address pr comments

elastic · Jun 21, 2023 · 267f68a · 267f68a
1 parent 852928b
commit 267f68a
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 17 deletions.
diff --git a/x-pack/filebeat/docs/inputs/input-entity-analytics.asciidoc b/x-pack/filebeat/docs/inputs/input-entity-analytics.asciidoc
@@ -181,28 +181,32 @@ Example device document:
 {
     "@timestamp": "2022-11-04T09:57:19.786056-05:00",
     "event": {
-        "action": "user-discovered",
+        "action": "device-discovered",
     },
     "azure_ad": {
-        "userPrincipalName": "example.user@example.com",
-        "mail": "example.user@example.com",
-        "displayName": "Example User",
-        "givenName": "Example",
-        "surname": "User",
-        "jobTitle": "Software Engineer",
-        "mobilePhone": "123-555-1000",
-        "businessPhones": ["123-555-0122"]
+        "accountEnabled": true,
+        "displayName": "DESKTOP-LETW452G",
+        "operatingSystem": "Windows",
+        "operatingSystemVersion": "10.0.19043.1337",
+        "physicalIds": {
+            "extensionAttributes": {
+                "extensionAttribute1": "BYOD-Device"
+            }
+        },
+        "alternativeSecurityIds": [
+            {
+                "type": 2,
+                "identityProvider": null,
+                "key": "DGFSGHSGGTH345A...35DSFH0A"
+            },
+        ]
     },
-    "user": {
-        "id": "5ebc6a0f-05b7-4f42-9c8a-682bbc75d0fc",
+    "device": {
+        "id": "2fbbb8f9-ff67-4a21-b867-a344d18a4198",
         "group": [
             {
                 "id": "331676df-b8fd-4492-82ed-02b927f8dd80",
                 "name": "group1"
-            },
-            {
-                "id": "d140978f-d641-4f01-802f-4ecc1acf8935",
-                "name": "group2"
             }
         ]
     },

diff --git a/x-pack/filebeat/input/entityanalytics/provider/azuread/azure.go b/x-pack/filebeat/input/entityanalytics/provider/azuread/azure.go
@@ -151,6 +151,8 @@ func (p *azure) runFullSync(inputCtx v2.Context, store *kvstore.Store, client be
 	}
 
 	if len(state.users) != 0 {
+		p.logger.Debugw("publishing users", "count", len(state.devices))
+
 		tracker := kvstore.NewTxTracker(ctx)
 
 		start := time.Now()
@@ -166,6 +168,8 @@ func (p *azure) runFullSync(inputCtx v2.Context, store *kvstore.Store, client be
 	}
 
 	if len(state.devices) != 0 {
+		p.logger.Debugw("publishing devices", "count", len(state.devices))
+
 		tracker := kvstore.NewTxTracker(ctx)
 
 		start := time.Now()
@@ -361,6 +365,7 @@ func (p *azure) doFetch(ctx context.Context, state *stateStore, fullSync bool) (
 		}
 		u.Modified = true
 		if u.Deleted {
+			p.logger.Debugw("not expanding membership for deleted user", "user", userID)
 			return
 		}
 
@@ -379,6 +384,7 @@ func (p *azure) doFetch(ctx context.Context, state *stateStore, fullSync bool) (
 		}
 		d.Modified = true
 		if d.Deleted {
+			p.logger.Debugw("not expanding membership for deleted device", "device", devID)
 			return
 		}
 
@@ -461,7 +467,7 @@ func (p *azure) publishUser(u *fetcher.User, state *stateStore, inputID string,
 	client.Publish(event)
 }
 
-// publishDevice will publish a user document using the given beat.Client.
+// publishDevice will publish a device document using the given beat.Client.
 func (p *azure) publishDevice(d *fetcher.Device, state *stateStore, inputID string, client beat.Client, tracker *kvstore.TxTracker) {
 	deviceDoc := mapstr.M{}
 

diff --git a/x-pack/filebeat/input/entityanalytics/provider/azuread/statestore.go b/x-pack/filebeat/input/entityanalytics/provider/azuread/statestore.go
@@ -104,7 +104,7 @@ func newStateStore(store *kvstore.Store) (*stateStore, error) {
 
 		return nil
 	}); err != nil && !errIsItemNotFound(err) {
-		return nil, fmt.Errorf("unable to get users from state: %w", err)
+		return nil, fmt.Errorf("unable to get devices from state: %w", err)
 	}
 
 	if err = s.tx.ForEach(groupsBucket, func(key, value []byte) error {