[Security Solution] [Bug] Enabling Entity Store shows An error occurred during entity store resource initialization in second space if user re-create the space with same name again.

[arvindersingh-qasource]

Describe the bug
Enabling Entity Store shows An error occurred during entity store resource initialization in second space if user re-create the space with same name again.

Kibana/Elasticsearch Stack version

VERSION: 8.18.0
BUILD: 82852
COMMIT: dae17b1f42873e0b3a53fbe6bf3482fc891800db

Pre Conditions

1. Kibana v8.18.0 must be available.
2. Second Space must be available. ( here - Sandbox )

Steps

1. Login with user in Second Space. ( here - Sandbox )
2. Navigate to Management -> Stack Management -> Entity Store
3. Enable Entity Store.
4. Observe that Entity Store will be enabled successfully.
5. Navigate to Manage Spaces.
6. Switch to Default Space.
7. Now from Manage Space, delete the Second Space in which Entity Store was enabled earlier. ( here - Sandbox )
8. Now click on Create Space button.
9. Enter the Space name same as for earlier deleted spaces. ( here - Sandbox )
10. Switch to newly created Space. ( here - Sandbox )
11. Navigate to Management -> Stack Management -> Entity Store
12. Enable Entity Store.
13. Observe that there will be error shown as An error occurred during entity store resource initialization.

Expected Result
User should be able to enable Entity Store again in second space when the space is created with same name as it was for earlier deleted space having entity store enabled.

Screen Recording

Spaces.-.Elastic.-.Google.Chrome.2025-03-27.17-23-37.mp4

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[arvindersingh-qasource]

@muskangulati-qasource Please review this ticket .

Thanks.

[elasticmachine]

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

[muskangulati-qasource]

Reviewed and assigned to @jaredburgettelastic
cc: @abhishekbhatia1710

[abhishekbhatia1710]

Hi,

This error seems to be related to transforms, indicating that a transform with the same name already exists.

When a space is deleted, its associated transforms are not removed because spaces in Kibana are a UI-level abstraction and do not directly manage ES resources like transforms or even ingest pipelines. Deleting a space deletes only the associated saved objects.

I believe to properly clean up ES resources, users should first use the "Clear Entity Data" button at the top of the Entity Store page before deleting the space. This ensures that related ES resources are handled along with the Entity Store data.

Could you try the following steps and check if the issue persists?

1. Create a new space.
2. Enable the Entity Store in the new space.
3. Go to Stack Management -> Transforms.
4. Search for the space name in the search box.
5. You should see transforms for the Entity Store, such as entities-v1-latest-security_<host|user|service>_<space_name>.
6. Delete the Entity Store data from the Entity Store page by clicking on "Clear Entity Data".
7. The transforms that were previously visible under Stack Management -> Transforms should no longer be present.
8. Now, delete the space.
9. Recreate the same space.
10. Enable the Entity Store again.
11. It should now be enabled successfully.

[arvindersingh-qasource]

Hey @abhishekbhatia1710

Thanks for the workaround steps.

We have performed the same and we were able to enable the Entity Store using the mentioned steps. However, we have some queries related to the mentioned scenario.

Observations

Query

• Query 1 : When we delete any space the user prompt says This space and all contents will be permanently deleted. You can't recover deleted spaces. so as per the message in modal, while deleting any space, all the contents of the space should be deleted permanently and if it is saying You can't recover deleted spaces. so creating a Space with same name again should NOT recover any older data.

Please let us know if anything else is required from our end.

Thanks.

[jaredburgettelastic]

@arvindersingh-qasource Agreed, I think this is indeed a bug (thank you @abhishekbhatia1710 for the workaround! 🚀 )

I'm discussing with Rules Management/Detection team how we can solve this problem across Security, as we'll need a way to hook into the "Delete Space" API in order to delete our additional resources. Stay tuned!

For now, I'm reducing the impact to "medium" (as there is a workaround), and removing triage_needed