Module profiles 

Username-to-profile-uid resolution for alert (and, in 0.4.1, case) assignment.

The assignees routes take user profile uids, and a uid exists only after its user has activated a profile by logging into Kibana at least once. Resolution is flavor-dependent (triage spec section 7): Hosted and self-managed use the public suggest API; Serverless answers 410 there, so it uses the Security solution’s own internal suggestion route — the one the assignee picker in the UI calls.

Structs

UserProfile

Constants

PUBLIC_SUGGEST_PATH

UID_PREFIX

Prefix that bypasses resolution: uid:<profile_uid> is passed through. The escape hatch, not the primary interface.

Functions

decode_internal

Decode GET /internal/detection_engine/users/_find: a bare array.

decode_public

Decode POST /_security/profile/_suggest: {total, took, profiles: [...]}.

internal_find_path

pick_exact

Match the suggestion list exactly on user.username, mirroring rule-name resolution: never a prefix, never a silent first pick.

resolve_assignee

Resolve an assignee argument to a profile uid. uid:<uid> bypasses resolution entirely; anything else is a username resolved per flavor.

suggest

Suggest activated profiles matching name, on the route this flavor serves.