[Entity Analytics] [Entity Store] Telemetry (elastic#196880)

## Summary

This PR adds telemetry for the Entity Store.
Client side tracks UI enablement actions, whilst Kibana side tracks
execution time of the store initialisation process and execution time of
the enrich policy task.
Finally we also track number of entities in the store

x-pack/plugins/security_solution/public/common/lib/telemetry/constants.ts

@@ -68,6 +68,8 @@ export enum TelemetryEventTypes {
   EntityDetailsClicked = 'Entity Details Clicked',
   EntityAlertsClicked = 'Entity Alerts Clicked',
   EntityRiskFiltered = 'Entity Risk Filtered',
+  EntityStoreEnablementToggleClicked = 'Entity Store Enablement Toggle Clicked',
+  EntityStoreDashboardInitButtonClicked = 'Entity Store Initialization Button Clicked',
   MLJobUpdate = 'ML Job Update',
   AddRiskInputToTimelineClicked = 'Add Risk Input To Timeline Clicked',
   ToggleRiskSummaryClicked = 'Toggle Risk Summary Clicked',

x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/index.ts

@@ -214,3 +214,36 @@ export const assetCriticalityCsvImportedEvent: TelemetryEvent = {
     },
   },
 };
+
+export const entityStoreInitEvent: TelemetryEvent = {
+  eventType: TelemetryEventTypes.EntityStoreDashboardInitButtonClicked,
+  schema: {
+    timestamp: {
+      type: 'date',
+      _meta: {
+        description: 'Timestamp of the event',
+        optional: false,
+      },
+    },
+  },
+};
+
+export const entityStoreEnablementEvent: TelemetryEvent = {
+  eventType: TelemetryEventTypes.EntityStoreEnablementToggleClicked,
+  schema: {
+    timestamp: {
+      type: 'date',
+      _meta: {
+        description: 'Timestamp of the event',
+        optional: false,
+      },
+    },
+    action: {
+      type: 'keyword',
+      _meta: {
+        description: 'Event toggle action',
+        optional: false,
+      },
+    },
+  },
+};

x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/types.ts

@@ -59,6 +59,15 @@ export interface ReportAssetCriticalityCsvImportedParams {
   };
 }
 
+export interface ReportEntityStoreEnablementParams {
+  timestamp: string;
+  action: 'start' | 'stop';
+}
+
+export interface ReportEntityStoreInitParams {
+  timestamp: string;
+}
+
 export type ReportEntityAnalyticsTelemetryEventParams =
   | ReportEntityDetailsClickedParams
   | ReportEntityAlertsClickedParams
@@ -68,7 +77,9 @@ export type ReportEntityAnalyticsTelemetryEventParams =
   | ReportAddRiskInputToTimelineClickedParams
   | ReportAssetCriticalityCsvPreviewGeneratedParams
   | ReportAssetCriticalityFileSelectedParams
-  | ReportAssetCriticalityCsvImportedParams;
+  | ReportAssetCriticalityCsvImportedParams
+  | ReportEntityStoreEnablementParams
+  | ReportEntityStoreInitParams;
 
 export type EntityAnalyticsTelemetryEvent =
   | {
@@ -106,4 +117,12 @@ export type EntityAnalyticsTelemetryEvent =
   | {
       eventType: TelemetryEventTypes.AssetCriticalityCsvImported;
       schema: RootSchema<ReportAssetCriticalityCsvImportedParams>;
+    }
+  | {
+      eventType: TelemetryEventTypes.EntityStoreEnablementToggleClicked;
+      schema: RootSchema<ReportEntityStoreEnablementParams>;
+    }
+  | {
+      eventType: TelemetryEventTypes.EntityStoreDashboardInitButtonClicked;
+      schema: RootSchema<ReportEntityStoreInitParams>;
     };

x-pack/plugins/security_solution/public/common/lib/telemetry/events/telemetry_events.ts

@@ -21,6 +21,8 @@ import {
   assetCriticalityCsvPreviewGeneratedEvent,
   assetCriticalityFileSelectedEvent,
   assetCriticalityCsvImportedEvent,
+  entityStoreEnablementEvent,
+  entityStoreInitEvent,
 } from './entity_analytics';
 import {
   assistantInvokedEvent,
@@ -172,6 +174,8 @@ export const telemetryEvents = [
   assetCriticalityCsvPreviewGeneratedEvent,
   assetCriticalityFileSelectedEvent,
   assetCriticalityCsvImportedEvent,
+  entityStoreEnablementEvent,
+  entityStoreInitEvent,
   toggleRiskSummaryClickedEvent,
   RiskInputsExpandedFlyoutOpenedEvent,
   addRiskInputToTimelineClickedEvent,

x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.mock.ts

@@ -43,4 +43,6 @@ export const createTelemetryClientMock = (): jest.Mocked<TelemetryClientStart> =
   reportOpenNoteInExpandableFlyoutClicked: jest.fn(),
   reportAddNoteFromExpandableFlyoutClicked: jest.fn(),
   reportPreviewRule: jest.fn(),
+  reportEntityStoreEnablement: jest.fn(),
+  reportEntityStoreInit: jest.fn(),
 });

x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.ts

@@ -45,6 +45,8 @@ import type {
   ReportEventLogShowSourceEventDateRangeParams,
   ReportEventLogFilterByRunTypeParams,
   PreviewRuleParams,
+  ReportEntityStoreEnablementParams,
+  ReportEntityStoreInitParams,
 } from './types';
 import { TelemetryEventTypes } from './constants';
 
@@ -216,4 +218,12 @@ export class TelemetryClient implements TelemetryClientStart {
   public reportPreviewRule = (params: PreviewRuleParams) => {
     this.analytics.reportEvent(TelemetryEventTypes.PreviewRule, params);
   };
+
+  public reportEntityStoreEnablement = (params: ReportEntityStoreEnablementParams) => {
+    this.analytics.reportEvent(TelemetryEventTypes.EntityStoreEnablementToggleClicked, params);
+  };
+
+  public reportEntityStoreInit = (params: ReportEntityStoreInitParams) => {
+    this.analytics.reportEvent(TelemetryEventTypes.EntityStoreDashboardInitButtonClicked, params);
+  };
 }

x-pack/plugins/security_solution/public/common/lib/telemetry/types.ts

@@ -32,6 +32,8 @@ import type {
   ReportAssetCriticalityCsvPreviewGeneratedParams,
   ReportAssetCriticalityFileSelectedParams,
   ReportAssetCriticalityCsvImportedParams,
+  ReportEntityStoreEnablementParams,
+  ReportEntityStoreInitParams,
 } from './events/entity_analytics/types';
 import type {
   AssistantTelemetryEvent,
@@ -78,17 +80,7 @@ export * from './events/ai_assistant/types';
 export * from './events/alerts_grouping/types';
 export * from './events/data_quality/types';
 export * from './events/onboarding/types';
-export type {
-  ReportEntityAlertsClickedParams,
-  ReportEntityDetailsClickedParams,
-  ReportEntityRiskFilteredParams,
-  ReportRiskInputsExpandedFlyoutOpenedParams,
-  ReportToggleRiskSummaryClickedParams,
-  ReportAddRiskInputToTimelineClickedParams,
-  ReportAssetCriticalityCsvPreviewGeneratedParams,
-  ReportAssetCriticalityFileSelectedParams,
-  ReportAssetCriticalityCsvImportedParams,
-} from './events/entity_analytics/types';
+export * from './events/entity_analytics/types';
 export * from './events/document_details/types';
 export * from './events/manual_rule_run/types';
 export * from './events/event_log/types';
@@ -168,6 +160,9 @@ export interface TelemetryClientStart {
   ): void;
   reportAssetCriticalityCsvImported(params: ReportAssetCriticalityCsvImportedParams): void;
   reportCellActionClicked(params: ReportCellActionClickedParams): void;
+  // Entity Analytics Entity Store
+  reportEntityStoreEnablement(params: ReportEntityStoreEnablementParams): void;
+  reportEntityStoreInit(params: ReportEntityStoreInitParams): void;
 
   reportAnomaliesCountClicked(params: ReportAnomaliesCountClickedParams): void;
   reportDataQualityIndexChecked(params: ReportDataQualityIndexCheckedParams): void;

x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts

@@ -9,6 +9,7 @@ import type { UseMutationOptions } from '@tanstack/react-query';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { useCallback, useState } from 'react';
 
+import { useKibana } from '../../../../common/lib/kibana/kibana_react';
 import type {
   DeleteEntityEngineResponse,
   InitEntityEngineResponse,
@@ -21,6 +22,7 @@ const ENTITY_STORE_ENABLEMENT_INIT = 'ENTITY_STORE_ENABLEMENT_INIT';
 
 export const useEntityStoreEnablement = () => {
   const [polling, setPolling] = useState(false);
+  const { telemetry } = useKibana().services;
 
   useEntityEngineStatus({
     disabled: !polling,
@@ -46,8 +48,11 @@ export const useEntityStoreEnablement = () => {
   });
 
   const enable = useCallback(() => {
+    telemetry?.reportEntityStoreInit({
+      timestamp: new Date().toISOString(),
+    });
     initialize().then(() => setPolling(true));
-  }, [initialize]);
+  }, [initialize, telemetry]);
 
   return { enable };
 };
@@ -65,10 +70,17 @@ export const useInvalidateEntityEngineStatusQuery = () => {
 };
 
 export const useInitEntityEngineMutation = (options?: UseMutationOptions<{}>) => {
+  const { telemetry } = useKibana().services;
   const invalidateEntityEngineStatusQuery = useInvalidateEntityEngineStatusQuery();
   const { initEntityStore } = useEntityStoreRoutes();
   return useMutation<InitEntityEngineResponse[]>(
-    () => Promise.all([initEntityStore('user'), initEntityStore('host')]),
+    () => {
+      telemetry?.reportEntityStoreEnablement({
+        timestamp: new Date().toISOString(),
+        action: 'start',
+      });
+      return Promise.all([initEntityStore('user'), initEntityStore('host')]);
+    },
     {
       ...options,
       mutationKey: INIT_ENTITY_ENGINE_STATUS_KEY,
@@ -86,10 +98,17 @@ export const useInitEntityEngineMutation = (options?: UseMutationOptions<{}>) =>
 export const STOP_ENTITY_ENGINE_STATUS_KEY = ['POST', 'STOP_ENTITY_ENGINE'];
 
 export const useStopEntityEngineMutation = (options?: UseMutationOptions<{}>) => {
+  const { telemetry } = useKibana().services;
   const invalidateEntityEngineStatusQuery = useInvalidateEntityEngineStatusQuery();
   const { stopEntityStore } = useEntityStoreRoutes();
   return useMutation<StopEntityEngineResponse[]>(
-    () => Promise.all([stopEntityStore('user'), stopEntityStore('host')]),
+    () => {
+      telemetry?.reportEntityStoreEnablement({
+        timestamp: new Date().toISOString(),
+        action: 'stop',
+      });
+      return Promise.all([stopEntityStore('user'), stopEntityStore('host')]);
+    },
     {
       ...options,
       mutationKey: STOP_ENTITY_ENGINE_STATUS_KEY,

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.ts

@@ -11,12 +11,14 @@ import type {
   SavedObjectsClientContract,
   AuditLogger,
   IScopedClusterClient,
+  AnalyticsServiceSetup,
 } from '@kbn/core/server';
 import { EntityClient } from '@kbn/entityManager-plugin/server/lib/entity_client';
 import type { SortOrder } from '@elastic/elasticsearch/lib/api/types';
 import type { TaskManagerStartContract } from '@kbn/task-manager-plugin/server';
 import type { DataViewsService } from '@kbn/data-views-plugin/common';
 import { isEqual } from 'lodash/fp';
+import moment from 'moment';
 import type { AppClient } from '../../..';
 import type {
   Entity,
@@ -53,6 +55,10 @@ import {
   isPromiseFulfilled,
   isPromiseRejected,
 } from './utils';
+import {
+  ENTITY_ENGINE_INITIALIZATION_EVENT,
+  ENTITY_ENGINE_RESOURCE_INIT_FAILURE_EVENT,
+} from '../../telemetry/event_based/events';
 import type { EntityRecord } from './types';
 import { CRITICALITY_VALUES } from '../asset_criticality/constants';
 
@@ -66,6 +72,7 @@ interface EntityStoreClientOpts {
   kibanaVersion: string;
   dataViewsService: DataViewsService;
   appClient: AppClient;
+  telemetry?: AnalyticsServiceSetup;
 }
 
 interface SearchEntitiesParams {
@@ -170,6 +177,7 @@ export class EntityStoreDataClient {
     filter: string,
     pipelineDebugMode: boolean
   ) {
+    const setupStartTime = moment().utc().toISOString();
     const { logger, namespace, appClient, dataViewsService } = this.options;
     const indexPatterns = await buildIndexPatterns(namespace, appClient, dataViewsService);
 
@@ -249,12 +257,22 @@ export class EntityStoreDataClient {
       });
       logger.info(`Entity store initialized for ${entityType}`);
 
+      const setupEndTime = moment().utc().toISOString();
+      const duration = moment(setupEndTime).diff(moment(setupStartTime), 'seconds');
+      this.options.telemetry?.reportEvent(ENTITY_ENGINE_INITIALIZATION_EVENT.eventType, {
+        duration,
+      });
+
       return updated;
     } catch (err) {
       this.options.logger.error(
         `Error initializing entity store for ${entityType}: ${err.message}`
       );
 
+      this.options.telemetry?.reportEvent(ENTITY_ENGINE_RESOURCE_INIT_FAILURE_EVENT.eventType, {
+        error: err.message,
+      });
+
       await this.engineClient.update(entityType, ENGINE_STATUS.ERROR);
 
       await this.delete(entityType, taskManager, { deleteData: true, deleteEngine: false });