entityanalytics_entra_id: add support for request trace logging

elastic · Aug 12, 2024 · c1d4a87 · c1d4a87
1 parent 9532d71
commit c1d4a87
Show file tree

Hide file tree

Showing 5 changed files with 19 additions and 2 deletions.
diff --git a/packages/entityanalytics_entra_id/changelog.yml b/packages/entityanalytics_entra_id/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.3.0"
+ changes:
+ - description: Add support for request trace logging.
+ type: enhancement
+ link: https:/elastic/integrations/pull/
 - version: "1.2.0"
  changes:
  - description: Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template.

diff --git a/...ages/entityanalytics_entra_id/data_stream/entity/_dev/test/system/test-default-config.yml b/...ages/entityanalytics_entra_id/data_stream/entity/_dev/test/system/test-default-config.yml
@@ -8,3 +8,4 @@ data_stream:
  login_endpoint: http://{{Hostname}}:{{Port}}
  api_endpoint: http://{{Hostname}}:{{Port}}/v1.0
  dataset: all
+ enable_request_tracer: true
diff --git a/packages/entityanalytics_entra_id/data_stream/entity/agent/stream/entity-analytics.yml.hbs b/packages/entityanalytics_entra_id/data_stream/entity/agent/stream/entity-analytics.yml.hbs
@@ -1,4 +1,8 @@
 provider: azure-ad
+{{#if enable_request_tracer}}
+tracer.filename: "../../logs/entra_id/http-request-trace-*.ndjson"
+tracer.maxbackups: 5
+{{/if}}
 sync_interval: {{sync_interval}}
 update_interval: {{update_interval}}
 client_id: {{client_id}}

diff --git a/packages/entityanalytics_entra_id/data_stream/entity/manifest.yml b/packages/entityanalytics_entra_id/data_stream/entity/manifest.yml
@@ -132,6 +132,13 @@ streams:
  # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk
  # sxSmbIUfc2SGJGCJD4I=
  # -----END CERTIFICATE-----
+ - name: enable_request_tracer
+ type: bool
+ title: Enable request tracing
+ multi: false
+ required: false
+ show_user: false
+ description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.
  - name: tags
  type: text
  title: Tags

diff --git a/packages/entityanalytics_entra_id/manifest.yml b/packages/entityanalytics_entra_id/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: entityanalytics_entra_id
 title: "Microsoft Entra ID Entity Analytics"
-version: "1.2.0"
+version: "1.3.0"
 description: "Collect identities from Microsoft Entra ID (formerly Azure Active Directory) with Elastic Agent."
 type: integration
 categories:
@@ -10,7 +10,7 @@ categories:
  - security
 conditions:
  kibana:
- version: "^8.13.0"
+ version: "^8.15.1"
  elastic:
  subscription: "basic"
 icons: