[Fleet] Return audit unenroll reason (#205542)

## Summary

Closes #194884 

Returns the `audit_unenrolled_reason` in the response body when getting
agents within Kibana


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

### Identify risks

N/A

---------

Co-authored-by: Elastic Machine <[email protected]>
Co-authored-by: kibanamachine <[email protected]>

Author: 3 people

oas_docs/bundle.json

@@ -15715,6 +15715,9 @@
                             ],
                             "type": "object"
                           },
+                          "audit_unenrolled_reason": {
+                            "type": "string"
+                          },
                           "components": {
                             "items": {
                               "additionalProperties": false,
@@ -17725,6 +17728,9 @@
                           ],
                           "type": "object"
                         },
+                        "audit_unenrolled_reason": {
+                          "type": "string"
+                        },
                         "components": {
                           "items": {
                             "additionalProperties": false,
@@ -18202,6 +18208,9 @@
                           ],
                           "type": "object"
                         },
+                        "audit_unenrolled_reason": {
+                          "type": "string"
+                        },
                         "components": {
                           "items": {
                             "additionalProperties": false,

oas_docs/bundle.serverless.json

@@ -15715,6 +15715,9 @@
                             ],
                             "type": "object"
                           },
+                          "audit_unenrolled_reason": {
+                            "type": "string"
+                          },
                           "components": {
                             "items": {
                               "additionalProperties": false,
@@ -17725,6 +17728,9 @@
                           ],
                           "type": "object"
                         },
+                        "audit_unenrolled_reason": {
+                          "type": "string"
+                        },
                         "components": {
                           "items": {
                             "additionalProperties": false,
@@ -18202,6 +18208,9 @@
                           ],
                           "type": "object"
                         },
+                        "audit_unenrolled_reason": {
+                          "type": "string"
+                        },
                         "components": {
                           "items": {
                             "additionalProperties": false,

oas_docs/output/kibana.serverless.yaml

@@ -16084,6 +16084,8 @@ paths:
                           required:
                             - id
                             - version
+                        audit_unenrolled_reason:
+                          type: string
                         components:
                           items:
                             additionalProperties: false
@@ -16529,6 +16531,8 @@ paths:
                         required:
                           - id
                           - version
+                      audit_unenrolled_reason:
+                        type: string
                       components:
                         items:
                           additionalProperties: false
@@ -16866,6 +16870,8 @@ paths:
                         required:
                           - id
                           - version
+                      audit_unenrolled_reason:
+                        type: string
                       components:
                         items:
                           additionalProperties: false

oas_docs/output/kibana.yaml

@@ -18213,6 +18213,8 @@ paths:
                           required:
                             - id
                             - version
+                        audit_unenrolled_reason:
+                          type: string
                         components:
                           items:
                             additionalProperties: false
@@ -18655,6 +18657,8 @@ paths:
                         required:
                           - id
                           - version
+                      audit_unenrolled_reason:
+                        type: string
                       components:
                         items:
                           additionalProperties: false
@@ -18991,6 +18995,8 @@ paths:
                         required:
                           - id
                           - version
+                      audit_unenrolled_reason:
+                        type: string
                       components:
                         items:
                           additionalProperties: false

x-pack/platform/plugins/shared/fleet/common/types/models/agent.ts

@@ -92,6 +92,7 @@ interface AgentBase {
   enrolled_at: string;
   unenrolled_at?: string;
   unenrollment_started_at?: string;
+  audit_unenrolled_reason?: string;
   upgraded_at?: string | null;
   upgrade_started_at?: string | null;
   upgrade_details?: AgentUpgradeDetails;
@@ -255,6 +256,10 @@ export interface FleetServerAgent {
   /**
    * Date/time the Elastic Agent was last upgraded
    */
+  audit_unenrolled_reason?: string;
+  /**
+   * Reason for agent unenrollment
+   */
   upgraded_at?: string | null;
   /**
    * Date/time the Elastic Agent started the current upgrade

x-pack/platform/plugins/shared/fleet/server/services/agents/crud.ts

@@ -112,7 +112,6 @@ export async function getAgents(
   } else {
     throw new FleetError('Either options.agentIds or options.kuery are required to get agents');
   }
-
   return agents;
 }
 
@@ -490,7 +489,6 @@ async function _filterAgents(
     appContextService.getLogger().error(`Error querying agents: ${JSON.stringify(err)}`);
     throw err;
   }
-
   const agents = res.hits.hits.map(searchHitToAgent);
   const total = res.hits.total as number;
 

x-pack/platform/plugins/shared/fleet/server/services/agents/helpers.ts

@@ -65,6 +65,7 @@ export function searchHitToAgent(
     enrolled_at: hit._source?.enrolled_at!,
     unenrolled_at: hit._source?.unenrolled_at!,
     unenrollment_started_at: hit._source?.unenrollment_started_at,
+    audit_unenrolled_reason: hit._source?.audit_unenrolled_reason!,
     upgraded_at: hit._source?.upgraded_at,
     upgrade_started_at: hit._source?.upgrade_started_at,
     upgrade_details: hit._source?.upgrade_details,
@@ -106,7 +107,6 @@ export function searchHitToAgent(
   } else {
     agent.status = hit.fields.status[0];
   }
-
   return agent;
 }
 

x-pack/platform/plugins/shared/fleet/server/types/rest_spec/agent.ts

@@ -135,6 +135,7 @@ export const AgentResponseSchema = schema.object({
   enrolled_at: schema.string(),
   unenrolled_at: schema.maybe(schema.string()),
   unenrollment_started_at: schema.maybe(schema.string()),
+  audit_unenrolled_reason: schema.maybe(schema.string()),
   upgraded_at: schema.maybe(schema.oneOf([schema.literal(null), schema.string()])),
   upgrade_started_at: schema.maybe(schema.oneOf([schema.literal(null), schema.string()])),
   upgrade_details: schema.maybe(