[Security Solution][Endpoint] Add additional properties to the Script defintion

oas_docs/output/kibana.serverless.yaml

@@ -90649,6 +90649,18 @@ components:
           type: string
         example:
           type: string
+        fileHash:
+          description: SHA256 hash of the script file that was uploaded
+          example: abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8
+          type: string
+        fileName:
+          description: Name of the script file that was uploaded
+          example: collect_host_data.sh
+          type: string
+        fileSize:
+          description: Size of the script file that was uploaded in bytes
+          example: 12345
+          type: integer
         id:
           example: 123e4567-e89b-12d3-a456-426655440000
           format: uuid

oas_docs/output/kibana.yaml

@@ -101351,6 +101351,18 @@ components:
           type: string
         example:
           type: string
+        fileHash:
+          description: SHA256 hash of the script file that was uploaded
+          example: abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8
+          type: string
+        fileName:
+          description: Name of the script file that was uploaded
+          example: collect_host_data.sh
+          type: string
+        fileSize:
+          description: Size of the script file that was uploaded in bytes
+          example: 12345
+          type: integer
         id:
           example: 123e4567-e89b-12d3-a456-426655440000
           format: uuid

x-pack/solutions/security/plugins/security_solution/common/api/endpoint/scripts_library/common.yaml

@@ -25,6 +25,18 @@ components:
           type: array
           items:
             $ref: '#/components/schemas/EndpointScriptPlatform'
+        fileName:
+          type: string
+          description: Name of the script file that was uploaded
+          example: collect_host_data.sh
+        fileSize:
+          type: integer
+          description: Size of the script file that was uploaded in bytes
+          example: 12345
+        fileHash:
+          type: string
+          description: SHA256 hash of the script file that was uploaded
+          example: abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8
         requiresInput:
           type: boolean
         downloadUri:
@@ -71,6 +83,9 @@ components:
           id: 123e4567-e89b-12d3-a456-426655440000
           name: Collect host data
           platform: [ linux, macos ]
+          fileName: collect_host_data.sh
+          fileSize: 12345
+          fileHash: abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8
           requiresInput: false
           downloadUri: /api/endpoint/scripts_library/123e4567-e89b-12d3-a456-426655440000/download
           description: Collects host data for investigation

x-pack/solutions/security/plugins/security_solution/common/endpoint/types/scripts_library.ts

@@ -14,6 +14,11 @@ export interface EndpointScript {
   id: string;
   name: string;
   platform: Array<SupportedHostOsType>;
+  fileName: string;
+  /** Size of file in bytes */
+  fileSize: number;
+  /** SHA-256 hash of the file */
+  fileHash: string;
   /** If `true`, then the script, when invoked, requires input arguments to be provided */
   requiresInput: boolean;
   /**

x-pack/solutions/security/plugins/security_solution/docs/openapi/ess/security_solution_endpoint_management_api_2023_10_31.bundled.schema.yaml

@@ -1182,6 +1182,18 @@ components:
           type: string
         example:
           type: string
+        fileHash:
+          description: SHA256 hash of the script file that was uploaded
+          example: abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8
+          type: string
+        fileName:
+          description: Name of the script file that was uploaded
+          example: collect_host_data.sh
+          type: string
+        fileSize:
+          description: Size of the script file that was uploaded in bytes
+          example: 12345
+          type: integer
         id:
           example: 123e4567-e89b-12d3-a456-426655440000
           format: uuid

x-pack/solutions/security/plugins/security_solution/docs/openapi/serverless/security_solution_endpoint_management_api_2023_10_31.bundled.schema.yaml

@@ -1182,6 +1182,18 @@ components:
           type: string
         example:
           type: string
+        fileHash:
+          description: SHA256 hash of the script file that was uploaded
+          example: abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8
+          type: string
+        fileName:
+          description: Name of the script file that was uploaded
+          example: collect_host_data.sh
+          type: string
+        fileSize:
+          description: Size of the script file that was uploaded in bytes
+          example: 12345
+          type: integer
         id:
           example: 123e4567-e89b-12d3-a456-426655440000
           format: uuid

x-pack/solutions/security/plugins/security_solution/server/endpoint/lib/scripts_library/saved_objects/mappings.ts

@@ -15,7 +15,10 @@ const ScriptsLibraryAttributesSchemaV1 = schema.object({
   id: schema.string(),
   name: schema.string(),
   platform: schema.arrayOf(schema.string()),
-  hash: schema.maybe(schema.string()),
+  file_id: schema.string(),
+  file_name: schema.string(),
+  file_size: schema.number(),
+  file_hash_sha256: schema.string(),
   requires_input: schema.maybe(schema.boolean()),
   description: schema.maybe(schema.string()),
   instructions: schema.maybe(schema.string()),
@@ -42,7 +45,10 @@ export const scriptsLibrarySavedObjectType: SavedObjectsType = {
       id: { type: 'keyword' },
       name: { type: 'keyword' },
       platform: { type: 'keyword' },
-      hash: { type: 'keyword' },
+      file_id: { type: 'keyword' },
+      file_name: { type: 'keyword' },
+      file_size: { type: 'long' },
+      file_hash_sha256: { type: 'keyword' },
       requires_input: { type: 'boolean' },
       description: { type: 'keyword' },
       instructions: { type: 'keyword' },

x-pack/solutions/security/plugins/security_solution/server/endpoint/services/scripts_library/mocks.ts

@@ -27,6 +27,9 @@ const generateScriptEntryMock = (overrides: Partial<EndpointScript> = {}): Endpo
     id: '1-2-3',
     name: 'script one',
     platform: ['linux', 'macos'],
+    fileName: 'my_script.sh',
+    fileSize: 12098,
+    fileHash: 'e5441eb2bb',
     requiresInput: false,
     downloadUri: SCRIPTS_LIBRARY_ITEM_DOWNLOAD_ROUTE.replace('{script_id}', '1-2-3'),
     description: 'does some stuff',
@@ -66,7 +69,10 @@ const generateSavedObjectScriptEntryMock = (
     namespaces: ['default'],
     attributes: {
       id: '1-2-3',
-      hash: 'e5441eb2bb',
+      file_id: 'file-1-2-3',
+      file_size: 12098,
+      file_name: 'my_script.sh',
+      file_hash_sha256: 'e5441eb2bb',
       name: 'my script',
       platform: ['macos', 'linux'],
       requires_input: undefined,

x-pack/solutions/security/plugins/security_solution/server/endpoint/services/scripts_library/scripts_library_client.test.ts

@@ -65,12 +65,15 @@ describe('scripts library client', () => {
 
     it('should create a file record and upload file content to it', async () => {
       await scriptsClient.create(createBodyMock);
+      const scriptSoId = (
+        endpointAppServicesMock.savedObjects.createInternalUnscopedSoClient().create as jest.Mock
+      ).mock.calls[0][2].id;
 
       expect(filesPluginClient.create).toHaveBeenCalledWith({
-        id: expect.any(String),
         metadata: {
           mime: 'application/text',
           name: 'foo.txt',
+          meta: { scriptId: scriptSoId },
         },
       });
 
@@ -79,9 +82,10 @@ describe('scripts library client', () => {
       });
     });
 
-    it('should create a new script entry in the library using same id as File storage', async () => {
+    it('should create a script entry (SO) with expected content', async () => {
       await scriptsClient.create(createBodyMock);
-      const scriptId = filesPluginClient.create.mock.calls[0][0].id;
+      const soClientMock = endpointAppServicesMock.savedObjects.createInternalUnscopedSoClient();
+      const scriptSoId = (soClientMock.create as jest.Mock).mock.calls[0][2].id;
 
       expect(
         endpointAppServicesMock.savedObjects.createInternalUnscopedSoClient().create
@@ -91,8 +95,11 @@ describe('scripts library client', () => {
           description: 'does some stuff',
           example: 'bash -c script_one.sh',
           path_to_executable: undefined,
-          hash: 'e5441eb2bb',
-          id: scriptId,
+          file_hash_sha256: 'e5441eb2bb',
+          file_id: '123',
+          file_name: 'test.txt',
+          file_size: 1234,
+          id: scriptSoId,
           instructions: 'just execute it',
           name: 'script one',
           platform: ['linux', 'macos'],
@@ -102,7 +109,7 @@ describe('scripts library client', () => {
           updated_by: 'elastic',
           updated_at: expect.any(String),
         },
-        { id: scriptId }
+        { id: scriptSoId }
       );
     });
 
@@ -131,6 +138,9 @@ describe('scripts library client', () => {
         downloadUri: '/api/endpoint/scripts_library/1-2-3/download',
         id: '1-2-3',
         name: 'my script',
+        fileHash: 'e5441eb2bb',
+        fileName: 'my_script.sh',
+        fileSize: 12098,
         platform: ['macos', 'linux'],
         requiresInput: false,
         updatedAt: '2025-11-24T16:04:17.471Z',
@@ -251,6 +261,9 @@ describe('scripts library client', () => {
             id: '1-2-3',
             instructions: undefined,
             name: 'my script',
+            fileHash: 'e5441eb2bb',
+            fileName: 'my_script.sh',
+            fileSize: 12098,
             pathToExecutable: undefined,
             platform: ['macos', 'linux'],
             requiresInput: false,

x-pack/solutions/security/plugins/security_solution/server/endpoint/services/scripts_library/scripts_library_client.ts

@@ -95,7 +95,10 @@ export class ScriptsLibraryClient implements ScriptsLibraryClientInterface {
       instructions,
       example,
       id: '',
-      hash: '',
+      file_id: '',
+      file_size: 0,
+      file_name: '',
+      file_hash_sha256: '',
       requires_input: requiresInput,
       path_to_executable: pathToExecutable,
       created_by: '',
@@ -116,6 +119,9 @@ export class ScriptsLibraryClient implements ScriptsLibraryClientInterface {
       instructions,
       requires_input: requiresInput = false,
       path_to_executable: pathToExecutable = undefined,
+      file_name: fileName,
+      file_size: fileSize,
+      file_hash_sha256: fileHash,
       created_by: createdBy,
       updated_by: updatedBy,
       created_at: createdAt,
@@ -128,6 +134,9 @@ export class ScriptsLibraryClient implements ScriptsLibraryClientInterface {
       id,
       name,
       platform: platform as EndpointScript['platform'],
+      fileName,
+      fileSize,
+      fileHash,
       downloadUri,
       requiresInput,
       description,
@@ -202,10 +211,10 @@ export class ScriptsLibraryClient implements ScriptsLibraryClientInterface {
 
     const fileStorage = await this.filesClient
       .create({
-        id: scriptId,
         metadata: {
           name: fileStream.hapi.filename ?? scriptDefinition.name.replace(/\D\W/g, '_'),
           mime: fileStream.hapi.headers['content-type'] ?? 'application/octet-stream',
+          meta: { scriptId },
         },
       })
       .catch((error) => {
@@ -246,7 +255,10 @@ export class ScriptsLibraryClient implements ScriptsLibraryClientInterface {
 
     Object.assign(soAttributes, {
       id: scriptId,
-      hash: fileStorage.data.hash.sha256,
+      file_id: fileStorage.id,
+      file_name: fileStorage.data.name,
+      file_size: fileStorage.data.size ?? 0,
+      file_hash_sha256: fileStorage.data.hash.sha256,
       created_by: this.username,
       updated_by: this.username,
     });