Create initialization API for privileged user monitoring engine

[CAWilson94]

Summary

This PR creates the initialisation API for priv user monitoring - basic route and barebones kibana task with a console log are included.

[elasticmachine]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!

[Copilot]

PR Overview

This PR creates the initialization API for the privileged user monitoring engine. It adds a new API route for initialization, configures a Kibana task to run the monitoring engine, and integrates API key management along with related saved objects and index mappings.

Reviewed Changes

File	Description
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/init.ts	Adds the initialization route for privilege monitoring.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/tasks/state.ts	Defines the state schema and default state for the monitoring task.
x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/engine/init.gen.ts	Provides generated types for the engine initialization response.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/indicies.ts	Sets up index names and mappings for privileged monitoring.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/saved_object/privilege_monitoring_type.ts	Defines the saved object type and mappings for privilege monitoring status.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/saved_object/privilege_monitoring.ts	Implements methods for creating, updating, and retrieving the engine descriptor.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/constants.ts	Sets constants used in task registration and engine status.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/auth/api_key.ts	Manages API key generation and retrieval for the engine.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/tasks/privilege_monitoring_task.ts	Registers and defines the task for running privilege monitoring.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privilege_monitoring_data_client.ts	Implements the data client that initializes the engine, creates indices, and starts the monitoring task.
(Other files)	Update various route registrations and quickstart client integration to support the new engine API.

Copilot reviewed 24 out of 24 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/tasks/privilege_monitoring_task.ts:66

• [nitpick] The use of 'Great Success' in the task title may appear informal and could be confusing; consider updating it to a more descriptive title reflecting the task purpose.

title: 'Entity Analytics Privilege Monitoring - Great Success',

PR Overview

This PR introduces an initialization API for the privileged user monitoring engine. It implements a new API route for initialization, integrates telemetry and task management in the data client, and sets up supporting saved objects, index mappings, and tests.

• Added a new API route for privilege monitoring engine initialization.
• Implemented a data client that handles index creation, API key generation, and telemetry reporting.
• Updated tests and mocks to support the new features.

Reviewed Changes

File	Description
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/init.ts	New route for initializing the monitoring engine.
x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/common.gen.ts	Auto-generated common definitions for privilege monitoring.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/saved_object/privilege_monitoring.test.ts	Tests for saved object operations related to the engine.
x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/engine/init.gen.ts	Auto-generated API definitions for engine initialization.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/indices.ts	New index mapping definitions and functions for user and group indices.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/auditing/actions.ts	Added auditing action constants.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/auth/privileges.ts	Defined runtime privileges for the monitoring engine.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/constants.ts	New constants including engine status and mappings version.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/auth/api_key.ts	API key management for privilege monitoring with a saved object integration.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privilege_monitoring_data_client.mock.ts	Mock implementation for the monitoring engine data client.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/auth/saved_object.ts	Utility for generating a saved object ID using UUID v5.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/configurations.ts	Added new configuration file for privilege monitoring.
x-pack/solutions/security/plugins/security_solution/common/api/quickstart_client.gen.ts	Extended quickstart client with an API method for engine initialization.
x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/routes/mocks/request_context.ts	Updated mocks to include privilege monitoring data client.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privilege_monitoring_data_client.ts	Data client implementation for privilege monitoring including index management, task scheduling, auditing, and telemetry reporting.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/register_entity_store_routes.ts	Route registration for the new privilege monitoring API.
x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privilege_monitoring_data_client.test.ts	Basic test setup for the new data client.

Copilot reviewed 31 out of 31 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (2)

x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/data_client/privilege_monitoring_data_client.ts:164

• The ternary operator in the audit function is ambiguous; the way it's structured now always results in AUDIT_TYPE.DELETION when the action isn't CREATE. Consider using a clear if/else chain or grouping the conditions with parentheses.

const type = action === PrivilegeMonitoringEngineActions.CREATE ? AUDIT_TYPE.CREATION : PrivilegeMonitoringEngineActions.DELETE ? AUDIT_TYPE.DELETION : AUDIT_TYPE.CHANGE;

x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/auth/api_key.ts:33

• The API key manager functions are being executed immediately instead of being passed as callable functions. Wrap each function call in an anonymous function (e.g., generate: () => generate(deps)) so that they are invoked when called.

export const getApiKeyManager = (deps: ApiKeyManagerDependencies) => { return { generate: generate(deps), getApiKey: getApiKey(deps), getClientFromApiKey: getClientFromApiKey(deps), getRequestFromApiKey, }; };