diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 21edb3c2e941..6421eeb8e263 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -93,6 +93,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Fix PEM key validation for CEL and HTTPJSON inputs. {pull}38405[38405] - Fix filebeat gcs input panic {pull}38407[38407] - Rename `activity_guid` to `activity_id` in ETW input events to suit other Windows inputs. {pull}38530[38530] +- Add missing provider registration and fix published entity for Active Directory entityanalytics provider. {pull}38645[38645] *Heartbeat* diff --git a/x-pack/filebeat/input/entityanalytics/input.go b/x-pack/filebeat/input/entityanalytics/input.go index 25238fd305c0..64b3ae46d33b 100644 --- a/x-pack/filebeat/input/entityanalytics/input.go +++ b/x-pack/filebeat/input/entityanalytics/input.go @@ -15,6 +15,7 @@ import ( "github.com/elastic/go-concert/unison" // For provider registration. + _ "github.com/elastic/beats/v7/x-pack/filebeat/input/entityanalytics/provider/activedirectory" _ "github.com/elastic/beats/v7/x-pack/filebeat/input/entityanalytics/provider/azuread" _ "github.com/elastic/beats/v7/x-pack/filebeat/input/entityanalytics/provider/okta" ) diff --git a/x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go b/x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go index fa8bc7325fa4..fed77b48d679 100644 --- a/x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go +++ b/x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go @@ -383,7 +383,7 @@ func (p *adInput) publishMarker(ts, eventTime time.Time, inputID string, start b func (p *adInput) publishUser(u *User, state *stateStore, inputID string, client beat.Client, tracker *kvstore.TxTracker) { userDoc := mapstr.M{} - _, _ = userDoc.Put("activedirectory", u.User) + _, _ = userDoc.Put("activedirectory", u.Entry) _, _ = userDoc.Put("labels.identity_source", inputID) _, _ = userDoc.Put("user.id", u.ID)