--- title: Active Directory Entity Analytics description: This Active Directory Entity Analytics integration allows users to securely stream User Entities data to Elastic Security via the Active Directory LDAP... url: https://www.elastic.co/docs/reference/integrations/entityanalytics_ad products: - Elastic integrations applies_to: - Serverless Observability projects: Preview - Serverless Security projects: Preview - Elastic Stack: Preview since 9.5 --- # Active Directory Entity Analytics | | | |-------------------------------------------------------------------------------------------------|--------------------------------------------------------------------| | **Version** | 0.24.2 : Preview ([View all](#changelog)) | | **Managed integration release status** | : Beta | | **Subscription level**[What's this?](https://www.elastic.co/subscriptions) | Basic | | **Developed by**[What's this?](https://www.elastic.co/docs/reference/integrations/developed-by) | Elastic | | **Ingestion method(s)** | API | | **Minimum Kibana version(s)** | 9.5.0 | You can use this integration as an Elastic Managed integration on Elastic Cloud Hosted deployments running this version or later. To use pre-release integrations, go to the **Integrations** page in Kibana, scroll down, and toggle on the _Display beta integrations_ option. This Active Directory Entity Analytics integration allows users to securely stream User Entities data to Elastic Security via the Active Directory LDAP look-ups. When integrated with Elastic Security, this valuable data can be leveraged within Elastic for risk-scoring scenarios (e.g., context enrichments) and detecting advanced analytics (UBA) use cases. ## Upgrading to v0.15.0 from v0.14 and lower of the integration In v0.15.0 of the integration the user and device data was split into separate data streams. The data ingested into your index will be the same but you may need to update device searches if you were using them. When you upgrade from a version prior to v0.15.0 you will need to reconfigure the integration and enable it due to internal changes in the package. See [Resolve conflicts](https://www.elastic.co/guide/en/fleet/current/upgrade-integration.html#resolve-conflicts) in the Fleet documentation for details. ## Data streams The Active Directory Entity Analytics integration collects identity data. - **User** is used to retrieve all user entries available from an Active Directory server. - **Device** is used to retrieve all device entries available from an Active Directory server. - **Group** contains standalone documents for Active Directory groups that have no direct members, collected when the *Include empty groups* option is enabled. Groups with members are already represented through membership enrichment on user and device entities. ## Requirements Elastic Agent must be installed for standard deployments. For more details, check the Elastic Agent [installation instructions](https://docs-edge.elastic.dev/docs/reference/fleet/install-elastic-agents). ## Setup ### Elastic Managed enabled integration Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. For more information, refer to [Elastic Managed integrations](https://www.elastic.co/docs/manage-data/ingest/managed-integrations/managed-integrations) and the [Elastic Managed integrations FAQ](https://www.elastic.co/docs/manage-data/ingest/managed-integrations/managed-integrations-faq). Because the agent must still speak LDAP to an Active Directory server, the server must be reachable over the public internet on TCP port 636 (LDAPS). Plain LDAP on port 389 is not accepted in this configuration. Elastic Managed deployment works with: - **Microsoft Entra Domain Services (Azure AD DS)** — when the "Allow secure LDAP access over the internet" option is enabled on the managed domain, the domain is assigned a public IP address on port 636. See [Configure secure LDAP for Microsoft Entra Domain Services](https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-configure-ldaps) for setup instructions. Elastic Managed integrations do not use a fixed range of egress IP addresses, so the secure LDAP endpoint must accept connections from the public internet; restrict access using the other controls Microsoft recommends, such as requiring a valid certificate and strong credentials. - **JumpCloud Cloud LDAP** — `ldap.jumpcloud.com:636` is a public endpoint and requires no additional configuration. - **Okta LDAP Interface** — `.ldap.okta.com:636` is a public endpoint and requires no additional configuration. Elastic Managed deployment does **not** work without additional network connectivity for: - Traditional on-premises Active Directory domain controllers (not internet-exposed) - AWS Managed Microsoft AD (VPC-internal only) - Google Cloud Managed Microsoft AD (private network only) For on-premises AD that is not internet-accessible, use standard agent-based deployment with an Elastic Agent running inside your network. ### Collect data from Active Directory 1. Obtain the LDAP username, for example `CN=Administrator,CN=Users,DC=testserver,DC=local` and password, and LDAP host address for the Active Directory server that you will be collecting data from. 2. Determine the Base DN for the directory to be used, for example `CN=Users,DC=testserver,DC=local`. ### Enabling the integration in Elastic: 1. In Kibana navigate to **Management** > **Integrations**. 2. In the search bar, type **Active Directory Entity Analytics**. 3. Select the **Active Directory Entity Analytics** integration and add it. 4. While adding the integration, add the user, host and base DN details obtained above. 5. Save the integration. ## Usage The Active Directory provider periodically contacts the server, retrieves updates for users, devices, and groups, updates its internal cache of metadata, and ships updated records to Elasticsearch. Fetching and shipping updates occurs in one of two processes: **full synchronizations** and **incremental updates**. Full synchronizations send the entire list of users, devices, and groups in state. Incremental updates send only records that changed since the last sync. Changes include metadata updates, additions, and deletions. By default, full synchronizations occur every 24 hours and incremental updates occur every 15 minutes. These intervals may be customized to suit your use case. By default this integration uses **minimal-state sync**, which routes user, device, and group documents directly to the `user`, `device`, and `group` data streams. Existing policies are updated to use minimal-state sync on upgrade. Minimal-state sync requires Elastic Agent 9.5.0 or later; older agents use the legacy sync. This integration provides an **asset inventory**, a point-in-time snapshot of which users and devices exist and their current properties. It does not provide an audit trail of who changed what, or when. If you need to track administrative changes to Active Directory objects, consider collecting Windows Security event logs (e.g., Event IDs 4720, 4722, 4738, 4743) via the [System integration](https://docs.elastic.co/integrations/system). ## Sample Events A user document: ```json { "@timestamp": "2024-02-05T06:37:40.876026-05:00", "activedirectory": { "id": "CN=Guest,CN=Users,DC=testserver,DC=local", "user": { "accountExpires": "2185-07-21T23:34:33.709551516Z", "badPasswordTime": "0", "badPwdCount": "0", "cn": "Guest", "codePage": "0", "countryCode": "0", "dSCorePropagationData": [ "2024-01-22T06:37:40Z", "1601-01-01T00:00:01Z" ], "description": "Built-in account for guest access to the computer/domain", "distinguishedName": "CN=Guest,CN=Users,DC=testserver,DC=local", "instanceType": "4", "isCriticalSystemObject": true, "lastLogoff": "0", "lastLogon": "2185-07-21T23:34:33.709551616Z", "logonCount": "0", "memberOf": "CN=Guests,CN=Builtin,DC=testserver,DC=local", "name": "Guest", "objectCategory": "CN=Person,CN=Schema,CN=Configuration,DC=testserver,DC=local", "objectClass": [ "top", "person", "organizationalPerson", "user" ], "objectGUID": "hSt/40XJQU6cf+J2XoYMHw==", "objectSid": "AQUAAAAAAAUVAAAA0JU2Fq1k30YZ7UPx9QEAAA==", "primaryGroupID": "514", "pwdLastSet": "2185-07-21T23:34:33.709551616Z", "sAMAccountName": "Guest", "sAMAccountType": "805306368", "uSNChanged": "8197", "uSNCreated": "8197", "userAccountControl": "66082", "whenChanged": "2024-01-22T06:36:59Z", "whenCreated": "2024-01-22T06:36:59Z" }, "whenChanged": "2024-01-22T06:36:59Z" }, "user": { "id": "CN=Guest,CN=Users,DC=testserver,DC=local" }, "labels": { "identity_source": "activedirectory-1" } } ``` ## Logs reference ### User This is the `User` dataset. | Field | Description | Type | |--------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------| | @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | | asset.category | | keyword | | asset.costCenter | | keyword | | asset.create_date | | date | | asset.id | | keyword | | asset.last_seen | | date | | asset.last_status_change_date | | date | | asset.last_updated | | date | | asset.name | | keyword | | asset.status | | keyword | | asset.type | | keyword | | asset.vendor | | keyword | | data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: * Must not contain `-` * No longer than 100 characters | constant_keyword | | data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: * Must not contain `-` * No longer than 100 characters | constant_keyword | | data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | | entityanalytics_ad.groups.admin_count | | keyword | | entityanalytics_ad.groups.cn | | keyword | | entityanalytics_ad.groups.description | | keyword | | entityanalytics_ad.groups.distinguished_name | | keyword | | entityanalytics_ad.groups.ds_core_propagation_data | | date | | entityanalytics_ad.groups.group_type | | keyword | | entityanalytics_ad.groups.id | | keyword | | entityanalytics_ad.groups.instance_type | | keyword | | entityanalytics_ad.groups.is_critical_system_object | | boolean | | entityanalytics_ad.groups.member | | keyword | | entityanalytics_ad.groups.member_of | | keyword | | entityanalytics_ad.groups.name | | keyword | | entityanalytics_ad.groups.object_category | | keyword | | entityanalytics_ad.groups.object_class | | keyword | | entityanalytics_ad.groups.object_guid | | keyword | | entityanalytics_ad.groups.object_sid | | keyword | | entityanalytics_ad.groups.sam_account_name | | keyword | | entityanalytics_ad.groups.sam_account_type | | keyword | | entityanalytics_ad.groups.usn_changed | | keyword | | entityanalytics_ad.groups.usn_created | | keyword | | entityanalytics_ad.groups.when_changed | | date | | entityanalytics_ad.groups.when_created | | date | | entityanalytics_ad.id | | keyword | | entityanalytics_ad.user.account_expires | | keyword | | entityanalytics_ad.user.account_never_expires | True if the account is set to never expire. | boolean | | entityanalytics_ad.user.admin_count | | keyword | | entityanalytics_ad.user.bad_password_time | | keyword | | entityanalytics_ad.user.bad_pwd_count | | keyword | | entityanalytics_ad.user.cn | | keyword | | entityanalytics_ad.user.code_page | | keyword | | entityanalytics_ad.user.constrained_delegation | True if the account is trusted for constrained delegation. | boolean | | entityanalytics_ad.user.country_code | | keyword | | entityanalytics_ad.user.description | | keyword | | entityanalytics_ad.user.direct_reports | | keyword | | entityanalytics_ad.user.distinguished_name | | keyword | | entityanalytics_ad.user.dont_require_preauth | True if the account does not require Kerberos pre-authentication. | boolean | | entityanalytics_ad.user.ds_core_propagation_data | | date | | entityanalytics_ad.user.enabled | If the account is enabled. | boolean | | entityanalytics_ad.user.instance_type | | keyword | | entityanalytics_ad.user.is_critical_system_object | | boolean | | entityanalytics_ad.user.last_logoff | | keyword | | entityanalytics_ad.user.last_logon | | date | | entityanalytics_ad.user.last_logon_timestamp | | date | | entityanalytics_ad.user.locked | True if the account is locked out. | boolean | | entityanalytics_ad.user.logon_count | | keyword | | entityanalytics_ad.user.logon_script_enabled | True if a logon script is configured for the account. | boolean | | entityanalytics_ad.user.mail | The user's email address from Active Directory. | keyword | | entityanalytics_ad.user.managed_objects | | keyword | | entityanalytics_ad.user.member_of | | keyword | | entityanalytics_ad.user.msDS-* | | keyword | | entityanalytics_ad.user.name | | keyword | | entityanalytics_ad.user.object_category | | keyword | | entityanalytics_ad.user.object_class | | keyword | | entityanalytics_ad.user.object_dn | | keyword | | entityanalytics_ad.user.object_guid | | keyword | | entityanalytics_ad.user.object_sid | | keyword | | entityanalytics_ad.user.password_not_required | True if the account does not require a password. | boolean | | entityanalytics_ad.user.primary_group_id | | keyword | | entityanalytics_ad.user.privileged_group_member | True if the user is a member of a privileged group. | boolean | | entityanalytics_ad.user.pwd_last_set | | date | | entityanalytics_ad.user.reversible_encryption_password | True if the user password is stored with reversible encryption. | boolean | | entityanalytics_ad.user.sam_account_name | | keyword | | entityanalytics_ad.user.sam_account_type | | keyword | | entityanalytics_ad.user.sensitive_object | True if the account cannot be delegated. | boolean | | entityanalytics_ad.user.service_principal_name | | keyword | | entityanalytics_ad.user.show_in_advanced_view_only | | boolean | | entityanalytics_ad.user.uac_list | | keyword | | entityanalytics_ad.user.unconstrained_delegation | True if the account is trusted for unconstrained delegation. | boolean | | entityanalytics_ad.user.use_des_key_only | True if the account is configured to only use DES encryption. | boolean | | entityanalytics_ad.user.user_account_control | | keyword | | entityanalytics_ad.user.user_principal_name | The user's login name in UPN format (for example, *user@domain.com*). | keyword | | entityanalytics_ad.user.usn_changed | | keyword | | entityanalytics_ad.user.usn_created | | keyword | | entityanalytics_ad.user.when_changed | | date | | entityanalytics_ad.user.when_created | | date | | entityanalytics_ad.when_changed | | date | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | | input.type | Type of filebeat input. | keyword | | labels.identity_source | | keyword | | user.account.activated_date | | date | | user.account.change_date | | date | | user.account.create_date | | date | | user.account.password_change_date | | date | | user.account.status.deprovisioned | | boolean | | user.account.status.locked_out | | boolean | | user.account.status.password_expired | | boolean | | user.account.status.recovery | | boolean | | user.account.status.suspended | | boolean | | user.entity.attributes.mfa_enabled | Indicates whether multi-factor authentication is enabled for this entity. Typically applicable to User entities. | boolean | | user.entity.lifecycle.last_activity | Timestamp of the most recent action performed by or attributed to this entity (active use). Distinct from `entity.last_seen_timestamp`, which records when the entity was last observed in data; `last_activity` implies the entity was active, not only seen. Typically applicable to User, Host, and Service entities. | date | | user.entity.relationships.administers.host.id | Referenced host ids. | keyword | | user.entity.relationships.administers.host.name | Referenced host names. | keyword | | user.entity.relationships.administers.user.domain | Referenced user directory or AD/LDAP domain names (same semantics as ECS `user.domain`). | keyword | | user.entity.relationships.supervises.user.domain | Referenced user directory or AD/LDAP domain names (same semantics as ECS `user.domain`). | keyword | | user.entity.relationships.supervises.user.id | Referenced user ids. | keyword | | user.entity.relationships.supervises.user.name | Referenced user short names or logins. | keyword | | user.geo.city_name | | keyword | | user.geo.country_iso_code | | keyword | | user.geo.name | | keyword | | user.geo.postal_code | | keyword | | user.geo.region_name | | keyword | | user.geo.timezone | | keyword | | user.organization.name | | keyword | | user.profile.department | | keyword | | user.profile.first_name | | keyword | | user.profile.id | | keyword | | user.profile.job_title | | keyword | | user.profile.last_name | | keyword | | user.profile.manager | | keyword | | user.profile.mobile_phone | | keyword | | user.profile.other_identities | | keyword | | user.profile.primaryPhone | | keyword | | user.profile.secondEmail | | keyword | | user.profile.status | | keyword | | user.profile.type | | keyword | ### Device This is the `Device` dataset. | Field | Description | Type | |----------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------| | @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | | asset.category | | keyword | | asset.costCenter | | keyword | | asset.create_date | | date | | asset.id | | keyword | | asset.last_seen | | date | | asset.last_status_change_date | | date | | asset.last_updated | | date | | asset.name | | keyword | | asset.status | | keyword | | asset.type | | keyword | | asset.vendor | | keyword | | data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: * Must not contain `-` * No longer than 100 characters | constant_keyword | | data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: * Must not contain `-` * No longer than 100 characters | constant_keyword | | data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | | entityanalytics_ad.device.account_expires | | keyword | | entityanalytics_ad.device.account_never_expires | True if the account is set to never expire. | boolean | | entityanalytics_ad.device.admin_count | | keyword | | entityanalytics_ad.device.bad_password_time | | keyword | | entityanalytics_ad.device.bad_pwd_count | | keyword | | entityanalytics_ad.device.cn | | keyword | | entityanalytics_ad.device.code_page | | keyword | | entityanalytics_ad.device.constrained_delegation | True if the account is trusted for constrained delegation. | boolean | | entityanalytics_ad.device.country_code | | keyword | | entityanalytics_ad.device.description | | keyword | | entityanalytics_ad.device.direct_reports | | keyword | | entityanalytics_ad.device.distinguished_name | | keyword | | entityanalytics_ad.device.dont_require_preauth | True if the account does not require Kerberos pre-authentication. | boolean | | entityanalytics_ad.device.ds_core_propagation_data | | date | | entityanalytics_ad.device.enabled | If the account is enabled. | boolean | | entityanalytics_ad.device.instance_type | | keyword | | entityanalytics_ad.device.is_critical_system_object | | boolean | | entityanalytics_ad.device.last_logoff | | keyword | | entityanalytics_ad.device.last_logon | | date | | entityanalytics_ad.device.last_logon_timestamp | | date | | entityanalytics_ad.device.locked | True if the account is locked out. | boolean | | entityanalytics_ad.device.logon_count | | keyword | | entityanalytics_ad.device.logon_script_enabled | True if a logon script is configured for the account. | boolean | | entityanalytics_ad.device.managed_objects | | keyword | | entityanalytics_ad.device.member_of | | keyword | | entityanalytics_ad.device.msDS-* | | keyword | | entityanalytics_ad.device.name | | keyword | | entityanalytics_ad.device.object_category | | keyword | | entityanalytics_ad.device.object_class | | keyword | | entityanalytics_ad.device.object_dn | | keyword | | entityanalytics_ad.device.object_guid | | keyword | | entityanalytics_ad.device.object_sid | | keyword | | entityanalytics_ad.device.password_not_required | True if the account does not require a password. | boolean | | entityanalytics_ad.device.primary_group_id | | keyword | | entityanalytics_ad.device.privileged_group_member | True if the user is a member of a privileged group. | boolean | | entityanalytics_ad.device.pwd_last_set | | date | | entityanalytics_ad.device.reversible_encryption_password | True if the user password is stored with reversible encryption. | boolean | | entityanalytics_ad.device.sam_account_name | | keyword | | entityanalytics_ad.device.sam_account_type | | keyword | | entityanalytics_ad.device.sensitive_object | True if the account cannot be delegated. | boolean | | entityanalytics_ad.device.service_principal_name | | keyword | | entityanalytics_ad.device.show_in_advanced_view_only | | boolean | | entityanalytics_ad.device.uac_list | | keyword | | entityanalytics_ad.device.unconstrained_delegation | True if the account is trusted for unconstrained delegation. | boolean | | entityanalytics_ad.device.use_des_key_only | True if the account is configured to only use DES encryption. | boolean | | entityanalytics_ad.device.user_account_control | | keyword | | entityanalytics_ad.device.usn_changed | | keyword | | entityanalytics_ad.device.usn_created | | keyword | | entityanalytics_ad.device.when_changed | | date | | entityanalytics_ad.device.when_created | | date | | entityanalytics_ad.groups.admin_count | | keyword | | entityanalytics_ad.groups.cn | | keyword | | entityanalytics_ad.groups.description | | keyword | | entityanalytics_ad.groups.distinguished_name | | keyword | | entityanalytics_ad.groups.ds_core_propagation_data | | date | | entityanalytics_ad.groups.group_type | | keyword | | entityanalytics_ad.groups.id | | keyword | | entityanalytics_ad.groups.instance_type | | keyword | | entityanalytics_ad.groups.is_critical_system_object | | boolean | | entityanalytics_ad.groups.member | | keyword | | entityanalytics_ad.groups.member_of | | keyword | | entityanalytics_ad.groups.name | | keyword | | entityanalytics_ad.groups.object_category | | keyword | | entityanalytics_ad.groups.object_class | | keyword | | entityanalytics_ad.groups.object_guid | | keyword | | entityanalytics_ad.groups.object_sid | | keyword | | entityanalytics_ad.groups.sam_account_name | | keyword | | entityanalytics_ad.groups.sam_account_type | | keyword | | entityanalytics_ad.groups.usn_changed | | keyword | | entityanalytics_ad.groups.usn_created | | keyword | | entityanalytics_ad.groups.when_changed | | date | | entityanalytics_ad.groups.when_created | | date | | entityanalytics_ad.id | | keyword | | entityanalytics_ad.when_changed | | date | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | | host.entity.attributes.managed | Indicates whether the entity is managed by an external administration or control system. Typically applicable to Host and Service entities. | boolean | | host.entity.lifecycle.last_activity | Timestamp of the most recent action performed by or attributed to this entity (active use). Distinct from `entity.last_seen_timestamp`, which records when the entity was last observed in data; `last_activity` implies the entity was active, not only seen. Typically applicable to User, Host, and Service entities. | date | | host.entity.relationships.administers.host.id | Referenced host ids. | keyword | | host.entity.relationships.administers.host.name | Referenced host names. | keyword | | host.entity.relationships.administers.user.domain | Referenced user directory or AD/LDAP domain names (same semantics as ECS `user.domain`). | keyword | | host.entity.relationships.supervises.user.domain | Referenced user directory or AD/LDAP domain names (same semantics as ECS `user.domain`). | keyword | | host.entity.relationships.supervises.user.id | Referenced user ids. | keyword | | host.entity.relationships.supervises.user.name | Referenced user short names or logins. | keyword | | input.type | Type of filebeat input. | keyword | | labels.identity_source | | keyword | | user.account.activated_date | | date | | user.account.change_date | | date | | user.account.create_date | | date | | user.account.password_change_date | | date | | user.account.status.deprovisioned | | boolean | | user.account.status.locked_out | | boolean | | user.account.status.password_expired | | boolean | | user.account.status.recovery | | boolean | | user.account.status.suspended | | boolean | | user.geo.city_name | | keyword | | user.geo.country_iso_code | | keyword | | user.geo.name | | keyword | | user.geo.postal_code | | keyword | | user.geo.region_name | | keyword | | user.geo.timezone | | keyword | | user.organization.name | | keyword | | user.profile.department | | keyword | | user.profile.first_name | | keyword | | user.profile.id | | keyword | | user.profile.job_title | | keyword | | user.profile.last_name | | keyword | | user.profile.manager | | keyword | | user.profile.mobile_phone | | keyword | | user.profile.other_identities | | keyword | | user.profile.primaryPhone | | keyword | | user.profile.secondEmail | | keyword | | user.profile.status | | keyword | | user.profile.type | | keyword | ### Group This is the `Group` dataset. It contains standalone documents for Active Directory groups that have no direct members, collected when the *Include empty groups* option is enabled. Groups with members are already represented through membership enrichment on user and device entities. | Field | Description | Type | |-----------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------| | @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | | asset.category | | keyword | | asset.create_date | | date | | asset.id | | keyword | | asset.last_updated | | date | | asset.name | | keyword | | asset.type | | keyword | | data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: * Must not contain `-` * No longer than 100 characters | constant_keyword | | data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: * Must not contain `-` * No longer than 100 characters | constant_keyword | | data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | | entityanalytics_ad.group.admin_count | | keyword | | entityanalytics_ad.group.cn | | keyword | | entityanalytics_ad.group.description | | keyword | | entityanalytics_ad.group.distinguished_name | | keyword | | entityanalytics_ad.group.ds_core_propagation_data | | date | | entityanalytics_ad.group.group_type | | keyword | | entityanalytics_ad.group.instance_type | | keyword | | entityanalytics_ad.group.is_critical_system_object | | boolean | | entityanalytics_ad.group.member_of | | keyword | | entityanalytics_ad.group.name | | keyword | | entityanalytics_ad.group.object_category | | keyword | | entityanalytics_ad.group.object_class | | keyword | | entityanalytics_ad.group.object_dn | | keyword | | entityanalytics_ad.group.object_guid | | keyword | | entityanalytics_ad.group.object_sid | | keyword | | entityanalytics_ad.group.sam_account_name | | keyword | | entityanalytics_ad.group.sam_account_type | | keyword | | entityanalytics_ad.group.show_in_advanced_view_only | | boolean | | entityanalytics_ad.group.usn_changed | | keyword | | entityanalytics_ad.group.usn_created | | keyword | | entityanalytics_ad.group.when_changed | | date | | entityanalytics_ad.group.when_created | | date | | entityanalytics_ad.when_changed | | date | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | | group.domain | | keyword | | group.id | | keyword | | group.name | | keyword | | input.type | Type of filebeat input. | keyword | | labels.identity_source | | keyword | ## Changelog | Version | Details | Minimum Kibana version | |------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------| | **0.24.2** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/22348))Default `paging_size` to 500 so that searches of directories with more than 1,000 entries do not fail.**Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/22348))Drop the ID-only deletion documents sent by minimal-state sync, which were indexed as user markers. | 9.5.0 | | **0.24.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/22298))Remove the package-level `conditions.agent.version` condition, which made Fleet silently drop this integration's inputs from agents older than the condition. Minimal-state sync (`use_minimal_state`) is now gated in the input template on Elastic Agent 9.5.0 or later; older agents use the legacy sync. | 9.5.0 | | **0.24.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/20987))Update Elastic Managed integration documentation to the current wording and docs links. | 9.5.0 | | **0.23.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/20572))Add tags to ingest pipeline processors and add `preserve_original_event` to pipeline-level `on_failure` handlers. | 9.5.0 | | **0.22.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/20212))Add agentless deployment mode and minimal-state sync support. Existing policies switch to the minimal-state sync implementation on upgrade. | 9.5.0 | | **0.21.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/20103))Add the Advanced Analytics (UEBA) subcategory | 9.4.0 | | **0.20.3** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/19633))Set the administered host name to its FQDN in the user entity administers relationship, matching the device pipeline. | 9.4.0 | | **0.20.2** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/19302))Remove misleading event.action values from sample events in documentation and clarify that this integration provides asset inventory, not an audit trail. | 9.4.0 | | **0.20.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/19390))Fix LDAP bind failures caused by special characters in credentials. | 9.4.0 | | **0.20.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/18337))Add support for ECS entity fields. | 9.4.0 | | **0.19.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/19226))Fix asset.type handling across Active Directory entity datasets, including groups, by preventing post-rename marker processing from overriding the correct entity type. | 9.4.0 | | **0.19.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/18235))Add support for collecting empty Active Directory groups. | 9.4.0 | | **0.18.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/17758))Add mail and userPrincipalName fields to support email and name-based entity matching. | 9.0.38.19.0 | | **0.17.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/16076))Allow rerouting permissions to write data to other data streams. | 9.0.38.19.0 | | **0.17.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/15642))Improve field mappings for device entities. | 9.0.38.19.0 | | **0.16.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/14223))Add support for collection device entities.**Breaking change** ([View pull request](https://github.com/elastic/integrations/pull/14223))Split data stream by entity type. | 9.0.38.19.0 | | **0.15.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/14158))ECS version updated to 8.17.0. | 9.0.08.16.0 | | **0.14.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/14173))Remove members from group information by default. | 9.0.08.16.0 | | **0.14.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/13573))Remove redundant installation instructions. | 9.0.08.16.0 | | **0.13.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/13550))Map user group details to ECS fields. | 9.0.08.16.0 | | **0.12.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/13362))Add config option to set TLS options. | 9.0.08.16.0 | | **0.11.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/13174))Enrich the user object with account details and security-related settings. | 9.0.08.16.0 | | **0.10.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/13145))Fix user account control value look-ups. | 9.0.08.16.0 | | **0.10.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/13084))Changes the field used to populate `user.name` to `sam_account_name`. | 9.0.08.16.0 | | **0.9.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/13094))Avoid renaming `msDS-*` fields. | 9.0.08.16.0 | | **0.8.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/13013))Improve users identity and account control mappings.**Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/13013))Fix SID rendering. | 9.0.08.16.0 | | **0.7.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/12919))Update Kibana constraint to support 9.0.0. | 9.0.08.16.0 | | **0.6.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/12109))Add "preserve_original_event" tag to documents with `event.kind` manually set to "pipeline_error". | 8.16.0 | | **0.5.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/12046))Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error". | 8.16.0 | | **0.4.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/10955))Expose user and group attribute configurations to the user. | 8.16.0 | | **0.3.2** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/11372))Don't leak collection implementation details. | 8.14.0 | | **0.3.1** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/11210))Update documentation. | 8.14.0 | | **0.3.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/10923))Format SID and GUID in canonical formats. | 8.14.0 | | **0.2.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/10762))Expose paging size configuration to the user. | 8.14.0 | | **0.1.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/10135))Removed import_mappings. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. | 8.14.0 | | **0.0.1** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/9485))Initial Release. | 8.14.0 |