Pin individual entities in graph by albertoblaz · Pull Request #251299 · elastic/kibana

albertoblaz · 2026-02-02T17:32:46Z

Summary

Part of the fixes needed to close #239954

PRs:

API allows for pinning events/alerts by document ID but we don't have a proper way to represent that in the UI so we're skipping for now

Screenshots

Pinning no entities from the group

Pinning "admin2@example.com" entity

Pinning "admin2@example.com" and "admin-user2@example.com" entities

Pinning all entities in actor node

pinnedIds field sent in the request payload

How to test

Deploy a local env using the following command:
yarn es snapshot --license trial -E xpack.security.authc.api_key.enabled=true
Run kibana using yarn start --no-base-path
Go to Advanced settings and make sure these toggles are on:
- securitySolution:enableGraphVisualization
- securitySolution:enableAssetInventory

Run these commands:

node scripts/es_archiver load x-pack/solutions/security/test/cloud_security_posture_functional/es_archives/logs_gcp_audit --es-url http://elastic:changeme@localhost:9200 --kibana-url http://elastic:changeme@localhost:5601

node scripts/es_archiver load x-pack/solutions/security/test/cloud_security_posture_functional/es_archives/security_alerts_modified_mappings --es-url http://elastic:changeme@localhost:9200 --kibana-url http://elastic:changeme@localhost:5601

node scripts/es_archiver load x-pack/solutions/security/test/cloud_security_posture_functional/es_archives/entity_store --es-url http://elastic:changeme@localhost:9200 --kibana-url http://elastic:changeme@localhost:5601

node scripts/es_archiver load x-pack/solutions/security/test/cloud_security_posture_functional/es_archives/entity_store_v2 --es-url http://elastic:changeme@localhost:9200 --kibana-url http://elastic:changeme@localhost:5601

Go to Security -> Explore -> Network/Users/Hosts
Open an event's flyout, then expand Graph Visualization. Apply filters to see events from September, 1st 2017 till Now. Add an event.action filter set to "google.iam.admin.v1.CreateUser", then keep adding user.entity.id or event.id filters set to the IDs in the entity node using the OR operator
Individual entities/events/alerts should be pinned correctly in the graph, outside the entity/label groups

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

Identify risks

elasticmachine · 2026-02-03T09:19:38Z

Pinging @elastic/contextual-security-apps (Team:Cloud Security)

x-pack/solutions/security/packages/kbn-cloud-security-posture/common/schema/graph/v1.ts

kfirpeled · 2026-02-03T09:34:37Z

x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/fetch_graph.ts

+      .join(', ')}), targetEntityId,
+    null
+  )`
+      : '| EVAL pinned = TO_STRING(null)';


why TO_STRING?

x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/fetch_graph.ts

x-pack/solutions/security/packages/kbn-cloud-security-posture/common/schema/graph/v1.ts

albertoblaz · 2026-02-04T08:54:33Z

.../kbn-cloud-security-posture/graph/src/components/graph_investigation/graph_investigation.tsx

+      return getFilterValues(searchFilters, [
+        EVENT_ID,
+        ...GRAPH_ACTOR_ENTITY_FIELDS,
+        ...GRAPH_TARGET_ENTITY_FIELDS,
+      ]).map(String);


Reads all kinds of entity IDs from applied filters (user.entity.id, service.target.entity.id, ...). Reads also from event.id, though we might read from _id instead. @kfirpeled WDYT?

Changed to _id

It is a nice workaround, but it is a workaround.
Eventually, we wish to manage state of list of nodes that are pinned

Since we don't have design yet for pinning an event. From your work here, I assume that if we had the ability to pin an event/alert we will add a filter of _id: eventDocId/alertDocId

That filter is really adds anything to the graph, except for pinning the node. So that's why it is a workaround for a missing pinning capability.

Just be aware that we haven't discussed it yet, to add a filter in order to pin a node. While it is true for actors and targets, it is not true for alert and event.

We previously did it for POC purposes, but it wasn't a requirement

x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/types.ts

x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/fetch_graph.ts

alexreal1314 · 2026-02-09T16:26:33Z

x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/v1.ts

  };
  showUnknownTarget: boolean;
  nodesLimit?: number;
+  pinnedIds?: string[];


@albertoblaz I assume we are also going to use this feature when showing the graph in the entities flyout - in that case how would we know if we should pass the pinnedIds param to the fetch events query or the fetch entities query?
In order to solve it need to we could make the pinnedIds param an array of objects:

Suggested change

pinnedIds?: string[];

pinnedIds?: Array<{ id: string; type: 'event' | 'alert' | 'entity' }>

then we can filter the pinnedIds array for relevant types before calling fetch events or fetch entities and we also have an explicit context - each id is tagged with its type, so there’s no ambiguity.

I don't see that necessary unless I'm missing something.

The current implementation is intentionally type-agnostic. If you check the ESQL query, when one of the IDs in pinnedIds matches an existing _id in our data, we return it. And for entities, we try to match each ID with every possible entity ID (user.entity.id, user.target.entity.id, service.entity.id, etc). IDs in our backend are inherently distinct so we can't have collisions across data types.

So I'd say in the entities flyout, it's the client's responsibility to pass entities-only when fetching entities and events-only when fetching events. And the backend will handle the filtering implicitly. Adding type metadata is unnecessary and makes the API schema more verbose without a clear benefit since the current approach already handles the separation correctly and allows for more data types without adding a new domain-related field i.e. pinnedRelationships.

But if I misunderstood you or you still think there's an edge case we're not covering here, please let me know and I'll update the code

I agree with @albertoblaz for now, in case it is not necessary yet. we can leave it as is.
Worst case scenario, we can introduce a breaking change to the API and increase the API version.

@alexreal1314 as we discussed in the sync, if you see it fit. you can change it later on

...ckages/kbn-cloud-security-posture/graph/src/components/graph_investigation/search_filters.ts

kfirpeled

Rejecting fast: I expect to see API tests

Specifically, how it handles pinning entities. To verify if the event is not being duplicated.

UPDATE:
Looking at the second example you've attached, it seems to me it duplicates nodes like target and dedup the event action.

However, I'd expect to see only the actor being extracted. And the events should be grouped to 6.
Can you elaborate on the product/user experience reasons you chose to implement it this way?

x-pack/solutions/security/packages/kbn-cloud-security-posture/common/schema/graph/v1.ts

kfirpeled · 2026-02-11T10:41:04Z

.../kbn-cloud-security-posture/graph/src/components/graph_investigation/graph_investigation.tsx

+      return getFilterValues(searchFilters, [
+        EVENT_ID,
+        ...GRAPH_ACTOR_ENTITY_FIELDS,
+        ...GRAPH_TARGET_ENTITY_FIELDS,
+      ]).map(String);


It is a nice workaround, but it is a workaround.
Eventually, we wish to manage state of list of nodes that are pinned

Since we don't have design yet for pinning an event. From your work here, I assume that if we had the ability to pin an event/alert we will add a filter of _id: eventDocId/alertDocId

That filter is really adds anything to the graph, except for pinning the node. So that's why it is a workaround for a missing pinning capability.

Just be aware that we haven't discussed it yet, to add a filter in order to pin a node. While it is true for actors and targets, it is not true for alert and event.

We previously did it for POC purposes, but it wasn't a requirement

kfirpeled · 2026-02-11T11:08:00Z

...ck/solutions/security/plugins/cloud_security_posture/server/routes/graph/utils/esql.utils.ts

+
+  const pinnedParamsStr = pinnedIds.map((_id, idx) => `?pinned_id${idx}`).join(', ');
+
+  return `| EVAL pinned = CASE(


kfirpeled · 2026-02-11T11:10:52Z

...ck/solutions/security/plugins/cloud_security_posture/server/routes/graph/utils/esql.utils.ts

+ * @param pinnedIds - Array of IDs to check against (document _id, entity IDs)
+ * @returns ESQL statement string
+ */
+export const buildPinnedEsql = (pinnedIds?: string[]): string => {


nit: not sure if I'd place this function under esql_utils.ts
as it is not a repeated logic, there's no need to place it here and export it.

we should look at esql_utils.ts as a utility function that can be used by others
examples like: building json's string, lookup join with entity store. Are good examples that can be re-used by others.

My point was not to pollute the main file and split it in smaller functions. But moved it back to fetch_graph.ts

kfirpeled · 2026-02-11T11:11:14Z

...ck/solutions/security/plugins/cloud_security_posture/server/routes/graph/fetch_graph.test.ts

    });
  });
+
+  describe('Pinned IDs', () => {


x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/fetch_graph.ts

This reverts commit 506c58c.

kibanamachine · 2026-02-12T09:47:00Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#10725

[✅] x-pack/solutions/security/test/cloud_security_posture_api/config.ts: 25/25 tests passed.

see run history

kfirpeled

LGTM, @albertoblaz please check if you can find a good way to pin only a specific entity without its entire sub-graph

x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/fetch_graph.ts

kfirpeled · 2026-02-15T12:18:30Z

x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/v1.ts

  };
  showUnknownTarget: boolean;
  nodesLimit?: number;
+  pinnedIds?: string[];


@alexreal1314 as we discussed in the sync, if you see it fit. you can change it later on

x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/fetch_graph.ts

albertoblaz · 2026-02-18T10:16:41Z

Waiting on #251178 to merge

elasticmachine · 2026-02-19T22:38:22Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 5a4f749
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-251299-5a4f749174c6

Failed CI Steps

FTR Configs #152

Test Failures

[job] [logs] FTR Configs #152 / discover/ccs_compatible discover search CCS cancel classic mode should show warning and results

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	11.1MB	11.1MB	+506.0B

History

💔 Build #398052 failed 2f51c5a
💔 Build #398043 failed 90fd0f4
💛 Build #393668 was flaky 00bf4a7
💛 Build #392784 was flaky bf53bcf
💔 Build #391898 failed c15f8ec

cc @albertoblaz

Pin entities

a420be2

albertoblaz self-assigned this Feb 2, 2026

albertoblaz added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Cloud Security Cloud Security team related v9.4.0 labels Feb 2, 2026

albertoblaz mentioned this pull request Feb 2, 2026

Mutate Graph filters from flyout actions #250105

Open

8 tasks

albertoblaz requested review from alexreal1314 and kfirpeled February 2, 2026 18:17

albertoblaz added the ci:build-serverless-image label Feb 2, 2026

albertoblaz marked this pull request as ready for review February 3, 2026 09:19

albertoblaz requested a review from a team as a code owner February 3, 2026 09:19

kfirpeled reviewed Feb 3, 2026

View reviewed changes

x-pack/solutions/security/packages/kbn-cloud-security-posture/common/schema/graph/v1.ts Outdated Show resolved Hide resolved

kfirpeled reviewed Feb 3, 2026

View reviewed changes

github-advanced-security bot found potential problems Feb 3, 2026

View reviewed changes

x-pack/solutions/security/packages/kbn-cloud-security-posture/common/schema/graph/v1.ts Fixed Show fixed Hide fixed

albertoblaz and others added 4 commits February 3, 2026 15:45

Merge branch 'main' into graph-ungroup

3dd196b

Extend API to pin events/alerts

88fb679

Add a max limit to pinnedIds

02d0607

Merge branch 'main' into graph-ungroup

22c50a4

albertoblaz commented Feb 4, 2026

View reviewed changes

albertoblaz and others added 3 commits February 4, 2026 14:04

Encapsulate ESQL helper

9a635bb

Replace event.id with _id

073c9b2

Merge branch 'main' into graph-ungroup

f957495

albertoblaz requested a review from a team February 4, 2026 15:11

Merge branch 'main' into graph-ungroup

c15f8ec

alexreal1314 reviewed Feb 9, 2026

View reviewed changes

albertoblaz and others added 3 commits February 10, 2026 20:46

Merge branch 'main' into graph-ungroup

daaaf90

Refine comment

dc28d49

Set pinnedIds maxSize to GRAPH_NODES_LIMIT

506c58c

Refactor search_filters: get rid of flatten

bf53bcf

albertoblaz commented Feb 10, 2026

View reviewed changes

...ckages/kbn-cloud-security-posture/graph/src/components/graph_investigation/search_filters.ts Outdated Show resolved Hide resolved

kfirpeled requested changes Feb 11, 2026

View reviewed changes

albertoblaz and others added 9 commits February 11, 2026 18:50

Revert "Set pinnedIds maxSize to GRAPH_NODES_LIMIT"

fba883f

This reverts commit 506c58c.

Set API-only limit for pinnedIds

4849924

Pin only filtered actor/target entities, not events

1bd8bc0

Move buildPinnedEsql back to fetch_graph.ts

502894d

Show pinned elements first

104c2f7

Add API tests for pinning

b24b6da

Clean-up previously created spaces

6bb04bc

Merge branch 'main' into graph-ungroup

0550c0b

Delete unused DOC_ID

00bf4a7

albertoblaz requested a review from kfirpeled February 12, 2026 00:02

kfirpeled approved these changes Feb 15, 2026

View reviewed changes

alexreal1314 reviewed Feb 15, 2026

View reviewed changes

x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/fetch_graph.ts Outdated Show resolved Hide resolved

alexreal1314 approved these changes Feb 15, 2026

View reviewed changes

albertoblaz and others added 5 commits February 19, 2026 16:40

Merge remote-tracking branch 'upstream/main' into graph-ungroup

f4af09c

Fix FTR tests flakiness when adding filters

a269bbe

Move pinnedIds inside query field

c7fbe32

Sort events by action, pinning, isOrigin

abe1c09

Merge branch 'main' into graph-ungroup

90fd0f4

albertoblaz enabled auto-merge (squash) February 19, 2026 18:24

albertoblaz and others added 4 commits February 19, 2026 19:47

Fix type issues

652f449

Merge branch 'main' into graph-ungroup

2f51c5a

Fix tests after refactor

e0c0bdd

Merge branch 'main' into graph-ungroup

5a4f749

albertoblaz merged commit 06f92ef into elastic:main Feb 19, 2026
16 checks passed

	pinnedIds?: string[];
	pinnedIds?: Array<{ id: string; type: 'event' \| 'alert' \| 'entity' }>


		const pinnedParamsStr = pinnedIds.map((_id, idx) => `?pinned_id${idx}`).join(', ');

		return `\| EVAL pinned = CASE(

Conversation

albertoblaz commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Screenshots

How to test

Checklist

Identify risks

Uh oh!

elasticmachine commented Feb 3, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kfirpeled left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Feb 12, 2026

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#10725

Uh oh!

kfirpeled left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

albertoblaz commented Feb 18, 2026

Uh oh!

elasticmachine commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Async chunks

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

albertoblaz commented Feb 2, 2026 •

edited

Loading

kfirpeled left a comment •

edited

Loading

elasticmachine commented Feb 19, 2026 •

edited

Loading