entityanalytics_okta: map group fields and add test infrastructure #10973
Conversation
efd6
added
enhancement
efd6
force-pushed
the
10096-entityanalytics_okta
branch
from
c04c143
to
81b794f
Compare
🚀 Benchmarks reportTo see the full report comment with |
|
💚 Build Succeeded
History
cc @efd6 |
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
| "group": { | ||
| "id": [ | ||
| "OGYzMDMwYjFmODBiNjli" | ||
| ], | ||
| "name": [ | ||
| "Everyone" | ||
| ] | ||
| }, |
There was a problem hiding this comment.
Note also that the group fields may be used directly at the root of the events.
The ECS documentation suggests using group fields also at the root of the event: https://www.elastic.co/guide/en/ecs/current/ecs-group.html. We could possibly copy them to root as well.
There was a problem hiding this comment.
Yeah. I think just moving this there, and adding the user fields would be better. I'll revise this.
There was a problem hiding this comment.
Hang on. No, I was getting confused by the github fold. I think this is the right place; the group is specifically for the user. We could also have it at the root, but I think it would be best to wait to see if a user has a good reason to do this before we add that. So I'll merge as is.
|
Package entityanalytics_okta - 1.5.0 containing this change is available at https://epr.elastic.co/search?package=entityanalytics_okta |
Proposed commit message
See title.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots