Skip to content

Entity Analytics Okta: add support for ECS entity fields#18525

Draft
chemamartinez wants to merge 10 commits intoelastic:mainfrom
chemamartinez:18290-entityanalytics_okta-entity-fields
Draft

Entity Analytics Okta: add support for ECS entity fields#18525
chemamartinez wants to merge 10 commits intoelastic:mainfrom
chemamartinez:18290-entityanalytics_okta-entity-fields

Conversation

@chemamartinez
Copy link
Copy Markdown
Contributor

Proposed commit message

Adds ECS entity field support to the Okta Entity Analytics integration
for both the entity and user data streams.

Maps device managed status, OS version, user last activity, manager
relationships, MFA status, role permissions, enrolled devices, and
direct reports to host.entity.* and user.entity.* fields:

- host.os.version from device profile osVersion
- host.entity.attributes.managed from device profile managed field
- user.entity.lifecycle.last_activity from last_login timestamp
- user.entity.relationships.administered_by (user_id, username) from
  the user's manager profile fields
- user.entity.attributes.mfa_enabled set to true when the user has at
  least one ACTIVE factor. Requires the new enrich_user_factors option,
  which adds one API request per user to /api/v1/users/{id}/factors
- user.entity.attributes.permissions from the labels of custom role
  permissions. Requires the new enrich_user_perms option, which enables
  role enrichment and adds one API call per custom role per user to
  /api/v1/iam/roles/{roleId}/permissions
- user.entity.relationships.owns ({host_id, hostname}) from the list of
  enrolled devices. Requires the new enrich_user_devices option, which
  adds one API request per user to /api/v1/users/{id}/devices
- user.entity.relationships.supervises ({user_id, email, username}) from
  the direct reports list. Requires the new enrich_user_supervises option,
  which is derived server-side from managerId with no extra API calls

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

@chemamartinez chemamartinez self-assigned this Apr 20, 2026
@chemamartinez chemamartinez added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:entityanalytics_okta Okta Entity Analytics labels Apr 20, 2026
Comment thread packages/entityanalytics_okta/changelog.yml
@github-actions
Copy link
Copy Markdown
Contributor

✅ Vale Linting Results

No issues found on modified lines!


The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link
Copy Markdown

💚 Build Succeeded

cc @chemamartinez

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:entityanalytics_okta Okta Entity Analytics Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Entity Analytics Okta: add support for entity fields

2 participants