Entity Analytics 9.4 updates for UEBA integrations

[jmcarlock]

Proposed commit message

Updates UEBA packages for Entity Analytics in the 9.4 release.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Test with ITP

[github-actions]

Vale Linting Results

Summary: 1 warning, 9 suggestions found

⚠️ Warnings (1)

File	Line	Rule	Message
packages/ded/docs/README.md	83	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.

💡 Suggestions (9)

File	Line	Rule	Message
packages/ded/docs/README.md	37	Elastic.WordChoice	Consider using 'refer to if it's a document, view if it's a UI element' instead of 'See', unless the term is in the UI.
packages/ded/docs/README.md	52	Elastic.Wordiness	Consider using 'if' instead of 'In the event that'.
packages/dga/docs/README.md	84	Elastic.Repetition	"Detection" is repeated.
packages/lmd/docs/README.md	46	Elastic.WordChoice	Consider using 'refer to if it's a document, view if it's a UI element' instead of 'See', unless the term is in the UI.
packages/lmd/docs/README.md	76	Elastic.Clone	Use Clone only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.
packages/pad/docs/README.md	96	Elastic.Wordiness	Consider using 'if' instead of 'In the event that'.
packages/problemchild/docs/README.md	16	Elastic.WordChoice	Consider using 'refer to if it's a document, view if it's a UI element' instead of 'see', unless the term is in the UI.
packages/problemchild/docs/README.md	124	Elastic.WordChoice	Consider using 'refer to if it's a document, view if it's a UI element' instead of 'See', unless the term is in the UI.
packages/problemchild/docs/README.md	126	Elastic.Repetition	"Detection" is repeated.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[sodhikirti07]

@jmcarlock Thanks for making the changes. I've left a few comments around documentation and adding fields to the transforms. Other are some minor changes.

[andrewkroh]

I was giving this a quick look and noticed a pre-existing issue with ECS event.kind in the problemchild pipeline. It makes the event.kind into an array, but in ECS this is a scalar field. So instead of append processors those should be set. It's pre-existing, so feel free to ignore this if you don't want to address it now. I can open an issue for it if you'd like. See

https://github.com/elastic/integrations/wiki/Fleet-Package-Code-Review-Comments#pipeline-on_failure-handler-must-set-eventkind-pipeline_error

• packages/problemchild/elasticsearch/ingest_pipeline/problem_child_inference_pipeline.yml:397

• packages/problemchild/elasticsearch/ingest_pipeline/problem_child_ingest_pipeline.yml:8

[jmcarlock]

@andrewkroh Thank you for the review! This was an easy fix so I added it here

[jmcarlock]

@rylnd @abhishekbhatia1710 @dplumlee Along with the PR in Kibana, could you also review this PR for changes relevant to your team? 🙏

[peteharverson]

Changes to the ML jobs LGTM

[susan-shu-c]

Hi Gus, let's consider cherry-picking the relevant commits from #18038 so that users don't get too many version bumps at once (as opposed to if we merged that PR and this one too)

[theletterf]

@susan-shu-c Brought the docs changes in c196362

[kapral18]

DED and LMD changes look correct — job IDs, transforms, fields, dashboards, and docs are all internally consistent.

The PAD package has four issues:

1. Functional bug: The Windows dashboard searchSourceJSON query lists 8 job IDs but omits pad_windows_rare_region_name_by_user_ea, so anomalies from that job are silently filtered from all Lens panels (only the swim lane shows them).
2. Copy-paste error: The Windows dashboard swimlane panelTitle references Linux job names.
3. Doc typo: The Anomaly Detection Jobs table lists pad_okta_spike_in_group_application_assignment_change but the actual job ID is pad_okta_spike_in_group_application_assignment_changes_ea (missing trailing s and _ea suffix).
4. Doc error: pad_linux_high_median_process_command_line_entropy_by_user_ea is listed with "Okta Integration" as the supported platform — should be "Linux".

Everything else (transform field additions, ML module renames, changelog/manifest bumps) is clean across all three packages.

[jmcarlock]

This will be merged closer to Kibana release as integrations are independent this schedule.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 6bc505c

History

• 💚 Build #40386 succeeded 1fb8987
• 💚 Build #40382 succeeded 9432801
• 💚 Build #40323 succeeded 6c8c1d7
• 💚 Build #39964 succeeded 871b1cf
• 💚 Build #39906 succeeded fbe77bd
• 💚 Build #39738 succeeded c669892

[kapral18]

thanks for addressing

[jmcarlock]

Thanks you Karen for the review!