x-pack/filebeat/input/entityanalytics/provider/activedirectory: new package #37919

efd6 · 2024-02-08T06:40:36Z

Proposed commit message

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

Testing requires setting up an active directory test server (or pointing the test at an existing server). There are notes in the test file explaining how pointing the tests at the server is handled. I used instructions here for setting up a local VM test server.

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

elasticmachine · 2024-02-08T09:45:10Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2024-03-21T21:04:26.401+0000
Duration: 139 min 0 sec

Test stats 🧪

Test	Results
Failed	0
Passed	3352
Skipped	185
Total	3537

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

elasticmachine · 2024-02-12T20:14:36Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

mergify · 2024-02-12T20:35:07Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b i8559-activedirectory-fe upstream/i8559-activedirectory-fe
git merge upstream/main
git push upstream i8559-activedirectory-fe

mergify · 2024-02-19T21:24:13Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b i8559-activedirectory-fe upstream/i8559-activedirectory-fe
git merge upstream/main
git push upstream i8559-activedirectory-fe

mergify · 2024-02-21T14:37:56Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b i8559-activedirectory-fe upstream/i8559-activedirectory-fe
git merge upstream/main
git push upstream i8559-activedirectory-fe

kcreddy

Change LGTM 👍🏼 Just added few nits/clarifications.

x-pack/filebeat/docs/inputs/input-entity-analytics.asciidoc

x-pack/filebeat/input/entityanalytics/provider/activedirectory/statestore.go

kcreddy · 2024-03-21T16:47:10Z

x-pack/filebeat/docs/inputs/input-entity-analytics.asciidoc

+[float]
+===== `ad_user`
+
+The client user name. Used for authentication. Field is required.


Does this user need any additional permissions to fetch other users? Should they be documented?

kcreddy · 2024-03-21T17:02:39Z

x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go

+
+// runIncrementalUpdate will run an incremental update. The process is similar
+// to full synchronization, except only users which have changed (newly
+// discovered, modified, or deleted) will be published.


How are user deletes handled? Unlike okta, this doesn't seem to have a Deleted/DEPROVISIONED status.
So, until the next full sync happens, there could be stale(deleted) users in the state?

AD doesn't have a notion of deleted. I was thinking about this and wasn't sure what we should do. At the very least, "deleted" should be removed from the docs, but I'll take a look at possible approaches to see if we can reconstruct this functionality.

I've added a method for handling deletion. It's not a complete approach, but I think it is the best we can get.

Thanks Dan. That makes sense

…ackage The activedirectory package provides an entity analytics provider for Active Directory.

elasticmachine · 2024-03-21T21:05:19Z

💚 Build Succeeded

Buildkite Build
Commit: 9e4d31d

History

💚 Build #2381 succeeded e376410
💚 Build #1557 succeeded 35886e4
💚 Build #1493 succeeded c10edcd
💚 Build #1292 succeeded 73313b8
💚 Build #1291 succeeded a376c7d

cc @efd6

elasticmachine · 2024-03-21T21:05:20Z

💚 Build Succeeded

Buildkite Build
Commit: 9e4d31d

History

💚 Build #1102 succeeded e376410

cc @efd6

elasticmachine · 2024-03-21T21:05:21Z

💚 Build Succeeded

Buildkite Build
Commit: 9e4d31d

History

💚 Build #1537 succeeded e376410
💚 Build #713 succeeded 35886e4
💚 Build #649 succeeded c10edcd
💚 Build #463 succeeded 73313b8
💚 Build #462 succeeded a376c7d

cc @efd6

elasticmachine · 2024-03-21T21:05:21Z

💚 Build Succeeded

Buildkite Build
Commit: 9e4d31d

History

💚 Build #1144 succeeded e376410

cc @efd6

elasticmachine · 2024-03-21T21:05:21Z

💚 Build Succeeded

Buildkite Build
Commit: 9e4d31d

History

💚 Build #2374 succeeded e376410
💚 Build #1549 succeeded 35886e4
💚 Build #1485 succeeded c10edcd
💚 Build #1298 succeeded 73313b8
💚 Build #1297 succeeded a376c7d

cc @efd6

elasticmachine · 2024-03-21T21:05:25Z

💚 Build Succeeded

Buildkite Build
Commit: 9e4d31d

History

💚 Build #1112 succeeded e376410

cc @efd6

elasticmachine · 2024-03-21T21:05:26Z

💚 Build Succeeded

Buildkite Build
Commit: 9e4d31d

History

💚 Build #1099 succeeded e376410

cc @efd6

elasticmachine · 2024-03-21T21:05:27Z

💚 Build Succeeded

Buildkite Build
Commit: 9e4d31d

History

💚 Build #3592 succeeded e376410
💚 Build #2763 succeeded 35886e4
💚 Build #2699 succeeded c10edcd
💚 Build #2512 succeeded 73313b8
💚 Build #2511 succeeded a376c7d

cc @efd6

elasticmachine · 2024-03-21T21:34:21Z

💚 Build Succeeded

Buildkite Build
Commit: 9e4d31d

History

💔 Build #2671 failed e376410
💚 Build #1846 succeeded 35886e4
💚 Build #1789 succeeded c10edcd
💚 Build #1623 succeeded 73313b8
💚 Build #1622 succeeded a376c7d

cc @efd6

elasticmachine · 2024-03-21T21:44:29Z

💚 Build Succeeded

Buildkite Build
Commit: 9e4d31d

History

💔 Build #4024 failed e376410
💚 Build #3185 succeeded 35886e4
💚 Build #3128 succeeded c10edcd
💚 Build #2962 succeeded 73313b8
💔 Build #2814 failed 56019f0

cc @efd6

kcreddy

LGTM 👍🏼

efd6 added enhancement Filebeat Filebeat backport-skip Skip notification from the automated backport with mergify Team:Security-Service Integrations Security Service Integrations Team 8.13-candidate labels Feb 8, 2024

efd6 self-assigned this Feb 8, 2024

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Feb 8, 2024

efd6 force-pushed the i8559-activedirectory-fe branch from dea35ac to 9ed9d39 Compare February 8, 2024 06:41

efd6 force-pushed the i8559-activedirectory-fe branch 2 times, most recently from 56019f0 to a376c7d Compare February 12, 2024 20:13

efd6 marked this pull request as ready for review February 12, 2024 20:14

efd6 requested a review from a team as a code owner February 12, 2024 20:14

efd6 force-pushed the i8559-activedirectory-fe branch from a376c7d to 73313b8 Compare February 12, 2024 20:38

efd6 force-pushed the i8559-activedirectory-fe branch from 73313b8 to c10edcd Compare February 19, 2024 21:30

efd6 force-pushed the i8559-activedirectory-fe branch from c10edcd to 35886e4 Compare February 21, 2024 20:01

efd6 force-pushed the i8559-activedirectory-fe branch from 35886e4 to e376410 Compare March 19, 2024 21:53

kcreddy approved these changes Mar 21, 2024

View reviewed changes

efd6 added 3 commits March 22, 2024 06:24

x-pack/filebeat/input/entityanalytics/provider/activedirectory: new p…

4f7b367

…ackage The activedirectory package provides an entity analytics provider for Active Directory.

address pr comments

1b2d9ff

support partial reconstruction of deletion state

9e4d31d

efd6 force-pushed the i8559-activedirectory-fe branch from e376410 to 9e4d31d Compare March 21, 2024 21:04

efd6 requested a review from kcreddy March 21, 2024 21:04

kcreddy approved these changes Mar 22, 2024

View reviewed changes

efd6 merged commit 8bf2581 into elastic:main Mar 22, 2024
43 of 46 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

x-pack/filebeat/input/entityanalytics/provider/activedirectory: new package #37919

x-pack/filebeat/input/entityanalytics/provider/activedirectory: new package #37919

efd6 commented Feb 8, 2024 •

edited

Loading

elasticmachine commented Feb 8, 2024 •

edited

Loading

Build stats

Test stats 🧪

elasticmachine commented Feb 12, 2024

mergify bot commented Feb 12, 2024

mergify bot commented Feb 19, 2024

mergify bot commented Feb 21, 2024

kcreddy left a comment

kcreddy Mar 21, 2024

efd6 Mar 21, 2024

kcreddy Mar 21, 2024

efd6 Mar 21, 2024

efd6 Mar 21, 2024

kcreddy Mar 22, 2024

elasticmachine commented Mar 21, 2024

elasticmachine commented Mar 21, 2024

elasticmachine commented Mar 21, 2024

elasticmachine commented Mar 21, 2024

elasticmachine commented Mar 21, 2024

elasticmachine commented Mar 21, 2024

elasticmachine commented Mar 21, 2024

elasticmachine commented Mar 21, 2024

elasticmachine commented Mar 21, 2024

elasticmachine commented Mar 21, 2024

kcreddy left a comment

x-pack/filebeat/input/entityanalytics/provider/activedirectory: new package #37919

x-pack/filebeat/input/entityanalytics/provider/activedirectory: new package #37919

Conversation

efd6 commented Feb 8, 2024 • edited Loading

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

elasticmachine commented Feb 8, 2024 • edited Loading

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

🤖 GitHub comments

elasticmachine commented Feb 12, 2024

mergify bot commented Feb 12, 2024

mergify bot commented Feb 19, 2024

mergify bot commented Feb 21, 2024

kcreddy left a comment

Choose a reason for hiding this comment

kcreddy Mar 21, 2024

Choose a reason for hiding this comment

efd6 Mar 21, 2024

Choose a reason for hiding this comment

kcreddy Mar 21, 2024

Choose a reason for hiding this comment

efd6 Mar 21, 2024

Choose a reason for hiding this comment

efd6 Mar 21, 2024

Choose a reason for hiding this comment

kcreddy Mar 22, 2024

Choose a reason for hiding this comment

elasticmachine commented Mar 21, 2024

💚 Build Succeeded

History

elasticmachine commented Mar 21, 2024

💚 Build Succeeded

History

elasticmachine commented Mar 21, 2024

💚 Build Succeeded

History

elasticmachine commented Mar 21, 2024

💚 Build Succeeded

History

elasticmachine commented Mar 21, 2024

💚 Build Succeeded

History

elasticmachine commented Mar 21, 2024

💚 Build Succeeded

History

elasticmachine commented Mar 21, 2024

💚 Build Succeeded

History

elasticmachine commented Mar 21, 2024

💚 Build Succeeded

History

elasticmachine commented Mar 21, 2024

💚 Build Succeeded

History

elasticmachine commented Mar 21, 2024

💚 Build Succeeded

History

kcreddy left a comment

Choose a reason for hiding this comment

efd6 commented Feb 8, 2024 •

edited

Loading

elasticmachine commented Feb 8, 2024 •

edited

Loading