fix: Skip instance-level enrichment for elastic. Ensure enrichments are applied conditionally (#4645)

Author: VladimirFilonov

keep/api/bl/enrichments_bl.py

@@ -716,6 +716,8 @@ def disposable_enrich_entity(
         alert_id = UUIDType(binary=False).process_bind_param(
             last_alert.alert_id, self.db_session.bind.dialect
         )
+        # For elastic we do not save instance-level enrichments
+        common_kwargs["should_exist"] = False
         self.enrich_entity(fingerprint=alert_id, audit_enabled=False, **common_kwargs)
 
     def enrich_entity(

keep/providers/base/base_provider.py

@@ -287,19 +287,21 @@ def _enrich(self, enrichments, results, audit_enabled=True):
                 "audit_enabled": audit_enabled,
             }
 
-            # enrich the alert with _enrichments
-            enrichments_bl.enrich_entity(
-                enrichments=_enrichments,
-                action_description=f"Workflow enriched the alert with {enrichment_string}",
-                **common_kwargs,
-            )
+            if _enrichments:
+                # enrich the alert with _enrichments
+                enrichments_bl.enrich_entity(
+                    enrichments=_enrichments,
+                    action_description=f"Workflow enriched the alert with {enrichment_string}",
+                    **common_kwargs,
+                )
 
-            # enrich with disposable enrichments
-            enrichments_bl.disposable_enrich_entity(
-                enrichments=disposable_enrichments,
-                action_description=f"Workflow enriched the alert with {disposable_enrichment_string}",
-                **common_kwargs,
-            )
+            if disposable_enrichments:
+                # enrich with disposable enrichments
+                enrichments_bl.disposable_enrich_entity(
+                    enrichments=disposable_enrichments,
+                    action_description=f"Workflow enriched the alert with {disposable_enrichment_string}",
+                    **common_kwargs,
+                )
 
             should_check_incidents_resolution = (
                 _enrichments.get("status", None) == "resolved"