EntityAnalytics Entra ID: add support for ECS entity fields by chemamartinez · Pull Request #18621 · elastic/integrations

chemamartinez · 2026-04-23T15:59:08Z

Proposed commit message

Adds ECS entity field support to the Microsoft Entra ID Entity Analytics
integration for both the entity and device data streams.

Maps device managed status, last sign-in activity, owner relationships,
user manager relationships, sign-in activity, app role permissions,
direct reports, and MFA status to host.entity.* and user.entity.* fields:

- host.entity.attributes.managed from the isManaged device property.
  Only populated when the existing intune_managed_devices option is
  enabled, as this field requires the DeviceManagementManagedDevices.Read.All
  permission and an active Intune licence.
- host.entity.lifecycle.last_activity from approximateLastSignInDateTime device property.
- user.entity.lifecycle.last_activity from signInActivity.lastSignInDateTime. Requires the
  new user_sign_in_activity option, which adds signInActivity to the $select parameter
  on the users delta query.
- user.entity.attributes.permissions from the appRoleDisplayName of each app role assignment.
  Requires the new user_app_role_assignments option, which adds appRoleAssignments to
  the $expand parameter on the users delta query.
- user.entity.relationships.supervises (user_id, username, email) from the user's direct reports.
  Requires the new user_direct_reports option, which adds directReports to the $expand
  parameter on the users delta query. Note: Microsoft Graph limits this expansion to 20 objects per query.
- user.entity.attributes.mfa_enabled set to true when isMfaRegistered is true in the
  MFA registration details. Requires the new enrich_with_mfa option, which calls
  GET /reports/authenticationMethods/userRegistrationDetails once per sync/update cycle
  and merges results by user ID. Also requires the AuditLog.Read.All application permission
  in Azure in addition to existing permissions. Requires Kibana 9.4.0+.

Test sample are AI-generated logs with random data.

Warning

It cannot be merged until 9.4.0 is released.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

Closes Entity Analytics Entra ID: add support for entity fields #18292

github-actions · 2026-04-23T16:00:21Z

✅ Vale Linting Results

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

elasticmachine · 2026-04-23T17:06:10Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

elastic-vault-github-plugin-prod · 2026-04-23T17:33:05Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

efd6 · 2026-04-28T04:18:48Z

+        for (def owner : ctx.device.registered_owners) {
+          def entry = new HashMap();
+          def userObj = new HashMap();
+          if (owner?.id != null) userObj.put("id", owner.id);


We can short circuit this by checking owner == null and continuing if it is.

Prefer not to use un-braced if.

This entire processor has been removed at 5a42108.

efd6 · 2026-04-28T04:23:35Z

+        if (ctx.user == null) ctx.user = new HashMap();
+        if (ctx.user.entity == null) ctx.user.entity = new HashMap();
+        if (ctx.user.entity.relationships == null) ctx.user.entity.relationships = new HashMap();


Suggested change

if (ctx.user == null) ctx.user = new HashMap();

if (ctx.user.entity == null) ctx.user.entity = new HashMap();

if (ctx.user.entity.relationships == null) ctx.user.entity.relationships = new HashMap();

ctx.user = ctx.user ?: [:];

ctx.user.entity = ctx.user.entity ?: [:];

ctx.user.entity.relationships = ctx.user.entity.relationships ?: [:];

(similar above)

efd6 · 2026-04-28T04:24:53Z

+      source: |
+        def supervises = new ArrayList();
+        for (def report : ctx.entityanalytics_entra_id.user.direct_reports) {
+          def entry = new HashMap();


Similar comments here and below.

efd6 · 2026-04-28T04:26:43Z

The origin of the test inputs should be described in the commit message.

efd6 · 2026-05-01T09:29:33Z

/test

github-actions · 2026-05-05T07:56:47Z

TL;DR

The failed Buildkite job is a docs/fields consistency failure, not a runtime pipeline bug. The PR moved supervisor email to user.entity.relationships.supervises.user.email, but packages/entityanalytics_entra_id/docs/README.md still documents the old field path.

Remediation

Regenerate and commit the package README docs for this package (or directly update the stale field row) so it matches current field definitions.
Re-run the package check step (.buildkite/scripts/test_one_package.sh packages/entityanalytics_entra_id ...) after the docs update.

Investigation details

Root Cause

ecs.yml was updated to define user.entity.relationships.supervises.user.email, and the ingest pipeline/test fixture were updated accordingly, but the checked-in docs table still contains user.entity.relationships.supervises.email.

packages/entityanalytics_entra_id/data_stream/entity/fields/ecs.yml:133-142
- removed email
- added user.email
packages/entityanalytics_entra_id/data_stream/entity/elasticsearch/ingest_pipeline/user.yml:246-250
- moved report.mail into entry.user.email
packages/entityanalytics_entra_id/docs/README.md:373
- still lists user.entity.relationships.supervises.email

Evidence

Build: https://buildkite.com/elastic/integrations/builds/42314
Job/step: Check integrations entityanalytics_entra_id
Key log excerpt:

README.md is outdated. Rebuild the package with 'elastic-package build'
--- want
+++ got
@@ -372,3 +372,3 @@
-| user.entity.relationships.supervises.email |  | keyword |
+| user.entity.relationships.supervises.user.email |  | keyword |
Error: checking package failed: checking readme files are up-to-date failed: files do not match

Verification

Not run locally in this environment; diagnosis is based on the Buildkite failure log plus PR commit diff (52ad36c9e8).

Follow-up

After regenerating docs, check for any other renamed nested relationship fields to avoid repeated README drift failures in subsequent PRs.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

EntityAnalytics Entra ID: add support for ECS entity fields #18621 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#18621 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

elasticmachine · 2026-05-28T20:50:44Z

💚 Build Succeeded

Buildkite Build
Commit: 6a5e617

History

💔 Build #43706 failed 97b1e91
💚 Build #42318 succeeded a8eb57a
💔 Build #42314 failed 52ad36c
💔 Build #42184 failed 4a8702e
💚 Build #42142 succeeded 71ceb0e

cc @chemamartinez

alexreal1314 · 2026-05-31T20:15:09Z

@chemamartinez I don't see as part of this pr assignment of user.entity.relationships.administers, is it something we can't infer on the integration level?

chemamartinez · 2026-06-02T14:48:04Z

@alexreal1314 for this integration, it was populated at first but that change was reverted at 5a42108, as the most similar field at the source was the owner of the entity. After some discussions, we decided to revert it as the field specifies only administration relationships (not ownership) should be included here.

elastic-vault-github-plugin-prod · 2026-06-03T10:36:17Z

Package entityanalytics_entra_id - 1.10.0 containing this change is available at https://epr.elastic.co/package/entityanalytics_entra_id/1.10.0/

chemamartinez added 8 commits April 21, 2026 10:51

Add host.entity.attributes.managed field support

c86e63f

Add user.entity.relationships.administered_by field support

b112d24

Add last_activity field support

1067298

Add user.entity.attributes.permissions field support

ebd09e7

Add user.entity.relationships.supervises field support

c0c986b

Add user.entity.attributes.mfa_enabled field support

ef602b1

Add changelog and bump version

d7c5c2b

Fix select.users list and update fields in docs

1560113

chemamartinez self-assigned this Apr 23, 2026

chemamartinez added enhancement New feature or request Integration:entityanalytics_entra_id Microsoft Entra ID Entity Analytics Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Apr 23, 2026

macroscopeapp Bot reviewed Apr 23, 2026

View reviewed changes

Comment thread packages/entityanalytics_entra_id/changelog.yml Outdated

Comment thread packages/entityanalytics_entra_id/changelog.yml Outdated

Fix changelog entry type

eeedbd6

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Apr 23, 2026

chemamartinez added 2 commits April 23, 2026 18:52

Update changelog with PR link

c747414

Rename subfields in relationships fields

47cda24

chemamartinez marked this pull request as ready for review April 23, 2026 17:06

chemamartinez requested a review from a team as a code owner April 23, 2026 17:06

macroscopeapp Bot reviewed Apr 23, 2026

View reviewed changes

Comment thread packages/entityanalytics_entra_id/data_stream/entity/elasticsearch/ingest_pipeline/user.yml

github-actions Bot mentioned this pull request Apr 24, 2026

[oblt-aw][agent-suggestions] Agent suggestions - 2026-04-24 elastic/oblt-actions#916

Closed

4 tasks

efd6 reviewed Apr 28, 2026

View reviewed changes

github-actions Bot mentioned this pull request Apr 28, 2026

[Beyondtrust PRA] fix session_owner type and update documentation #18677

Closed

chemamartinez added 3 commits April 30, 2026 17:56

Revert support for administered_by to follow spec updates

5a42108

Check entry is non-empty before adding it

ef5dc95

Apply requested changes

71ceb0e

macroscopeapp Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread packages/entityanalytics_entra_id/data_stream/entity/elasticsearch/ingest_pipeline/user.yml

Add if condition to app_role_display_name

4a8702e

chemamartinez requested a review from efd6 April 30, 2026 17:08

chemamartinez added 2 commits May 5, 2026 09:27

Fix append emptyness condition

3eb713c

Add email inside user field in relationships

52ad36c

macroscopeapp Bot reviewed May 5, 2026

View reviewed changes

Comment thread packages/entityanalytics_entra_id/data_stream/entity/elasticsearch/ingest_pipeline/user.yml

This comment has been minimized.

Sign in to view

Update email field in docs

a8eb57a

efd6 approved these changes May 7, 2026

View reviewed changes

chemamartinez mentioned this pull request May 7, 2026

EntityAnalytics AD: add support for ECS entity fields #18337

Merged

5 tasks

github-actions Bot mentioned this pull request May 22, 2026

[docs-patrol] Document AWS VPC Flow unsupported-format pipeline_error behavior #19165

Open

4 tasks

chemamartinez added 2 commits May 28, 2026 19:14

Merge branch 'main' into 18292-entityanalytics_entraid-entity-fields

cf32466

Sync entity fields definitions with ECS

97b1e91

chemamartinez requested a review from a team as a code owner May 28, 2026 17:24

Fix building of relationships field to match expected structure

6a5e617

efd6 approved these changes May 28, 2026

View reviewed changes

alexreal1314 mentioned this pull request Jun 3, 2026

Administers Relationship maintainer (based on raw_identifiers) elastic/kibana#266374

Closed

9 tasks

chemamartinez merged commit 375db4e into elastic:main Jun 3, 2026
10 checks passed

github-actions Bot mentioned this pull request Jun 3, 2026

[breaking-change] Undocumented breaking changes detected (2026-06-03) #19361

Open

3 tasks

alexreal1314 mentioned this pull request Jun 21, 2026

Supervises relationship maintainer investigation (raw_identifiers) elastic/kibana#274248

Closed

5 tasks

alexreal1314 mentioned this pull request Aug 6, 2026

[Entity Analytics] Add owns relationship maintainer for Entra ID (log-based) elastic/kibana#283366

Closed

7 tasks

Navigation Menu

Uh oh!

EntityAnalytics Entra ID: add support for ECS entity fields - #18621

EntityAnalytics Entra ID: add support for ECS entity fields#18621
chemamartinez merged 21 commits into
elastic:mainfrom
chemamartinez:18292-entityanalytics_entraid-entity-fields

chemamartinez commented Apr 23, 2026 •

edited

Loading

github-actions Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

elasticmachine commented Apr 23, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Apr 23, 2026 •

edited

Loading

efd6 Apr 28, 2026

chemamartinez Apr 30, 2026

efd6 Apr 28, 2026

efd6 Apr 28, 2026

efd6 commented Apr 28, 2026

Uh oh!

efd6 commented May 1, 2026

Uh oh!

This comment has been minimized.

github-actions Bot commented May 5, 2026

Root Cause

Evidence

Verification

Follow-up

elasticmachine commented May 28, 2026

alexreal1314 commented May 31, 2026

chemamartinez commented Jun 2, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jun 3, 2026

Labels

5 participants

Uh oh!

Conversation

chemamartinez commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Related issues

github-actions Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Vale Linting Results

Uh oh!

Uh oh!

elasticmachine commented Apr 23, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

efd6 Apr 28, 2026

Choose a reason for hiding this comment

chemamartinez Apr 30, 2026

Choose a reason for hiding this comment

efd6 Apr 28, 2026

Choose a reason for hiding this comment

efd6 Apr 28, 2026

Choose a reason for hiding this comment

efd6 commented Apr 28, 2026

Uh oh!

efd6 commented May 1, 2026

Uh oh!

This comment has been minimized.

github-actions Bot commented May 5, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

Follow-up

elasticmachine commented May 28, 2026

💚 Build Succeeded

History

alexreal1314 commented May 31, 2026

chemamartinez commented Jun 2, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jun 3, 2026

Labels

5 participants

chemamartinez commented Apr 23, 2026 •

edited

Loading

github-actions Bot commented Apr 23, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Apr 23, 2026 •

edited

Loading