From 8c4837f277e0f5471db3b751c62c65189616a58c Mon Sep 17 00:00:00 2001
From: Mark Hopkin <mark.hopkin@elastic.co>
Date: Thu, 24 Oct 2024 17:05:09 +0100
Subject: [PATCH] [Entity Store] Bugfix: Double nested arrays (#197589)

## Summary

Entities were appearing in the entity store with double nested arrays
like below.

The issue was that the arrays changed from `List` to `Set` type and the
code only checked for lists. Using `Collection` has fixed this.

```
        "_index": ".entities.v1.latest.security_host_default",
        "_id": "c03w7AZsMkm_obWF2HZEirgAAAAAAAAA",
        "_score": 1,
        "_source": {
          "host": {
            "hostname": [
              [
                "small-host-1.example.small.com"
              ]
            ],
            "domain": [
              [
                "example.small.com"
              ]
            ],
            "ip": [
              [
                "192.168.1.1",
                "192.168.1.0",
                "192.168.1.3",
                "192.168.1.2",
                "192.168.1.9",
                "192.168.1.8",
                "192.168.1.5",
                "192.168.1.4",
                "192.168.1.7",
                "192.168.1.6"
              ]
            ],
            ```

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 855456b3bf26204c9a32008a1bc538d9c63b5190)
---
 .../entity_analytics/entity_store/entity_store_data_client.ts   | 2 +-
 .../entity_store/field_retention_definition/collect_values.ts   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.ts
index 90ed3fee561a3..001fe181185b7 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.ts
@@ -153,7 +153,7 @@ export class EntityStoreDataClient {
       filter,
       pipelineDebugMode
     ).catch((error) => {
-      logger.error('There was an error during async setup of the Entity Store', error);
+      logger.error(`There was an error during async setup of the Entity Store: ${error}`);
     });
 
     return descriptor;
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/field_retention_definition/collect_values.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/field_retention_definition/collect_values.ts
index 3241b1dce29fa..ee26c0dbd64c8 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/field_retention_definition/collect_values.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/field_retention_definition/collect_values.ts
@@ -30,7 +30,7 @@ export const collectValuesProcessor: FieldRetentionOperatorBuilder<CollectValues
   Set uniqueVals = new HashSet();
   
   if (!(${isFieldMissingOrEmpty(ctxField)})) {
-    if(${ctxField} instanceof List) {
+    if(${ctxField} instanceof Collection) {
       uniqueVals.addAll(${ctxField});
     } else {
       uniqueVals.add(${ctxField});