Open
Conversation
ReviewersBuildkite won't run for external contributors automatically; you need to add a comment:
NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details. |
Oddly
added a commit
to Oddly/integrations
that referenced
this pull request
Mar 14, 2026
andrewkroh
added
documentation
Adds a new integration for FreeIPA identity management servers with 5 data streams: KDC authentication, 389DS directory access, directory errors, Dogtag CA audit, and IPA API operations. Uses the filestream input to tail log files. Includes five alerting rule templates, two optional Elasticsearch transforms for cross-event enrichment (connection-to-IP and bind-to-user correlation, shipped inactive), ingest pipelines with full ECS and SIEM field mapping (event categorization, observer metadata, GeoIP), and pipeline tests validated against Elasticsearch 9.3.1 with both synthetic and real-log test data from a live FreeIPA deployment.
Changes from testing all 16 detection rules against a live FreeIPA 4.12.2 environment with Elastic Agent 9.3.2: Pipeline improvements: - Extract bind_dn and user.name from bind RESULT events (tag=97) - Extract CN from certificate SubjectID for user.name instead of full DN - Handle list-format arguments in ipa_api target entity grok - Add event.outcome to directory_errors sample event Container compatibility: - Enable prospector.scanner.symlinks on all 5 filestream inputs for FreeIPA containers that symlink /var/log paths to /data/var/log Documentation: - Clarify that debug=True is optional for IPA API logging - Regenerate published README from build template Test quality: - Enable deterministic timestamp validation for directory_access, directory_errors, and ca_audit pipeline tests - Regenerate expected test output for all pipeline changes All 18 pipeline tests pass. Lint and build pass.
Remove duplicate Transforms section that appeared after the Data Streams. Move alert rule template descriptions from the second Transforms section to the Alert rule templates section where they belong. Replace the directory_access sample event from a bare RESULT with empty related fields to a BIND event showing user context (bind_dn, bind_method, user.name, related.user).
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
Pipeline coverage: add conn=Internal handling for directory_access, extract wtime/optime from RESULT lines, extract CRLNum/CRLSize from CA audit events, and broaden CA event type mappings to cover CONFIG_*, AUDIT_LOG_*, KEY_RECOVERY_*, and OCSP_* event families. ECS enrichments: map CA audit certificate fields to file.x509 (serial_number, subject.distinguished_name, issuer.distinguished_name), add rule.name for sudorule/hbacrule IPA API commands, populate related.hosts for DNS and service commands, and refine event.category for DNS (iam+network), cert (iam+authentication), and service (iam+configuration) command families. Test events added for A1/T1 disconnect reasons, Internal connection SRCH/RESULT, DELTA_CRL_GENERATION, AUDIT_LOG_SHUTDOWN, CONFIG_CRL, and KEY_RECOVERY_REQUEST.
The directory_access pipeline was failing on TLS connection info lines (1283 grok errors) and directory_errors on tab-continuation lines (8 errors). TLS lines are now parsed into tls.version, tls.cipher, and tls.client.x509.* fields instead of being dropped, and continuation lines are dropped before the grok stage. All five pipelines now set service.type, and the three client-facing streams (kdc, directory_access, ipa_api) populate client.ip, network.protocol, and network.transport. The directory_access pipeline derives destination.port from the SSL flag and mirrors destination.ip to server.ip. The ipa_api pipeline sets http.request.method and url.path. The ca_audit pipeline maps server_host and server_port to destination.ip/port and filters the anonymous SubjectID "--" from user.name. The directory_errors pipeline maps the replication LDAP error code to error.code.
Remove operation_id from the latest_bind transform unique_key so LOOKUP JOIN queries from any operation on a connection can resolve the BIND identity, not just the BIND operation itself. Regenerate the KDC sample event from a real pipeline simulation. The previous sample had contradictory fields: a success outcome with error_code and event.reason set, and both user.* and source.user.* populated when the pipeline renames one to the other for S4U events.
Every sample event was hand-crafted and had issues: directory_access mixed fields from 6 different operation types into one document, ipa_api had wrong duration units and fields from unrelated commands, ca_audit was stuffed with fields from multiple event types, and directory_errors had outcome/type contradicting its log level. All four are now generated by running a representative raw log line through the current pipeline.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Initial release of the FreeIPA (Red Hat IdM) integration. Collects security-relevant logs from five FreeIPA subsystems using filestream input: Kerberos KDC authentication events, 389 Directory Server access and error logs, Dogtag CA signed audit events, and IPA JSON API operations. Includes five ES|QL alerting rule templates that activate on Stack 9.2+, three optional transforms for cross-event LDAP correlation, and comprehensive ECS field mappings including x509 certificate fields and rule.name for policy objects. Dashboards will follow in a separate PR.
Changes
kdc,directory_access,directory_errors,ca_audit,ipa_apiTesting
elastic-package checkpasses (lint + build), full_review passes with 0 errors/0 warnings