playing around, can show this as demo

x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/insights_tab_csp.tsx

@@ -29,28 +29,33 @@ const insightsButtons: EuiButtonGroupOptionProps[] = [
 /**
  * Insights view displayed in the document details expandable flyout left section
  */
-export const InsightsTabCsp = memo(({ name }: { name: string }) => {
-  const panels = useExpandableFlyoutState();
-  const activeInsightsId = panels.left?.path?.subTab ?? 'misconfigurationTabId';
+export const InsightsTabCsp = memo(
+  ({ name, fieldName }: { name: string; fieldName: 'host.name' | 'user.name' }) => {
+    const panels = useExpandableFlyoutState();
+    const activeInsightsId = panels.left?.path?.subTab ?? 'misconfigurationTabId';
 
-  return (
-    <>
-      <EuiButtonGroup
-        color="primary"
-        legend={i18n.translate('xpack.securitySolution.flyout.left.insights.optionsButtonGroups', {
-          defaultMessage: 'Insights options',
-        })}
-        options={insightsButtons}
-        idSelected={activeInsightsId}
-        onChange={() => {}}
-        buttonSize="compressed"
-        isFullWidth
-        data-test-subj={'insightButtonGroupsTestId'}
-      />
-      <EuiSpacer size="xl" />
-      <MisconfigurationFindingsDetailsTable fieldName={'host.name'} queryName={name} />
-    </>
-  );
-});
+    return (
+      <>
+        <EuiButtonGroup
+          color="primary"
+          legend={i18n.translate(
+            'xpack.securitySolution.flyout.left.insights.optionsButtonGroups',
+            {
+              defaultMessage: 'Insights options',
+            }
+          )}
+          options={insightsButtons}
+          idSelected={activeInsightsId}
+          onChange={() => {}}
+          buttonSize="compressed"
+          isFullWidth
+          data-test-subj={'insightButtonGroupsTestId'}
+        />
+        <EuiSpacer size="xl" />
+        <MisconfigurationFindingsDetailsTable fieldName={fieldName} queryName={name} />
+      </>
+    );
+  }
+);
 
 InsightsTabCsp.displayName = 'InsightsTab';

x-pack/plugins/security_solution/public/cloud_security_posture/components/index.tsx

@@ -13,7 +13,13 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import { useCspSetupStatusApi } from '@kbn/cloud-security-posture/src/hooks/use_csp_setup_status_api';
 import { MisconfigurationsPreview } from './misconfiguration/misconfiguration_preview';
 
-export const EntityInsight = <T,>({ hostName }: { hostName: string }) => {
+export const EntityInsight = <T,>({
+  name,
+  fieldName,
+}: {
+  name: string;
+  fieldName: 'host.name' | 'user.name';
+}) => {
   const { euiTheme } = useEuiTheme();
   const getSetupStatus = useCspSetupStatusApi();
   const hasMisconfigurationFindings = getSetupStatus.data?.hasMisconfigurationsFindings;
@@ -45,7 +51,7 @@ export const EntityInsight = <T,>({ hostName }: { hostName: string }) => {
             }
           >
             <EuiSpacer size="m" />
-            <MisconfigurationsPreview hostName={hostName} />
+            <MisconfigurationsPreview name={name} fieldName={fieldName} />
             <EuiSpacer size="m" />
           </EuiAccordion>
         </>

x-pack/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx

@@ -18,10 +18,12 @@ import { ExpandablePanel } from '@kbn/security-solution-common';
 import { buildEntityFlyoutPreviewQuery } from '@kbn/cloud-security-posture-common';
 import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
 import { useCspSetupStatusApi } from '@kbn/cloud-security-posture/src/hooks/use_csp_setup_status_api';
+import { UserDetailsPanelKey } from '../../../flyout/entity_details/user_details_left';
 import { HostDetailsPanelKey } from '../../../flyout/entity_details/host_details_left';
 import { useRiskScore } from '../../../entity_analytics/api/hooks/use_risk_score';
 import { RiskScoreEntity } from '../../../../common/entity_analytics/risk_engine';
-import { buildHostNamesFilter } from '../../../../common/search_strategy';
+import type { HostRiskScore, UserRiskScore } from '../../../../common/search_strategy';
+import { buildHostNamesFilter, buildUserNamesFilter } from '../../../../common/search_strategy';
 
 const FIRST_RECORD_PAGINATION = {
   cursorStart: 0,
@@ -131,9 +133,15 @@ const MisconfigurationPreviewScore = ({
   );
 };
 
-export const MisconfigurationsPreview = ({ hostName }: { hostName: string }) => {
+export const MisconfigurationsPreview = ({
+  name,
+  fieldName,
+}: {
+  name: string;
+  fieldName: 'host.name' | 'user.name';
+}) => {
   const { data } = useMisconfigurationPreview({
-    query: buildEntityFlyoutPreviewQuery('host.name', hostName),
+    query: buildEntityFlyoutPreviewQuery(fieldName, name),
     sort: [],
     enabled: true,
     pageSize: 1,
@@ -147,38 +155,56 @@ export const MisconfigurationsPreview = ({ hostName }: { hostName: string }) =>
   const hasMisconfigurationFindingsIndex =
     useCspSetupStatusApi().data?.hasMisconfigurationsFindings || false;
   const hostNameFilterQuery = useMemo(
-    () => (hostName ? buildHostNamesFilter([hostName]) : undefined),
-    [hostName]
+    () => (name ? buildHostNamesFilter([name]) : undefined),
+    [name]
+  );
+
+  const buildFilterQuery = useMemo(
+    () => (fieldName === 'host.name' ? buildHostNamesFilter([name]) : buildUserNamesFilter([name])),
+    [fieldName, name]
   );
 
   const riskScoreState = useRiskScore({
-    riskEntity: RiskScoreEntity.host,
-    filterQuery: hostNameFilterQuery,
+    riskEntity: fieldName === 'host.name' ? RiskScoreEntity.host : RiskScoreEntity.user,
+    filterQuery: buildFilterQuery,
     onlyLatest: false,
     pagination: FIRST_RECORD_PAGINATION,
   });
   const { data: hostRisk } = riskScoreState;
   const hostRiskData = hostRisk && hostRisk.length > 0 ? hostRisk[0] : undefined;
-  const isRiskScoreExist = !!hostRiskData?.host.risk;
+  const isRiskScoreExist =
+    fieldName === 'host.name'
+      ? !!(hostRiskData as HostRiskScore)?.host.risk
+      : !!(hostRiskData as UserRiskScore)?.user.risk;
   const { openLeftPanel } = useExpandableFlyoutApi();
   const isPreviewMode = false;
   const goToEntityInsightTab = useCallback(() => {
     openLeftPanel({
-      id: HostDetailsPanelKey,
-      params: {
-        name: hostName,
-        isRiskScoreExist,
-        isMisconfigurationFindingsIndexExist: hasMisconfigurationFindingsIndex,
-        isMisconfigurationFindingsForThisQueryExist: hasMisconfigurationFindingsForThisQuery,
-        path: { tab: 'csp_insights' },
-      },
+      id: fieldName === 'host.name' ? HostDetailsPanelKey : UserDetailsPanelKey,
+      params:
+        fieldName === 'host.name'
+          ? {
+              name,
+              isRiskScoreExist,
+              isMisconfigurationFindingsIndexExist: hasMisconfigurationFindingsIndex,
+              isMisconfigurationFindingsForThisQueryExist: hasMisconfigurationFindingsForThisQuery,
+              path: { tab: 'csp_insights' },
+            }
+          : {
+              user: { name, email: ['ALPHA'] },
+              isRiskScoreExist,
+              isMisconfigurationFindingsIndexExist: hasMisconfigurationFindingsIndex,
+              isMisconfigurationFindingsForThisQueryExist: hasMisconfigurationFindingsForThisQuery,
+            },
+      path: { tab: 'csp_insights' },
     });
   }, [
-    hasMisconfigurationFindingsForThisQuery,
-    hasMisconfigurationFindingsIndex,
-    hostName,
-    isRiskScoreExist,
     openLeftPanel,
+    fieldName,
+    name,
+    isRiskScoreExist,
+    hasMisconfigurationFindingsIndex,
+    hasMisconfigurationFindingsForThisQuery,
   ]);
   const link = useMemo(
     () =>

x-pack/plugins/security_solution/public/entity_analytics/components/entity_details_flyout/index.tsx

@@ -28,7 +28,13 @@ export const getRiskInputTab = ({ entityType, entityName, scopeId }: RiskInputsT
   content: <RiskInputsTab entityType={entityType} entityName={entityName} scopeId={scopeId} />,
 });
 
-export const getInsightsInputTab = ({ name }: { name: string }) => ({
+export const getInsightsInputTab = ({
+  name,
+  fieldName,
+}: {
+  name: string;
+  fieldName: 'host.name' | 'user.name';
+}) => ({
   id: EntityDetailsLeftPanelTab.CSP_INSIGHTS,
   'data-test-subj': INSIGHTS_TAB_TEST_ID,
   name: (
@@ -37,5 +43,5 @@ export const getInsightsInputTab = ({ name }: { name: string }) => ({
       defaultMessage="Insights"
     />
   ),
-  content: <InsightsTabCsp name={name} />,
+  content: <InsightsTabCsp name={name} fieldName={fieldName} />,
 });

x-pack/plugins/security_solution/public/flyout/entity_details/host_details_left/index.tsx

@@ -57,7 +57,7 @@ export const HostDetailsPanel = ({
     // Determine if the Insights tab should be included
     const insightsTab =
       isMisconfigurationFindingsIndexExist && isMisconfigurationFindingsForThisQueryExist
-        ? [getInsightsInputTab({ name })]
+        ? [getInsightsInputTab({ name, fieldName: 'host.name' })]
         : [];
     return [[...riskScoreTab, ...insightsTab], EntityDetailsLeftPanelTab.RISK_INPUTS, () => {}];
   }, [

x-pack/plugins/security_solution/public/flyout/entity_details/host_right/content.tsx

@@ -72,7 +72,7 @@ export const HostPanelContent = ({
         observedFields={observedFields}
         queryId={HOST_PANEL_OBSERVED_HOST_QUERY_ID}
       />
-      <EntityInsight hostName={hostName} />
+      <EntityInsight name={hostName} fieldName={'host.name'} />
     </FlyoutBody>
   );
 };

x-pack/plugins/security_solution/public/flyout/entity_details/user_details_left/index.tsx

@@ -28,6 +28,8 @@ export interface UserDetailsPanelProps extends Record<string, unknown> {
   user: UserParam;
   path?: PanelPath;
   scopeId: string;
+  isMisconfigurationFindingsIndexExist?: boolean;
+  isMisconfigurationFindingsForThisQueryExist?: boolean;
 }
 export interface UserDetailsExpandableFlyoutProps extends FlyoutPanelProps {
   key: 'user_details';
@@ -40,10 +42,27 @@ export const UserDetailsPanel = ({
   user,
   path,
   scopeId,
+  isMisconfigurationFindingsIndexExist,
+  isMisconfigurationFindingsForThisQueryExist,
 }: UserDetailsPanelProps) => {
   const managedUser = useManagedUser(user.name, user.email);
-  const tabs = useTabs(managedUser.data, user.name, isRiskScoreExist, scopeId);
-  const { selectedTabId, setSelectedTabId } = useSelectedTab(isRiskScoreExist, user, tabs, path);
+  const tabs = useTabs(
+    managedUser.data,
+    user.name,
+    isRiskScoreExist,
+    scopeId,
+    isMisconfigurationFindingsIndexExist,
+    isMisconfigurationFindingsForThisQueryExist
+  );
+
+  const { selectedTabId, setSelectedTabId } = useSelectedTab(
+    isRiskScoreExist,
+    user,
+    tabs,
+    path,
+    isMisconfigurationFindingsIndexExist,
+    isMisconfigurationFindingsForThisQueryExist
+  );
 
   if (managedUser.isLoading) return <FlyoutLoading />;
 
@@ -67,7 +86,9 @@ const useSelectedTab = (
   isRiskScoreExist: boolean,
   user: UserParam,
   tabs: LeftPanelTabsType,
-  path: PanelPath | undefined
+  path: PanelPath | undefined,
+  isMisconfigurationFindingsIndexExist?: boolean,
+  isMisconfigurationFindingsForThisQueryExist?: boolean
 ) => {
   const { openLeftPanel } = useExpandableFlyoutApi();
 
@@ -87,6 +108,8 @@ const useSelectedTab = (
       params: {
         user,
         isRiskScoreExist,
+        isMisconfigurationFindingsIndexExist,
+        isMisconfigurationFindingsForThisQueryExist,
       },
     });
   };

x-pack/plugins/security_solution/public/flyout/entity_details/user_details_left/tabs.tsx

@@ -8,7 +8,10 @@
 import React, { useMemo } from 'react';
 import { FormattedMessage } from '@kbn/i18n-react';
 
-import { getRiskInputTab } from '../../../entity_analytics/components/entity_details_flyout';
+import {
+  getRiskInputTab,
+  getInsightsInputTab,
+} from '../../../entity_analytics/components/entity_details_flyout';
 import { UserAssetTableType } from '../../../explore/users/store/model';
 import { ManagedUserDatasetKey } from '../../../../common/search_strategy/security_solution/users/managed_details';
 import type {
@@ -26,7 +29,9 @@ export const useTabs = (
   managedUser: ManagedUserHits,
   name: string,
   isRiskScoreExist: boolean,
-  scopeId: string
+  scopeId: string,
+  isMisconfigurationFindingsIndexExist?: boolean,
+  isMisconfigurationFindingsForThisQueryExist?: boolean
 ): LeftPanelTabsType =>
   useMemo(() => {
     const tabs: LeftPanelTabsType = [];
@@ -51,8 +56,19 @@ export const useTabs = (
       tabs.push(getEntraTab(entraManagedUser));
     }
 
+    if (isMisconfigurationFindingsIndexExist && isMisconfigurationFindingsForThisQueryExist) {
+      tabs.push(getInsightsInputTab({ name, fieldName: 'user.name' }));
+    }
+
     return tabs;
-  }, [isRiskScoreExist, managedUser, name, scopeId]);
+  }, [
+    isMisconfigurationFindingsForThisQueryExist,
+    isMisconfigurationFindingsIndexExist,
+    isRiskScoreExist,
+    managedUser,
+    name,
+    scopeId,
+  ]);
 
 const getOktaTab = (oktaManagedUser: ManagedUserHit) => ({
   id: EntityDetailsLeftPanelTab.OKTA,

x-pack/plugins/security_solution/public/flyout/entity_details/user_right/content.tsx

@@ -23,6 +23,7 @@ import { ObservedEntity } from '../shared/components/observed_entity';
 import type { ObservedEntityData } from '../shared/components/observed_entity/types';
 import { useObservedUserItems } from './hooks/use_observed_user_items';
 import type { EntityDetailsLeftPanelTab } from '../shared/components/left_panel/left_panel_header';
+import { EntityInsight } from '../../../cloud_security_posture/components';
 
 interface UserPanelContentProps {
   userName: string;
@@ -89,6 +90,7 @@ export const UserPanelContent = ({
           openDetailsPanel={openDetailsPanel}
         />
       )}
+      <EntityInsight name={userName} fieldName={'user.name'} />
     </FlyoutBody>
   );
 };