Identify customer churn

[CohenIdo]

Motivation As part of exploring our product adoption we would like to have a tool which will indicate on customer churn. To support it In https://github.com/elastic/security-team/issues/5829 we added to cloud_security_posture telemetry payload a section which indicates how many packages policies contains the cloud posture integration and how many agents contains those package policies:

    cspm: {
      status: { type: 'keyword' },
      installedPackagePolicies: { type: 'long' },
      healthyAgents: { type: 'long' },
    },
    kspm: {
      status: { type: 'keyword' },
      installedPackagePolicies: { type: 'long' },
      healthyAgents: { type: 'long' },
    },
    vuln_mgmt: {
      status: { type: 'keyword' },
      installedPackagePolicies: { type: 'long' },
      healthyAgents: { type: 'long' },
    },

Customer who had our package policies installed with running agents and later removed our package from his package policies is considered churn.

Definition of done

• [ ] All fetched telemetry data is indexed automatically as a raw data (json payload) in bigQuery under the table bronze_raw_docs.kibana_snapshot . As a first step we need to fetch and map the relevant fields from the bronze layer to the silver_kbn_cloud_security_accounts_stats. Here you can find the relevant sql model.
• [ ] Add the new field in the silver layer from the previous step also to the gold_cloud_security_adoption
• [ ] create a visual representation in looker studio dashboard indicating which customers are churning.

Related tasks/epics

• [ ] link to telemetry docs TBD

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

[tehilashn]

@kfirpeled - I see this task did not get in to "sprint 25". does it mean it will not get in to 8.9?

[kfirpeled]

probably not, moved candidate to next release