Added mapping for actor and target entity id, related.entity

[kfirpeled]

Summary

resolve #221036

Adds new fields mapping: actor.entity.id, target.entity.id, related.entity of type keyword to the security's alert index.
These fields are necessary for querying the alerts index as part of the graph feature (#221037).

related.entity is currently waiting for ECS approval - elastic/ecs#2360
actor.entity.id, target.entity.id are added only to security's alerts

How this PR effects:

• Allows the user filter by actor.entity.id, target.entity.id, related.entity

Video 🎥

**Before:**

Screen.Recording.2025-06-18.at.19.19.18.mov

After:

Screen.Recording.2025-06-18.at.19.21.51.mov

Besides the immediate effect of the ability to fetch data using these fields, this PR is a requirement to move forward with upcoming features like: #224783

Example video of upcoming use 🎥

Screen.Recording.2025-06-29.at.19.42.23.mov

How to test locally

1. Start elasticsearch and kibana locally
2. To add mock data run the following:

node scripts/es_archiver load x-pack/solutions/security/test/cloud_security_posture_functional/es_archives/logs_gcp_audit \
 --es-url http://elastic:changeme@localhost:9200 \
 --kibana-url http://elastic:changeme@localhost:5601

node scripts/es_archiver load x-pack/solutions/security/test/cloud_security_posture_functional/es_archives/security_alerts \
 --es-url http://elastic:changeme@localhost:9200 \
 --kibana-url http://elastic:changeme@localhost:5601

3. Open Alerts page in kibana. Update the date-picker to include data from a year ago. Then check one of the alerts details opening the right-side flyout and find the "Graph preview" section in it.
4. Filter by one of these fields

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

Identify risks

• In case the new mapping is not applied on existing documents, it means they won't be retrieved using the new fields

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

[kfirpeled]

Is that correct to import from 8.19? or should I've imported from earlier release?

[denar50]

I think this is fine, given that the new mappings are always based on those of the previous release.

[ymao1]

response ops changes lgtm

[denar50]

LGTM! I have ran the PR locally and tested that indeed I am able to filter by the added fields following the instructions provided.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 1e689a8

Metrics [docs]

✅ unchanged

History

• 💛 Build #313793 was flaky 091b849
• 💚 Build #313146 succeeded 106635f
• 💔 Build #312692 failed 74420bf
• 💔 Build #312613 failed 21cc8f2
• 💚 Build #311150 succeeded ae8ff27
• 💚 Build #310608 succeeded 318db3a

[elasticmachine]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!