[SecuritySolution][Endpoint][ResponseActions] Response action telemetry (endpoint/third party)

[ashokaditya]

Summary

Adds server-side telemetry collection for response action creation and responses.
part of elastic/security-team/issues/7466

Events from telemetry staging

Dashboard on staging

This PR adds Server Side EBTs (event-based telemetry) for:

Action creation event

"event_type": [
    "endpoint_response_action_sent"
  ],
  "properties": [
    {
      "responseActions": {
        "actionId": "696608a5-1908-457d-9072-5f555c740ffc",
        "agentType": "sentinel_one",
        "command": "unisolate",
        "isAutomated": false
      }
    }
  ],

Action response event

{
"event_type": [
    "endpoint_response_action_status_change_event"
  ],
  "properties": [
    {
      "responseActions": {
        "actionId": "696608a5-1908-457d-9072-5f555c740ffc",
        "agentType": "sentinel_one",
        "actionStatus": "successful",
        "command": "unisolate",
      }
    }
  ],
}

Action creation error event

"event_type": [
    "endpoint_response_action_sent_error"
  ],
  "properties": [
    {
      "responseActions": {
        "command": "execute",
        "error": "error message",
        "agentType": "endpoint"
      }
    }
  ],

Note: This PR does not add response completion telemetry for endpoint agent type. There would be follow up PRs to add that and some usage/snapshot telemetry.

Checklist

• Unit or functional tests were updated or added to match the most common scenarios
• Flaky Test Runner was used on any tests changed
• If a plugin configuration key changed, check if it needs to be allow-listed in the cloud and added to the docker list

[ashokaditya]

/ci

[elasticmachine]

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

[paul-tavares]

👍

[paul-tavares]

👍

[paul-tavares]

Maybe in a follow up PR - perhaps the checks for the feature flag should be moved to the actual methods (sendActionCreationTelemetry(), sendActionCreationErrorTelemetry(), etc.) instead of having to sprinkle them through out the code. Doing so would also protect if the methods are called from other areas without first having done the check on the feature flag. Something for you to consider 😄

[ashokaditya]

Yeah, I thought about that too. I can just make that change in this PR.

[ashokaditya]

done 6fc895f

[ashokaditya]

LGTM 👍 Good to see some data finally :)

Are you planning to add snapshot telemetry regarding actions too?

Yes, those will follow.

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 3b5711c

Failed CI Steps

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	20.5MB	20.5MB	-2.7KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	87.2KB	87.2KB	+35.0B

History

• 💛 Build #237505 was flaky 6fc895f
• 💛 Build #237463 was flaky 9cbbbb7
• 💚 Build #237403 succeeded 9a49b94
• 💛 Build #237069 was flaky 1b5dfab
• 💛 Build #236865 was flaky fb2de6f
• 💛 Build #236565 was flaky 484a6b4

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @ashokaditya

[kibanamachine]

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/11066915521

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation