Opened from failing KB functional tests in test/functional/kb/definitions/. Some feature routes exist but require a one-time runtime API call before the tests hit them. No docker env flag creates this state, so the ops fail (streams 422, entity store 400 "install first", risk engine 404/400).
After the existing Kibana readiness gate in .buildkite/run-kb-tests-runner.sh, add idempotent provisioning curls (ignore "already enabled"):
- Wired streams (422):
POST /api/streams/_enable
- Entity Store (400):
POST /api/security/entity_store/install
- Risk engine (404/400): risk-engine init/enable call
Note: Entity Store V2 currently disables the legacy risk API; confirm which surface the definitions target before enabling. Verify each provisioning call returns 2xx, then unskip the dependent generated scripts incrementally.
Failing test definitions:
Wired streams (422, stack + serverless):
streams_delete_streams_name.yml
streams_delete_streams_streamname_attachments_attachmenttype_attachmentid.yml
streams_get_streams_name.yml
streams_get_streams_name_ingest.yml
streams_get_streams_name_query.yml
streams_get_streams_streamname_attachments.yml
streams_post_streams_name_content_export.yml
streams_post_streams_name_content_import.yml
streams_post_streams_name_fork.yml
streams_post_streams_streamname_attachments_bulk.yml
streams_put_streams_name.yml
streams_put_streams_name_ingest.yml
streams_put_streams_name_query.yml
streams_put_streams_streamname_attachments_attachmenttype_attachmentid.yml
Entity Store not installed (400, stack + serverless):
security_entity_store_delete_security_entity_store_entities.yml
security_entity_store_get_security_entity_store_resolution_group.yml
security_entity_store_post_security_entity_store_entities_entitytype.yml
security_entity_store_post_security_entity_store_resolution_link.yml
security_entity_store_post_security_entity_store_resolution_unlink.yml
security_entity_store_put_security_entity_store.yml
security_entity_store_put_security_entity_store_entities_bulk.yml
security_entity_store_put_security_entity_store_entities_entitytype.yml
Risk engine unavailable (404/400, stack):
security_entity_analytics_api_clean_up_risk_engine.yml
security_entity_analytics_api_configure_risk_engine_saved_object.yml
security_entity_analytics_api_schedule_risk_engine_now.yml
Opened from failing KB functional tests in
test/functional/kb/definitions/. Some feature routes exist but require a one-time runtime API call before the tests hit them. Nodockerenv flag creates this state, so the ops fail (streams 422, entity store 400 "install first", risk engine 404/400).After the existing Kibana readiness gate in
.buildkite/run-kb-tests-runner.sh, add idempotent provisioningcurls (ignore "already enabled"):POST /api/streams/_enablePOST /api/security/entity_store/installNote: Entity Store V2 currently disables the legacy risk API; confirm which surface the definitions target before enabling. Verify each provisioning call returns 2xx, then unskip the dependent generated scripts incrementally.
Failing test definitions:
Wired streams (422, stack + serverless):
streams_delete_streams_name.ymlstreams_delete_streams_streamname_attachments_attachmenttype_attachmentid.ymlstreams_get_streams_name.ymlstreams_get_streams_name_ingest.ymlstreams_get_streams_name_query.ymlstreams_get_streams_streamname_attachments.ymlstreams_post_streams_name_content_export.ymlstreams_post_streams_name_content_import.ymlstreams_post_streams_name_fork.ymlstreams_post_streams_streamname_attachments_bulk.ymlstreams_put_streams_name.ymlstreams_put_streams_name_ingest.ymlstreams_put_streams_name_query.ymlstreams_put_streams_streamname_attachments_attachmenttype_attachmentid.ymlEntity Store not installed (400, stack + serverless):
security_entity_store_delete_security_entity_store_entities.ymlsecurity_entity_store_get_security_entity_store_resolution_group.ymlsecurity_entity_store_post_security_entity_store_entities_entitytype.ymlsecurity_entity_store_post_security_entity_store_resolution_link.ymlsecurity_entity_store_post_security_entity_store_resolution_unlink.ymlsecurity_entity_store_put_security_entity_store.ymlsecurity_entity_store_put_security_entity_store_entities_bulk.ymlsecurity_entity_store_put_security_entity_store_entities_entitytype.ymlRisk engine unavailable (404/400, stack):
security_entity_analytics_api_clean_up_risk_engine.ymlsecurity_entity_analytics_api_configure_risk_engine_saved_object.ymlsecurity_entity_analytics_api_schedule_risk_engine_now.yml