x-pack/solutions/security/.agents/skills/entity-store/references/contracts.md
interface EntityStoreSetupContract {
registerEntityMaintainer: (config: RegisterEntityMaintainerConfig) => void;
}
interface EntityStoreStartContract {
createCRUDClient: (
esClient: ElasticsearchClient,
namespace: string,
getWorkflowsClient?: () => Promise<{
emitEvent: (triggerId: string, payload: Record<string, unknown>) => Promise<void>;
}>
) => EntityStoreCRUDClient; // Exposes create + update only
createResolutionClient: (esClient: ElasticsearchClient, namespace: string) => ResolutionClient;
}
All route handlers receive this context (from server/types.ts):
interface EntityStoreApiRequestHandlerContext {
core: CoreRequestHandlerContext;
logger: Logger;
assetManagerClient: AssetManagerClient; // Engine lifecycle
entityMaintainersClient: EntityMaintainersClient; // Maintainer management
crudClient: CRUDClient; // Entity CRUD operations
resolutionClient: ResolutionClient; // Link/unlink/group
ccsLogsExtractionClient: CcsLogsExtractionClient; // Cross-cluster extraction
logsExtractionClient: LogsExtractionClient; // Standard logs extraction
historySnapshotClient: HistorySnapshotClient; // History snapshots
featureFlags: FeatureFlags;
security: SecurityPluginStart;
namespace: string;
}
.entities.v2.latest.security_{namespace} (single-shard, mode: 'lookup').entities.v2.updates.security_{namespace} (data stream)entity.source — array of strings. Priority cascade: event.module > event.dataset > data_stream.datasetentity.namespace — from event.module (e.g., 'okta', 'active_directory', 'local')entity.EngineMetadata.Type — entity type discriminator on shared indexentity.relationships.resolution.resolved_to — alias target (resolution)entity.relationships.resolution.risk.* — aggregated risk on target entity