{ "name": "entityanalytics_ad", "title": "Active Directory Entity Analytics", "version": "0.15.0", "release": "beta", "description": "Collect User Identities from Active Directory Entity with Elastic Agent.", "type": "integration", "download": "/epr/entityanalytics_ad/entityanalytics_ad-0.15.0.zip", "path": "/package/entityanalytics_ad/0.15.0", "icons": [ { "src": "/img/logo.svg", "path": "/package/entityanalytics_ad/0.15.0/img/logo.svg", "title": "Active Directory Logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.16.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/entityanalytics_ad/entityanalytics_ad-0.15.0.zip.sig", "format_version": "3.0.2", "readme": "/package/entityanalytics_ad/0.15.0/docs/README.md", "license": "basic", "assets": [ "/package/entityanalytics_ad/0.15.0/LICENSE.txt", "/package/entityanalytics_ad/0.15.0/changelog.yml", "/package/entityanalytics_ad/0.15.0/manifest.yml", "/package/entityanalytics_ad/0.15.0/validation.yml", "/package/entityanalytics_ad/0.15.0/docs/README.md", "/package/entityanalytics_ad/0.15.0/img/logo.svg", "/package/entityanalytics_ad/0.15.0/data_stream/user/manifest.yml", "/package/entityanalytics_ad/0.15.0/data_stream/user/sample_event.json", "/package/entityanalytics_ad/0.15.0/data_stream/user/fields/base-fields.yml", "/package/entityanalytics_ad/0.15.0/data_stream/user/fields/beats.yml", "/package/entityanalytics_ad/0.15.0/data_stream/user/fields/ecs.yml", "/package/entityanalytics_ad/0.15.0/data_stream/user/fields/fields.yml", "/package/entityanalytics_ad/0.15.0/data_stream/user/agent/stream/entity-analytics.yml.hbs", "/package/entityanalytics_ad/0.15.0/data_stream/user/elasticsearch/ingest_pipeline/default.yml", "/package/entityanalytics_ad/0.15.0/data_stream/user/elasticsearch/ingest_pipeline/entity.yml", "/package/entityanalytics_ad/0.15.0/data_stream/user/elasticsearch/ingest_pipeline/marker.yml" ], "policy_templates": [ { "name": "user", "title": "User Identities", "description": "Collect user identities.", "inputs": [ { "type": "entity-analytics", "title": "Collect user identities", "description": "Collecting identities from Active Directory." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "entityanalytics_ad.user", "title": "Collect User Identities logs from Active Directory", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "entity-analytics", "vars": [ { "name": "ad_base_dn", "type": "text", "title": "Active Directory Base DN", "description": "The Base DN for the Active Directory.", "multi": false, "required": true, "show_user": true }, { "name": "ad_url", "type": "text", "title": "Active Directory URL", "description": "The URL for the Active Directory server including the appropriate LDAP scheme.", "multi": false, "required": true, "show_user": true }, { "name": "ad_user", "type": "text", "title": "Active Directory User", "description": "The Active Directory user DN.", "multi": false, "required": true, "show_user": true }, { "name": "ad_password", "type": "password", "title": "Active Directory User Password", "description": "The Active Directory user's password, used for authentication.", "multi": false, "required": true, "show_user": true }, { "name": "sync_interval", "type": "text", "title": "Sync Interval", "description": "How often full synchronizations should occur. Must be greater than Update Interval. Expected value is a duration string (15m, 1h, 1m30, etc), defaults to 24h. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "update_interval", "type": "text", "title": "Update Interval", "description": "How often incremental updates should occur. Must be less than Sync Interval. Expected value is a duration string (15m, 1h, 1m30, etc), defaults to 15m. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "id", "type": "text", "title": "Input ID", "description": "Identity Source. Which will be added to every event as a label.", "multi": false, "required": false, "show_user": false }, { "name": "paging_size", "type": "integer", "title": "Paging Size", "description": "Paging size for the directory responses (no limit if not set).", "multi": false, "required": false, "show_user": false }, { "name": "user_attributes", "type": "text", "title": "User Attributes", "description": "User attributes to request from the AD server (all if not set). Attribute names should be obtained from the AD server rather than from the fields within ingested documents, as fields are renamed during ingest.", "multi": true, "required": false, "show_user": false }, { "name": "group_attributes", "type": "text", "title": "Group Attributes", "description": "Group attributes to request from the AD server (all if not set). Attribute names should be obtained from the AD server rather than from the fields within ingested documents, as fields are renamed during ingest.", "multi": true, "required": false, "show_user": false }, { "name": "preserve_group_member_list", "type": "bool", "title": "Preserve group member list", "description": "Unless set, the member list will be deleted from group attributes to avoid large documents.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "entityanalytics_ad-user" ] }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve entityanalytics_ad.user fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "entity-analytics.yml.hbs", "title": "User Identities logs", "description": "Collect User Identities logs from Active Directory.", "enabled": true, "ingestion_method": "API" } ], "package": "entityanalytics_ad", "path": "user" } ] }