Skip to content

[sentinel_one] Split domain-qualified user.name values into user.domain - #16728

Merged
chrisberkhout merged 3 commits into
elastic:mainfrom
chrisberkhout:sentinel_one-domain-user-split
Jan 2, 2026
Merged

[sentinel_one] Split domain-qualified user.name values into user.domain#16728
chrisberkhout merged 3 commits into
elastic:mainfrom
chrisberkhout:sentinel_one-domain-user-split

Conversation

@chrisberkhout

@chrisberkhout chrisberkhout commented Dec 30, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

[sentinel_one] Split domain-qualified `user.name` values into `user.domain` (#)

According to the ECS usage guidance[1]:

> When a system provides a composite value for the user name (e.g.
> DOMAINNAME\username), capture the domain name in `user.domain` and the
> user name (without the domain) in `user.name`.

[1]: https://www.elastic.co/docs/reference/ecs/ecs-user-usage#ecs-user-identifiers

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices
@chrisberkhout chrisberkhout self-assigned this Dec 30, 2025
@chrisberkhout
chrisberkhout requested a review from a team as a code owner December 30, 2025 10:17
@chrisberkhout chrisberkhout added Integration:sentinel_one SentinelOne bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Dec 30, 2025
@elasticmachine

elasticmachine commented Dec 30, 2025

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
@chrisberkhout
chrisberkhout force-pushed the sentinel_one-domain-user-split branch from e55fa6c to b6be142 Compare December 30, 2025 10:19
@elasticmachine

elasticmachine commented Dec 30, 2025

Copy link
Copy Markdown

💚 Build Succeeded

cc @chrisberkhout
ShourieG
ShourieG approved these changes Jan 2, 2026
View reviewed changes

@ShourieG ShourieG left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@chrisberkhout
chrisberkhout merged commit 1f9f446 into elastic:main Jan 2, 2026
8 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jan 2, 2026

Copy link
Copy Markdown
Contributor

Package sentinel_one - 2.0.1 containing this change is available at https://epr.elastic.co/package/sentinel_one/2.0.1/
jakubgalecki0 pushed a commit to jakubgalecki0/integrations that referenced this pull request Feb 19, 2026
@chrisberkhout @jakubgalecki0
[sentinel_one] Split domain-qualified user.name values into `user.d…
acab8ac 
…omain` (elastic#16728)

According to the ECS usage guidance[1]:

> When a system provides a composite value for the user name (e.g.
> DOMAINNAME\username), capture the domain name in `user.domain` and the
> user name (without the domain) in `user.name`.

[1]: https://www.elastic.co/docs/reference/ecs/ecs-user-usage#ecs-user-identifiers
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:sentinel_one SentinelOne Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@chrisberkhout @elasticmachine @ShourieG