Skip to content

Commit 951d4f0

Browse files
navnit-elasticnavnit-elastic
authored
entityanalytics_entra_id: ingest extra fields selected via select in Custom Options (#14433)
This change updates the ingest pipeline to preserve extra fields selected through custom options. Previously, it only mapped the default fields and removed remaining fields under the azure_ad field. Now, it automatically maps the extra fields to the appropriate location under the entityanalytics_entra_id field.
1 parent 2b117e2 commit 951d4f0

File tree

9 files changed

+324
-156
lines changed

9 files changed

+324
-156
lines changed

‎packages/entityanalytics_entra_id/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.8.1"
3+
changes:
4+
- description: Fix pipeline to ingest extra fields selected via `select` configuration in `Custom Options`.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/14433
27
- version: "1.8.0"
38
changes:
49
- description: Remove redundant installation instructions.

‎packages/entityanalytics_entra_id/data_stream/entity/_dev/test/pipeline/test-users.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,43 @@
11
{
22
"events": [
3+
{
4+
"@timestamp": "2023-03-06T10:07:13.883Z",
5+
"azure_ad": {
6+
"userPrincipalName": "[email protected]",
7+
"mail": "[email protected]",
8+
"displayName": "First21480 Last11836",
9+
"givenName": "First21480",
10+
"surname": "Last11836",
11+
"jobTitle": "Manager",
12+
"officeLocation": "608 St N, Somewhere, ABC, XYZ",
13+
"mobilePhone": "231-482-2649",
14+
"businessPhones": [
15+
"55-692-8856",
16+
"552-265-6614"
17+
],
18+
"accountEnabled": true,
19+
"department": "Security"
20+
},
21+
"event": {
22+
"action": "user-discovered"
23+
},
24+
"labels": {
25+
"identity_source": "entra_id-1"
26+
},
27+
"user": {
28+
"id": "aa534e49-edfd-4541-8256-8bbf34f122b4",
29+
"group": [
30+
{
31+
"id": "e7089e3a-2c83-4f08-8280-7530ed39b6ca",
32+
"name": "Group 5202"
33+
},
34+
{
35+
"id": "526588ce-2828-4cb1-9c9b-e57026e94b82",
36+
"name": "Group 16739"
37+
}
38+
]
39+
}
40+
},
341
{
442
"@timestamp": "2023-03-06T10:07:13.883Z",
543
"azure_ad": {

‎packages/entityanalytics_entra_id/data_stream/entity/_dev/test/pipeline/test-users.json-expected.json‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,114 @@
11
{
22
"expected": [
3+
{
4+
"@timestamp": "2023-03-06T10:07:13.883Z",
5+
"asset": {
6+
"category": "entity",
7+
"group": [
8+
{
9+
"id": "e7089e3a-2c83-4f08-8280-7530ed39b6ca",
10+
"name": "Group 5202"
11+
},
12+
{
13+
"id": "526588ce-2828-4cb1-9c9b-e57026e94b82",
14+
"name": "Group 16739"
15+
}
16+
],
17+
"id": "aa534e49-edfd-4541-8256-8bbf34f122b4",
18+
"type": "microsoft_entra_id_user"
19+
},
20+
"data_stream": {
21+
"dataset": "entityanalytics_entra_id.user",
22+
"namespace": "default",
23+
"type": "logs"
24+
},
25+
"ecs": {
26+
"version": "8.11.0"
27+
},
28+
"entityanalytics_entra_id": {
29+
"user": {
30+
"account_enabled": true,
31+
"business_phones": [
32+
"55-692-8856",
33+
"552-265-6614"
34+
],
35+
"department": "Security",
36+
"display_name": "First21480 Last11836",
37+
"given_name": "First21480",
38+
"group": [
39+
{
40+
"id": "e7089e3a-2c83-4f08-8280-7530ed39b6ca",
41+
"name": "Group 5202"
42+
},
43+
{
44+
"id": "526588ce-2828-4cb1-9c9b-e57026e94b82",
45+
"name": "Group 16739"
46+
}
47+
],
48+
"id": "aa534e49-edfd-4541-8256-8bbf34f122b4",
49+
"job_title": "Manager",
50+
"mail": "[email protected]",
51+
"mobile_phone": "231-482-2649",
52+
"office_location": "608 St N, Somewhere, ABC, XYZ",
53+
"surname": "Last11836",
54+
"user_principal_name": "[email protected]"
55+
}
56+
},
57+
"event": {
58+
"category": [
59+
"iam"
60+
],
61+
"kind": "asset",
62+
"original": "{\"@timestamp\":\"2023-03-06T10:07:13.883Z\",\"azure_ad\":{\"businessPhones\":[\"55-692-8856\",\"552-265-6614\"],\"mail\":\"[email protected]\",\"mobilePhone\":\"231-482-2649\",\"officeLocation\":\"608 St N, Somewhere, ABC, XYZ\",\"displayName\":\"First21480 Last11836\",\"surname\":\"Last11836\",\"givenName\":\"First21480\",\"jobTitle\":\"Manager\",\"department\":\"Security\",\"accountEnabled\":true,\"userPrincipalName\":\"[email protected]\"},\"ecs\":{\"version\":\"8.11.0\"},\"event\":{\"action\":\"user-discovered\"},\"user\":{\"id\":\"aa534e49-edfd-4541-8256-8bbf34f122b4\",\"group\":[{\"name\":\"Group 5202\",\"id\":\"e7089e3a-2c83-4f08-8280-7530ed39b6ca\"},{\"name\":\"Group 16739\",\"id\":\"526588ce-2828-4cb1-9c9b-e57026e94b82\"}]},\"labels\":{\"identity_source\":\"entra_id-1\"},\"tags\":[\"preserve_original_event\",\"preserve_duplicate_custom_fields\"],\"_index\":\"logs-entityanalytics_entra_id.entity-default\",\"_id\":\"_id\",\"_version\":-3}",
63+
"type": [
64+
"user",
65+
"info"
66+
]
67+
},
68+
"labels": {
69+
"identity_source": "entra_id-1"
70+
},
71+
"related": {
72+
"user": [
73+
"[email protected]",
74+
"[email protected]",
75+
"First21480 Last11836",
76+
"aa534e49-edfd-4541-8256-8bbf34f122b4"
77+
]
78+
},
79+
"tags": [
80+
"preserve_original_event",
81+
"preserve_duplicate_custom_fields"
82+
],
83+
"user": {
84+
"email": "[email protected]",
85+
"enabled": true,
86+
"first_name": "First21480",
87+
"full_name": "First21480 Last11836",
88+
"group": [
89+
{
90+
"id": "e7089e3a-2c83-4f08-8280-7530ed39b6ca",
91+
"name": "Group 5202"
92+
},
93+
{
94+
"id": "526588ce-2828-4cb1-9c9b-e57026e94b82",
95+
"name": "Group 16739"
96+
}
97+
],
98+
"id": "aa534e49-edfd-4541-8256-8bbf34f122b4",
99+
"job_title": "Manager",
100+
"last_name": "Last11836",
101+
"name": "[email protected]",
102+
"phone": [
103+
"231-482-2649",
104+
"55-692-8856",
105+
"552-265-6614"
106+
],
107+
"work": {
108+
"location_name": "608 St N, Somewhere, ABC, XYZ"
109+
}
110+
}
111+
},
3112
{
4113
"@timestamp": "2023-03-06T10:07:13.883Z",
5114
"asset": {

‎packages/entityanalytics_entra_id/data_stream/entity/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,6 @@ processors:
4646
tag: pipeline_to_user
4747
if: ctx.user?.id != null
4848

49-
- remove:
50-
field:
51-
- azure_ad
52-
tag: remove_azure_ad
53-
ignore_missing: true
5449
- remove:
5550
field:
5651
- entityanalytics_entra_id.user.account_enabled

0 commit comments

Comments
 (0)