/lists_items/trial_license_complete_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/serverless.config.ts

.buildkite/ftr_security_stateful_configs.yml

@@ -62,6 +62,7 @@ enabled:
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/user_roles/trial_license_complete_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/trial_license_complete_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/basic_license_essentials_tier/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/entity_analytics/entity_store/trial_license_complete_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/exception_lists_items/trial_license_complete_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/lists_items/trial_license_complete_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/ess.config.ts

x-pack/plugins/security_solution/common/api/entity_analytics/entity_store/common.gen.ts

@@ -36,3 +36,9 @@ export const EngineDescriptor = z.object({
   status: EngineStatus.optional(),
   filter: z.string().optional(),
 });
+
+export type InspectQuery = z.infer<typeof InspectQuery>;
+export const InspectQuery = z.object({
+  response: z.array(z.string()),
+  dsl: z.array(z.string()),
+});

x-pack/plugins/security_solution/common/api/entity_analytics/entity_store/common.schema.yaml

@@ -6,7 +6,6 @@ info:
 paths: {}
 components:
   schemas:
-
     EntityType:
       type: string
       enum:
@@ -31,7 +30,21 @@ components:
         - installing
         - started
         - stopped
-    
+
     IndexPattern:
       type: string
-
+
+    InspectQuery:
+      type: object
+      properties:
+        response:
+          type: array
+          items:
+            type: string
+        dsl:
+          type: array
+          items:
+            type: string
+      required:
+        - dsl
+        - response

x-pack/plugins/security_solution/common/api/entity_analytics/entity_store/entities/common.gen.ts

@@ -0,0 +1,128 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/*
+ * NOTICE: Do not edit this file manually.
+ * This file is automatically generated by the OpenAPI Generator, @kbn/openapi-generator.
+ *
+ * info:
+ *   title: Common Entities Schemas
+ *   version: 1
+ */
+
+import { z } from '@kbn/zod';
+
+export type UserEntityRecord = z.infer<typeof UserEntityRecord>;
+export const UserEntityRecord = z.object({
+  user: z
+    .object({
+      full_name: z.array(z.string()).optional(),
+      domain: z.array(z.string()).optional(),
+      roles: z.array(z.string()).optional(),
+      name: z.string(),
+      id: z.array(z.string()).optional(),
+      email: z.array(z.string()).optional(),
+      hash: z.array(z.string()).optional(),
+    })
+    .optional(),
+  entity: z
+    .object({
+      /**
+       * The last seen timestamp of the entity.
+       */
+      lastSeenTimestamp: z.string().datetime(),
+      /**
+       * The schema version of the entity.
+       */
+      schemaVersion: z.string(),
+      /**
+       * The definition version of the entity.
+       */
+      definitionVersion: z.string(),
+      /**
+       * The display name of the entity.
+       */
+      displayName: z.string(),
+      /**
+       * The identity fields of the entity.
+       */
+      identityFields: z.array(z.string()),
+      /**
+       * The ID of the entity.
+       */
+      id: z.string(),
+      /**
+       * The type of the entity.
+       */
+      type: z.literal('node'),
+      /**
+       * The first seen timestamp of the entity.
+       */
+      firstSeenTimestamp: z.string().datetime(),
+      /**
+       * The definition ID of the entity.
+       */
+      definitionId: z.string(),
+    })
+    .optional(),
+});
+
+export type HostEntityRecord = z.infer<typeof HostEntityRecord>;
+export const HostEntityRecord = z.object({
+  host: z
+    .object({
+      hostname: z.array(z.string()).optional(),
+      domain: z.array(z.string()).optional(),
+      ip: z.array(z.string()).optional(),
+      name: z.string(),
+      id: z.array(z.string()).optional(),
+      type: z.array(z.string()).optional(),
+      mac: z.array(z.string()).optional(),
+      architecture: z.array(z.string()).optional(),
+    })
+    .optional(),
+  entity: z
+    .object({
+      /**
+       * The last seen timestamp of the entity.
+       */
+      lastSeenTimestamp: z.string().datetime(),
+      /**
+       * The schema version of the entity.
+       */
+      schemaVersion: z.string(),
+      /**
+       * The definition version of the entity.
+       */
+      definitionVersion: z.string(),
+      /**
+       * The display name of the entity.
+       */
+      displayName: z.string(),
+      /**
+       * The identity fields of the entity.
+       */
+      identityFields: z.array(z.string()),
+      /**
+       * The ID of the entity.
+       */
+      id: z.string(),
+      /**
+       * The type of the entity.
+       */
+      type: z.literal('node'),
+      /**
+       * The first seen timestamp of the entity.
+       */
+      firstSeenTimestamp: z.string().datetime(),
+      /**
+       * The definition ID of the entity.
+       */
+      definitionId: z.string(),
+    })
+    .optional(),
+});

x-pack/plugins/security_solution/common/api/entity_analytics/entity_store/entities/common.schema.yaml

@@ -0,0 +1,172 @@
+openapi: 3.0.0
+info:
+  title: Common Entities Schemas
+  description: Common Entities schemas for the Entity Store
+  version: '1'
+paths: {}
+components:
+  schemas:
+    UserEntityRecord:
+      type: object
+      properties:
+        user:
+          type: object
+          properties:
+            full_name:
+              type: array
+              items:
+                type: string
+            domain:
+              type: array
+              items:
+                type: string
+            roles:
+              type: array
+              items:
+                type: string
+            name:
+              type: string
+            id:
+              type: array
+              items:
+                type: string
+            email:
+              type: array
+              items:
+                type: string
+            hash:
+              type: array
+              items:
+                type: string
+          required:
+            - name
+        entity:
+          type: object
+          properties:
+            lastSeenTimestamp:
+              type: string
+              format: date-time
+              description: The last seen timestamp of the entity.
+            schemaVersion:
+              type: string
+              description: The schema version of the entity.
+            definitionVersion:
+              type: string
+              description: The definition version of the entity.
+            displayName:
+              type: string
+              description: The display name of the entity.
+            identityFields:
+              type: array
+              items:
+                type: string
+              description: The identity fields of the entity.
+            id:
+              type: string
+              description: The ID of the entity.
+            type:
+              type: string
+              enum:
+                - node
+              description: The type of the entity.
+            firstSeenTimestamp:
+              type: string
+              format: date-time
+              description: The first seen timestamp of the entity.
+            definitionId:
+              type: string
+              description: The definition ID of the entity.
+          required:
+            - lastSeenTimestamp
+            - schemaVersion
+            - definitionVersion
+            - displayName
+            - identityFields
+            - id
+            - type
+            - firstSeenTimestamp
+            - definitionId
+    HostEntityRecord:
+      type: object
+      properties:
+        host:
+          type: object
+          properties:
+            hostname:
+              type: array
+              items:
+                type: string
+            domain:
+              type: array
+              items:
+                type: string
+            ip:
+              type: array
+              items:
+                type: string
+            name:
+              type: string
+            id:
+              type: array
+              items:
+                type: string
+            type:
+              type: array
+              items:
+                type: string
+            mac:
+              type: array
+              items:
+                type: string
+            architecture:
+              type: array
+              items:
+                type: string
+          required:
+            - name
+        entity:
+          type: object
+          properties:
+            lastSeenTimestamp:
+              type: string
+              format: date-time
+              description: The last seen timestamp of the entity.
+            schemaVersion:
+              type: string
+              description: The schema version of the entity.
+            definitionVersion:
+              type: string
+              description: The definition version of the entity.
+            displayName:
+              type: string
+              description: The display name of the entity.
+            identityFields:
+              type: array
+              items:
+                type: string
+              description: The identity fields of the entity.
+            id:
+              type: string
+              description: The ID of the entity.
+            type:
+              type: string
+              enum:
+                - node
+              description: The type of the entity.
+            firstSeenTimestamp:
+              type: string
+              format: date-time
+              description: The first seen timestamp of the entity.
+            definitionId:
+              type: string
+              description: The definition ID of the entity.
+          required:
+            - lastSeenTimestamp
+            - schemaVersion
+            - definitionVersion
+            - displayName
+            - identityFields
+            - id
+            - type
+            - firstSeenTimestamp
+            - definitionId