[Telemetry][Security Solution] Send new Endpoint field (elastic#209149)

## Summary Make the Security Solution `endpoint-meta-telemetry` task send the new Endpoint field `Endpoint.metrics.top_process_trees` ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Elastic Machine <[email protected]>
hop-dev · Feb 4, 2025 · e15d089 · e15d089
1 parent 7adc337
commit e15d089
Show file tree

Hide file tree

Showing 8 changed files with 5,276 additions and 7 deletions.
diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/preview_sender.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/preview_sender.ts
@@ -167,11 +167,14 @@ export class PreviewTelemetryEventsSender implements ITelemetryEventsSender {
   }
 
   public sendAsync(channel: TelemetryChannel, events: unknown[]): void {
-    this.composite.sendAsync(channel, events);
+    const result = this.composite.simulateSendAsync(channel, events);
+    this.sentMessages = [...this.sentMessages, ...result];
   }
 
   public simulateSendAsync(channel: TelemetryChannel, events: unknown[]): string[] {
-    return this.composite.simulateSendAsync(channel, events);
+    const result = this.composite.simulateSendAsync(channel, events);
+    this.sentMessages = [...this.sentMessages, ...result];
+    return result;
   }
 
   public updateQueueConfig(channel: TelemetryChannel, config: QueueConfig): void {

diff --git a/...solutions/security/plugins/security_solution/server/lib/telemetry/preview_task_metrics.ts b/...solutions/security/plugins/security_solution/server/lib/telemetry/preview_task_metrics.ts
@@ -34,19 +34,18 @@ export class PreviewTaskMetricsService implements ITaskMetricsService {
   }
 
   public start(name: string): Trace {
-    this.logger.error('Simulating TaskMetricsService.start');
+    this.logger.info('Simulating TaskMetricsService.start');
     return this.composite.start(name);
   }
 
   public createTaskMetric(trace: Trace, error?: Error): TaskMetric {
-    this.logger.error('Simulating TaskMetricsService.createTaskMetric');
+    this.logger.info('Simulating TaskMetricsService.createTaskMetric');
     return this.composite.createTaskMetric(trace, error);
   }
 
   public async end(trace: Trace, error?: Error): Promise<void> {
-    this.logger.error('Simulating TaskMetricsService.end');
+    this.logger.info('Simulating TaskMetricsService.end');
     const metric = this.composite.createTaskMetric(trace, error);
-    const result = this.sender.simulateSendAsync(TelemetryChannel.TASK_METRICS, [metric]);
-    this.sentMessages = [...this.sentMessages, ...result];
+    this.sender.simulateSendAsync(TelemetryChannel.TASK_METRICS, [metric]);
   }
 }
diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/tasks/endpoint.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/tasks/endpoint.ts
@@ -312,6 +312,7 @@ class EndpointMetadataProcessor {
       system_impact: systemImpact,
       threads,
       event_filter: eventFilter,
+      top_process_trees: topProcessTrees,
     } = endpointMetric.Endpoint.metrics;
     const endpointPolicyDetail = extractEndpointPolicyConfig(policyConfig);
     if (endpointPolicyDetail) {
@@ -336,6 +337,7 @@ class EndpointMetadataProcessor {
         systemImpact,
         threads,
         eventFilter,
+        topProcessTrees,
       },
       endpoint_meta: {
         os: endpointMetric.host.os,

diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/types.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/types.ts
@@ -281,6 +281,22 @@ export interface EndpointMetrics {
     active_global_count: number;
     active_user_count: number;
   };
+  top_process_trees: {
+    values: Event[];
+  };
+}
+
+interface Event {
+  event_count: number;
+  last_seen: string;
+  sample: Sample;
+}
+
+interface Sample {
+  command_line: string;
+  entity_id: string;
+  executable: string;
+  parent_command_line: string;
 }
 
 interface EndpointMetricOS {