[Security Solutions] Updates usage collector telemetry to use PIT (Point in Time) and restructuring of folders

x-pack/plugins/security_solution/server/plugin.ts

@@ -168,10 +168,10 @@ export class Plugin implements ISecuritySolutionPlugin {
 
     initUsageCollectors({
       core,
-      kibanaIndex: core.savedObjects.getKibanaIndex(),
       signalsIndex: DEFAULT_ALERTS_INDEX,
       ml: plugins.ml,
       usageCollection: plugins.usageCollection,
+      logger,
     });
 
     this.telemetryUsageCounter = plugins.usageCollection?.createUsageCounter(APP_ID);

x-pack/plugins/security_solution/server/usage/collector.ts

@@ -5,38 +5,26 @@
  * 2.0.
  */
 
-import { CoreSetup, SavedObjectsClientContract } from '../../../../../src/core/server';
-import { CollectorFetchContext } from '../../../../../src/plugins/usage_collection/server';
-import { CollectorDependencies } from './types';
-import { fetchDetectionsMetrics } from './detections';
-import { SAVED_OBJECT_TYPES } from '../../../cases/common/constants';
-// eslint-disable-next-line no-restricted-imports
-import { legacyRuleActionsSavedObjectType } from '../lib/detection_engine/rule_actions/legacy_saved_object_mappings';
+import type { CollectorFetchContext } from '../../../../../src/plugins/usage_collection/server';
+import type { CollectorDependencies } from './types';
+import { getDetectionsMetrics } from './detections/get_metrics';
+import { getInternalSavedObjectsClient } from './get_internal_saved_objects_client';
 
 export type RegisterCollector = (deps: CollectorDependencies) => void;
+
 export interface UsageData {
   detectionMetrics: {};
 }
 
-export async function getInternalSavedObjectsClient(core: CoreSetup) {
-  return core.getStartServices().then(async ([coreStart]) => {
-    // note: we include the "cases" and "alert" hidden types here otherwise we would not be able to query them. If at some point cases and alert is not considered a hidden type this can be removed
-    return coreStart.savedObjects.createInternalRepository([
-      'alert',
-      legacyRuleActionsSavedObjectType,
-      ...SAVED_OBJECT_TYPES,
-    ]);
-  });
-}
-
 export const registerCollector: RegisterCollector = ({
   core,
-  kibanaIndex,
   signalsIndex,
   ml,
   usageCollection,
+  logger,
 }) => {
   if (!usageCollection) {
+    logger.debug('Usage collection is undefined, therefore returning early without registering it');
     return;
   }
 
@@ -525,12 +513,16 @@ export const registerCollector: RegisterCollector = ({
     },
     isReady: () => true,
     fetch: async ({ esClient }: CollectorFetchContext): Promise<UsageData> => {
-      const internalSavedObjectsClient = await getInternalSavedObjectsClient(core);
-      const soClient = internalSavedObjectsClient as unknown as SavedObjectsClientContract;
-
+      const savedObjectsClient = await getInternalSavedObjectsClient(core);
+      const detectionMetrics = await getDetectionsMetrics({
+        signalsIndex,
+        esClient,
+        savedObjectsClient,
+        logger,
+        mlClient: ml,
+      });
       return {
-        detectionMetrics:
-          (await fetchDetectionsMetrics(kibanaIndex, signalsIndex, esClient, soClient, ml)) || {},
+        detectionMetrics: detectionMetrics || {},
       };
     },
   });

x-pack/plugins/security_solution/server/usage/constants.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/**
+ * We limit the max results window to prevent in-memory from blowing up when we do correlation.
+ * This is limiting us to 10,000 cases and 10,000 elastic detection rules to do telemetry and correlation
+ * and the choice was based on the initial "index.max_result_window" before this turned into a PIT (Point In Time)
+ * implementation.
+ *
+ * This number could be changed, and the implementation details of how we correlate could change as well (maybe)
+ * to avoid pulling 10,000 worth of cases and elastic rules into memory.
+ *
+ * However, for now, we are keeping this maximum as the original and the in-memory implementation
+ */
+export const MAX_RESULTS_WINDOW = 10_000;
+
+/**
+ * We choose our max per page based on 1k as that
+ * appears to be what others are choosing here in the other sections of telemetry:
+ * https://github.com/elastic/kibana/pull/99031
+ */
+export const MAX_PER_PAGE = 1_000;