Fix user authentication area chart (#146783)

## Summary

Original issue: #131791

Before: No area chart displayed for user authentications:

<img width="1505" alt="Screenshot 2022-12-01 at 13 02 17"
src="https://user-images.githubusercontent.com/6295984/205059727-2be51425-9b61-4595-8ad6-9a80b4a4bea5.png">


<img width="1101" alt="Screenshot 2022-12-01 at 12 55 42"
src="https://user-images.githubusercontent.com/6295984/205058753-1f97cca1-b3b8-4b58-ae8a-9e5ada107e9f.png">

Most of the data of area charts look like:

```
[
        {
          "key_as_string": "2022-12-01T00:00:00.000Z",
          "key": 1669852800000, // x
          "doc_count": 12,
          "count": {
            "value": 0 // y
          }
        }
]
```

but user authentications' data looks like:
```
[
        {
          "key_as_string": "2022-12-01T00:00:00.000Z",
          "key": 1669852800000, // x
          "doc_count": 12,
          "count": {
            "doc_count": 0 // y
          }
        }
]
```
The parser (formatGeneralHistogramData) picked up only count.value and
ignored count.doc_count. Therefore y value for user authentication was
not picked up and no data for rendering the area chart.


After: User authentication area chart should be displayed properly.
<img width="1505" alt="Screenshot 2022-12-01 at 13 07 21"
src="https://user-images.githubusercontent.com/6295984/205060657-a9fbfa42-5ae5-449d-84d5-6df3f97d2464.png">



### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

x-pack/plugins/security_solution/common/search_strategy/common/index.ts

@@ -19,6 +19,23 @@ export type Maybe<T> = T | null;
 
 export type SearchHit = IEsSearchResponse<object>['rawResponse']['hits']['hits'][0];
 
+export interface KpiHistogramData {
+  x?: Maybe<number>;
+  y?: Maybe<number>;
+}
+
+export interface KpiHistogram<T> {
+  key_as_string: string;
+  key: number;
+  doc_count: number;
+  count: T;
+}
+
+export interface KpiGeneralHistogramCount {
+  value?: number;
+  doc_count?: number;
+}
+
 export interface PageInfoPaginated {
   activePage: number;
   fakeTotalCount: number;

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/kpi/common/index.ts

@@ -11,14 +11,3 @@ export interface HostsKpiHistogramData {
   x?: Maybe<number>;
   y?: Maybe<number>;
 }
-
-export interface HostsKpiHistogram<T> {
-  key_as_string: string;
-  key: number;
-  doc_count: number;
-  count: T;
-}
-
-export interface HostsKpiGeneralHistogramCount {
-  value: number;
-}

x-pack/plugins/security_solution/common/search_strategy/security_solution/users/kpi/authentications/index.ts

@@ -6,8 +6,8 @@
  */
 
 import type { IEsSearchResponse } from '@kbn/data-plugin/common';
-import type { Inspect, Maybe } from '../../../../common';
-import type { KpiHistogramData, RequestBasicOptions } from '../../..';
+import type { Inspect, KpiHistogramData, Maybe } from '../../../../common';
+import type { RequestBasicOptions } from '../../..';
 
 export type UsersKpiAuthenticationsRequestOptions = RequestBasicOptions;
 

x-pack/plugins/security_solution/common/search_strategy/security_solution/users/kpi/index.ts

@@ -5,5 +5,4 @@
  * 2.0.
  */
 
-export * from './common';
 export * from './total_users';

x-pack/plugins/security_solution/common/search_strategy/security_solution/users/kpi/total_users/index.ts

@@ -6,9 +6,8 @@
  */
 
 import type { IEsSearchResponse } from '@kbn/data-plugin/common';
-import type { Inspect, Maybe } from '../../../../common';
+import type { Inspect, KpiHistogramData, Maybe } from '../../../../common';
 import type { RequestBasicOptions } from '../../..';
-import type { KpiHistogramData } from '../common';
 
 export type TotalUsersKpiRequestOptions = RequestBasicOptions;
 

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/common/format_general_histogram_data.test.ts

@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { KpiGeneralHistogramCount, KpiHistogram } from '../../../../../common/search_strategy';
+import { formatGeneralHistogramData } from './format_general_histogram_data';
+
+describe('formatGeneralHistogramData', () => {
+  test('Picks up data from count.value', () => {
+    const mockHistogramData = [
+      {
+        key_as_string: '2022-12-01T00:00:00.000Z',
+        key: 1669852800000,
+        doc_count: 4,
+        count: {
+          doc_count: 4,
+        },
+      } as KpiHistogram<KpiGeneralHistogramCount>,
+    ];
+    const result = formatGeneralHistogramData(mockHistogramData);
+
+    expect(result).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "x": 1669852800000,
+          "y": 4,
+        },
+      ]
+    `);
+  });
+
+  test('Picks up data from count.doc_count - userAuthentications', () => {
+    const mockUserAuthentications = [
+      {
+        key_as_string: '2022-12-01T04:00:00.000Z',
+        key: 1669867200000,
+        doc_count: 4,
+        count: {
+          value: 1,
+        },
+      },
+    ];
+    const result = formatGeneralHistogramData(mockUserAuthentications);
+
+    expect(result).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "x": 1669867200000,
+          "y": 1,
+        },
+      ]
+    `);
+  });
+});

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/common/index.ts → x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/common/format_general_histogram_data.ts

@@ -6,17 +6,17 @@
  */
 
 import type {
-  HostsKpiHistogram,
-  HostsKpiGeneralHistogramCount,
-  HostsKpiHistogramData,
-} from '../../../../../../../common/search_strategy';
+  KpiHistogramData,
+  KpiGeneralHistogramCount,
+  KpiHistogram,
+} from '../../../../../common/search_strategy';
 
 export const formatGeneralHistogramData = (
-  data: Array<HostsKpiHistogram<HostsKpiGeneralHistogramCount>>
-): HostsKpiHistogramData[] | null =>
+  data: Array<KpiHistogram<KpiGeneralHistogramCount>>
+): KpiHistogramData[] | null =>
   data && data.length > 0
-    ? data.map<HostsKpiHistogramData>(({ key, count }) => ({
+    ? data.map<KpiHistogramData>(({ key, count }) => ({
         x: key,
-        y: count.value,
+        y: count.doc_count ?? count.value,
       }))
     : null;

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/hosts/index.ts

@@ -16,7 +16,7 @@ import type {
 import { inspectStringifyObject } from '../../../../../../utils/build_query';
 import type { SecuritySolutionFactory } from '../../../types';
 import { buildHostsKpiHostsQuery } from './query.hosts_kpi_hosts.dsl';
-import { formatGeneralHistogramData } from '../common';
+import { formatGeneralHistogramData } from '../../../common/format_general_histogram_data';
 
 export const hostsKpiHosts: SecuritySolutionFactory<HostsKpiQueries.kpiHosts> = {
   buildDsl: (options: HostsKpiHostsRequestOptions) => buildHostsKpiHostsQuery(options),

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/index.ts

@@ -5,6 +5,5 @@
  * 2.0.
  */
 
-export * from './common';
 export * from './hosts';
 export * from './unique_ips';

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/unique_ips/index.ts

@@ -16,7 +16,7 @@ import type {
 import { inspectStringifyObject } from '../../../../../../utils/build_query';
 import type { SecuritySolutionFactory } from '../../../types';
 import { buildHostsKpiUniqueIpsQuery } from './query.hosts_kpi_unique_ips.dsl';
-import { formatGeneralHistogramData } from '../common';
+import { formatGeneralHistogramData } from '../../../common/format_general_histogram_data';
 
 export const hostsKpiUniqueIps: SecuritySolutionFactory<HostsKpiQueries.kpiUniqueIps> = {
   buildDsl: (options: HostsKpiUniqueIpsRequestOptions) => buildHostsKpiUniqueIpsQuery(options),

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/users/kpi/authentications/index.ts

@@ -16,7 +16,7 @@ import type {
   UsersKpiAuthenticationsStrategyResponse,
   UsersQueries,
 } from '../../../../../../../common/search_strategy';
-import { formatGeneralHistogramData } from '../../../hosts/kpi';
+import { formatGeneralHistogramData } from '../../../common/format_general_histogram_data';
 
 export const usersKpiAuthentications: SecuritySolutionFactory<UsersQueries.kpiAuthentications> = {
   buildDsl: (options: UsersKpiAuthenticationsRequestOptions) =>

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/users/kpi/total_users/index.ts

@@ -21,9 +21,9 @@ import type {
 } from '../../../../../../../common/search_strategy/security_solution/users/kpi/total_users';
 
 import { inspectStringifyObject } from '../../../../../../utils/build_query';
-import { formatGeneralHistogramData } from '../../../hosts/kpi';
 import type { SecuritySolutionFactory } from '../../../types';
 import { buildTotalUsersKpiQuery } from './query.build_total_users_kpi.dsl';
+import { formatGeneralHistogramData } from '../../../common/format_general_histogram_data';
 
 export const totalUsersKpi: SecuritySolutionFactory<UsersQueries.kpiTotalUsers> = {
   buildDsl: (options: TotalUsersKpiRequestOptions) => buildTotalUsersKpiQuery(options),