entityanalytics_ad: expose attribute selection configuration

packages/entityanalytics_ad/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.4.0"
+ changes:
+ - description: Expose user and group attribute configurations to the user.
+ type: enhancement
+ link: https://github.com/elastic/integrations/pull/10955
 - version: "0.3.2"
  changes:
  - description: Don't leak collection implementation details.

packages/entityanalytics_ad/data_stream/user/agent/stream/entity-analytics.yml.hbs

@@ -5,6 +5,18 @@ ad_base_dn: {{ad_base_dn}}
 ad_url: {{ad_url}}
 ad_user: {{ad_user}}
 ad_password: {{ad_password}}
+{{#if user_attributes}}
+user_attributes:
+{{#each user_attributes as |attr|}}
+ - {{attr}}
+{{/each}}
+{{/if}}
+{{#if group_attributes}}
+group_attributes:
+{{#each group_attributes as |attr|}}
+ - {{attr}}
+{{/each}}
+{{/if}}
 {{#if paging_size}}
 ad_paging_size: {{paging_size}}
 {{/if}}

packages/entityanalytics_ad/data_stream/user/manifest.yml

@@ -65,6 +65,24 @@ streams:
  multi: false
  required: false
  show_user: false
+ - name: user_attributes
+ type: text
+ title: User Attributes
+ description: >-
+ User attributes to request from the AD server (all if not set). Attribute names should be obtained from the
+ AD server rather than from the fields within ingested documents, as fields are renamed during ingest.
+ multi: true
+ required: false
+ show_user: false
+ - name: group_attributes
+ type: text
+ title: Group Attributes
+ description: >-
+ Group attributes to request from the AD server (all if not set). Attribute names should be obtained from the
+ AD server rather than from the fields within ingested documents, as fields are renamed during ingest.
+ multi: true
+ required: false
+ show_user: false
  - name: tags
  type: text
  title: Tags

packages/entityanalytics_ad/manifest.yml

@@ -1,14 +1,14 @@
 format_version: "3.0.2"
 name: entityanalytics_ad
 title: Active Directory Entity Analytics
-version: "0.3.2"
+version: "0.4.0"
 description: "Collect User Identities from Active Directory Entity with Elastic Agent."
 type: integration
 categories:
  - security
 conditions:
  kibana:
- version: "^8.14.0"
+ version: "^8.16.0"
  elastic:
  subscription: "basic"
 screenshots: []