Skip to content

{ti_opencti, entityanalytics_entra_id}: Add input name to request tracer path#17619

Merged
kcreddy merged 2 commits intoelastic:mainfrom
kcreddy:fix-request-tracer-paths
Mar 3, 2026
Merged

{ti_opencti, entityanalytics_entra_id}: Add input name to request tracer path#17619
kcreddy merged 2 commits intoelastic:mainfrom
kcreddy:fix-request-tracer-paths

Conversation

@kcreddy
Copy link
Contributor

@kcreddy kcreddy commented Mar 2, 2026

Proposed commit message

{ti_opencti, entityanalytics_entra_id}: Fix request tracer file path to use the input name

The tracer log directory must match the input type name for logs to be
written to the correct location. Updated entityanalytics_entra_id to use
"azure-ad" (matching the provider) and ti_opencti to use "cel" (matching
the input type) instead of the incorrect custom directory names.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

System tests run successfully only after fix.

Before

{"log.level":"error","@timestamp":"2026-03-02T11:53:53.548Z","message":"Input 'entity-analytics-azure-ad' failed with: unable to create fetcher: unable to unpack Graph API Fetcher config: request tracer path must be within \"/usr/share/elastic-agent/data/elastic-agent-967aff/components/logs/azure-ad\" path accessing 'tracer'","component.id

After (successful):

--- Test results for package: entityanalytics_entra_id - START ---
╭──────────────────────────┬─────────────┬───────────┬───────────┬────────┬───────────────╮
│ PACKAGE                  │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │  TIME ELAPSED │
├──────────────────────────┼─────────────┼───────────┼───────────┼────────┼───────────────┤
│ entityanalytics_entra_id │ entity      │ system    │ default   │ PASS   │ 29.778491542s │
╰──────────────────────────┴─────────────┴───────────┴───────────┴────────┴───────────────╯
--- Test results for package: entityanalytics_entra_id - END   ---
Done

Related issues

@kcreddy kcreddy self-assigned this Mar 2, 2026
@kcreddy kcreddy added bugfix Pull request that fixes a bug issue Integration:ti_opencti OpenCTI Integration:entityanalytics_entra_id Microsoft Entra ID Entity Analytics Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Mar 2, 2026
@kcreddy kcreddy marked this pull request as ready for review March 2, 2026 12:10
@kcreddy kcreddy requested a review from a team as a code owner March 2, 2026 12:10
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elasticmachine
Copy link

💚 Build Succeeded

cc @kcreddy

@kcreddy kcreddy merged commit d165af4 into elastic:main Mar 3, 2026
9 checks passed
@elastic-vault-github-plugin-prod

Package entityanalytics_entra_id - 1.9.1 containing this change is available at https://epr.elastic.co/package/entityanalytics_entra_id/1.9.1/

@elastic-vault-github-plugin-prod

Package ti_opencti - 2.12.1 containing this change is available at https://epr.elastic.co/package/ti_opencti/2.12.1/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:entityanalytics_entra_id Microsoft Entra ID Entity Analytics Integration:ti_opencti OpenCTI Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants