[9.0] [Security Solution] Send EBT when diagnostic query is empty (#238040) (#238080)

kibanamachine · szaffarano · elasticmachine · web-flow · commit e14423707381 · 2025-10-09T11:47:57.000+02:00
# Backport This will backport the following commits from `main` to `9.0`: - [[Security Solution] Send EBT when diagnostic query is empty (#238040)](#238040)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Sebastián Zaffarano <sebastian.zaffarano@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_service.test.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_service.test.ts
@@ -266,6 +266,43 @@ describe('Security Solution - Health Diagnostic Queries - HealthDiagnosticServic
         expect(result[0].passed).toBe(true);
         expect(mockLogger.warn).toHaveBeenCalledWith('Error sending EBT', expect.any(Object));
       });
+
+      test('should send EBT events even when query returns no results', async () => {
+        const lastExecutionByQuery = { 'test-query': 1640995200000 };
+        mockQueryExecutor.search.mockReturnValue(from([]));
+
+        const result = await service.runHealthDiagnosticQueries(lastExecutionByQuery);
+
+        expect(result).toHaveLength(1);
+        expect(result[0]).toMatchObject({
+          name: 'test-query',
+          passed: true,
+          numDocs: 0,
+        });
+
+        expect(mockAnalytics.reportEvent).toHaveBeenCalledTimes(2);
+
+        expect(mockAnalytics.reportEvent).toHaveBeenCalledWith(
+          'telemetry_health_diagnostic_query_result_event',
+          expect.objectContaining({
+            name: 'test-query',
+            queryId: 'test-query-1',
+            page: 0,
+            data: [],
+            traceId: expect.any(String),
+          })
+        );
+
+        expect(mockAnalytics.reportEvent).toHaveBeenCalledWith(
+          'telemetry_health_diagnostic_query_stats_event',
+          expect.objectContaining({
+            name: 'test-query',
+            passed: true,
+            numDocs: 0,
+            traceId: expect.any(String),
+          })
+        );
+      });
     });
   });
 });
diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_service.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_service.ts
@@ -6,7 +6,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { bufferCount, from, mergeMap, take, tap } from 'rxjs';
+import { bufferCount, defaultIfEmpty, from, mergeMap, take, tap } from 'rxjs';
 import { cloneDeep } from 'lodash';
 import type {
   TaskManagerSetupContract,
@@ -127,6 +127,9 @@ export class HealthDiagnosticServiceImpl implements HealthDiagnosticService {
             // publish N documents in the same EBT
             bufferCount(telemetryConfiguration.health_diagnostic_config.query.bufferSize),
 
+            // emit empty array if no items were buffered (ensures EBT is always sent)
+            defaultIfEmpty([]),
+
             // apply filterlist
             mergeMap((result) => from(applyFilterlist(result, query.filterlist, this.salt)))
           )
