[AD Entity Analytics] Fix UserAccountControl Attribute Table

[w0rk3r]

Proposed commit message

entityanalytics_ad: fix UAC attribute bit table Previous implementation used the MS-SAMR, but the active directory objects use the adschema[1][2][3]. [1]https://learn.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol [2]https://learn.microsoft.com/en-us/windows/win32/api/iads/ne-iads-ads_user_flag_enum [3]https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties 

Summary

Fix the bit table to be compatible with the AD Schema (https://learn.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol) instead of MS-SAMR, as it is the implementation used in active directory objects.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

elastic-package test pipeline -v

Related issues

Part of https://github.com/elastic/ia-trade-team/issues/537

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

Can you provide a screenshot showing the correspondence between the values and the string representation for the cases that have changed so that we can see that the change is correct, or alternatively/additionally, a link that states that this is the table that should be used?

[efd6]

Suggest this for commit message (pending additional information)

entityanalytics_ad: fix UAC attribute bit table Previous implementation used the MS-SAMR, but the active directory objects use the adschema[1][2][3]. [1]https://learn.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol [2]https://learn.microsoft.com/en-us/windows/win32/api/iads/ne-iads-ads_user_flag_enum [3]https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties 

[w0rk3r]

@efd6 we can use the krbtgt useraccountcontrol value (514) as an example to check this. It should be "ACCOUNTDISABLE" & "NORMAL_ACCOUNT"

It is the same example from the documentation: https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties

The flags are cumulative. To disable a user's account, set the UserAccountControl attribute to 0x0202 (0x002 + 0x0200). In decimal, it's 514 (2 + 512).

And if we check the table:

ACCOUNTDISABLE	0x0002	2

NORMAL_ACCOUNT	0x0200	512

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
96.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 980707e

History

• 💚 Build #23480 succeeded 1721686
• 💚 Build #23470 succeeded fcbe267

cc @w0rk3r

[efd6]

Thanks. I added the link for PARTIAL_SECRET_ACCOUNT to the proposed commit message as well.

[elastic-vault-github-plugin-prod]

Package entityanalytics_ad - 0.10.1 containing this change is available at https://epr.elastic.co/package/entityanalytics_ad/0.10.1/